joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026f50
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011dedd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10198754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.10027300
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.tutorial::BeginAuthSessionViaCredentialsRequest.0
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.10026e00
xor ecx, ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [edx], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xc
call fcn.10027260
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebp - 0x1c], eax
movzx ecx, byte [ebp - 0xd]
push ecx
push 0x1019f940
mov ecx, dword [ebp - 0x1c]
call fcn.10026ea0
mov edx, dword [ebp - 0x18]
add edx, 0x14
mov dword [ebp - 0x20], edx
movzx eax, byte [ebp - 0xe]
push eax
push 0x1019f940
mov ecx, dword [ebp - 0x20]
call fcn.10026ea0
mov ecx, dword [ebp - 0x18]
add ecx, 0x18
mov dword [ebp - 0x24], ecx
movzx edx, byte [ebp - 0xf]
push edx
push 0x1019f940
mov ecx, dword [ebp - 0x24]
call fcn.10026ea0
mov eax, dword [ebp - 0x18]
add eax, 0x1c
mov dword [ebp - 0x28], eax
movzx ecx, byte [ebp - 0x10]
push ecx
push 0x1019f940
mov ecx, dword [ebp - 0x28]
call fcn.10026ea0
mov edx, dword [ebp - 0x18]
add edx, 0x20
mov dword [ebp - 0x2c], edx
movzx eax, byte [ebp - 0x11]
push eax
push 0x1019f940
mov ecx, dword [ebp - 0x2c]
call fcn.10026ea0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x18]
xor eax, eax
xor ecx, ecx
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x34], 0
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x35], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10059c60
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e783
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10198754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x10149373
mov ecx, dword [ebp - 0x14]
call fcn.100124c5
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov dword [ebp - 0x18], ecx
push 0x10149373
mov ecx, dword [ebp - 0x18]
call fcn.100124c5
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 0x30
mov dword [ebp - 0x1c], edx
push 0x10149373
mov ecx, dword [ebp - 0x1c]
call fcn.100124c5
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x48], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x4c], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.10069fc0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1005a4d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e7f6
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x10198754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_K32GetModuleInformation
push str.simulator.dll
mov eax, dword [ebp + 8]
push eax
call fcn.100f32e2
add esp, 8
test eax, eax
je 0x1005a59a
mov ecx, dword [ebp - 0x18]
mov dword [0x1019df20], ecx
push 0x6c
lea ecx, [ebp - 0x8c]
call fcn.10022b40
lea ecx, [ebp - 0x8c]
call fcn.10059c60
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
push str._bin_simulator.dll
call fcn.100124c5
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x8c]
call fcn.10061df0
mov byte [ebp - 0x165], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.10059d60
jmp 0x1005a6de
push str.diversion.dll
mov ecx, dword [ebp + 8]
push ecx
call fcn.100f32e2
add esp, 8
test eax, eax
je 0x1005a618
mov edx, dword [ebp - 0x18]
mov dword [0x1019df20], edx
push 0x6c
lea ecx, [ebp - 0xf8]
call fcn.10022b40
lea ecx, [ebp - 0xf8]
call fcn.10059c60
mov dword [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x170], esp
push str._bindiversion.dll
call fcn.100124c5
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xf8]
call fcn.10061df0
mov byte [ebp - 0x166], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.10059d60
jmp 0x1005a6de
push str.steamclient.dll
mov edx, dword [ebp + 8]
push edx
call fcn.100f32e2
add esp, 8
test eax, eax
je 0x1005a6aa
movzx eax, byte [0x1019df69]
test eax, eax
je 0x1005a63d
jmp 0x1005a6de
mov byte [0x1019df69], 1
mov ecx, dword [ebp - 0x18]
mov dword [0x1019df20], ecx
push 0x6c
lea ecx, [ebp - 0x164]
call fcn.10022b40
lea ecx, [ebp - 0x164]
call fcn.10059c60
mov dword [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x174], esp
push str._steamclient.dll
call fcn.100124c5
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x164]
call fcn.10061df0
mov byte [ebp - 0x167], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.10059d60
jmp 0x1005a6de
cmp dword [ebp - 0x18], 0
jbe 0x1005a6de
cmp dword [0x1019df20], 0
jbe 0x1005a6de
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [0x1019df20]
jne 0x1005a6de
mov dword [ebp - 0x20], 0xff
lea edx, [ebp - 0x20]
push edx
push 0
push 0x10063110
call fcn.10104c5b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006bd80
mov esp, ebp
pop ebp
ret

Function at 0x1005a7b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x1005a7c2
jmp 0x1005a7e1
mov ecx, dword [ebp + 8]
mov dword [0x1019df24], ecx
call fcn.1005a770
push 0
push 0
push 0x1005a700
call fcn.10104c5b
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005cfa0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 8], eax
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 4], 0
jmp 0x1005cfd7
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x1019dfe8]
jae 0x1005d00b
lfence
mov edx, dword [ebp - 4]
mov eax, dword [0x1019dfe4]
mov ecx, dword [eax + edx*4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
mov eax, dword [0x1019dfe4]
mov ecx, dword [eax + edx*4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1005cfce
mov edx, dword [0x1019dfe4]
push edx
call fcn.10103aa0
add esp, 4
mov dword [0x1019dfe4], 0
mov dword [0x1019dfe8], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret

Function at 0x1005d1e0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x10198754]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xffffffff
je 0x1005d325
cmp dword [ebp - 0x2d4], 0
je 0x1005d325
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xffffffff
je 0x1005d30e
mov dword [ebp - 0x2d0], 0x10001
mov dword [ebp - 0x2d8], 0
lea edx, [ebp - 0x2d0]
push edx
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1005d30c
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x2e0], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2e0]
push ecx
call fcn.1005d5d0
add esp, 0xc
test eax, eax
jne 0x1005d305
cmp dword [ebp - 0x2d8], 3
jge 0x1005d2da
lfence
mov edx, dword [ebp - 0x2d4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 0x2d8]
add ecx, 1
mov dword [ebp - 0x2d8], ecx
jmp 0x1005d303
lfence
mov edx, dword [ebp - 0x2d4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d4], 0
jmp 0x1005d30c
jmp 0x1005d307
jmp 0x1005d30c
jmp 0x1005d258
jmp 0x1005d325
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006bd80
mov esp, ebp
pop ebp
ret
Function at 0x1005e340
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e8ad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10198754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.10027300
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.tutorial::PollAuthSessionStatusResponse.0
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.10026e00
xor ecx, ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [edx], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xc
call fcn.10027260
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebp - 0x1c], eax
movzx ecx, byte [ebp - 0xd]
push ecx
push 0x1019f940
mov ecx, dword [ebp - 0x1c]
call fcn.10026ea0
mov edx, dword [ebp - 0x18]
add edx, 0x14
mov dword [ebp - 0x20], edx
movzx eax, byte [ebp - 0xe]
push eax
push 0x1019f940
mov ecx, dword [ebp - 0x20]
call fcn.10026ea0
mov ecx, dword [ebp - 0x18]
add ecx, 0x18
mov dword [ebp - 0x24], ecx
movzx edx, byte [ebp - 0xf]
push edx
push 0x1019f940
mov ecx, dword [ebp - 0x24]
call fcn.10026ea0
mov eax, dword [ebp - 0x18]
add eax, 0x1c
mov dword [ebp - 0x28], eax
movzx ecx, byte [ebp - 0x10]
push ecx
push 0x1019f940
mov ecx, dword [ebp - 0x28]
call fcn.10026ea0
mov edx, dword [ebp - 0x18]
add edx, 0x20
mov dword [ebp - 0x2c], edx
movzx eax, byte [ebp - 0x11]
push eax
push 0x1019f940
mov ecx, dword [ebp - 0x2c]
call fcn.10026ea0
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
mov dword [ebp - 0x30], ecx
movzx edx, byte [ebp - 0x12]
push edx
push 0x1019f940
mov ecx, dword [ebp - 0x30]
call fcn.10026ea0
mov eax, dword [ebp - 0x18]
xor ecx, ecx
xor edx, edx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062227
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
shl al, cl
call fcn.101a9a9f
mov eax, 0x5011369a
lea esi, [esi + eax - 0x5011369b]
movzx eax, byte [esi + eax - 0x5011369a]
mov ecx, 0x50241fae
and cl, cl
btr ecx, 0xac
xor al, bl
push ecx
rol cl, 0x46
add cx, cx
neg al
xadd cl, ch
not al
bts ecx, 4
bswap ecx
rol al, 1
bt ecx, ecx
not dword [esp + ecx - 0x75562450]
xor dword [esp + ecx - 0x75562450], 0x7bc9f89
sbb al, 0x30
push ecx
push ecx
xor bl, al
sal dword [esp + ecx - 0x75562450], cl
lea eax, [esp + eax + 0xc]
call fcn.101a2d9f

Function at 0x100622d4
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea eax, [eax + eax*8 + 0x283d24ad]
mov dword [esp + eax*2 - 0x39b46530], eax
movzx eax, byte [esi + eax - 0x1cda3298]
xor al, bl
sal byte [esp + 1], 0xc6
sbb al, 0x38
call fcn.101a7060

Function at 0x100622f8
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x100623bb
Capabilities:
Terminate process

Disassembly:
push 0xbaafe72a
not ebp
jmp fcn.101a2d20

Function at 0x10062487
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp 0x100625bc
mov word [edi], dx
call fcn.10069086
push 0x1a1180a1
mov word [edi], cx
call fcn.101a50d7
push 0x608ecf0c
push 0x89815b19
mov dword ss:[edx], eax
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x100625b2
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x4301ee3e
call fcn.101a861d

Function at 0x100625e7
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
sub cl, 0x38
neg cl
mov dword [esp + 4], 0x2729bb85
not cl
shl dword [esp + 4], 0x6b
mov dword [esp], 0xe18bc380
neg cl
xor bl, cl
neg byte [esp + 7]
sal dword [esp + 4], 0x78
lea ecx, [esp + ecx + 8]
jp 0x101a70a3
adc edi, 1
add ax, bp
push 0xae865b94
mov word [edi], ax
lea esp, [esp + 4]
jmp fcn.101a9e3e
jae 0x101a6294
mov ax, word [edi + ebp]
dec bp
neg ebp
mov bp, word [edi + 2]
jl 0x1006928e
mov edx, dword [edi]
push 0x1b9a0680
call fcn.101a3c59
mov ch, 0x9c
Function at 0x10062970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10062994
xor eax, eax
jmp 0x10062a14
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100629ab
xor eax, eax
jmp 0x10062a14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100629f7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x100629f7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100629ce
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10062a03
xor eax, eax
jmp 0x10062a14
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10062a11
xor eax, eax
jmp 0x10062a14
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10062a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10198754]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x10062a87
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10062a8e
mov al, 1
jmp 0x10062b7c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.10010b73
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.10010b73
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.10010b77
add esp, 8
movzx eax, al
test eax, eax
je 0x10062ad4
xor al, al
jmp 0x10062b7c
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.100653f0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x10062b16
cmp dword [ebp - 0x34], 1
je 0x10062b1d
cmp dword [ebp - 0x34], 3
je 0x10062b6f
jmp 0x10062b7a
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10062b4f
lfence
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.10105db8
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10062b4f
xor al, al
jmp 0x10062b7c
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x10062b63
mov dword [ebp - 0x3c], 1
jmp 0x10062b6a
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x10062b7c
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x10062b7c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006bd80
mov esp, ebp
pop ebp
ret

Function at 0x10063375
Capabilities:
Terminate process

Disassembly:
xor ebx, ecx
shl dword [esp + 0xc], 0xeb
sbb edi, 4
push 0x9d3f7234
mov dword [edi], ecx
lea esp, [esp + 0x14]
jmp fcn.101a8301

Function at 0x1006354c
Capabilities:
Terminate process

Disassembly:
call fcn.101a4298
pop ecx
rol dl, 1
mov ecx, 0x62f8e0d
shr cl, 0xe7
sbb dl, 0x30
btr cx, cx
or cx, cx
imul ecx, ecx
xor bl, dl
add edx, esp
add cx, word [edx + ecx - 0x72c40000]
sub edi, 2
jmp 0x10063e09
mov word [edi], cx
push 0xbb986c20
lea esp, [esp + 4]
jmp fcn.101a8301

Function at 0x10063675
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not al
mov dword [esp + 4], 0x88b3ea5
and dl, al
call fcn.10062487

Function at 0x100637bd
Capabilities:
Terminate process

Disassembly:
push 0x9fa28c2c
mov word [edi], bp
jmp loc.101a4e7e
Function at 0x10063865
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esi, [esi + edx - 0x695f2c44]
mov dword [esp + edx - 0x695f2c43], 0xcfbe2988
push edx
xadd dword [esp + edx - 0x695f2c3f], edx
movzx edx, byte [esi]
inc word [esp + 5]
sub word [esp + 6], 0x840c
shr dword [esp], 0x43
xor dl, bl
and dword [esp + 3], 0x40b5519b
ror dl, 1
not word [esp + 4]
inc dl
or dword [esp + 2], 0xe9943cae
jbe 0x101a94bc
not dl
rol dl, 1
sar dword [esp + 4], 0xb0
xor bl, dl
jmp loc.101a55b6
lea esp, [esp + 0x10]
jmp fcn.101a9e3e
push 0x6636e812
mov dword [edi], edx
push 0x8413a03e
push 0x12242b94
jmp 0x101a4016

Function at 0x10063946
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc edi, 2
jmp fcn.101a7ca4

Function at 0x10063a71
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov ebp, 0x619a1aa0
mov dword [esp + ebp - 0x619a1aa0], 0xc812aab0
mov ebp, dword [edi + ebp - 0x619a1a9c]
add edi, 4
add edx, ebp
call fcn.101a6638

Function at 0x10063a95
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.101a9e3e

Function at 0x10063a9e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xf719480a
mov dword [edi], eax
jmp loc.101a2468

Function at 0x10063e1a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xaa8d249e
xor byte [esp + 2], 0xa2
adc edi, 4
shr dword [esp], 5
jbe 0x101a5f22
call fcn.10060980
mov byte [ebp - 4], 1
cmovbe ecx, ecx
lea ecx, [ebp - 0x274]
jmp 0x10064a6b
call fcn.10064dc8
or dx, dx
neg cl
call fcn.101a7de6

Function at 0x10063e75
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xc5005faa
not dword [esp]
sbb edi, 3
push 0xe8901895
jmp fcn.101a4024

Function at 0x10063ed6
Capabilities:
Terminate process

Disassembly:
sub edi, 2
mov dword [esp], 0x1170b04
not word [esp + 1]
push 0x6fb7b5ae
mov word [edi], cx
call fcn.101a95ed
jmp loc.101a557f

Function at 0x10063f26
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 6
mov dword [esp], 0x7aad3485
jmp loc.101aa00b

Function at 0x10063fb0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x3818ed90
lea esp, [esp + 0x14]
jmp fcn.101a9e3e
Function at 0x100647e0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x9e03a89d
jmp loc.101a4e6c

Function at 0x100649df
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a9e3e

Function at 0x10064a2b
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
shl bp, cl
mov word [edi], bp
call fcn.101a5f3c
lea ecx, [ebp - 0x2b4]
jmp fcn.101a3962

Function at 0x10064b3d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not dword [esp + 7]
mov word [edi], dx
jmp loc.101a6ef1

Function at 0x10064b5c
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 7
mov dword [ebp], ecx
push 0xdba71f28
lea esp, [esp + 4]
jmp fcn.101a9e3e
jbe 0x101a5d4b
lea ecx, [ebp - 0x69c]
call fcn.100126b3
push 0
xchg ch, ch
seta ch
jmp loc.101a4a21
mov word [eax], bp
call fcn.101a929e
mov ecx, 0x6e00a92e
mov ebp, dword [edi + ecx - 0x6e00a92e]
sal ecx, 0xe6
btr cx, cx
shl ecx, 0xd5
mov ecx, dword [edi + ecx - 0x6ffffffc]
jns 0x10064800
mov edi, dword [edi]
jmp 0x10064c5f
jmp fcn.101a8301
jns 0x1006378f
jmp loc.10063ea1

Function at 0x10064b8e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0x9282cd3a
add cx, 0xe90a
shr dword [esp], 0xe8
call fcn.101a4e83

Function at 0x10064ba5
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0xbf9af935
adc edi, 1
shl ebp, cl
push 0x69b79a90
push 0xca802013
jmp fcn.101a20c3

Function at 0x10064bd4
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp], 0x9ab3f909
add edi, 2
xor byte [esp + 1], 9
jp 0x101a9e23
mov eax, 0x1a19789c
mov eax, dword [eax + edi - 0x1a19789c]
push 0xdc281db1
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
sal edx, cl
mov dword [edi], edx
push 0xb23292a4
jmp 0x101a392e

Function at 0x10064c8d
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [esp + 4], 0xa3a8b989
and dl, al
push 0xb3a323a1
push 0x171ea03c
jmp loc.101a9749

Function at 0x10064dc8
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not eax
push 0xcca0c219
or word [esp + 1], 0x6e05
mov dword [esp + 4], 0xe5bc460f
not ebp
call fcn.101a615a
movzx cx, byte [edi]
mov edx, 0x30248726
lea edx, [edx + edx*8 - 0x11d06eda]
btr edx, 0x8b
mov dl, byte [edi + 2]
call fcn.101a6a24
xor bp, bx
jmp loc.101a6e92