joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021b90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [0x100ba184]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
mov dword [ebp + 0xc], esi
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push edi
mov dword [ebp - 0x10], esp
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100ba190]
and ecx, eax
lea ebx, [ecx*8]
mov ecx, dword [0x100ba17c]
mov eax, dword [ebx + esi]
cmp eax, ecx
jne 0x10021c16
mov esi, ecx
jmp 0x10021c1c
mov esi, dword [ebx + esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x10021c2e
mov ecx, dword [edx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x10021c63
cmp esi, eax
jne 0x10021c22
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10021ca0
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [0x100ba184]
jmp 0x10021ca3
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [0x100ba180]
call fcn.1002249c
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + ecx]
cmp eax, dword [0x100ba17c]
jne 0x10021cbc
mov dword [ebx + ecx], edi
mov eax, dword [0x100ba184]
mov dword [ebx + eax + 4], edi
jmp 0x10021ce4
cmp eax, esi
jne 0x10021cc5
mov dword [ebx + ecx], edi
jmp 0x10021ce4
mov eax, dword [ebx + ecx + 4]
mov eax, dword [eax]
mov dword [ebx + ecx + 4], eax
cmp eax, edi
je 0x10021ce4
mov ecx, dword [0x100ba184]
mov eax, dword [ecx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx + 4], eax
mov ecx, 0x100ba178
mov dword [ebp - 4], 2
call fcn.10021d30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10021dc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x10021e31
cmp dword [ecx], edi
jne 0x10021e29
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10021e39
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10021e39
cmp dword [ecx], edi
jne 0x10021e3c
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1002249c
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10021e70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x10021ef1
mov esi, dword [ebx + 4]
jmp 0x10021ef7
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x10021f0c
mov ecx, dword [edi]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x10021f53
cmp esi, eax
jne 0x10021f00
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10021f3c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10021f8d
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x10021faf
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.1002249c
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x10021f95
mov dword [ecx], edi
jmp 0x10021faf
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10021faf
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10021d30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10024ab5
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x100601d6
call fcn.1005d833
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10024bd2
cmp byte [ebx + 0x3e], 0
je 0x10024bd2
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.10022dcf
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x10024b01
xor al, al
jmp 0x10024bd4
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.1001c300
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10024b31
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.10022dcf
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x10024b66
sub eax, 1
je 0x10024b6a
dec eax
sub eax, 1
je 0x10024bc0
xor bl, bl
jmp 0x10024bc2
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x10024b7a
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x10024ba2
cmp eax, 0x10
jae 0x10024b89
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10034781
add esp, 0x10
cmp esi, eax
jne 0x10024b62
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x10024bc0
test esi, esi
jne 0x10024b25
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1001c3d0
jmp 0x10024b1f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10006950
mov al, bl
jmp 0x10024bd4
mov al, 1
call fcn.1005d7ee
ret
Function at 0x100250dc
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10060328
call fcn.1005d833
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x10025101
xor eax, eax
jmp 0x1002527a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1002512d
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x1002512d
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1002527a
cmp dword [esi + 0x4c], 0
je 0x10025277
mov ecx, esi
call fcn.10024d02
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x10025160
push dword [esi + 0x4c]
push edi
call fcn.1002468b
pop ecx
pop ecx
test al, al
je 0x10025277
movzx ebx, di
jmp 0x10025277
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.1001c300
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10025198
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.10022dcf
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x1002526b
cmp eax, 1
jg 0x10025246
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x100251e1
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x1002520e
cmp eax, 0x10
jae 0x100251f0
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.10034781
add esp, 0x10
cmp edi, eax
jne 0x10025241
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x10025211
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x1002523b
test edi, edi
jne 0x1002518c
cmp dword [ebp - 0x18], 0x20
jae 0x10025265
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.1001c3d0
jmp 0x10025186
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x10025265
cmp eax, 3
jne 0x1002526b
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.1002468b
pop ecx
pop ecx
test al, al
je 0x10025265
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10006950
mov ax, bx
call fcn.1005d7ee
ret 4

Function at 0x1003df1d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003dbe0

Function at 0x1003df28
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003dd61
Function at 0x10049488
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x101894a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x10188ca1
jmp 0x1018930b
push eax
push edx
push eax
push edx
pushal
popal
rdtsc
jl 0x10189319
jb 0x1018931f
pop edx
pop eax
pushal
push eax
push edx
rdtsc
pop edx
pop eax
push ecx
pop ecx
push eax
push edx
rdtsc
pop edx
pop eax
popal
rdtsc
push eax
jns 0x1018933a
pop eax
pop edx
pop eax
push eax
push edx
jmp 0x10189351
pushal
ja 0x10189358
push edi
pop edi
jbe 0x10189360
jmp 0x10189373
popal
rdtsc
jge 0x1018939a
jmp 0x10189394
js 0x1018939a
pop edx
pop eax
pushfd
push edi
push edx
mov dword [esp], ebx
push esi
mov esi, 0x7ffd2efa
inc esi
shl esi, 6
neg esi
neg esi
add esi, 0xb443d4
mov ebx, esi
pop esi
mov dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
push eax
mov eax, esp
add eax, 4
sub eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
mov dword [esp], edx
mov dword [esp], 0x5f7f4da7
add dword [esp], 0x3bfb1081
xor dword [esp], 0x9b62d28e
push 0x621f6a82
mov dword [esp], eax
mov dword [esp], edx
mov dword [esp], edi
mov dword [esp], eax
push eax
push esp
pop eax
push edx
mov edx, 0x6dedee1a
neg edx
add edx, 0x6fe9f4a9
shl edx, 8
add edx, 0x2dd64151
not edx
xor edx, 0xd6232faa
sub eax, 0x2f768234
add eax, edx
add eax, 0x2f768234
pop edx
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push esi
mov esi, esp
push ecx
mov ecx, 4
add esi, ecx
pop ecx
add esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
push dword [esp + 8]
push dword [esp]
mov ebx, dword [esp]
add esp, 4
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
sub ebp, 0xfbe01c9
add ebp, eax
add ebp, 0xfbe01c9
pop eax
xchg dword [esp], ebp
pop esp
push dword [esp]
pop eax
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
push ebp
push dword [esp + 4]
mov ebp, dword [esp]
add esp, 4
pop dword [esp]
pop esp
jmp 0x1016a550
Function at 0x1018bc16
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1018b4a3
jmp 0x1018bae5
jmp 0x1018baef
pushal
push eax
push edx
jg 0x1018baf8
rdtsc
push eax
push edx
rdtsc
pop edx
pop eax
push edx
pop edx
pop edx
pop eax
jns 0x1018bb0c
pushal
popal
push edx
pushal
popal
pop edx
popal
pushfd
push ecx
mov dword [esp], 0x425ba1b3
mov dword [esp], edx
mov dword [esp], 0x68ffd3fa
and dword [esp], 0x7efdfe3b
shr dword [esp], 1
shr dword [esp], 2
and dword [esp], 0x7cb2055d
add dword [esp], 0x13eb8b17
or dword [esp], 0x7f6e3c76
shl dword [esp], 7
xor dword [esp], 0xffdfbf31
push eax
mov dword [esp], 0x7fff0ba9
and dword [esp], 0x1ac5e8fc
sub dword [esp], 1
sub dword [esp], 0xf0a02e46
mov dword [esp], esi
mov dword [esp], 0x18b4a8
sub esp, 4
mov dword [esp], esi
mov esi, esp
add esi, 4
push ebp
mov ebp, 4
sub esi, 0x78f75926
sub esi, ebp
add esi, 0x78f75926
pop ebp
xchg dword [esp], esi
pop esp
mov dword [esp], eax
push ecx
push esp
pop ecx
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edx
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push ecx
mov ecx, esp
push eax
mov eax, 4
add ecx, eax
mov eax, dword [esp]
add esp, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp + 8]
push dword [esp]
mov ebx, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ebp
mov ebp, esp
push eax
mov eax, 4
add ebp, eax
pop eax
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp]
pop eax
push ecx
mov ecx, esp
push ebx
mov ebx, 0x57ffb19e
and ebx, 0x7bb6ca06
or ebx, 0x7ff71503
xor ebx, 0x7ff79503
add ecx, ebx
pop ebx
push ebx
mov ebx, 4
add ecx, ebx
pop ebx
xchg dword [esp], ecx
pop esp
jmp 0x1016a550
Function at 0x1018c3a1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1018bc8e
jmp 0x1018c2cc
pushal
push edx
jmp 0x1018c2df
pop edx
push eax
jg 0x1018c2e7
jo 0x1018c2ed
pop eax
pushal
push edi
pop edi
jp 0x1018c2f7
push eax
pop eax
popal
popal
pushal
jmp 0x1018c30c
push edx
push ecx
pop ecx
pop edx
jle 0x1018c31c
push eax
push edx
rdtsc
pop edx
pop eax
popal
pushfd
push 0x2fa23afe
mov dword [esp], ebx
mov dword [esp], 0x772ff67c
push edi
mov edi, 0x5d9f9100
sub dword [esp + 4], 0x6e9e846f
add dword [esp + 4], edi
add dword [esp + 4], 0x6e9e846f
pop edi
sub dword [esp], 0x1adfdf7a
shl dword [esp], 2
inc dword [esp]
and dword [esp], 0x2bda1129
sub dword [esp], 0x2399fd75
push ecx
push edi
mov dword [esp], ebp
mov ebp, 0x18bc93
mov dword [esp + 4], ebp
push dword [esp]
pop ebp
add esp, 4
push edi
mov edi, esp
push ecx
mov ecx, 4
add edi, 0x6b7db2c1
add edi, ecx
sub edi, 0x6b7db2c1
pop ecx
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ebx
mov dword [esp], eax
push ebp
mov ebp, esp
add ebp, 4
push edx
push 0x2d81161e
mov dword [esp], eax
mov eax, 0x7bf70bc6
mov edx, 0x8408f43e
add edx, eax
pop eax
sub ebp, edx
pop edx
xchg dword [esp], ebp
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push dword [esp + 8]
push dword [esp]
push dword [esp]
pop ebx
add esp, 4
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push ebp
push esp
mov ebp, dword [esp]
add esp, 4
add ebp, 4
push esi
mov esi, 4
add ebp, esi
pop esi
xchg dword [esp], ebp
pop esp
mov eax, dword [esp]
push ebx
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
mov esp, dword [esp]
jmp 0x10175b28
Function at 0x1018f2db
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1018eb8d
jmp 0x1018f1ae
push ecx
js 0x1018f1b9
pushal
popal
push edi
pop edi
pop ecx
pushfd
push edi
mov dword [esp], 0x557d263a
sub dword [esp], 0x76ef9a3b
and dword [esp], 0x461ed606
neg dword [esp]
sub dword [esp], 0xb203e906
mov dword [esp], ecx
mov dword [esp], 0x6ffb040b
neg dword [esp]
sub dword [esp], 0x9004fbc4
push ebp
mov dword [esp], 0x7bfd41cb
shl dword [esp], 1
push ebp
mov ebp, 0xffffffff
sub dword [esp + 4], ebp
pop ebp
xor dword [esp], 0x8a0acab6
and dword [esp], 0x7fb74712
shr dword [esp], 7
add dword [esp], 0xff1d8b10
push ebp
mov dword [esp], edi
mov dword [esp], 0x7fff0f00
dec dword [esp]
sub dword [esp], 0x7d5a8c65
and dword [esp], 0x63faf9b1
push edx
mov edx, 0x533d87b1
add dword [esp + 4], edx
pop edx
mov dword [esp], eax
push edx
mov dword [esp], 0x5fbc8fcc
not dword [esp]
push edx
mov edx, 0x7f7b64df
add dword [esp + 4], edx
pop edx
mov dword [esp], edi
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
push dword [esp + 8]
push dword [esp]
mov ebx, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push edx
mov dword [esp], 0x7188207a
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
pop esp
push dword [esp]
mov eax, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
push edx
mov edx, 4
add ebp, edx
pop edx
xchg dword [esp], ebp
pop esp
jmp 0x10177d1a
Function at 0x101902d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1018faff
jmp 0x1019014b
push eax
push edx
jb 0x1019015b
pushal
popal
push eax
push edx
rdtsc
pop edx
pop eax
push eax
push edx
push eax
pop eax
push eax
pop eax
rdtsc
push eax
push edx
rdtsc
pop edx
pop eax
push esi
pop esi
pop edx
pop eax
rdtsc
push eax
push edx
push eax
push edx
rdtsc
pop edx
pop eax
rdtsc
pushal
popal
push eax
pop eax
pop edx
pop eax
pop edx
pop eax
push eax
push edx
jmp 0x10190193
rdtsc
pushal
jmp 0x101901a9
jmp 0x101901b5
js 0x101901bb
popal
pop edx
pop eax
pushfd
push eax
mov eax, esp
add eax, 4
sub eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
mov dword [esp], eax
mov dword [esp], 0x7efdd039
add dword [esp], 0x8102325b
push ebx
mov dword [esp], 0x6a7a2496
sub dword [esp], 0x6ffb23b4
xor dword [esp], 0x1fff6f73
shl dword [esp], 2
shr dword [esp], 2
add dword [esp], 0x38771fa5
and dword [esp], 0x7f79cea1
push ecx
mov ecx, 0x7dbfa900
and dword [esp + 4], ecx
pop ecx
push edi
mov edi, 0x5d297304
xor dword [esp + 4], edi
pop edi
push ecx
mov ecx, esp
add ecx, 4
push eax
push edx
mov edx, 0x51bfbb80
mov eax, 0xae404484
add eax, edx
mov edx, dword [esp]
add esp, 4
sub ecx, eax
pop eax
xchg dword [esp], ecx
pop esp
mov dword [esp], eax
sub esp, 4
mov dword [esp], ecx
mov dword [esp], 0x4f5741a5
push edi
mov edi, 0x6d2bb670
xor dword [esp + 4], edi
pop edi
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
pop ebx
push esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp]
pop eax
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], edx
mov edx, 4
add ebp, edx
pop edx
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x101719fb
Function at 0x1019a833
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1019a13e
jmp 0x1019a75b
jnp 0x1019a77d
push eax
push edx
push eax
push edx
rdtsc
pop edx
pop eax
rdtsc
push eax
push edx
rdtsc
pop edx
pop eax
pop edx
pop eax
push eax
push edx
push eax
pop eax
rdtsc
pushal
popal
pop edx
pop eax
push esi
jbe 0x1019a786
pushal
popal
pop esi
pushfd
sub esp, 4
mov dword [esp], ecx
mov dword [esp], 0x5f9f67e5
shl dword [esp], 1
not dword [esp]
inc dword [esp]
neg dword [esp]
inc dword [esp]
add dword [esp], 0x9074c796
push edx
mov edx, 0xb04c68d0
add dword [esp + 4], edx
pop edx
push ebx
mov ebx, esp
add ebx, 4
push esi
mov esi, 4
sub ebx, esi
pop esi
xchg dword [esp], ebx
pop esp
mov dword [esp], esi
mov dword [esp], 0x7fbf9d65
neg dword [esp]
xor dword [esp], 0x8059c3d8
push edx
mov dword [esp], 0x1eb0ee82
mov dword [esp], esi
mov dword [esp], 0x5c13e061
mov dword [esp], ecx
mov dword [esp], eax
push esi
mov esi, esp
add esi, 4
push edi
push ebx
push 0x3ae1513f
mov ebx, dword [esp]
add esp, 4
and ebx, 0x7d21a5b
add ebx, 0xfd3fefe9
mov edi, ebx
pop ebx
sub esi, edi
pop edi
xchg dword [esp], esi
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push ebp
mov ebp, esp
push esi
mov esi, 4
add ebp, esi
pop esi
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push ebx
mov dword [esp], edi
mov edi, esp
push ecx
mov ecx, 0x4cedc9f5
not ecx
or ecx, 0x3b6a59e1
xor ecx, 0xbb7a7fef
add edi, ecx
pop ecx
push ebx
mov ebx, 4
add edi, ebx
pop ebx
xchg dword [esp], edi
pop esp
push dword [esp]
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
add esp, 4
jmp 0x10177d1a