joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10182730
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
test eax, 0x62c862a2
cbw
and esp, 0xfffffff8
or ah, ah
sbb ax, sp
mov eax, dword [0x10169b5c]
lea esp, [esp - 0x2c]
cmp bp, dx
push ebx
push esi
push edi
cmp dx, sp
test eax, eax
jmp 0x10335c56
je 0x103b0c41
cmp byte [0x1016a0b0], 0
jmp 0x10343a4c
pop esi
bswap ebx
pop ebx
jmp 0x10245350
mov dword [esp + 0x18], eax
jmp 0x104207b1
mov esp, ebp
pop ebp
jmp 0x104e09f6
mov dword [esp + 0x24], 0
test eax, eax
jmp 0x104d0460
je 0x103b0c41
mov eax, dword [eax + 0x20]
jmp 0x103b10bd
je 0x103b0c41
call fcn.103f4afa
test al, al
jmp 0x104a2a79
je 0x103b0c41
mov ecx, dword [0x9a86b8]
clc
mov dword [esp + 0x2c], ecx
clc
cmc
test ecx, ecx
jmp 0x103bbbd3
pop edi
jmp 0x1020588c
push eax
call 0x1017d8f0
test eax, eax
jmp 0x101fa6e7
je 0x103b0c41
mov ecx, dword [0x1016a3e0]
cdq
stc
sub eax, edx
stc
jmp 0x10418c5a
mov dword [esp + 0x14], ecx
clc
jmp 0x1029c818
call edi
mov ecx, dword [0x1016a3dc]
xor ebx, eax
jmp 0x104719bd
je 0x103b0c41
mov eax, dword [ebp + 0xc]
test dx, 0x191
test eax, eax
jmp 0x1036272f
sar eax, 1
jmp 0x10207a8a
call fcn.10354377
call 0x104a8dcd
mov ebx, eax
jmp 0x10405983
jle 0x1048d3b4
mov edx, dword [ebx + 0x11]
bt cx, 0xdb
bsf ecx, ebx
bsr cx, ax
xor edx, edi
movzx ecx, sp
or ch, 0x61
bt cx, 0xf1
mov ecx, dword [edx]
stc
jmp 0x103c726e
call fcn.10354377
mov esi, eax
call edi
xor esi, eax
neg al
sar ah, cl
btc di, 0x27
mov edi, dword [esi + 4]
neg cl
rcl ax, cl
ror ch, cl
xor edi, dword [esi]
rcr ch, cl
cmc
mov eax, dword [ebx + 0x12d]
rol edi, 3
rcr cl, cl
bsr ecx, esi
xor eax, edi
not ecx
mov ecx, dword [eax]
btr ax, bp
mov al, bh
sar ax, cl
mov eax, dword [0xc2d2e0]
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], ecx
cmp ebp, eax
mov dword [esp + 0x30], eax
test eax, eax
jmp 0x10465951
je 0x103b0c41
cmp dword [ebp + 8], 0
jmp 0x10415b90
jle 0x1048d3b4
ret 8

Function at 0x101b28de
Capabilities:
Check for software breakpoints

Disassembly:
push 0xf19a5be3
call fcn.101daf97
Function at 0x10211bb2
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebp
rcr dh, 0xf2
mov ebp, esp
or edx, 0x731176a6
add dx, cx
push 0xffffffffffffffff
adc edx, 0x41740f47
bsf eax, ecx
push 0x100e9ed1
jmp 0x10211bb2
push esi
push eax
jmp 0x1038509c
mov eax, dword fs:[0]
rcl dx, cl
bsf edx, ecx
push eax
rol dl, cl
sub esp, 0xefc
mov eax, dword [0x1014ade0]
inc edx
test dl, 0xb6
sar dx, 0x20
xor eax, ebp
rol dx, cl
movsx dx, al
cmp dx, 0x1332
mov dword [ebp - 0x10], eax
cmc
push ebx
adc dx, cx
bts dx, bx
push esi
sbb dx, bp
cdq
push edi
movzx edx, ax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x206
sal dl, 0x51
or dl, 0xd1
rcl dl, cl
xor esi, esi
bt edx, 0x66
dec edx
or edx, 0x108c5939
lea edx, [ebp - 0xa96]
test di, sp
sub ecx, ecx
jmp 0x10415713
push esi
push ecx
jmp 0x1045f841
push edx
jmp 0x1031eeaa
mov word [ebp - 0x490], ax
jmp 0x103680f2
push esi
jmp 0x1025fafc
mov dword [ebp - 0xea8], esi
jmp 0x103bb2f0
mov byte [ebp - 0xee8], 0
call fcn.10078950
add esp, 0xc
push 0x1ff
cwd
not edx
lea edx, [ebp - 0x287]
jmp 0x102ea704
add esp, 0xc
jmp 0x1049b5ff
call fcn.10078950
lea esp, [esp + 0xc]
cmp ebp, 0x5e6763ba
or eax, esp
push 0x206
test esi, eax
sar ah, cl
lea eax, [ebp - 0xc9e]
test bx, 0x3f83
clc
cmp si, 0x633e
sub edx, edx
jmp 0x101cde71
jmp 0x10423639
mov word [ebp - 0xca0], dx
jmp 0x1046ae96
mov edx, dword [ebp - 0xef8]
xchg cl, ch
jmp 0x103d7a44
call fcn.10078950
add esp, 0xc
push 0x206
lea ecx, [ebp - 0x48e]
cmp ecx, 0x1cf4601a
xor eax, eax
push esi
jmp 0x103d2612
mov byte [ebp - 0x288], 0
jmp 0x10436d1f
push ecx
jmp 0x1027a045
jne 0x103ad62c
sub eax, eax
jmp 0x1036eb87
lea ecx, [ebp - 0xca0]
jmp 0x1002a3ba
push edx
jmp 0x10455ace
push esi
jmp 0x103f65b3
call fcn.10078950
mov edi, dword [ebp + 8]
test ebx, 0x525b32a8
jmp 0x1035cbff
mov dword [ebp - 0xef8], eax
mov word [ebp - 0xa98], cx
jmp 0x103b6f75
mov dword [ebp - 0xf00], esi
jmp 0x1034d6e8
call fcn.10078950
add esp, 0xc
push 0x3f
jmp 0x1049b722
call fcn.1035d368
mov ebx, eax
test esi, edi
test si, 0x579f
cmp ebx, esi
jmp 0x103d5a7c
lea ecx, [ebp - 0xee7]
jmp 0x10247b68

Function at 0x1023595c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
jmp 0x103d14a9
je 0x10486f05
push 0x104
movsx eax, di
jmp 0x10418bd1
lea eax, [ebp - 0x3e4]
bswap cx
push eax
not ch
jmp 0x1003a644
push 0xd9343681
call fcn.101e5271
je 0x101e0a64
lea ecx, [ebp - 0x418]
mov dh, 0xe4
push ecx
bswap dx
mov dh, dh
lea edx, [ebp - 0x788]
jmp 0x104a70ad
push edx
setp al
cwde
lea eax, [ebp - 0x950]
not edx
movzx dx, al
cmovne ecx, esi
push eax
bswap ecx
mov cx, di
not dl
lea ecx, [ebp - 0x788]
mov edx, esp
movzx dx, ah
push ecx
mov edx, ebp
push 6
not dl
lea edx, [ebp - 0x18]
push 0x4d
jmp 0x10358c59
call fcn.10073240
add esp, 8
cmp si, ax
stc
test eax, eax
jmp 0x103fd8e7
push edx
jmp 0x10046c48
call 0x102a0888
push edi
jmp 0x10486f03
je 0x101e0a64
mov edi, dword [ebp - 0x1178]
call fcn.1035d368
mov edi, eax
cmp edi, ebx
jmp 0x101b7cff
lea eax, [ebp - 0x520]
push eax
push ebx
jmp 0x1017a50a
call esi
mov ecx, dword [ebp - 0x1178]
cwd
not ah
push ecx
lea edx, [ebp - 0x520]
jmp 0x102413a0
push edx
jmp 0x10346626
Function at 0x1026a892
Capabilities:
Encode data using xor

Disassembly:
push 0xf19a5be3
call fcn.101daf97
mov al, 0xd2
wait
mov esp, edi
mov al, dl
xchg ebp, eax
lds ebx, [edx]
push ebp
push ecx
push edx
lds ebx, [ebp + 0x3b830a32]
pop eax
inc edi
push ds
cmp ah, byte [esi + 0x3b8e8aa9]
sbb eax, 0x277eb882
dec ebx
xor al, 9
and eax, 0xb75847c0
loopne 0x1026a8a3
inc ebp
or ah, byte [ebx + ebx*8 - 0x30f22dc6]
neg ebx
les ecx, [ebx - 0x6e]
inc ebx
cmp byte [ebp + 0x6f19e5cb], bl
outsb dx, byte [esi]
push esp
or al, 0x6e
xchg edx, eax
and edx, dword cs:[eax + 0x6f371d93]
enter 0xfffffffffffff007, 0xffffffffffffffc5
xlatb
pushfd
mov cl, 0x97
xchg esp, eax
cmp ebp, dword [0xab57d840]
fnstsw word [esi + ebp*4 - 7]
mov esp, fs
invalid
Function at 0x10368179
Capabilities:
Hash data with crc32

Disassembly:
jne 0x1041060d
jmp fcn.103bede5
call fcn.100dba70
mov dword [esp + 0x10], eax
test eax, eax
jmp 0x101d9476
call fcn.10078950
add esp, 0xc
jmp 0x10458dcf
mov word [esp + 0x22c], dx
jmp 0x101ef9a9
push ebx
jmp 0x103b7316
push ecx
jmp 0x102c6422
push eax
jmp 0x10214458
call fcn.100dbbd0
test eax, eax
jmp 0x103a32b9
push ebx
call fcn.100337d0
lea esp, [esp + 4]
test ebx, 0x32031cb
test eax, eax
jmp 0x10357adc
jne 0x104b195a
push ebx
jmp 0x10314ada
push ebp
adc cx, 0x42a8
add ebp, esp
btr ax, 0x51
mov ebp, esp
sub ch, bl
shld eax, eax, 0x58
and esp, 0xfffffff8
cmp di, 0x3f23
sub esp, 0x62c
xadd ax, ax
xchg ah, ch
stc
mov eax, dword [0x1014ade0]
ror ch, 0x55
btr ecx, 0x87
xor eax, esp
movsx ecx, bp
bswap ecx
mov dword [esp + 0x628], eax
adc ch, 0xec
rol cl, 0x49
shr ch, 0x7a
push ebx
sub ecx, edx
rol cx, 0xc1
push esi
or cl, 0xf4
push edi
or cl, ch
sub eax, eax
push 0x206
movzx cx, bl
push eax
lea ecx, [esp + 0x432]
jmp 0x104825cc
je 0x104b195a
push 0x200
mov cl, ah
xchg ecx, ecx
movzx ecx, bp
lea ecx, [esp + 0x24]
jmp 0x102d544d
and ebx, esi
invalid
call fcn.101a7992
test eax, eax
jmp loc.100050bc
call fcn.10078950
add esp, 0xc
shrd eax, esi, 0x38
or ah, 0xf8
xor edx, edx
movsx ax, cl
nop
push 0x206
movzx eax, cx
push edx
lahf
cmovbe ax, dx
cbw
lea eax, [esp + 0x22a]
jmp 0x10303e58
mov ebx, dword [esp + 0x10]
jmp 0x10339ee6
push 0
jmp 0x1047f7b9
call fcn.100dba70
mov ebx, eax
cmp esp, 0x688931d4
cmc
stc
mov dword [esp + 0x10], ebx
test ebx, ebx
je fcn.103bede5
jmp 0x10339ee6
push ecx
mov word [esp + 0x434], ax
jmp 0x103c3af3
push ebx
jmp 0x101e57e6

Function at 0x103784ab
Capabilities:
Read file on windows

Disassembly:
push 0xf3318878
call fcn.10417a54
Function at 0x10386240
Capabilities:
Hash data with crc32

Disassembly:
push 0xf3318878
call fcn.10417a54

Function at 0x103a1d8d
Capabilities:
Encode data using base64

Disassembly:
push ebp
rol bp, 0x1e
mov ebp, esp
push 0xffffffffffffffff
jmp 0x104822cb
push eax
lea esp, [esp - 0x18]
btc eax, 0x52
push ebx
push esi
push edi
add eax, 0x58f6067e
mov eax, dword [0x1014ade0]
ror ebx, 0x34
adc ebx, 0x441507c1
xor eax, ebp
push eax
rcl bh, cl
rcl bx, 0x1a
lea eax, [ebp - 0xc]
shl bx, cl
shr bl, 0x3d
mov dword fs:[0], eax
sbb edi, 0x37d92587
mov ebx, dword [ebp + 8]
and edi, edx
bts edi, esi
cmp bx, dx
mov eax, dword [ebp + 0xc]
cmovne di, sp
btc edi, eax
lea edi, [ebx + eax]
cmp esp, 0x3d500a0e
cmc
mov byte [ebp + 0xb], 0
mov dword [ebp - 0x20], edi
cmp ebx, edi
jae 0x10447497
push 0x100e8720
add eax, esp
sal ah, cl
mov eax, dword fs:[0]
jmp 0x103f72e1

Function at 0x103a27ee
Capabilities:
Execute anti-debugging instructions
Reference processor manufacturer constants

Disassembly:
mov byte [ebp - 0x46], 0x6f
jmp 0x10361897
push esi
jmp 0x10402460
mov byte [ebp - 0x48], 0x56
jmp 0x103b0b56
mov byte [ebp - 0x41], 0x79
jmp loc.1001cf47
mov byte [ebp - 0x45], 0x78
mov byte [ebp - 0x44], 0x54
jmp 0x103898ea
mov byte [ebp - 0x43], 0x72
jmp 0x10430a17
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x1014ade0]
jmp 0x1042ef14
mov byte [ebp - 0x47], 0x42
jmp 0x102ceb8d
push edi
jmp 0x1034f899
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
jmp 0x102d07e3
mov byte [ebp - 0x42], 0x61
jmp 0x1035f226
Function at 0x103dbb84
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.10072e95
mov word [ebx + esi*2], ax
jmp 0x104d623e
mov byte [esp + 0xcf], dl
mov byte [esp + 0xda], dl
jmp 0x1038831f
movzx eax, word [ebx + esi*2]
push eax
jmp 0x101e1711
push ecx
jmp 0x104217e6
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
jmp 0x1041f906
call fcn.1001d640
push eax
call fcn.104be1ca
add esp, 4
jmp 0x103c8331
jne 0x103c8339
call fcn.10049330
mov ebx, 0x20
mov al, 0x25
mov cl, 0x3a
not dl
mov dl, 0x54
jmp 0x102a54d7
jne 0x103a09c6
lea edx, [esp + 0x10]
mov di, 0x28e6
not di
push edx
not di
mov edi, 0x1016b75c
jmp 0x103a09c1
mov edx, dword [esp + 0x10]
jmp 0x1001425e
call fcn.1004a5d0
mov eax, dword [ebp + 0x18]
movsx edx, bx
mov cx, sp
mov ecx, dword [ebp + 0x14]
movsx dx, cl
mov dx, 0x1f06
setno dl
mov edx, dword [ebp + 0x10]
jmp 0x1044f61f
push edx
push eax
push ecx
jmp fcn.102ac392
test eax, eax
je 0x1035c523
mov ecx, dword [esp + 0x10]
jmp 0x10346284
push 0xf3318878
call fcn.10417a54
jb 0x1030d620
mov edx, dword [esp + 0x1c]
add esi, edx
btr si, 0x94
btc esi, edx
add edx, edx
mov esi, edi
cmovno esi, ebp
mov esi, ebx
jmp 0x103748a7
push eax
jmp 0x1048b815
call fcn.1003db20
add esp, 4
test eax, eax
jmp 0x103859b2
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
jmp 0x103af2ae
call fcn.104be1ca
lea esp, [esp + 4]
test bp, si
test eax, eax
jmp 0x1037d206
inc esi
stc
test edi, 0x242d288a
add esp, 4
clc
test ebp, edx
test bh, 0xc0
cmp esi, dword [esp + 0x1c]
jmp 0x103dbb8e
Function at 0x103dedbf
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x142], 0xb9
jmp 0x10442117
mov byte [esp + 0x151], 0xdc
mov byte [esp + 0x152], 0x82
jmp 0x1040737e
mov byte [esp + 0x13c], 0xb
jmp 0x104d2eb8
mov byte [esp + 0x147], 0x24
jmp 0x102a06d9
mov byte [esp + 0x173], bl
not bl
xchg bl, bl
mov bl, 0xd1
jmp 0x101ed1a0
mov byte [esp + 0x14e], 0xa6
mov byte [esp + 0x14f], 0x6c
jmp 0x104e93c2
mov byte [esp + 0x148], al
mov byte [esp + 0x149], 0x97
mov byte [esp + 0x14a], 0x62
jmp 0x104c33e3
mov byte [esp + 0x141], 0xc4
jmp 0x101804c3
mov dword [esp + 0x28], eax
jmp 0x103bb4b9
mov byte [esp + 0x172], bl
jmp 0x10286468
mov byte [esp + 0x146], 0x62
jmp 0x1021a688
mov byte [esp + 0x15b], 0x24
jmp 0x103bb3ea
mov byte [esp + 0x155], 0xea
mov byte [esp + 0x156], 0xeb
mov byte [esp + 0x157], 0x6e
jmp 0x10464d11
mov byte [esp + 0x145], 0x50
jmp 0x10343a5e
mov byte [esp + 0x15c], 0xf9
jmp 0x10018f9e
mov dword [esp + 0x24], ecx
jmp 0x10422d35
jne 0x103bfc71
push 0x80004005
call fcn.10007200
mov edx, dword [eax]
movsx ecx, bx
mov cx, bp
setne cl
mov ecx, eax
movsx eax, di
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov al, 0xb6
mov dword [esp + 0x2e0], esi
mov bl, 0x37
mov al, 0xaf
mov cl, 0x9c
mov dl, 0xac
mov cl, bl
mov cl, 0x53
jmp 0x102c8934
push eax
mov al, 0xdb
btr ax, dx
ror eax, 0xfb
lea esp, [esp - 0x2c8]
dec ax
xor ax, si
mov eax, dword [0x1014ade0]
xor eax, esp
test edx, ebx
mov dword [esp + 0x2c0], eax
push ebx
push esi
test ax, sp
neg ah
xchg al, al
push edi
test cx, sp
mov eax, dword [0x1014ade0]
xor eax, esp
push eax
shr ax, cl
lea eax, [esp + 0x2d8]
clc
test bh, 0x47
mov dword fs:[0], eax
rol eax, cl
mov ah, cl
mov eax, dword [ebp + 8]
cmc
stc
xor esi, esi
cmc
cmp dword [ebp + 0xc], esi
jmp 0x102bb830
mov byte [esp + 0x140], 0xc8
jmp 0x102b7144
mov byte [esp + 0x153], 0xf
jmp 0x1042eee8
mov dword [esp + 0x1c], edx
jle 0x101db102
call fcn.10063522
xor ecx, ecx
shr cl, 0x1f
xor cl, 0xea
cmp eax, esi
not cl
mov cl, 0xca
setne cl
jmp 0x10457b5b
mov byte [esp + 0x14d], 0xe8
jmp 0x102865df
mov byte [esp + 0x154], 0xed
jmp 0x10382c2c
mov byte [esp + 0x159], 4
mov byte [esp + 0x15a], 0xd8
jmp 0x10362f4f
mov byte [esp + 0x143], 0xe4
jmp 0x10447a9c
mov byte [esp + 0x144], 0x6d
jmp 0x103b2956
cmp ecx, esi
jmp 0x103bfc61
mov byte [esp + 0x158], 0x18
jmp 0x1043e796
mov byte [esp + 0x14c], 0x7d
jmp 0x10425320
mov byte [esp + 0x14b], 0x12
jmp 0x1048efc1
mov byte [esp + 0x13d], cl
mov byte [esp + 0x13e], 0x1a
mov byte [esp + 0x13f], 0xba
jmp 0x103e477c
mov byte [esp + 0x150], dl
jmp 0x101c7e2d

Function at 0x103f2d41
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov byte [esp + 0x67], 0xde
jmp loc.10013e44
mov byte [esp + 0x66], 0xfa
jmp 0x10217e25
mov byte [esp + 0x62], 0x44
mov byte [esp + 0x63], 0x87
jmp 0x1042d7e0
mov byte [esp + 0x65], 0x38
jmp 0x102b0a1f
push 0xf3318878
call fcn.10417a54
mov byte [esp + 0x61], 0x7e
jmp 0x103523ec
mov byte [esp + 0x64], 0x6f
jmp 0x10382a28
Function at 0x103f6f2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x1c], ebx
jmp 0x102480d9
call esi
mov ecx, dword [edi + 0x12d]
xor ebx, eax
bsf eax, ebp
mov dword [esp + 0x28], ebx
cmc
test bl, 0x26
setae dh
mov ebx, dword [ebx + 4]
sal edx, cl
rdtsc
mov eax, dword [esp + 0x28]
rol dh, 0xf8
xor ebx, dword [eax]
bts si, bx
mov eax, dword [edi + 0x141]
rol ebx, 3
shrd dx, dx, 0x94
xor eax, ebx
neg edx
mov edi, dword [eax]
stc
movsx esi, di
mov esi, dword [eax + 4]
inc eax
mov eax, dword [0x9a86b8]
xor ecx, ebx
movsx edx, di
mov edx, dword [ecx]
jmp 0x10210f2c
mov dword [esp + 0x30], edx
jmp 0x1041010b
call fcn.10354377
call 0x1042359c
mov edi, eax
call esi
mov ecx, dword [0x1016a3dc]
stc
clc
xor edi, eax
jmp 0x102b88f6
call fcn.10354377
mov ebx, eax
jmp 0x1024655d
mov dword [esp + 0x3c], edi
jmp 0x102b4213
push edi
jmp 0x102712c7
push ebp
mov ebp, esp
and esp, 0xfffffff8
rcr cx, cl
sub esp, 0x44
jmp 0x1049e989
mov dword [esp + 0x14], edi
jmp 0x10472104
mov ecx, dword [0x1016a3e0]
jmp 0x104c91c4
push ebx
push esi
jmp 0x103014f6

Function at 0x103f72e1
Capabilities:
Encode data using base64

Disassembly:
push ebp
rol bp, 0x1e
mov ebp, esp
push 0xffffffffffffffff
jmp 0x104822cb
push eax
lea esp, [esp - 0x18]
btc eax, 0x52
push ebx
push esi
push edi
add eax, 0x58f6067e
mov eax, dword [0x1014ade0]
ror ebx, 0x34
adc ebx, 0x441507c1
xor eax, ebp
push eax
rcl bh, cl
rcl bx, 0x1a
lea eax, [ebp - 0xc]
shl bx, cl
shr bl, 0x3d
mov dword fs:[0], eax
sbb edi, 0x37d92587
mov ebx, dword [ebp + 8]
and edi, edx
bts edi, esi
cmp bx, dx
mov eax, dword [ebp + 0xc]
cmovne di, sp
btc edi, eax
lea edi, [ebx + eax]
cmp esp, 0x3d500a0e
cmc
mov byte [ebp + 0xb], 0
mov dword [ebp - 0x20], edi
cmp ebx, edi
jae 0x10447497
push 0x100e8720
add eax, esp
sal ah, cl
mov eax, dword fs:[0]
jmp 0x103f72e1

Function at 0x103ff3b9
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x1045342b
inc eax
cmp eax, dword [esp + 0x30]
jmp 0x104e94f9
call fcn.10022630
mov esi, eax
test esi, 0x38782c5d
test esi, esi
jmp 0x1002bec3
je 0x1045342b
cmp byte [0x10169dba], 0
je 0x103edf9c
cmp dword [0x10169dbc], 2
mov ax, dx
lahf
bswap eax
mov eax, 1
jmp 0x104890e8
and dword [esi + 0x20], 0xfffffffc
setbe ah
jmp 0x1045342b
push 0xf3318878
call fcn.10417a54
call fcn.100419c0
lea esp, [esp + 4]
stc
cmp esi, 0x29fc0148
test al, al
jmp 0x103c8cb5
mov eax, dword [esp + 0x24]
jmp 0x10380a54
jl 0x104890fa
mov eax, 3
clc
cmp edi, 0x6a754b23
or dword [esi + 0x20], eax
jmp 0x1034f5f4
jl 0x104d0466
call fcn.10021390
mov ecx, eax
test ecx, ebp
mov dword [esp + 0x30], eax
shl al, cl
not ax
mov eax, dword [0x10169e64]
cmc
cmp si, bx
sub ecx, eax
cmp ecx, 0x927c0
jmp 0x1001ec4c
mov ecx, dword [esp + 0x24]
jmp 0x103b9294
mov dword [esp + 0x24], eax
jmp 0x1048d3ae
Function at 0x1040126d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
jmp loc.1000f2e2
call fcn.1026fc14
mov esi, eax
test sp, si
cmp esi, 0xffffffff
je 0x103c8ce4
mov edi, dword [0x100ec2ac]
movzx eax, ax
not dx
rdtsc
mov ebx, dword [0x100ec2a8]
not cx
cwd
movsx edx, si
lea ecx, [esp + 0x3c]
movsx dx, bh
rdtsc
push ecx
movzx eax, si
cbw
lea edx, [esp + 0x264]
not al
mov ax, 0x6118
movsx eax, si
push edx
bswap eax
mov eax, 0x6ce65d91
jmp 0x102dae2b
push edx
push 0x104
call fcn.1034e596
test eax, eax
jmp 0x10339d4e
push ecx
jmp 0x1039cce3
push str._s_s
lea eax, [esp + 0x67c]
jmp 0x1049bfd2
call fcn.10071de7
mov esp, ebp
xchg bp, bp
pop ebp
jmp loc.1006e1ac
push eax
cmovb ecx, edx
mov cx, 0x662c
not ecx
lea ecx, [esp + 0x26a]
jmp 0x104bdca8
push edx
jmp 0x1017d6b0
je 0x103c8ce4
lea eax, [esp + 0x260]
cmovge ecx, edx
push eax
movzx cx, bh
push str._s.dll
movsx ecx, cx
cmovns cx, di
lea ecx, [esp + 0x470]
jmp 0x103d5bd9
push eax
jmp 0x101badb7
call fcn.10077bfa
add esp, 0x10
lea edx, [esp + 0x10]
push edx
mov ax, bp
nop
lea eax, [esp + 0x46c]
jmp 0x1035eac7
mov word [esp + 0x26c], ax
jmp 0x103ff8d9
mov ecx, dword [esp + 0x87c]
pop edi
bts si, bx
pop esi
sbb bl, 0x1a
pop ebx
test cx, cx
xor ecx, esp
jmp 0x102e0e85
push 0x104
jmp 0x102bd467
lea ecx, [esp + 0x670]
push ecx
call edi
lea edx, [esp + 0x10]
jmp 0x1030d5df
call fcn.10078950
add esp, 0xc
cwd
mov dl, dh
lea edx, [esp + 0x260]
jmp 0x101f54e5
push ebp
sal ch, cl
xor ecx, edi
mov ebp, esp
sub ch, 0x28
and esp, 0xfffffff8
cmp ax, sp
xor cx, 0x47e3
sub esp, 0x874
btr ecx, 0x40
mov eax, dword [0x1014ade0]
shl ch, cl
neg ecx
xor eax, esp
mov dword [esp + 0x870], eax
or ch, 0xeb
jmp 0x104dcef1
push 0x104
push eax
jmp 0x104d38d2
push ecx
jmp 0x103bbe25
call fcn.10077bfa
add esp, 0x14
movzx ecx, bx
xchg cx, cx
jmp 0x103f4a0e
push ebx
sal ch, cl
not ecx
btr ecx, 0x72
push esi
push edi
sal cx, cl
sub eax, eax
push 0x206
jmp 0x102edf03
Function at 0x1041d1a6
Capabilities:
Read file on windows

Disassembly:
call dword [0x100ec3f0]
jmp 0x1039ad1a
call fcn.1007268f
add esp, 0x14
bsf ax, cx
cmp sp, bp
sal ah, cl
mov eax, 0x5a4d
stc
test ah, 0xb8
cmp word [ebp - 0x20], ax
jmp 0x1037d239
push edx
jmp 0x101c3366
je 0x1039ad1a
push eax
cdq
cwd
jmp 0x103f08da
call dword [0x100ec3fc]
push eax
jmp 0x101bc90e
je 0x103d9bd9
push eax
push 1
movzx ecx, di
xchg cl, ch
push 2
movzx ecx, cx
mov cx, 0xc83
lea ecx, [ebp - 0x20]
push ecx
jmp 0x10366d52
pop ecx
mov edi, 0x2ed2715f
pop edi
xchg bl, bl
mov si, 0x1963
pop esi
cmovge ebx, edx
pop ebx
mov esp, ebp
bswap bp
movsx ebp, ax
xchg bp, bp
pop ebp
jmp 0x1048ea74
call fcn.100727e8
add esp, 0xc
mov eax, dword [ebp - 0x1c]
clc
cmp ecx, edi
test sp, 0x4e12
cmp eax, edi
jmp 0x1020b9b2
call fcn.100725fb
mov edx, dword [ebp - 0x1c]
jmp 0x10209502
jne 0x1039ad1a
mov edi, 1
push 0xffffffffffffffff
jmp 0x1037d382
mov dword [ebp - 0x24], edi
jmp 0x1025405b
call fcn.10072308
add esp, 0xc
neg ah
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jmp 0x102afdae
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
bswap edi
not edi
movsx ecx, dx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
jmp 0x10320ef5
push 0x10112c74
setne ch
mov ch, 5
push esi
movsx ecx, sp
movzx cx, al
mov cl, al
lea ecx, [ebp - 0x1c]
jmp 0x10485f47
call fcn.100725fb
mov eax, dword [ebp - 0x1c]
jmp 0x104798c1
push 1
mov dx, 0x495e
push 2
movzx edx, bp
lea edx, [ebp - 0x20]
jmp 0x104474f6
push ebp
dec ah
mov ebp, esp
setge al
push 0xfffffffffffffffe
stc
push 0x102d3cc0
push 0x10078a30
mov eax, dword fs:[0]
cmp edi, ebp
push eax
bsf eax, ebx
rcr ax, 0xe3
lea esp, [esp - 0x14]
movzx eax, bp
xchg al, ah
shrd ax, si, 0xb0
push ebx
push esi
push edi
mov eax, dword [0x1014ade0]
sal si, 0xbd
shl si, 0x91
xor dword [ebp - 8], eax
xor eax, ebp
push eax
shr eax, cl
lea eax, [ebp - 0x10]
movsx esi, ax
bts si, sp
mov dword fs:[0], eax
btr si, 4
ror eax, 0x7d
mov dword [ebp - 0x18], esp
mov esi, ecx
rol al, cl
bts ax, sp
sub edi, edi
lahf
mov dword [ebp - 0x1c], edi
not al
setnp al
mov dword [ebp - 0x20], edi
setl ah
cbw
bswap ax
mov dword [ebp - 4], edi
movzx eax, bx
movsx ax, al
not ah
push 0x10112c70
cmovg ax, bp
push esi
bswap ax
jmp 0x104d024a
call fcn.1007268f
lea esp, [esp + 0x14]
add ch, 0x6e
mov ecx, 0x5a4d
cmp word [ebp - 0x20], cx
jmp 0x1037d239
push edx
jmp 0x103ec32c
push eax
jmp 0x1043cf6e
push ecx
jmp 0x1035c708
ret
lea eax, [ebp - 0x1c]
push eax
jmp 0x10387a20
Function at 0x10453ec4
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
push esi
jmp 0x1027158a
push edi
mov di, sp
push eax
cwde
movsx edi, ax
xchg di, ax
lea eax, [ebp - 0xc]
cmovae edi, ecx
mov edi, ebx
mov dword fs:[0], eax
bswap di
mov edi, ecx
jmp loc.1002a313
push ebp
or bp, 0x7733
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9e87
sbb eax, edi
cmovl eax, eax
mov eax, dword fs:[0]
stc
cmp ecx, 0x3385781a
push eax
btr eax, 0x34
setge ah
sub eax, esi
sub esp, 0x114
btc eax, 0x68
rcl ax, cl
mov eax, dword [0x1014ade0]
clc
cmc
xor eax, ebp
mov dword [ebp - 0x10], eax
jmp 0x101d547e
Function at 0x104a580e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
ror bh, 0x57
mov eax, esi
btc si, 0x73
pop esi
rcl ebx, cl
or cl, dh
adc bx, 0x47b2
pop ebx
movsx ecx, bx
sub ch, 5
movsx cx, dl
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp 0x1037c620
mov edi, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
bts si, ax
stc
mov esi, dword [edi + eax + 0x1c]
bsr edx, edi
rcr dh, cl
clc
mov edx, dword [edi + eax + 0x24]
cmp si, si
clc
mov dword [ebp - 0xe4], ecx
shrd ecx, ecx, 0xaa
rcl ch, cl
mov ecx, dword [edi + eax + 0x20]
lea esi, [esi + eax]
clc
jmp 0x103e6e65
lea edx, [edx + ecx - 1]
clc
cmp di, cx
cmp edx, 0x15ba7b00
cmp ebx, edx
jmp 0x104a6056
je 0x104e2f9d
cmp dword [edi + eax + 0x18], 0
mov dword [ebp - 0xd8], 0
jmp 0x104e2f97
mov ecx, dword [ebp - 4]
cmovl bx, bp
pop edi
mov bx, sp
shrd ebx, edi, 0x48
pop esi
xor ecx, ebp
xor eax, eax
jmp 0x103d967e
pop ebx
jmp 0x1049c5e4
mov dword [ebp - 0xe0], edx
test dl, bl
test ebx, 0xffff0000
jmp 0x1035e6d5
jb 0x10023651
mov edx, dword [ebp - 0xe4]
stc
lea eax, [eax + edx]
stc
clc
add eax, edi
cmp eax, 0x48806a3e
cmp esi, eax
jmp 0x104a1955
lea ecx, [ecx + eax]
stc
test esi, esi
add edx, eax
jmp 0x10466e8a
push 0
jmp 0x1049d5be
mov edx, dword [ebp - 0xd8]
mov ecx, dword [ecx + edx*4]
mov esi, ebx
rcr dl, cl
lea ecx, [ecx + eax]
cmc
or dl, bl
mov dl, byte [ecx]
cmp dl, byte [esi]
jmp 0x10054ef5
cmp esi, ecx
jmp 0x103e119a
mov byte [ebp - 0x70], 0
call fcn.10078950
push 0x63
lea ecx, [ebp - 0xd3]
jmp 0x1042081f
mov dword [ebp - 0xdc], esi
cmp bp, 0x3075
mov dword [ebp - 0xe8], ecx
clc
jmp 0x103e0af1
call fcn.10071de7
mov esp, ebp
movzx ebp, dx
pop ebp
ret
push ecx
jmp 0x10055200
ja 0x10023651
push 0x63
lea eax, [ebp - 0x6f]
push 0
push eax
jmp 0x104661f3
push ebp
rcl cl, cl
stc
or ax, bx
mov ebp, esp
sar cl, 0xfd
mov dx, bp
sub esp, 0xe8
mov eax, dword [0x1014ade0]
setns cl
cwd
xor eax, ebp
mov dword [ebp - 4], eax
adc dh, 0x77
test edi, 0x33f27261
ror ax, cl
mov eax, dword [ebp + 8]
and cl, 0xd5
sal cl, cl
mov cl, 0x6c
mov byte [ebp - 0xa], cl
xchg edx, edx
mov byte [ebp - 9], cl
bts dx, bx
mov ecx, dword [eax + 0x3c]
rcr dl, cl
push ebx
cwd
mov ebx, dword [ebp + 0xc]
bt dx, 0xa7
sar edx, cl
lea ecx, [ecx + eax]
btc edx, esi
inc edx
push esi
btr edx, 0xb2
mov byte [ebp - 0xc], 0x2e
neg esi
stc
rcr dx, 0xf1
mov byte [ebp - 0xb], 0x64
btc dx, 0x33
sbb dh, bh
rcr dh, cl
mov byte [ebp - 8], 0
rol dl, cl
push edi
jmp 0x102cabe8
ja 0x103981e8
sub ebx, ecx
mov esi, dword [esi + ebx*4]
add esi, eax
movsx ecx, di
lea ecx, [eax + edi]
jmp 0x1045f047
jg 0x10458bb9
mov ecx, dword [edi + eax + 0x10]
test al, al
cmp ebx, ecx
jb 0x103981e8
mov edx, dword [edi + eax + 0x14]
jmp 0x1033b818