joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433920
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x108
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.winvnc
push 0
mov dword [0x482f38], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
mov eax, dword [0x482f38]
push eax
push str.winvnc
push str._s_error:__d
lea ecx, [esp + 0x18]
push 0x100
push ecx
call fcn.00448283
mov eax, dword [esp + 0x124]
add esp, 0x14
lea edx, [esp + 0xc]
mov dword [esp + 8], eax
test esi, esi
mov dword [esp + 4], edx
je 0x4339a3
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x108
ret

Function at 0x433a40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
mov esi, 4
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x433a81
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
cmp dword [esp + 4], esi
je 0x433a92
mov eax, dword [esp + 0x18]
pop esi
add esp, 8
ret 0xc
mov eax, dword [esp + 8]
cmp eax, esi
mov eax, dword [esp + 0x18]
jne 0x433aa2
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret 0xc

Function at 0x433ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov esi, 0x100
push edi
push ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], esi
call ebp
test eax, eax
je 0x433af8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], 3
je 0x433b0b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
push esi
mov dword [esp + 0x18], esi
call fcn.0044826c
mov esi, eax
add esp, 4
test esi, esi
jne 0x433b28
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push esi
push eax
push 0
push edi
push ebx
call ebp
test eax, eax
je 0x433b52
push esi
call fcn.00447e1a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x10], 3
je 0x433b6e
push esi
call fcn.00447e1a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x433b80
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc

Function at 0x433ba0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0xfe
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x434c20
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 2
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
mov eax, esi
je 0x434c4a
mov dword [esi], 0
pop esi
add esp, 0x190
ret
mov cx, word [esp + 4]
mov word [0x482f52], cx
mov dword [esi], 0xffffffff
pop esi
add esp, 0x190
ret

Function at 0x434da0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 1
mov eax, dword [esi + 4]
test eax, eax
jl 0x434db8
call fcn.00434df0
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 4], eax
pop esi
test eax, eax
jge 0x434dd0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 1
push 6
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
neg eax
sbb eax, eax
neg eax
dec eax
pop ecx
ret

Function at 0x434ee0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jge 0x434ef8
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x434f47
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x434eee
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x434f41
pop edi
pop esi
add esp, 0x10
ret 8
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [edi + 4]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
pop edi
neg eax
dec eax
pop esi
add esp, 0x10
ret 8

Function at 0x434fa0
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x45844b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ecx + 4]
push edi
test eax, eax
mov dword [esp + 4], 1
jge 0x434fda
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push 0
push 0
push eax
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
test edi, edi
jge 0x434ffd
xor eax, eax
pop edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push esi
push 0x68
call fcn.0044826c
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x43502a
mov ecx, eax
call fcn.00434c80
mov esi, eax
test esi, esi
je 0x43502c
mov dword [esi + 4], edi
jmp 0x43503c
xor esi, esi
push 2
push edi
call dword [sym.imp.WSOCK32.dll_shutdown]
push edi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push 4
push eax
push 1
push 6
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4350b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
jne 0x4350e3
mov eax, str._unavailable_
add esp, 0x14
ret

Function at 0x4350f0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x43511b
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x435119
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x435119
mov eax, dword [eax]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x435120
Capabilities:
Set socket configuration

Disassembly:
mov al, byte [0x482f52]
push esi
cmp al, 2
push edi
mov esi, ecx
jae 0x435134
pop edi
xor eax, eax
pop esi
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x1006
push 0xffff
push edx
mov dword [esp + 0x20], eax
call edi
cmp eax, 0xffffffff
jne 0x435165
pop edi
xor eax, eax
pop esi
ret 4
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 0x1005
push 0xffff
push ecx
call edi
inc eax
pop edi
neg eax
sbb eax, eax
pop esi
ret 4

Function at 0x437960
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4585c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], 0
test eax, eax
je 0x4379b0
mov al, byte [esp + 0xb]
lea ecx, [esp + 0xb]
push 0x461490
push ecx
mov byte [esp + 0x13], al
call fcn.00449cff
mov eax, dword [0x484360]
lea edx, [esp + 0xc]
push edx
push 4
push esi
push 0x4375f0
push eax
push 0
call fcn.00449d39
mov ecx, dword [esp + 0x24]
add esp, 0x18
test eax, eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
jne 0x4379f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x461340
push edx
mov dword [esp + 0x18], eax
call fcn.00449cff
mov eax, dword [esi + 0x20]
push eax
call fcn.00437e60
mov ecx, dword [esi + 0x44]
add esp, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x437a28
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x461340
push edx
mov dword [esp + 0x18], eax
call fcn.00449cff
mov eax, dword [esi + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x437a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x461340
push ecx
mov dword [esp + 0x18], eax
call fcn.00449cff
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4380e0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x458668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x45ae9c
mov eax, dword [0x48434c]
push 0
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x438138
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 4]
push 0x461340
push ecx
mov dword [esp + 0xc], eax
call fcn.00449cff
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00437890
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44bb2f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x46eb28
cmp edx, dword [eax]
je 0x44bb51
add eax, 8
inc ecx
cmp eax, 0x46ebb8
jl 0x44bb42
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x46eb28]
jne 0x44bc7f
mov eax, dword [0x4843e0]
cmp eax, 1
je 0x44bc59
test eax, eax
jne 0x44bb82
cmp dword [0x46eaf4], 1
je 0x44bc59
cmp edx, 0xfc
je 0x44bc7f
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44bbb9
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00450e10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0044e610
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x44bbfc
lea eax, [ebp - 0x1a4]
push eax
call fcn.0044e610
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x45f01c
push edi
call fcn.004485d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00450e10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00450e20
lea eax, [ebp - 0xa0]
push 0x45effc
push eax
call fcn.00450e20
push dword [esi + 0x46eb2c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00450e20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00450d85
add esp, 0x2c
pop edi
jmp 0x44bc7f
lea eax, [ebp + 8]
lea esi, [esi + 0x46eb2c]
push 0
push eax
push dword [esi]
call fcn.0044e610
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x417f85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x417f94
pop dword [ebp - 0x18]
mov eax, 0x924a40c1
add eax, 0x6df73ed3
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x59156bdf
add dword [ebp - 0x28], 0xf53cd96c
mov dword [ebp - 0x24], 0x6dccc92a
add dword [ebp - 0x24], 0xc466831b
mov dword [ebp - 0x20], 0x5b77e73f
add dword [ebp - 0x20], 0xf0d45cef
mov dword [ebp - 0x1c], 0xa7bf17e7
add dword [ebp - 0x1c], 0x5840e819
lea eax, [ebp - 0x28]
push eax
mov eax, 0x1165c788
sub eax, 0x11239714
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x8ceee65e
sub dword [ebp - 0x28], 0x187c7d08
mov dword [ebp - 0x24], 0x30133815
sub dword [ebp - 0x24], 0xeea6d6a0
mov dword [ebp - 0x20], 0xc3ddf9ba
sub dword [ebp - 0x20], 0x606e8d4e
mov dword [ebp - 0x1c], 0x8e4a2b21
add dword [ebp - 0x1c], 0x71b5d4df
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3dad2
push 0
call eax
mov ecx, 0xf94e2776
sub ecx, 0xf94ddffb
xor esi, esi
add esi, eax
mov edi, 0x7d2c822f
sub edi, 0x7ce93e2f
add edi, dword [ebp - 0x18]
mov edx, 0x73d56aec
sub dword [ebp - 0x10], 0x43d9d7b0
mov ebx, dword [edi]
add dword [ebp - 0x10], 0x7bf4615f
sub ebx, edx
xor dword [ebp - 0x10], esi
mov dword [esi], ebx
sub dword [ebp - 0xc], ebx
add esi, 4
add edi, 4
loop 0x4180ad
add eax, 0x8af4a043
add eax, 0x750c707c
mov ebx, eax
add eax, 5
mov ecx, 0x32a826c7
add ecx, 0xcd97d939
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40288e
pop dword [ebp - 0x28]
mov eax, 0xb35d71d6
add eax, 0x4ce2b6b8
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x81e38df7
sub dword [ebp - 0x38], 0x339148ac
mov dword [ebp - 0x34], 0x10c13a34
sub dword [ebp - 0x34], 0xde8dedef
mov dword [ebp - 0x30], 0xda32da9e
add dword [ebp - 0x30], 0x72196990
mov dword [ebp - 0x2c], 0xebbfae3d
add dword [ebp - 0x2c], 0x144051c3
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xcc2ff5be
add dword [ebp - 0x38], 0xa8427398
mov dword [ebp - 0x34], 0x381e12fa
add dword [ebp - 0x34], 0x94e4e7b
mov dword [ebp - 0x30], 0xe190fff9
sub dword [ebp - 0x30], 0x7e21938d
mov dword [ebp - 0x2c], 0xd7b4fb49
add dword [ebp - 0x2c], 0x284b04b7
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4101d546
sub eax, 0x40c1649e
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x341ca
push 0
call eax
mov ecx, 0x2bf6d093
sub ecx, 0x2bf69283
xor edx, edx
add edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x28]
mov ebx, 0x8d8342a0
add ebx, 0xb2e043f8
sub dword [ebp - 4], eax
mov edi, dword [esi]
xor dword [ebp - 0x10], 0x2f81202
sub edi, ebx
add dword [ebp - 0x10], 0x69260285
mov dword [edx], edi
add dword [ebp - 0x18], eax
add edx, 4
add esi, 0xa0a625af
sub esi, 0xa0a625ab
loop 0x4029a7
add eax, 0xbcbc084b
sub eax, 0xbcbb1d38
mov ebx, eax
add eax, 0x17923fff
sub eax, 0x17923ffa
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x102c8e69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov dword [esp], 0x93eb014f
lea esp, [esp + 8]
jne 0x103cb6c9
pushal
pushfd
mov dword [esp + 4], 0x9181b54c
call fcn.104232d8
push edi
dec ecx
dec esi
dec ebp
dec ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
jmp 0x102cbf95
cmp byte [edi], 0x23
push edi
mov byte [esp], 0x1d
call 0x102d4e42
imul edx, edx, 0xa
jmp 0x102c8e3e
Function at 0x102ce6c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [ebp + 0x3bb1438d], ebp
retf 0x14ce
out dx, al
mov ecx, 0x9c6f7d35
jns 0x102c899d
clc
loopne 0x102c8a3b
pop esi
xor al, byte [ecx - 0x16a0a12a]
jne 0x102c8a2f
invalid
into
pop ss
mov ecx, 0xd19efa81
invalid
pop ebx
pop ebx
fsubr dword [edi - 0x68]
mov dh, 0x1c
jg 0x102c8a20
invalid
sbb byte [ebx - 0x3c], 0x27
retf
insb byte es:[edi], dx
mov dh, 0x1a
mov cl, 0xe2
adc eax, 0xa2daee56
jle 0x102c8a04
ljmp 0x3c5f:0xae83e88a
pushfd
lea esp, [esp + 0x34]
jbe 0x103cb5f8
or cx, 0x8c92
mov di, 0xcd21
movsx bx, al
mov edi, dword [edx + 0x24]
clc
call fcn.103cb9f1
loope 0x102c8a62
inc esp
out dx, al
mov eax, 0xa91198d7
push ecx
jns 0x102c8b13
xchg ebp, eax
push ebp
xchg ebp, eax
and ebp, ebx
xchg ecx, eax
invalid
sub byte [ebx + 0x60], al
push esi
sub cl, byte [esi + edi*2]
out 0xf5, al
dec ecx
pop ds
iretd
lea esp, [esp + 0x10]
jae fcn.102cd952
push eax
pushfd
lea esp, [esp + 8]
jmp 0x10422166
shr al, cl
or ax, 0x6a85
sal ax, cl
daa
push ebp
neg bp
ror bp, cl
mov ebp, esp
lea eax, [edi + 0x730cc365]
test al, 0xf3
aad 7
sub esp, 0x10
sub ax, di
inc ah
jp 0x1035e4be
not al
push esi
aad 0xa
bsr ax, sp
push edi
dec eax
push ebx
bt cx, 0xf
pushfd
aad 0x37
mov dword [esp], edx
lea eax, [esp - 0xed29b3]
call fcn.102d238a
pushfd
into
cmpsb byte [esi], byte es:[edi]
nop
mov eax, 0x17d607d7
jmp edi
pushfd
test eax, eax
pushal
lea esp, [esp + 0x24]
je fcn.102cd952
lea edx, [edi - 0x68341bc]
mov esi, dword [eax + 0x3c]
shr dx, 5
push edi
add esi, eax
bsr dx, bp
sbb dl, 0x76
mov edx, dword [esi + 0x78]
push ebx
test edx, edx
mov byte [esp + 4], 0x52
lea esp, [esp + 8]
je fcn.102cd952
mov cl, bh
movsx ecx, bl
sub ch, al
add edx, eax
bswap cx
pushfd
adc cl, 0x6f
mov ecx, dword [esi + 0x7c]
stc
pushfd
push 0x5e459038
stc
add ecx, edx
push 0x92167c6
cmc
stc
test ch, cl
mov dword [ebp - 0x10], ecx
pushal
bt sp, 6
adc cl, dl
sar cl, 7
mov ecx, dword [ebp + 0xc]
clc
cmp al, ch
cmp ecx, 0xffff
jmp 0x102c8a79
adc ax, sp
dec al
push esi
neg ax
rol ah, cl
push edi
dec ax
bt esp, eax
lea eax, [edx + 0x723b14a0]
bt si, bp
push ebx
movzx ax, al
push edx
add ax, si
bts ax, 0xc
mov eax, dword [ebp + 8]
clc
jmp 0x10423229
push ecx
bt si, cx
sub ecx, dword [edx + 0x10]
pushfd
pushfd
clc
cmp ecx, dword [edx + 0x14]
push ebx
jmp 0x102cda83
sbb edi, ebp
add di, sp
bts di, 4
mov edi, dword [edx + 0x24]
test ch, bh
clc
add edi, eax
cmp bl, bl
bt bx, bx
clc
movzx ecx, word [edi + ecx*2]
rcl di, 5
inc di
cmp dh, dl
mov edi, dword [edx + 0x1c]
pushfd
add edi, eax
stc
cmp ah, 0x90
mov edi, dword [edi + ecx*4]
call fcn.102c7726
mov dword [esp], 0x8190d6cd
call fcn.102cd5b3
mov edi, 0xa3571139
xlatb
jge 0x10422149
xor byte [eax], bl
and esi, dword [eax + edx*8]
int3
jmp 0x102d0733

Function at 0x102d0715
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x20]
jae fcn.102cd952
stc
push ebx
add ecx, 1
call fcn.102d2361
mov byte [esp], ch
lea esp, [esp + 0x44]
jge 0x102cc6dd
jae fcn.102cd952
pushfd
cmp bl, bh
add ecx, 1
call fcn.102d2bbc
Function at 0x102d2366
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
not al
mov byte [edi - 1], 0
pushfd
mov dword [esp], ebx
mov ah, 0xb5
lea eax, [0x102d51a5]
pushfd
pushal
mov dword [esp + 0x20], 0x102dcb44
pushal
call fcn.102cc91c

Function at 0x102d23c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.103cb894
pushfd
lea esp, [esp + 4]
jb 0x102ce6af
push 0x2f6749b2
push dword [esp]
push dword [esp + 8]
ret 0xc
test dl, bl
pushal
mov word [esp + 4], 0x2874
pushal
cmp ecx, dword [ebp - 4]
call fcn.102d0715
cld
bnd retf 0xb8cc
bt si, bx
push dword [esp]
mov byte [esp + 4], bl
cmp al, byte [edi]
not eax
lea edi, [edi + 1]
setns ah
push eax
mov eax, dword [esp + 0x30]
mov byte [esp], 0xf8
lea esp, [esp + 0x34]
ja 0x102caaed
pushal
pushfd
lea esp, [esp + 0x24]
jb 0x1035e537
test bl, 0
pushfd
clc
pushfd
cmp byte [edi - 1], 0
mov byte [esp], 0x60
mov byte [esp], 0x73
mov byte [esp + 4], dl
pushfd
lea esp, [esp + 0xc]
jne 0x102ca0a1
clc
btr edi, eax
mov edi, dword [edx + 0x24]
pushal
stc
add edi, eax
mov word [esp + 4], cx
push 0x1493b9d6
movzx ecx, word [edi + ecx*2]
push eax
lea esp, [esp + 0x28]
jmp 0x10422166

Function at 0x103cae54
Capabilities:
Encode data using xor

Disassembly:
leave
fild word [eax]
aaa
cmc
int 0xe9
dec edi
mul byte [edx]
mov byte [eax + 0x1fcf76d7], bh
pop edi
jmp 0x102cf02f
out 0x50, eax
loopne 0x102cf0e7
stosb byte es:[edi], al
inc esi
jno 0x102cf025
mov edx, 0xbff8eca9
adc edi, dword [edx + 0x193ddc6]
mov bh, 0x87
mov dword [0x93a307bf], eax
out dx, eax
mov bl, 0x62
in al, dx
clc
mov edi, 0xddc6ba13
xchg ebx, eax
add dword [edi + 0x7bfa387], esi
mov dword [0x62b3ef93], eax
insb byte es:[edi], dx
dec ecx
les esp, [esi]
shr byte [ecx - 0x42], 0xaf
wait
mov word [esp + 4], 0x3ad8
call fcn.102cca4a
mov bh, 0xce
cmpsb byte [esi], byte es:[edi]
xchg dword [eax - 0x648c0529], edi
ja 0x102cf106
mov eax, dword [ebx - 0x78bcd449]
pop es
shr dword [ebx + 0x2d], cl
xor dword [ecx], edx
and ebp, dword [ebx - 0x1aa6eea3]
imul ebp, dword [si], 0x7f
test dword [ebp - 0x62], ecx
sahf
and ch, bl
jno 0x102cf092
mov word [0xf6bb1fb8], ax
fisub dword [eax]
pop eax
cmp eax, 0x9d988dc6
mov esp, 0x4cf95de3
and eax, 0xd7614547
and ecx, dword [ebp + 0x2d]
sbb al, 0xea
jbe 0x102cf09c
sub eax, 0x9176ea1c
cwde
popfd
mov esp, 0x6d8e4c5d
invalid
pushfd
push 0x359c898f
pushfd
adc al, al
jmp 0x102cf0b8