joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100481f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100488e0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x1008c74c]
test eax, eax
je 0x10048303
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x10048243
cmp dword [eax + 4], 0
jne 0x100482fe
mov eax, dword [0x1008c74c]
test eax, eax
je 0x10048325
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x10048342
test eax, eax
jne 0x100482b8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1008c74c
movzx eax, byte [0x1008c829]
push 4
push 0xc
call fcn.10002ab0
add esp, 8
test eax, eax
je 0x1004836e
mov ecx, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov ecx, dword [0x1008c74c]
test ecx, ecx
je 0x10048356
dec ecx
push eax
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
test esi, esi
je 0x100482cd
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x100482cf
mov ecx, dword [esi + 4]
jmp 0x100482cf
xor ecx, ecx
mov esi, dword [eax + 4]
mov edx, dword [eax + 8]
test esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [eax + 4], 1
mov dword [eax + 8], ecx
je 0x100482fe
test edx, edx
je 0x100482fe
lock dec dword [edx]
jne 0x100482fe
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.10038180
mov eax, esi
add eax, 8
jmp 0x10048344
push 0x1008c74c
call fcn.1005e6b0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x10048239
jmp 0x10048243
push 0x1008c74c
call fcn.1005e6b0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x10048261
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1008c74c
mov edi, eax
call fcn.1005e6b0
add esp, 4
mov ecx, eax
mov eax, edi
jmp 0x100482ac
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.1005eeb0
add esp, 8
ud2
Function at 0x100572c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x10057318
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x10057310
cmp ebx, eax
ja 0x10057386
cmp eax, dword [ebp + 0x10]
ja 0x10057392
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x10057312
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x10057300
jmp 0x1005736f
ja 0x10057318
cmp edx, edi
mov ebx, eax
jne 0x100572d2
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x10057373
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x10057350
mov esi, edi
sub ecx, ebx
jns 0x10057367
jmp 0x10057375
cmp edi, edx
je 0x1005737c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x10057375
xor al, 1
cmp esi, edx
jne 0x10057330
jmp 0x10057375
xor eax, eax
jmp 0x10057375
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100721bc
call fcn.1005ef30
push 0x100721cc
push eax
push ebx
call fcn.1005f360
push 0x100721cc
push dword [ebp + 0x10]
push eax
call fcn.1005f340
Function at 0x1005d5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [edx + 0x10]
mov edi, dword [edx + 0x14]
mov dword [esp], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
movzx ebx, byte [esp + 0x24]
xor esi, esi
sub ebp, edi
jbe 0x1005d677
lea ecx, [edi + 1]
add edi, dword [edx + 0xc]
xor esi, esi
nop dword [eax + eax]
movzx ebx, byte [edi + esi]
mov eax, ebx
add al, 0xd0
cmp al, 0xa
jae 0x1005d63b
lea eax, [ecx + esi]
inc esi
cmp ebp, esi
mov dword [edx + 0x14], eax
jne 0x1005d620
mov esi, ebp
jmp 0x1005d66a
cmp ebx, 0x2e
je 0x1005d73e
cmp ebx, 0x45
je 0x1005d64e
cmp ebx, 0x65
jne 0x1005d66a
movzx eax, byte [esp + 0x24]
mov ecx, dword [esp]
push esi
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
call fcn.1000e600
jmp 0x1005d755
movzx ebx, byte [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
movd xmm1, eax
movd xmm0, ecx
mov eax, esi
punpckldq xmm1, xmm0
neg eax
punpckldq xmm1, xmmword [0x100610f0]
cmovs eax, esi
cmp eax, 0x135
subpd xmm1, xmmword [0x10061100]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
jb 0x1005d6e8
movsd xmm2, qword [0x10061c88]
xorpd xmm1, xmm1
nop dword [eax]
ucomisd xmm0, xmm1
jne 0x1005d6c8
jnp 0x1005d711
test esi, esi
jns 0x1005d75a
divsd xmm0, xmm2
add esi, 0x134
mov eax, esi
neg eax
cmovs eax, esi
cmp eax, 0x134
ja 0x1005d6c0
mov ecx, dword [0x1007909c]
test esi, esi
movsd xmm1, qword [ecx + eax*8]
js 0x1005d734
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x10061c90]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x10061ca0]
jae 0x1005d75a
test bl, bl
jne 0x1005d71d
xorpd xmm0, xmmword [0x10061cb0]
mov eax, dword [esp]
movsd qword [eax + 8], xmm0
xor eax, eax
mov ecx, dword [esp]
mov dword [ecx], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
divsd xmm0, xmm1
test bl, bl
je 0x1005d715
jmp 0x1005d71d
movzx eax, byte [esp + 0x24]
mov ecx, dword [esp]
push esi
push dword [esp + 0x30]
push dword [esp + 0x30]
push eax
call fcn.1000de60
add esp, 0x20
jmp 0x1005d72f
lea eax, [esp + 4]
mov dword [esp + 4], 0xe
push eax
push edx
call fcn.1005d970
mov ecx, dword [esp + 8]
add esp, 8
mov dword [ecx + 4], eax
mov eax, 1
jmp 0x1005d727
Function at 0x1005e6b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x1005e72c
mov eax, dword [entry1]
lea edi, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x1005e768
cmp dword [ebp - 0x14], 0
je 0x1005e74e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1005e785
mov ebx, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x1008c8e4]
nop dword [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x1008c8e4], esi
jne 0x1005e710
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov eax, ebx
jmp 0x1005e760
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x1005e7c1
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x1005e752
mov eax, dword [ebp - 0x10]
jmp 0x1005e760
mov eax, dword [esi]
jmp 0x1005e75f
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, esi
dec eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x10]
mov edx, 0x1006f6d0
push 0x1006f9dc
push eax
call fcn.1005e1d0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [ebp - 0x2c], 0x1006f990
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str.___rustc_79424056b05eaa9563d16dfab9b9a0c8f033f220librarycore_srcio_borrowed_buf.rs
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push 0x1006f9cc
push eax
call fcn.1005ef70
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x1006f990
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], str.___rustc_79424056b05eaa9563d16dfab9b9a0c8f033f220librarycore_srcio_borrowed_buf.rs
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.1005e200
int3
Function at 0x10002608
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
call fcn.1014e003
cwde
xor cl, byte [ebx - 0x7c36f7bb]
in al, dx
pushal
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10007b3a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.101ab77d
test eax, eax
je 0x10007b7d
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10007b7d
cmp word [eax], 0x5a4d
jne 0x10007b7d
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10007b7d
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.101ab79c
mov eax, dword [ebp + 8]
jmp 0x10007b96
mov esp, ebp
pop ebp
ret 4

Function at 0x10009edf
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
pushal
mov eax, 1
cpuid
mov dword [ebp + 8], eax
popal
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 0x3c
call fcn.10157e11
in eax, 0xe8
and dword [edi], 0x4589001a
shr byte [eax + 8], 1
add byte [eax], al
add al, ch
fsub qword [0xc4830003]
add al, 0x89
inc ebp
int3

Function at 0x1000d456
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.101ad807
test eax, eax
je 0x1000d4c1
push ecx
push ebx
xor eax, eax
xchg dword [ebp + 0xc], eax
xchg dword [ebp + 0x10], eax
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jle 0x1000d4bf
cmp word [ebx], 0x5a4d
jne 0x1000d4bf
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
cmp dword [ecx], 0x4550
jne 0x1000d4bf
cmp dword [ebp + 0x10], 0
je 0x1000d4b3
movzx eax, word [ecx + 0x16]
and eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x10]
jne 0x1000d4bf
cmp dword [ecx + 0x28], 0
je 0x1000d4bf
add ebx, dword [ecx + 0x28]
mov dword [ebp + 0xc], ebx
pop ebx
pop ecx
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.101ad79b
mov eax, dword [ebp + 0xc]
jmp 0x1000d4da
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000f841
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0x10000
jge 0x1000f861
mov eax, 0
jmp 0x1000f8ac
pushal
pushfd
sub esp, 0x40
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.101ae5c1
test eax, eax
je 0x1000f88a
call dword [ebp + 8]
mov dword [ebp + 8], eax
jmp 0x1000f88e
and dword [ebp + 8], 0
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.101ae5c6
add esp, 0x40
popfd
popal
mov eax, dword [ebp + 8]
jmp 0x1000f8ac
mov esp, ebp
pop ebp
ret 4

Function at 0x10091c58
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret
Function at 0x100f4f47
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop dword [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 0x20], esp
call fcn.100f4f0b
push dword [esp + 7]
jnp 0x100f4f62
mov byte [esp + 5], al
mov byte [esp + 9], ah
jmp 0x100f4f81
mov byte [esp + 5], al
jmp 0x100f4f97
mov byte [esp + 9], ah
push dword [esp + 8]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]

Function at 0x100f52c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], eax
call 0x100f51de
sub esp, 0x13
btr edx, edx
lea esp, [esp + 0xb]
xchg dword [esp + 3], eax
rdtsc
jmp 0x100f51f9
Function at 0x100f5aae
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
lea edx, [eax*4]
jmp 0x100f671a
rdtsc
rcl dx, cl
lea eax, [0x504f7fe8]
jmp 0x100f5b31
bts eax, eax
sub bl, 0xcf
rdtsc
mov ax, cx
jmp 0x100f5b6d
jmp 0x100f5b20
jmp 0x100f5b8c
mov edx, 0xd3d687c4
jmp 0x100f4ed5
mov eax, ebx
mov dh, 0x59
stc
jns 0x100f5b4c
js 0x100f5b4c
shl eax, 2
lea edx, [edi*4]
inc dl
jnp 0x100f5b4e
mov edx, 0xd3d687c4
jmp 0x100f4ed5
shr ah, 0
jmp 0x100f5db8
shr ah, 0
lea esp, [esp + 4]
sub bl, 0x91
neg ah
jo 0x100f5b4a
rdtsc
rcl dx, cl
lea eax, [0x504f7fe8]
bts eax, eax
jmp 0x100f5b34
rol dx, cl
js 0x100f5f91
clc
xchg dx, ax
mov ax, word [esp]
xchg dx, ax
jmp 0x100f5fc3
movzx ebx, byte [edi]
jmp 0x100f5f76
clc
xchg dx, ax
jmp 0x100f5f9a
mov ax, word [esp]
xchg dx, ax
mov eax, edi
rol eax, 0x17
mov ah, 0x40
not al
clc
ja 0x100f5fc7
mov eax, dword [esp]
jmp 0x100f6010
mov eax, edi
jmp 0x100f5fa3
jmp 0x100f600d
mov eax, 0x330b5f7b
jmp 0x100f5ff7
mov eax, 0x330b5f7b
rcr dl, 0
jmp 0x100f602c
rcr dl, 0
jmp 0x100f602c
mov eax, dword [esp]
sub bl, cl
je 0x100f5fc9
jne 0x100f5fd5
inc ax
not al
bts ax, bx
mov eax, 0xaaf4b0c3
jmp 0x100f60c7
mov dl, bl
mov ax, 0x3f69
clc
jge 0x100f6016
jl 0x100f603f
sbb al, 0x98
push cs
imul ebx, dword [eax + 0x6664752a], 0x66d0f640
bts eax, ebx
inc ax
not al
bts ax, bx
jmp 0x100f6409
jmp 0x100f60a7
not eax
mov ax, 0xc4cc
pushal
rol dl, 0
jno 0x100f607b
jo 0x100f61d5
sub al, byte [ebp - 0xc]
out 0xb8, eax
dec esi
cmp eax, 0x1b46869
mov eax, 0x68693d4e
mov ah, 1
mov eax, edi
mov ah, bl
mov eax, 0x3c5a05e2
mov ax, 0x6d4
mov eax, dword [esp]
jmp 0x100f615f
mov ax, 0xcb23
mov eax, dword [esp]
ror dl, 0
mov ax, cx
jmp 0x100f6091
lea eax, [edx*4]
jmp 0x100f6180
lea esp, [esp + 0x20]
xor dl, 0xd1
mov ah, 0xbc
call fcn.100f61b9
invalid
mov eax, 0x68693d4e
mov ah, 1
mov eax, edi
call fcn.100f60d6
bswap eax
pop word [esp]
lea eax, [edx + esi]
mov ax, word [esp]
mov ax, word [esp]
jmp 0x100f6215
lea esp, [esp + 0xc]
dec dl
mov ax, di
jmp 0x100f621d
push word [esp]
jl 0x100f61ff
jge 0x100f61ff
lea eax, [ebp + 0xd6e1]
mov ax, word [esp]
setnp ah
call fcn.100f6327
or dword [ecx + 0x778b7819], ecx
test eax, 0x2adfb82a
ret 0x8bcb
invalid
mov eax, 0xaaf4b0c3
mov ax, 0xcb23
jmp 0x100f60cb
pop ecx
lea edi, [ebp - 0xa6]
mov edi, dword [esp]
lea esp, [esp + 4]
jmp 0x100f6746
rol bl, 0
xchg dx, ax
mov ax, word [esp]
inc eax
jbe 0x100f5db5
ja 0x100f5bb4
xchg al, dl
rdtsc
mov edx, dword [esp]
bsf ax, sp
jmp 0x100f692c
pop esi
popfd
jmp 0x100f5f8c
mov edx, dword [esp]
xor bl, 0xb9
lea edx, [ebp*4]
call 0x100f68f3
and al, 0xa0
push ecx
mov al, byte [0x4ddd5a12]
adc al, 0xe7
push esi
movsb byte es:[edi], byte [esi]
mov esp, 0xbfb136db
mov ecx, edx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x100f6703
jl 0x100f674d
mov edx, dword [esp]
jmp 0x100f6750
Function at 0x100fb954
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x100fb9f7
lea ebp, [esp + 4]
lea ecx, [ebx*4]
xchg ebx, ecx
mov eax, 0x1ac14281
bt eax, edi
jno 0x100fb9c2
jo 0x100fb9ac
mov ebp, 0x45b6d343
mov cl, 0x85
add al, 0x9a
std
or al, 0xf3
xor eax, 0xb34021b1
push esp
xor bl, ch
rol byte [ecx + 0xbcec], cl
add bl, ch
mov bh, 0x27
inc edx
mov cl, 0xe
sub al, 0xa8
pop ecx
test al, 0x1a
inc ebp
hlt
jmp 0x100fb97e
sub esp, 0xbc
jmp 0x100fb9da
jmp 0x100fb9ac
mov ecx, 0x9a9ba35b
jmp 0x100fba21
mov edi, esp
neg eax
je 0x100fb9c4
mov ecx, 0x9a9ba35b
neg ax
setns bl
jmp 0x100fba27
mov esi, dword [esp + 0x30]
sets ah
mov ebp, dword [esp]
adc ecx, 0x1333057d
jp 0x100fb9aa
jnp 0x100fb9aa
mov bx, 0xf59
add ah, dl
jbe 0x100fba42
dec ah
jmp 0x100fba2c
neg ax
setns bl
mov ecx, esi
pushfd
jmp 0x100fba0b
xchg dx, ax
xchg ebx, eax
lea edx, [esi*4]
call fcn.100fbe83
test byte [edi], dh
push ds
imul ecx, dword [eax + 0x66ccfe2b], 0x8dc38792
adc al, 0xb5
add byte [eax], al
add byte [eax], al
dec ah
xchg dx, ax
xchg ebx, eax
lea edx, [esi*4]
not ax
xor edx, 0x9b300dfb
jmp 0x100fbec4
inc esi
xchg dh, bl
mov dl, byte [esp]
inc ebx
jne 0x100fbefa
neg ax
mov ax, word [esp]
jmp 0x100fbf37
neg ax
mov ax, word [esp]
not bx
call 0x100fbefc
cmpsd dword es:[esi], dword es:[edi]
aaa
push edx
mov eax, dword [0xe8eb5a1e]
bswap eax
stc
mov eax, ebp
xchg dword [esp], eax
pushal
jmp 0x100fbf4d
jmp 0x100fbee4
add esi, 0x5c8debeb
lea ebx, [ebx - 0x29]
lea eax, [0xdecbe167]
jmp 0x100fc061
not bx
jmp 0x100fbf12
xchg dx, bx
lea ebx, [esi - 0x22cc3c48]
mov bx, 0x743
mov byte [esp + 0x1d], dh
lea eax, [eax + 0x1f]
lea ebx, [ecx + edi]
jmp 0x100fc1a4
sub esp, 0x12
jmp 0x100fc023
jmp 0x100fbfcc
lea edx, [eax*4]
xchg ebx, eax
rdtsc
call 0x100fbfed
sbb byte [edi + 0x58996a0f], bl
jb 0x100fc007
jl 0x100fbfeb
ror bl, cl
mov bx, dx
cmc
jmp 0x100fbf78
mov dx, 0x6409
and ax, cx
bswap ebx
jmp 0x100fbf82
xchg dword [esp], eax
btc edx, esp
mov bh, 0x18
call fcn.100fc049
pop edx
fdiv qword [edx + 0x15]
in al, 1
test eax, 0x48d6bc8
enter 0xffffffffffff8d6b, 4
lea eax, [eax]
add byte [eax], al
add byte [esi - 0x75], ah
sbb al, 0x24
lea eax, [edi*4]
rdtsc
shl dl, 6
jmp 0x100fbfd7
add byte [esi + 0x3bb100f1], dl
mov ebp, 0x77c7342d
or al, 0x9f
out 0x11, al
nop
bsr ebx, esi
ror bl, cl
mov bx, dx
cmc
sub esp, 0x12
lea esp, [esp + 2]
rol esi, 0
ror edx, cl
je 0x100fbf80
mov dx, 0x6409
and ax, cx
bswap ebx
lea edx, [eax*4]
xchg ebx, eax
jmp 0x100fbf8b
mov ebx, eax
neg dx
js 0x100fc017
bsr ebx, esi
jmp 0x100fbf9c
not edx
mov bx, 0x28c7
push dword [esp + 0x20]
ret 0x24
mov dh, bl
bswap edx
lea edx, [ebp*4]
xchg dword [esp + 0x20], eax
bt bx, si
bt bx, si
jmp 0x100fc08d
Function at 0x10107563
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi + 0x50]
mov eax, 0x88425b0a
bswap eax
xchg dx, ax
bsf ax, di
jmp 0x10107567
mov ah, al
jmp 0x1010754d
jb 0x1010757d
jae 0x1010757d
rcl dword [ebp - 0x3b], cl
lodsb al, byte [esi]
pop edi
out dx, eax
inc ebx
invalid
mov dx, cx
cmp ebp, ebx
jg 0x101075b2
jle 0x1010758e
mov ch, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
ret 0x1f8c
mov ax, 0x24f6
jmp 0x101075b6
pushal
rdtsc
call fcn.101075c4
lea esp, [esp + 2]
mov dword [esp + 0x14], esi
pushfd
lea esp, [esp + 8]
popal
jmp 0x101075f6
mov ax, 0x24f6
ja 0x100f522b
mov dx, si
mov dl, cl
xchg edx, eax
jmp 0x10107594
lea edx, [eax + ebx]
rcl dx, 0xc
jle 0x10107646
bsf dx, di
jmp 0x10107630
mov dh, byte [esp]
jmp 0x1010764d
bsf dx, di
mov dh, byte [esp]
lea eax, [esi + 0x40]
push esp
mov dx, word [esp + 1]
mov dh, byte [esp]
jmp 0x10107694
mov edx, dword [esp]
dec dx
jmp 0x10107676
mov edx, dword [esp]
dec dx
lea edx, [ebp - 0x80]
pushal
jmp 0x101076e5
sub eax, ebx
mov edx, dword [esp]
cmp edx, eax
je 0x10107671
jne 0x1010765b
pushal
jmp 0x101076bb
sub edx, eax
clc
jmp 0x10107703
sub esp, 0x1f
mov byte [esp + 3], bh
lea esp, [esp + 3]
mov esp, edx
jmp 0x10107861
and dl, 0xfc
call fcn.1010767c
lea esp, [esp + 3]
jmp 0x101076cf
jb 0x101076c4
sub esp, 0x1f
mov byte [esp + 3], bh
jmp 0x101076ed
rep movsb byte es:[edi], byte [esi]
jmp 0x101077e5
mov edi, edx
mov ecx, eax
cld
jmp 0x10107733
pop esi
popfd
jmp fcn.100f6979
pop ecx
mov edi, dword [esp]
lea esp, [esp + 4]
jmp 0x10107793
push edi
push ecx
mov esi, ebx
jmp 0x10107749
pushfd
lea esi, [eax + edx - 0x40]
push esi
jmp 0x10107816

Function at 0x101075c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
ja 0x1010759c
jbe 0x101075eb
lea esp, [esp + 8]
popal
jmp 0x101075f6
lea esp, [esp + 2]
mov dword [esp + 0x14], esi
pushfd
jmp 0x101075cd

Function at 0x1010767c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
js 0x101076b5
mov word [esp], di
pushal
jmp 0x101076bb
mov word [esp], di
jmp 0x1010769f

Function at 0x10107a37
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, esi
jmp 0x101079d7
add ebx, 0xffffffff
jne 0x10107a1b
movzx eax, byte [ebx]
jmp 0x10107a03
mov bh, 0xd6
or edx, 0x2ad49fca
bsf edx, ebx
jmp 0x10107a5e
movzx eax, byte [ebx]
mov bh, 0xd6
or edx, 0x2ad49fca
bsf edx, ebx
mov bx, word [esp]
mov bx, word [esp]
call 0x10107a37
mov esp, 0x24048f66
not bx
mov word [esp], di
lea esp, [esp + 2]
jmp 0x10107a7a
mov dl, al
mov ebx, 0x553de33d
mov bx, dx
not bx
mov bx, bp
jmp 0x10107a64
mov bx, word [esp]
jmp 0x10107a2d
bswap ebx
mov bh, byte [esp]
mov ebx, dword [esp]
jmp 0x10107a8c
sub al, cl
lea ebx, [esi - 0x333962bc]
mov bl, byte [esp]
lea ebx, [esi + ebp]
mov edx, eax
jmp 0x10107a48
not dl
bsf ebx, ebx
jbe 0x10107cdc
bt bx, bp
mov bx, ax
bswap ebx
jmp 0x10107b13
mov bx, ax
bswap ebx
ror dl, 0
jmp 0x10107acd
bt bx, bp
jmp 0x10107b0e
Function at 0x10107bcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ebx, eax
jp 0x10107b8d
shr ebx, 0x13
jmp 0x10107bad

Function at 0x10109cac
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x100ea13d
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x100ea157
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x100ea146
pop esi
jmp 0x100ea162
ret 4
jmp 0x100ea130

Function at 0x10110589
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
jmp 0x101105a5
mov dl, 0x12
mov ah, byte [esp]
mov dx, word [esp]
lea eax, [ebp*4]
sub esp, 0x16
jp 0x101105d1
jnp 0x101105d6
in al, dx
hlt
call fcn.10110651
lea esp, [esp + 2]
jmp fcn.10110617

Function at 0x101383da
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
jmp 0x101383ff
and dword [eax + 4], 0
call fcn.10138452

Function at 0x10138408
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 8]
and dword [eax], 0
mov dword [eax + 8], 0x67452301
jmp 0x1013843c
mov dword [eax + 0xc], 0xefcdab89
push ebx
mov word [esp + 1], bp
jmp 0x10138457
lea esp, [esp + 4]
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x10159ebb
Capabilities:
Execute anti-debugging instructions

Disassembly:
stosd dword es:[edi], eax
mov cl, bh
rcl byte [ebx], cl
jg 0x10159f31
jbe 0x10159f25
mov al, byte [0xba004d8b]
mov ecx, 0x2ba190b3
invalid
jmp 0x10159f77
pop edx
push 0x5ee72011
xor eax, 0xd80d8cce
mov edi, 0xb6a038a7
aaa
push cs
mov dl, 0xc5
push esi
movsd dword es:[edi], dword [esi]
or eax, 0xbcdd1c9e
pop ss
int1
sbb eax, 0x5af2d380
xor ebx, 0xffffffe0
loopne 0x10159f9c
adc ebp, edx
pop esi
invalid
popal
jmp 0x10159fa1
lea esp, [esp + 2]
mov dword [esp + 0x2c], ecx
lea esp, [esp + 0x10]
jmp 0x10159f61
lea esp, [esp + 0x10]
popal
mov dx, word [eax]
stc
jmp 0x1015a007
bts eax, ecx
pushal
jmp 0x10159fea
mov dl, 0x35
mov dword [esp + 0x1c], ebp
push ebp
push dword [esp]
lea esp, [esp + 8]
xchg cx, ax
dec ax
jo 0x10159fd4
mov dl, 0x35
jmp 0x1015a00e
js 0x10159fab
bts eax, ecx
jmp 0x10159fae
mov dword [esp + 0x1c], ebp
push ebp
push dword [esp]
jmp 0x1015a01c
lea esp, [esp + 8]
jmp fcn.10159fe2

Function at 0x10159fe2
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
jmp 0x1015a786
jmp 0x1010884a
mov word [eax], dx
bswap eax
mov ah, byte [esp]
mov al, byte [esp]
inc eax
jae 0x1015a186
jb 0x1010884a
sub esp, 0xe
push dword [esp + 0xc]
lea esp, [esp + 2]
jmp 0x1015a7c1
jmp 0x1015a881
neg ax
jmp 0x1015a7f6
inc al
jmp 0x1015a7c6
add ebp, 8
call fcn.1015a7e0
mov dword [ebx], edx
call 0x1015a806
inc esi
lea esp, [esp]
lea eax, [edx*4]
jmp fcn.101079cf
mov edx, dword [ebp + 4]
mov eax, 0x716793d5
add ax, 0xe9df
jg 0x1015a7dc
inc al
neg ax
jmp 0x1015a7f6
mov ebx, dword [ebp]
lea edx, [ecx*4]
setbe ah
mov edx, esp
mov dx, word [esp]
jmp 0x1015a81e

Function at 0x1015a7e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi*4]
mov ax, word [esp + 1]
push dword [esp + 2]
jmp 0x1015a849
jle 0x1015a7fe
jg 0x1015a7fe
pop ecx
mov eax, 0x9e78f29b
bnd js 0x1015a7f1
fisttp qword [ebp + 0x32]
invalid