joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100365ce
Capabilities:
Inspect section memory permissions

Disassembly:
or eax, 0xffffffff
jmp fcn.10002429
jne 0x1000ea1c
cmp dword [ebp + 8], 0
jmp loc.1009bc4d
push ebp
not bp
rol ebp, 3
mov ebp, esp
test dx, 0xc732
test bx, di
sub esp, 0x3c
cmp si, 0x3e93
clc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
stc
cmp dword [ebp + 0x20], 0
jmp 0x10026099

Function at 0x1003a5e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], ax
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x1003b951
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
mov ecx, 0x2abda438
mov cx, 0xd791
push esi
mov ecx, dword [esp + ecx*2 - 0x557baf12]
mov dword [esp + 0x10], 0x31139965
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.100a4b25
movzx ecx, cx

Function at 0x1003ea8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x700c48b0
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
Function at 0x1003eb16
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0x9e0fd93d
call fcn.100533c8
push 0x21322109
lea eax, [esp + eax + 0x10]
push 0xcd1bf39d
jne 0x10198bd9
mov ecx, dword [ebp - 0x14]
sete dl
add ecx, 1
bt edx, 0x36
adc dh, 0x8e
or edx, ecx
mov dword [ebp - 0x14], ecx
bts edx, edx
mov edx, dword [ebp - 0x14]
cmp sp, si
cmc
test dx, si
cmp edx, dword [ebp - 0x2c]
jmp 0x100a10e9
dec dword [esp + 8]
jne 0x1002b653
push ebx
pushfd
mov ebx, 0x529dd0b6
or ebx, 0x7111180c
jge 0x100d7a15
xchg ebp, eax
jne 0x1003eafc
in eax, 0x8c
dec ebx
loop 0x1003eb31
loope 0x1003eb9a
out dx, al
adc eax, 0x7f1a5744
jbe 0x1003eb90
inc esp
lcall 0xa33, 0x7440cc53
popal
ljmp 0x78b3
mov bh, 0xfe
int1
sub dword [edx + 9], eax
mov al, byte [0xf16dea02]
out 0xa4, eax
inc eax
leave
inc ebp
mov cl, 0x41
mov dh, byte [esi + 0x5d]
popfd
mov dword [ecx], ecx
mov edx, 0x7f7bef76
inc edi
pop ebx
pop ss
jbe 0x1003eb98
mov al, byte [0xc2938237]
sub al, 0xc0
das
xchg edi, eax
aaa
adc byte [ebx + 0x2fc02cc2], 0x97
mov esp, 0xe98e99ba
cdq
mov gs, ecx
fidivr dword [edi + 0x2a65142e]
or dword [ebx + esi*2], 0x6d0e99fc
out dx, al
stc
loopne 0x1003ec25
outsb dx, byte [esi]
scasb al, byte es:[edi]
add dl, byte [eax]
scasb al, byte es:[edi]
vandpd ymm7, ymm0, ymm2
mov dword [0x5a346502], eax
int 0x22
xor dword [esp + esi*8 + 0x1e941cef], esp
pop esp
adc eax, 0x7f7d0a2f
add al, 0xd5
mov bl, 0x1c
inc edi
xor al, 0x6b
inc ecx
and ebp, dword [eax + 6]
jg 0x1003eb6d
mov ebp, 0x951b94cd
stc
jle 0x1003ec3e
cmp eax, dword [edx - 0x6c]
nop
int1
into
jge 0x1003ec60
xor eax, edx
xchg ebp, eax
jno 0x1003ec18
rcl byte [ebp + 0x16297166]
sub dword [esi], edx
push ss
xchg ecx, eax
test al, ah
retf
xchg ebp, eax
int1
add esi, dword [ebx]
imul ecx, dword [ecx - 0x5aab5119], 0xffffff8f
into
and dword [eax + 3], ebp
push ds
pop edi
outsb dx, byte [esi]
xor byte [eax - 0x58], 0x35
adc al, 0x96
aaa
dec eax
jo 0x1003ebee
or ebx, dword [edx + 0x37904672]
aaa
fadd qword [eax + 0x4f]
insd dword es:[edi], dx
push 0xffffffffffffff99
push cs
mov al, 0x83
jae 0x1003ebf6
mov gs, word [ebx - 0x60]
mov dl, 0xbd
jl 0x1003ebce
imul esp, dword [eax + 0x7cbdb226], 0xffffffa2
invalid
xor edx, dword [ebp + edx*4 + 0x16a85c29]
popal
loope 0x1003ebea
mov byte [0x7e3e8962], al
cmp byte [ecx - 0x40], bh
pop es
scasb al, byte es:[edi]
bound ecx, qword [ecx + 0x79387e3e]
rol byte [edi], 0xae
cmpsb byte [esi], byte es:[edi]
out dx, eax
dec ecx
jno 0x1003ec61
hlt
jnp 0x1003ec47
in eax, 0xe7
in al, dx
out 0xec, eax
popal
mov bh, 0xd9
in eax, dx
insd dword es:[edi], dx
int1
add al, 0x3b
dec eax
in al, dx
mov dl, dl
in al, dx
xor byte [ecx + 0x33], dl
ret 0xec43
push ebp
mov ebx, dword [esp + ebx - 0x739dd8b6]
mov dword [esp + 8], 0x89759865
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.100a4b25
movzx ecx, si
mov eax, dword [ebp + 0x58]
lea eax, [eax + 1]
movzx cx, ch
btc ecx, ebx
mov dword [ebp + 0x58], eax
rcr cx, 0x13
mov byte [eax], cl
jle 0x10004961
jmp 0x1017e979
Function at 0x100452af
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25

Function at 0x1004a9ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x1003a38e
jne 0x10146158
adc esi, 6
mov byte ss:[edx], al
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x1004c6bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], ax
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x1004f604
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec word [esp + 0xf]
jp 0x10117f23
xor bl, dl
lea edx, [esp + edx + 0x14]
mov dword [edx], ecx
jmp 0x1017338c
not word [esp + 9]
lea esp, [esp + 0x14]
jmp fcn.1014ffcc
jmp 0x10140f1e

Function at 0x10051c2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4397af82
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x10051d3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xb1aeb604
push 0x12129c8f
adc esi, 1
not dword [esp + 4]
shr bp, cl
mov word [esi], bp
not dword [esp + 3]
push 0xa231943c
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100533c8
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
jl fcn.1014ffcc

Function at 0x1005374f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x10053bea
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x10074867
mov ecx, dword [ebp - 0x20]
test bp, 0xd12c
add ecx, 1
jmp fcn.100edf85
call fcn.101462cb
test ebp, edi
test eax, eax
jmp 0x10043450
mov edx, dword [ebp - 0x20]
add al, 0x97
rcl cl, cl
mov eax, dword [ebp - 0x648]
not cl
mov cl, byte [eax]
sub ah, ah
mov byte [edx], cl
mov edx, dword [ebp - 0x20]
movsx eax, byte [edx]
shl dl, cl
cmc
mov dword [ebp - 0x724], eax
inc dx
shrd edx, ecx, 7
cmp esp, ebp
mov ecx, dword [ebp - 0x20]
cmp edi, edx
rcr dh, 9
add ecx, 1
btc dx, bx
mov dword [ebp - 0x20], ecx
xor dh, 0x93
cmp bh, 0x2d
btc dx, 0x88
mov edx, dword [ebp - 0x648]
test esp, esi
lea edx, [edx + 1]
test bx, si
mov dword [ebp - 0x648], edx
test esp, 0x530fe1d
cmp dword [ebp - 0x724], 0
je 0x10136ee8
jmp 0x10074867
jmp fcn.101416ea
mov dword [ebp + 0x30], 0
jmp 0x100e8b6c

Function at 0x1005aca7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
neg dword [esp + 4]
lea eax, [esp + eax + 0x18]
jl 0x1016a818
call fcn.10108432

Function at 0x1005e690
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc esi, 6
jmp loc.10172857

Function at 0x1005efcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x7887bd80
mov word [esi], ax
push 0x32ffda2
lea esp, [esp + 0x14]
jmp fcn.1014ffcc
Function at 0x1005f90b
Capabilities:
Encode data using base64
Encode data using xor
Execute anti-debugging instructions

Disassembly:
jle 0x101275bb
jbe 0x101d8806
leave
sub byte [edx + 1], cl
popfd
mov dword [esp + 4], 0x22c8e65
mov ebp, dword [esp + ebp + 0x14a28c5]
call fcn.101b3b9f
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.100a4b25
in al, 0xec
add eax, 0x9c05526b
mov bl, 0xd6
pop ebx
loop 0x101d87ed
aam 6
invalid

Function at 0x1005feb7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], 0xc3499c65
mov ebx, dword [esp]
call fcn.1007480c
imul eax, edx, 3
mov edx, dword [eax + 0x10081004]
not edx
xor ecx, edx
nop
add esi, edi
clc
mov dword [ebp - 0xa14], ecx
movzx esi, word [ebp - 0xf0a]
movzx eax, word [ebp - 0xf0e]
cmc
imul esi, eax
movzx ecx, word [ebp - 0xf10]
clc
cmc
imul esi, ecx
imul esi, dword [ebp - 0xa14]
jmp loc.10195414

Function at 0x100657a8
Capabilities:
Encode data using base64

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sar dh, 0x99
shr dh, 0x1f
sub esp, 0x98
mov eax, dword [ebp + 0x74]
rol dl, 0xa2
test ax, cx
mov dword [ebp + 0x68], eax
sets dl
mov dword [ebp + 0x60], 0
sal ah, 0xa2
rdtsc
mov ecx, 4
rcr ah, 0x9a
adc dh, 0xbd
shl ecx, 0
bts eax, edi
xadd edx, eax
mov edx, dword [ecx + 0x10081004]
inc cl
sar cx, cl
not edx
bts ecx, eax
xor edx, 0x9b113a98
btc ecx, 0x15
ror ah, 0xb5
mov eax, 4
not ecx
imul ecx, eax, 3
xchg ah, al
cmp ah, 0x90
mov eax, dword [ecx + 0x10081004]
sub cx, ax
bt cx, sp
not eax
rol cx, 0xbd
xor edx, eax
btr ax, 0x22
mov dword [ebp + 0x48], edx
or ch, 0x8d
mov ecx, 4
sal dl, 0x19
cmovne ax, ax
adc edx, ebp
shl ecx, 0
dec ax
sbb ax, dx
bsf eax, ebp
mov edx, dword [ecx + 0x10081004]
rol cl, cl
movzx ecx, si
not edx
or ch, ah
xor edx, 0x9b113e98
shld ecx, ecx, 0x8d
adc ah, ch
mov eax, 4
imul ecx, eax, 3
sal eax, cl
neg ah
xor al, al
mov eax, dword [ecx + 0x10081004]
adc ch, 0x33
movzx ecx, si
not eax
add cl, 0x35
sal cx, 0x1b
xor edx, eax
jmp loc.101380b3

Function at 0x10069a2f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edx
pushfd
mov edx, 0xb5300303
bswap edx
mov dx, 0x23b7
mov dl, 0xa
cmp dx, 0xde09
mov edx, dword [esp + 4]
mov dword [esp + 4], 0x89759865
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x100703d1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, 0xb3ad09bb
pushfd
xor bl, 0xc
not bl
mov dword [esp + 8], 0xd1bd8065
mov ebx, dword [esp + ebx + 0x4c52f6bc]
popfd
lea esp, [esp + 4]
call fcn.100a4b25
movsx ecx, bp

Function at 0x1007480c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
ja 0x1007fd7c
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.100a4b25

Function at 0x100785b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x87208296
lea esp, [esp + 0xc]
jmp fcn.1014ffcc
Function at 0x10079f37
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
lea esp, [esp + 0xc]
call fcn.100a4b25
jmp fcn.10133f2a

Function at 0x1007bcab
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], 0xdc968565
lea esp, [esp + 0xc]
call fcn.100a4b25

Function at 0x1007c8b9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
ror dl, 1
push 0x22174d37
add dl, 0x8e
xor dl, 0x8b
call fcn.101c04af

Function at 0x1007d09a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x1007e74d
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc esi, 6
jmp loc.100a69a0

Function at 0x1007ea4b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0x72b797ba
mov dword [esp + 4], esi
mov dword [esp], eax
push ebp
pushfd
mov ebp, 0
jmp loc.100bcf2c

Function at 0x1007eec4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x1007f305
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x1007f6c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp loc.100a396d
mov word [esi], dx
jmp 0x1007ef45

Function at 0x1007fac5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push edi
mov edi, 0x3d326c9d
pushfd
xor edi, 0x4b00d922
call fcn.101a5eed
mov dword [ebp - 0x5c], ecx
jmp fcn.101c3a5c

Function at 0x1008022c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
jmp 0x1000e801

Function at 0x10080285
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0x104
lahf
movzx ecx, si
movzx cx, bl
lea eax, [ebp - 0x508]
push eax
seta cl
xchg cl, ch
mov ecx, dword [ebp + 0x7c]
jmp loc.100fdaa5
push ebp
rcr ecx, cl
lea ebp, [esp - 0x74]
dec ecx
neg al
bsf eax, esi
sub esp, 0x57c
mov ax, 0x6913
cmovns cx, di
jmp 0x1000c687

Function at 0x100a1c53
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf8b49d0a
neg al
mov dword [esp + 4], 0xc52eb59a
mov byte [esp + 7], 0x8a
dec al
and word [esp + 4], 0x75af
xor bl, al
lea eax, [esp + eax + 0xc]
push 0xe4804e1f
push 0x8292fb38
mov dword [eax], ecx
push 0xd3ba0c3f
lea esp, [esp + 0x18]
jmp fcn.1014ffcc
Function at 0x100a3646
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
and ax, si
cwd
lea esp, [esp - 0x3c]
ror dh, 0xd
shl dh, 0x38
setns dl
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
rcl dl, cl
mov ecx, 4
bts eax, esp
shl ecx, 0
mov edx, dword [ecx + 0x10081004]
add ax, 0xa435
shl ch, cl
not edx
sal cl, 0xb5
xor edx, 0x64eec167
ror eax, 0x3a
stc
mov eax, 4
cmovl ecx, esi
imul ecx, eax, 3
shr al, 0x94
mov eax, dword [ecx + 0x10081004]
sal cx, cl
bswap ecx
ror cl, cl
not eax
dec cx
btc cx, si
xor edx, eax
sub cl, 0x8c
mov dword [ebp - 0x10], edx
rcl edx, cl
rcl cl, 0x9b
mov ecx, dword [ebp - 0x10]
stc
mov dword [ebp - 0xc], ecx
xor dx, di
jmp loc.1002ad02

Function at 0x100a45da
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
shrd ebp, esi, 0x99
mov ebp, esp
test esi, esp
jmp loc.100346dc

Function at 0x100a4b13
Capabilities:
Execute anti-debugging instructions

Disassembly:
or ax, dx
push 0x2c3d6c24
jmp 0x101227b6
jmp 0x1011016f
mov word [esi], ax
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
not ax
jmp 0x100d4486

Function at 0x100a4e74
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xa7254cba
xor cl, bl
neg cl
shr word [esp + 2], 0x85
jne 0x101a0feb
rol byte [esp + 3], 0x65
rol cl, 1
push 0x29b470ad
dec cl
sar dword [esp + 3], 0xf4
rol cl, 1
not cl
push 0xa016a195
xor bl, cl
sub esi, 2
mov dword [esp + 0xc], 0x7133620e
push 0x6b14e41f
mov byte [esp + 0xc], 0x9a
mov word [esi], cx
push 0x988bf61f
lea esp, [esp + 0x18]
jmp fcn.1016169c

Function at 0x100a4e8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esi], cx
push 0xc72e87b6
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100a963f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push esi
pushfd
mov esi, 0x3e33522c
mov esi, dword [esp + esi*2 - 0x7c66a454]
mov dword [esp + 4], 0xbfd58e65
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.100a4b25
call fcn.100c1761
mov cl, byte [eax]
jmp loc.100725e9

Function at 0x100aa5fc
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.100a4b25
push ebx
pushfd
mov ebx, 0x4b0b4290
sub ebx, ebx
lea ebx, [ebx + ebx*8 + 0x115618]
mov dword [esp + 8], 0xbfd58e65
mov ebx, dword [esp + ebx - 0x115614]
jle 0x101ce951
lea ecx, [ebp - 0x1dfc]
jmp 0x101af203
call fcn.100c1761
mov cl, byte [eax]
mov byte [ebp - 0xc93], cl
movsx edi, ax
sub edx, edx
mov byte [ebp - 0xc92], dl
mov ecx, 0x13
lahf
lea esi, [ebp - 0xcdf]
cwde
lea edi, [ebp - 0x36dc]
rep movsd dword es:[edi], dword [esi]
not eax
cbw
cwde
movsw word es:[edi], word [esi]
setb al
jmp loc.100286cb
jg 0x101ce951
je 0x1004cb6b
call fcn.100c1761
mov al, byte [eax]
setae ch
bswap ecx
mov byte [ebp - 0xc4b], al
push 0xe47f6878
cmovl cx, bp
lea ecx, [ebp - 0x2a74]
jmp loc.10014a27
Function at 0x100aaed2
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.100a4b25
push ecx
jmp 0x10187a73
jmp 0x101041ca
mov eax, 4
rcl ch, cl
shl eax, 0
mov ecx, ebx
sal cx, 0x3a
mov ecx, dword [eax + 0x10081004]
bt edx, ecx
not ecx
rcr ah, cl
bts ax, bx
sar dl, 0xb2
xor ecx, 0x9b113e9a
mov edx, 4
dec al
xor eax, ecx
stc
imul eax, edx, 3
bts dx, bx
bsr dx, dx
shl dx, cl
mov edx, dword [eax + 0x10081004]
not edx
btc eax, esi
bt eax, eax
stc
xor ecx, edx
sub eax, 0x1e9d91b2
xor eax, ebp
mov dword [ebp - 0x654], ecx
bswap ax
shr ah, 0x24
inc eax
mov eax, dword [ebp - 0x80]
cmp dh, 0xab
cmp eax, dword [ebp - 0x654]
jmp 0x101b2bb3
mov dword [ebp - 0xdd4], 0
clc
not al
adc dl, cl
mov cl, byte [ebp - 0xdd4]
xor eax, 0x74343e97
cdq
xor ax, bp
mov byte [ebp - 0x107], cl
mov edx, dword [ebp - 0x654]
lahf
xor edx, dword [ebp - 0x654]
ror eax, cl
rcl ax, cl
bt ax, 0x2e
mov dword [ebp - 0x654], edx
sub eax, edi
mov al, bh
btr ax, 0x8b
movzx eax, byte [ebp - 0x107]
cmp di, bx
cmc
test eax, eax
jmp 0x1000e97e
call fcn.1012c12a
add esp, 0xc
jmp 0x101c3a2b
jge 0x1011199e
mov dword [ebp - 0xdd4], 1
jmp 0x101119ad
mov dword [ebp - 0x80], 0
jmp 0x100de1db

Function at 0x100ae063
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.1014ffcc

Function at 0x100b339a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
mov dword [esp], 0x89759865
call fcn.100a4b25
call fcn.100c65ee

Function at 0x100b564a
Capabilities:
Encode data using base64

Disassembly:
call fcn.101423da
mov edx, 0xb4822c81
sub edi, 1
sal edx, 2
or edx, edx
inc dl
movzx edx, byte [edi]
jp 0x100dcfde
mov eax, 0x22dc02d
cwde
xor dl, bl
add eax, eax
xor eax, 0x8922621
inc dl
push eax
ror dl, 1
sar byte [esp + 2], 0x66
xchg ah, al
setns al
xor dl, 0x1c
bts eax, eax
not dl
xor bl, dl
or eax, 0x393cb8ac
and ax, ax
lea edx, [esp + edx + 4]
sbb eax, eax
adc word [esp + eax*8 + 1], ax
sub al, byte [esp + eax*8 + 3]
mov eax, dword [edx + eax*4 - 0x24]
push 0x97b88eb1
neg dword [esp + 4]
sbb esi, 3
mov dword [esi], eax
jmp 0x100fa67a
call fcn.100bdedb
movsx ecx, di

Function at 0x100b76d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esi + 4], eax
mov dword [esp], 0x148a3381
jmp loc.1002a3aa

Function at 0x100bed4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100bf3c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x76a6a51f
mov word [esi], dx
push 0x68830c06
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x100bf526
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x1c]
jmp fcn.1014ffcc

Function at 0x100c0db4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x731097b7
add esi, 8
mov dword ss:[ecx], eax
push 0xfc93f222
push 0x1caa7d86
jmp 0x1018b461
lea esp, [esp + 0x10]
jmp fcn.1014ffcc
Function at 0x100c2731
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
push edi
mov edi, 0x6729899a
push ebp
mov ebp, 0x5caacb39

Function at 0x100c65ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, 0xfa9d68bf
lea esi, [esi + esi*2 - 0x1674c9e5]
mov dword [esp + 4], 0x1ace8d65
mov esi, dword [esp + esi + 0x269c8fa8]
lea esp, [esp + 4]
call fcn.100a4b25

Function at 0x100c7ec7
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
jae 0x1012cee5
mov dword [esp], 0x1a209033
adc esi, 4
jmp 0x101bf284

Function at 0x100c9452
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x100ca2b3
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Inspect section memory permissions

Disassembly:
push edx
pushfd
mov edx, 0xddaf29bb
neg dl
shl dl, 0xb9
push edx
sub dx, 0xa59f
mov edx, dword [esp + edx + 0x22507ca7]
mov dword [esp + 8], 0x2b8cf765
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.100a4b25

Function at 0x100cbe9b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushfd
push ebp
mov ebp, 0xf093b5b1
and ebp, ebp
lea ebp, [ebp*2 + 0x61985817]
cmp ebp, 0x913af224
lea ebp, [ebp*8 - 0x375e9946]
push dword [esp + ebp*2 + 0x42c0fb00]
popfd
mov dword [esp + 4], 0x89759865
mov ebp, dword [esp + ebp*2 + 0x42c0fafc]
call fcn.100a4b20
call fcn.10009b06
lea ecx, [ebp - 0x1344]
jmp 0x101471d6
call fcn.10009b06
lea ecx, [ebp - 0x134c]
jmp loc.1001832c
call fcn.10009b06
lea ecx, [ebp - 0x1348]
jmp 0x10113c9a

Function at 0x100cd76d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
test edi, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0x89759865
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.100a4b25

Function at 0x100cdce7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0xcd1c8a65
lea esp, [esp + 8]
call fcn.100a4b25
mov edx, dword [ebp + 0x74]
cmovno ax, si
movzx eax, ax
lahf
push edx
mov eax, dword [ebp - 0x108]
jmp 0x101835bc
push eax
jmp fcn.1004293f

Function at 0x100d0a7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word es:[ebp], ax
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100d0eb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x99856fb7
mov word [esi], dx
push 0xd2a13cb2
jmp 0x101d0793
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100d0f56
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
call fcn.100a4b25

Function at 0x100d0f5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp], dl
jmp 0x101b1e84
lea esp, [esp + 0xc]
jmp fcn.1014ffcc

Function at 0x100d23b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4630ff3c
mov dword [esi], ecx
lea esp, [esp + 8]
jmp fcn.1014ffcc
Function at 0x100d3439
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
jmp fcn.1014ffcc

Function at 0x100d499e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x1a5f8d65
call fcn.100a4b25
nop

Function at 0x100d4cc7
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [esp + 8], 0xb83df51f
mov word [edx], cx
push 0xf01a361e
lea esp, [esp + 0x1c]
jae fcn.1014ffcc

Function at 0x100d58ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
shl al, cl
lea esp, [esp - 0x168]
shr eax, 0x2b
rcr ah, 0x92
mov dword [ebp - 0x64], 0
stc
bt cx, 0x34
shr ch, cl
mov eax, dword fs:[0x18]
btc ecx, edi
mov eax, dword [eax + 0x30]
jmp loc.10069548

Function at 0x100d65d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ecx
push 0xc384240a
push 0xe71f8905
mov dword [esi], ecx
push 0x280b0430
jmp 0x101d9a25
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x100d847f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x89021a9
lea esp, [esp + 0x14]
jmp fcn.1014ffcc

Function at 0x100d8492
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
jmp fcn.1014ffcc

Function at 0x100d85ef
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc esi, 7
not dword [esp]
jmp 0x101da26d
neg ebp
mov eax, dword [esi]
jp 0x10193ce0
mov dword [eax], ebp
jmp 0x101bba8c
mov ebp, dword [esi + 4]
mov dword [esp], 0xf697fd0d
jl 0x100b421b
call fcn.1007f045
jmp 0x1012c473

Function at 0x100dbf86
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 4
shrd dx, ax, cl
mov word [esi], dx
lea esp, [esp + 4]
jmp fcn.1014ffcc

Function at 0x100de065
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add dword [esp + 8], 0xeff2b94c
push dword [esp + 4]
popfd
lea esp, [esp + 0x18]
call fcn.100a4b25
jns 0x1004db8d