joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012a162
Capabilities:
Authenticate hmac

Disassembly:
call int.101dbe52
mov dword [0x10098814], eax
ret
push edx
xchg dword [esp + edx*2 - 0x382e0d26], eax
and dword [esp + edx*2 - 0x382e0d36], edx
lea edx, [edx + edx + 0x2e7620f1]
jle 0x100f3fd4
push ebx
push edx
jl 0x10130cc5
mov edx, dword [esp + edx - 0x66a42e13]
mov dword [esp + 0x14], eax
mov ebx, 0x891ce098
jbe 0x100013e2
add dword [esp + ebx + 0x76e31f74], 0x54a73
call 0x10155502
push edi
neg ebx
mov edi, 0x8a07ec01
and edi, 0xa72235ba
mov edi, dword [esp + edi + 0x7dfddc00]
xchg dword [esp + 0xc], edi
jle 0x101c733d
mov word [edi], dx
jmp 0x10162b67
jmp fcn.101bfa4c
call 0x1012b5c7
jo 0x101d8158
jg 0x10102423
shl bx, 0xb8
jne 0x10001032
mov ebx, dword [esp + 8]
mov dword [esp + 8], edi
mov dword [esp], 0xad005a97
neg dword [esp]
add byte [esp], 0x1c
jge 0x101ab27f
inc esp
and al, 0
sbb al, 0xf
lea ecx, [0xd9fffe3f]
cmp al, 0x9d
invalid
fnstcw word [ebx*4 + 0x27f43fff]
jno 0x101c7368
xor cl, bl
lea edx, [edi]
sal byte [edi], 0x69
in eax, dx
sbb ch, byte [ebx + 0x2254d76c]
cdq
mov dword [0x7cb248a3], eax
dec edi
sbb dword [edi], esp
cmp ch, byte [edx + ebp*8]
call 0xc5d03896
mov ch, 0xa6
cmpsb byte [esi], byte es:[edi]
salc
div bl
sbb eax, 0x2419302b
mov edx, 0x321e946e
mov byte [esi], bl
sub esi, dword [ebx]
out 0xdb, al
add eax, 0xffe1e213
and al, 0xba
outsb dx, byte [esi]
xchg esp, eax
push ds
xor cl, byte [eax - 0x19ccd4e2]
fild dword [0xffe1e213]
xchg esp, eax
sahf
dec ebx
cmp eax, esi
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
imul esp, dword [edi + edi*2 + 0x7f], 0x49709985
pop edi
add eax, 0xd33ce345
stosd dword es:[edi], eax
fadd qword [esi + 0x43]
jno 0x101c738f
shr dword [ebx + 0x714346dc], cl
sal dword [ebx - 0x65a8d6b6], 0xac
mov bl, 0x4a
sub dword [edi - 0x66], edx
lodsb al, byte [esi]
mov dl, 0xd8
jge 0x101c7427
rcr dword [edx], 1
jno 0x101c73c7
jns 0x101c744c
sub esp, dword [ecx + esi*2 - 0x40]
cdq
cmp al, 0xff
jnp 0x101c741c
mov edi, 0x19511af4
jl 0x101c73a2
sbb dword [esp + esi*4 + 0x3a], edi
jle 0x101c739a
cmp bh, byte [esi - 0x57]
into
ljmp 0x2298
jb 0x101c7399
push ds
salc
int3
mov esi, 0xbe04701d
sti
sbb eax, 0xfbbe0470
add eax, eax
or byte [ecx], dl
invalid
and al, 0xba
pushfd
or dl, byte [ebp + 0x3c06c3b9]
jge 0x101c740e
wait
invalid
push 0xffffffffffffffc6
sbb esi, esi
mov fs, word [eax - 0x57]
jl 0x101c7457
out 0x37, al
imul dword [edi]
call dword [esi + 0x22]
jne 0x101c741d
out dx, eax
loop 0x101c73eb
push cs
int3

Function at 0x1012a1ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
shr si, 0x4c
mov edi, 0x4a0f0338
call fcn.101f1a67

Function at 0x1012a1c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shl eax, 0x4e
xor bl, cl
cwde
call fcn.101d3592
Function at 0x1012bb59
Capabilities:
Authenticate hmac

Disassembly:
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp]
add edi, 0x8f20563d
xor di, word [esp + 0xe]
shl dword [esp + 0xc], 0x43
call fcn.1023baae
push 0x148fc601
lea esp, [esp + 0x10]
jmp fcn.10154f3a
pushfd
cmp edi, 0xa98dec00
mov edi, 0x560b2706
xchg dword [esp + edi - 0x560b26fe], ebx
je 0x101898eb
mov edi, dword [esp + edi - 0x560b2702]
mov dword [esp + 4], ebx
push edi
jle 0x100fcda6
mov edi, 0xb351dbe
not edi
shr edi, 0x1c
jns 0x1012bb49
mov ebp, dword [ebp]
call int.101cc8de
sub di, 0xcd85
test edi, 0x303ac7a8
call fcn.10136dff
push esi
pushfd
mov esi, 0x81ba5faf
shr si, 0xd2
shr esi, 0xda
xchg dword [esp + 0xc], ebp
je 0x101fef46
test si, 0x38a7
je 0x1012980e
push 0xd318ebbd
movzx esi, word [esp]
push esi
neg byte [esp]
call fcn.10108f45
call fcn.101a08ec
lcall 0x57b9, 0xbf073d6a
xor eax, 0x7dbc8b2b
mov ss, word [eax - 0x6b]
test eax, 0x9f6b99ba
lds ecx, [edi]
mov bh, 0xca
sal edx, cl
lea ebp, [ebp + ecx - 0x6b95]
adc ecx, ecx
movzx eax, cl
shl cl, 0xc3
mov esi, ebp
rol cl, 0x82
bt edx, eax
inc dx
jno 0x10154f2c
mov ebp, 0xc037ebad
call fcn.101ac917
xchg ebx, eax
sal byte [ebx - 0x74530c80], 1
rcr byte [ebx - 0x502f1836], 0xe6
mov dword [0xabd2ff82], eax
invalid
jl 0x10147f9e
bswap edi
mov edx, dword [esp + 4]
mov edx, dword [edx]
mov dword [esp + 4], edi
call fcn.10147eaf
sar dword [esp], 0xc9
not di
call fcn.101a44ec

Function at 0x1012c7b1
Capabilities:
Packed with generic packer

Disassembly:
sub ebx, 0x9bba1b36
and bx, bx
cmp bx, 0xb590
jge 0x10166455

Function at 0x1012fee7
Capabilities:
Authenticate hmac

Disassembly:
xchg dword [esp + 4], ebp
push ebx
pushfd
mov ebx, 0xcb2a13aa
mov ebx, 0xce21f6a7
shr ebx, 0x17
seta bl
jns 0x1024c749
lea ebx, [ebx + ebx - 0x16dfbb43]
or bl, 2
call fcn.101ac000
mov dword [esp + 8], ebp
xor ebx, 0xa2375806
jae 0x101551ff

Function at 0x101302e8
Capabilities:
Authenticate hmac

Disassembly:
push ebp
add dword [esp + 4], 0x8a5b3
mov ebp, 0xf813f992
nop
mov eax, 0x49a1abbf
shl ax, 0x17
or eax, 0x3f106d0b
call fcn.10197c37
pushfd
sub dword [esp + 8], 0xf194de13
xchg dword [esp + 0xc], ebx
jno 0x1020cf9f
push edx
call fcn.10177795
and word [esp + 8], 0x9cb5
call 0x1009db70
sub al, 0xe
push eax
aam 0x8b
add al, 0xea
ret 0xae55

Function at 0x1013188f
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x8a86dcb6
call fcn.101c11f8

Function at 0x10135912
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10155a64
lea esp, [esp + 0x10]
jmp fcn.100aa4cf
Function at 0x10135bd9
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xfffda2cb
mov eax, dword [esp + 0x10]
add dword [esp + 8], 0xd0136
push ebx
push ebp
mov ebp, 0x4d0ae006
lea eax, [eax + ebp - 0x4d0ae005]
push ebp
cmp dword [esp + ebp - 0x4d0ae006], 0xaeae0ca0
mov ebx, ebp
ja 0x100eb06e
push edx
mov dword [esp + ebp - 0x4d0adfe6], eax
or ebx, dword [esp + ebp - 0x4d0ae002]
mov edx, ebx
jo 0x1023d80c
shr ebx, 0x2f
nop
lea ebx, [edx*2 + 0x331ca704]
mov eax, 0xfb9282aa
lea ebp, [edx*4 + 0x553937a8]
push edi
push edx
cmp ebx, 0x243d371e
not dword [esp]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + edx - 0x4d0ae006]
mov edi, dword [esp + 0xc]
jns 0x100b23fd
lea ebx, [edx + ebp*8 + 0x73ba2b05]
mov byte [esp + edi - 0x4d0adffa], bl
mov di, word [esp + edx - 0x4d0ae005]
lea eax, [eax + ebx*2 + 0x45bcfbf7]
mov dword [esp + ebx*8 - 0x5f564838], ebp
jns 0x101f790e
call fcn.1024b743
mov edx, 0x172ea82d
mov ecx, edx
movzx dx, byte [edx + ebp - 0x172ea82d]
and cx, cx
mov cl, byte [ebp + ecx*4 - 0x5cbaa0b2]
push 0x4dbda100
call fcn.101b23ec
mov ecx, 0x1334d783
mov eax, dword [ebp + ecx*4 - 0x4cd35e0c]
jmp 0x101887db
xchg ch, cl
mov cl, byte [ebp + ecx*4 - 0x4cd20f58]
jmp 0x101ce58f
call fcn.101cb624

Function at 0x1013621c
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
add dword [esp], 0xfff10a73
shl word [esp + edi*2 - 0x6a13de56], 0x3d
neg edi
push ecx
jae fcn.100a1d53
add byte [esp + ebx*2 - 0x6a137ff0], 0xd

Function at 0x10136a42
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + esi*2 - 0x1716fef4], 0xefe9cc00
mov edx, 0x9f315334
mov word [esp + edx + 0x60ceacd0], dx
push ebp
lea eax, [eax + esi - 0x4cf4126f]
call fcn.101a67f4

Function at 0x10138d25
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + 0x14], 0xf212d
add ebp, 0x53b44634
push edi
jle fcn.101fcb33
mov eax, dword [esp + edi*2 + 0x6f500000]
call fcn.10220b62
lea esp, [esp + 8]
jmp fcn.101bfde6

Function at 0x1013c4a0
Capabilities:
Packed with generic packer

Disassembly:
not ebx
neg ebx
mov dword [esp + ebx*2 + 0x488b0fbc], ecx
jns 0x101d07b7
sub ebx, ebx
call fcn.100e2c70

Function at 0x1013ea9f
Capabilities:
Packed with generic packer

Disassembly:
je 0x1019be79
test esi, 0x75962eb3
call fcn.100d6624
bswap ebp
call fcn.1018537e
mov dword [esi], eax
push 0x4d17d51e
push 0xfb13e2b0
lea esp, [esp + 0x10]
jmp fcn.101f03e6

Function at 0x101403d3
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov dword [esp + edi - 0x7ffff683], edi
call fcn.101e146b
mov ecx, 0x9d0cfa9a
sub ecx, ecx
mov eax, ecx
xor al, byte [ebp + ecx]
or cl, byte [ebp + ecx + 2]
sub ebp, 2
call fcn.101d307f
mov dword [esp + 0x18], 0x1e3a7228
lea esp, [esp + 0x1c]
jae fcn.100019eb
Function at 0x1014041e
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
push 0x868e1037
shld dx, bp, cl
call fcn.100ee8c4
mov ecx, 0xe328123d
push ecx
inc cx
mov ebp, dword [esi]
dec cl
dec eax
neg ecx
dec eax
inc ecx
inc ecx
mov cl, byte [esi + 2]
jbe 0x1015caa4
mul dword [ebx + 0x46]
stosb byte es:[edi], al
int1
cmp ch, dh
leave
mov byte [0xc6db5054], al
stosb byte es:[edi], al
cmp dword [eax], edx
add eax, 0x40bc2a59
imul ecx, dword [esi], 0xffffffc2
or eax, eax
lodsd eax, dword [esi]
mov cl, 0xe2
adc al, 0x38
adc edi, esi
push edx
imul eax, dword [eax - 0x3b06b40b], 0xfbf67c6f
jmp 0x10140467
call fcn.10253bcf
mov eax, 0xb4001dbb
mov edx, eax
mov ax, word [esi]
btc dx, dx
bts dx, dx
bt edx, edx
mov dx, word [esi + 2]
jae 0x10231bb0
inc edx
xor bl, al
neg edx
add eax, esp
jmp 0x10244da6
sbb esi, 2
call fcn.102139da
inc esp
dec ecx
sbb esi, 7
dec ebp
mov dword [esi], esp
push 0x790b6c9f
dec eax
lea esp, [esp + 0x70]
jmp fcn.10144331
sal edx, 9
mov edx, dword [eax + edx - 0x6a3ffe00]
call fcn.100aec1f
mov ecx, 0xeb058a05
xchg ebx, eax
mov bh, 0x31
jns 0x10244d6e
test eax, 0xeb7017b7
sbb eax, 0xa7f19a7d
outsb dx, byte [esi]
daa
or byte [edi + 0x60], cl
xlatb
cmp al, 0xad
popal
pop edi
pop edi
stosb byte es:[edi], al
test bl, dl
retf

Function at 0x1014063c
Capabilities:
Packed with generic packer

Disassembly:
mov esi, dword [esp + esi + 0x5a6f0088]
shl dword [esp + 4], 0x5f
shl dword [esp + edi + 0x5a6f8d65], 0x97
call fcn.100ddf35
ja 0x1019d342
jne 0x1010c0d2

Function at 0x10141bde
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov edx, 0xf18a632e
call fcn.10138c8c

Function at 0x101422cd
Capabilities:
Encode data using xor

Disassembly:
jnp 0x1014227e
mov dl, 0x4d
or cl, al
pop esp
dec edx
idiv dword [edx + 8]
mov edi, 0x897a7e99
rcr dword [edx + ecx*2 - 9], 0x7a
or byte [edi - 0x76858167], bh
jno 0x1014224a
in eax, 0x44
and ch, dh
or eax, 0xa98f2a40
mov ebx, 0x64023771
mov ecx, 0x4e4bd937
xchg esp, eax
push edx
xor byte [ebp + 0x61bdd83], dl
loopne 0x101422e5
sub al, 0xa9
ja 0x10142215
rcl byte [edi], 0xe0
mov eax, 0x1e66d936
fldenv ss:[esi + 0x1e]
lock adc edi, dword [eax + 0xad31ed8]
dec eax
call 0x2b26597
push edx
sahf
push edx
and bh, byte [esi + 0x623cb018]
mov esi, 0x623cb018
mov esp, 0x5f42c45a
test dword [ebx - 0x67], eax
pushfd
mov dl, 0xdc
push ss
xor esi, dword [ebp - 0xd3b1e95]
in al, dx
bound esi, qword [ebp + 0x7b0fec37]
xor dword [esi - 0x1f], 0x33927799
jne 0x10142282
loope 0x1014223d
cdq
ja 0x10142238
xor esi, dword [ebp - 0x27]
xor al, byte [ecx + 0x56e41bff]
jb 0x1014228f
push edi
and ch, byte [edi]
leave
loope 0x101422a3
mov dl, 0xaf
or dword [edx + ebx*8 + 0x34], edx
ljmp 0xb238
shr bl, 0x1f
lea esi, [esi + 0x471bd036]
call fcn.100af3a7
mov al, 0x77
xchg ecx, eax
ja 0x1014226f
dec ecx
jle 0x101422a2
movntps xmmword [ebx + edx + 0x6546b9cd], xmm6
inc ebx
int 0xb9
inc esi
inc ebx
jg 0x101422dc
pop ds
mov cl, 0x7d
push edx
mov byte [0x1b45eac5], al
sub eax, 0xd941b79d
mov bh, 0x70
cmp al, 0x4d
sub eax, esp
ljmp 0x6309
Function at 0x10142acc
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + edx*8 + 0x5077a28]
call fcn.102206af
pop es
jb 0x10142b39
jmp 0x10142b4e
mov dh, byte [ecx + ebp + 8]
ror byte [ecx], cl
cmp dword [ecx - 0x60d87c12], esp
stc
jmp edi
cmp byte [ecx + 0x1a47570e], al
imul esp, dword [esi], 0x62
mov dl, 0x59
cmpsd dword [esi], dword es:[edi]
dec esi
in eax, dx
push eax
xchg byte [ebx + 0x101429e5], bh
adc esi, dword [esi + 0x60]
mov eax, 0x36ef0458
adc al, 0x90
int3
dec ecx
adc dword [esi + edx*2 - 0x2d8d55e7], ebx
jmp 0x10142b08
inc eax
imul ebx, dword [ebx], 0x36
inc edx
cmpsd dword [esi], dword es:[edi]
jb 0x10142b2f
xor edi, dword [eax]
xchg edi, ebp
ljmp 0x959a
mov ebx, 0x43956267
aaa
out dx, eax
sub dword [eax + edx], edx
jb 0x10142aec
test byte [edi], dh
push edx
and edx, edx
mov ebp, dword [esi]
adc al, 0x90
or eax, 0x20df5a10
sbb eax, 0x3873b34d
jge 0x10142b78
int 0x52
adc cl, byte [eax]
invalid
xchg ebp, eax
adc eax, 0x470cccd6
add dh, byte [esi - 0x4e]
push edx
xor dword [ebp + eax*8 - 0x2d], edx
out 0x27, eax
insb byte es:[edi], dx
or dword [edx + 0x3f2f9669], ebp
rcr esi, cl
xchg dword [esi], ebp
adc al, 0x10
jge 0x10142b7b
int3
invalid

Function at 0x101442c4
Capabilities:
Packed with generic packer

Disassembly:
pushfd
test bp, bp
jg 0x101be5c6

Function at 0x10145c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + edi + 0x21660ef8]
bswap edi
and edi, 0xd8910f08
shr edi, 0x35
test di, di
lea eax, [eax + 1]
push ebx
jbe 0x1011a2a7
call fcn.1011323c
xor dword [esp + edx*2 - 0x16580026], 0x110ed40b
jo fcn.10236ff9
mov edx, dword [esp + edx - 0xb2bffe3]
jo 0x1012f86a
call fcn.10219354

Function at 0x10149697
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call fcn.1016e40b
loopne 0x100f3b88
shr dword [ebp + 0x16], 0x5f
invalid
cmp bh, byte [esi - 0x60cb876b]
push esi
sbb eax, dword [edi - 0x4a613d6c]
rcr byte [edi + ebx*2], 1
xchg esi, eax
pop ebx
mov word [bp + si], ds
lea ax, [eax + 0xc]
daa
push cs
shr edi, cl
invalid
not dword [esp + edx + 0x18e1ffdd]
lea esi, [esi + edi + 0x6f77a96c]
jb 0x10141ce3
call fcn.1022255c
jmp 0x100f3b2d

Function at 0x1014ed00
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
js fcn.100aa4cf

Function at 0x1015262c
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp], 0xefe2cef3
not dword [esp + 0xc]
shl word [esp + 4], 0x35
jne fcn.101e15ad
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x18]
ret

Function at 0x10154c67
Capabilities:
Packed with generic packer

Disassembly:
push esi
not edx
lea eax, [eax + 1]
mov esi, edx
push esi
mov edx, esi
push esi
call fcn.1013c42d
mov dword [esp + 0x18], esi
lea edx, [edx + edx - 0x3ec6b70]
push esi
mov edx, 0x9aaf2809
bswap edx
pushfd
shr edx, 0x95
mov esi, dword [esp + 0x14]
and edx, edx
shr dx, 0x3c
je 0x101a1193
js 0x100f8e96
push ebx
lea esi, [esi + 1]
cmp dl, dh
setno dl
jge 0x1012b4c3
Function at 0x1015666a
Capabilities:
Encode data using xor

Disassembly:
call fcn.100af9f2
int3
xor dword [esp + 0x24], 0x5a29943f
ja 0x100a5e76
sal dword [ebx + edx*4], cl
cmc
cmp edx, esp
add dword [ecx - 0x19], eax
push es
stosd dword es:[edi], eax
in eax, dx
inc ecx
xchg esi, eax
popal
pop ds
sti
push ss
mov esp, cs
adc al, 0x48
nop
push edx
sti
xor ecx, 5
jae 0x1015668a
pop ss
invalid

Function at 0x1015b228
Capabilities:
Authenticate hmac

Disassembly:
neg dword [esp + 0x18]
call fcn.101147b1
mov edx, 0x9136e100
shr dx, 0xe5
neg dx
mov edx, edi
call fcn.10207204
mov ebx, dword [esp + ebx*2 + 0x6ad420b4]
mov dword [esp + 0x1c], ecx
sub word [esp + 0x18], 0x9611
jno 0x10116d0a

Function at 0x1015c941
Capabilities:
Packed with generic packer

Disassembly:
bswap ebx
ja 0x101f020b
salc
or ebx, 0x3f8457ad
jle 0x10114f42

Function at 0x1015e9c4
Capabilities:
Packed with generic packer

Disassembly:
ror dword [esp + 0x10], 0x44
dec eax
shl dword [esp + 0xd], 0x44
dec ecx
xor esi, edi
ror word [esp + 0xc], 0x48
jae 0x10192bf6
dec ecx
adc edi, 0xda1531a2
jmp 0x100a15c1
sal dword [esp + 8], 0x3b
dec ecx
sbb edi, 0x973b2e07
or dword [esp + 0xc], 0xd032619c
dec eax
shl dword [esp + 8], 0x85
dec ecx
xor edi, 0x1abcd04
dec eax
neg dword [esp + 8]
dec ecx
not edi
dec eax
mov dword [esp], 0x69b99e39
not dword [esp + 0xb]
jbe 0x10216b7e
invalid
setb byte [esp + 8]
dec ecx
bswap edi
rol byte [esp + 2], 0x42
dec ecx
not edi
push 0x6833b8b1
dec ecx
bswap edi
js 0x10111eb6

Function at 0x1015ea49
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x30], eax
mov ebx, dword [esp + ecx*8 + 0x18]
movzx esi, word [esp + esi*4 + 0x531caf64]
add dword [esp + ecx + 0xc], 0xefed5ab9
pop esi
bswap ebp
mov ebp, dword [esp + ecx + 0x28]
call int.1017252b
fsub st(4)
stc
invalid
push ecx
push edx
pushfd
mov edx, 0xdf3cf714
sub edx, edx
and edx, 0x278eca3a
jge 0x1014bd4e
mov esi, 0xeb38d430
shr ebp, 0x2d
sub ecx, ecx
je 0x10156501
les esi, [ecx]
mov al, byte [0x2e8f6af6]
push 0x98e815c4
outsb dx, byte [esi]
cmp dword [esi], 0x4b15ec64
xchg edx, eax
cmp cl, byte [esi - 0x47b072fb]
insb byte es:[edi], dx
pop ds
and cl, byte [esi]
mov eax, 0xd81a3fbd
jns 0x1015ea53
lahf
sahf
in al, 0x95
and esp, dword [ecx*8 + 0x5471a85e]
and al, 0xcd
pop esi
test al, 0x71
push esp
stosd dword es:[edi], eax
cmp al, 0xe2
stc
mov ebx, 0x96d479e9
aaa
dec ecx
sbb byte [ebx - 0x3a0f2875], 0x33
mov eax, dword [0x66b53b8d]
push ebp
je 0x1015eae1
dec edi
jne 0x1015ea40
xchg dword [edx], ebp
xchg ecx, eax
sal ecx, cl
inc esi
mov al, 0x2e
cwde
pop ss
fadd st(3)
je 0x1015eaf2
nop esp, eax
mov dl, 0x1b
popfd
jle 0x1015ea99
test bh, dl
mov al, 8
mov esi, 0x304213a2
in eax, 0xf2
js 0x1015eb3c
xlatb
xor dword [edi - 0x6f11775e], ebp
pop ebp
scasd eax, dword es:[edi]
mov byte [0x5d90ee88], al
dec edi
or dword [edi - 0x5e], edi
pop eax
fisubr word [ecx + ebp - 0x11]
xor cl, ch
outsb dx, byte [esi]
test dword [edx], 0x6aa6e800
call 0x100e55a1
and eax, 0xffffffec
inc edi
fsubr qword [ebx + ecx*4 - 0x308a1a07]
mov al, byte [0x467909d5]
retf
Function at 0x10160235
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + edx*4 + 0x3ffc0004], 0xc14a2
test edx, edx
push edi
jns 0x101fb4e9
call fcn.101d944e
mov ebx, 0x359c53b5
dec esi
lea ebx, [ebx + ebx - 0x359c53b9]
or bx, bx
jno 0x1012e0a2

Function at 0x10160436
Capabilities:
Authenticate hmac
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + 8], 0x95962820
xor dword [esp + 8], 0x249c1b28
push dword [esp + 0xc]
popfd
mov dword [esp + 0xc], edi
pushfd
sub dword [esp + 0xc], 0x693345b5
jae 0x101d51a4
movzx dx, byte [ebp]
mov eax, 0x1e197401
bts eax, eax
mov al, byte [ebp + eax - 0x1e197401]
jae 0x100fe1af
sub dword [esp + 0xc], 0xe68191a2
shr byte [esp + 0xc], 0x9c
shl word [esp + 0xc], 0x9f
neg byte [esp + 0xc]
shr word [esp + 0xc], 0x10
xor byte [esp + 0xc], 0x8d
add word [esp + 0xc], 0x303
add dword [esp + 4], 0xfffde050
mov edi, dword [esp + 0xc]
cmp edi, 0x3d9a1b37
jb 0x1011b72c
call fcn.101e3d25
jmp 0x101460be

Function at 0x10161edc
Capabilities:
Packed with generic packer

Disassembly:
seta byte [esp + 0x24]
call fcn.101ea897
mov word [ebp], dx
not dword [esp]
lea esp, [esp + 0x14]
jmp fcn.100aa4cf

Function at 0x10163acf
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0x4423e6b4
mov edi, dword [esp + edi - 0x4423e6a4]
mov dword [esp + 4], 0x79a6b429
pushfd
xor dword [esp + 8], 0xf02165a7
push edi
lea edi, [edi + 1]
sub word [esp + 0xc], 0x9c89
add dword [esp + 8], 0xeff63ffa
test word [esp + 0xc], 0xb301
call fcn.1010422b
mov edx, 0x7ea2303b
mov edx, dword [ebp + edx - 0x7ea2303b]
add ebp, 4
mov eax, 0x25b39583
mov esi, edx
push eax
inc dword [esp + eax - 0x25b39583]
pop ecx
jno 0x10168585
push 0xfd3d66b9
mov dword ss:[edx], eax
jmp 0x101e0e96
push 0x43b7ead
lea esp, [esp + 8]
jmp fcn.100aa4cf

Function at 0x1016e679
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
sets byte [esp + esi + 0x295e0766]
shr edi, 0x7a
xchg dword [esp + 0x34], eax
mov edx, dword [esp + 0x2c]
and edi, dword [esp + 0x18]
mov ecx, esi
cmp di, si
mov edi, dword [esp + esi*2 + 0x52bc0e8c]
jge 0x1020f2e6
xor edx, 0x44c75829
and al, 0
fldenv [ebx + 0x31]
mov ebx, 0x4095ee8
add al, ch
lahf
lea eax, [eax + eax]

Function at 0x1016e9eb
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ecx + 0x5ca5cc10]
call fcn.10255650

Function at 0x1016ecd5
Capabilities:
Encode data using base64

Disassembly:
mov bp, 0xc42a
xor ebp, edx
mov esi, dword [esp + 0x2c]
lea edx, [ebp*4 + 0x60b6203f]
xor dword [esp + edx + 0x52c6d1bd], 0x7d1daf08

Function at 0x101728d8
Capabilities:
Packed with generic packer

Disassembly:
not byte [esp + 0x28]
lea ebp, [ebp + 0x2e285e84]
neg bp
mov ebp, dword [esp + 0x20]
cmp byte [esp + 0x1c], 0x2f
sets byte [esp + 0x1c]
jo 0x101a737c
shr dword [esp + 0x28], 0x8f
shl word [esp + 0x1c], 0x27

Function at 0x1017441b
Capabilities:
Authenticate hmac

Disassembly:
jo 0x102047a3
jns 0x101ede78
xchg ebp, eax
invalid
invalid
invalid
Function at 0x10180c92
Capabilities:
Packed with generic packer

Disassembly:
jle 0x100f8574
inc ecx
mov eax, dword [esi]
mov ecx, 0x67398794
inc ebp
mov edi, dword [esi + ecx - 0x67398790]
shr cl, 0x81
inc edx
mov cl, byte [ecx + esi - 0x67398742]
call fcn.102381e7

Function at 0x10181826
Capabilities:
Packed with generic packer

Disassembly:
or word [esp + ecx - 0x2ff8e74c], 0x89b9
lea ebx, [ebx + ecx - 0x2ff8e74f]
jno 0x10252e47
int3
not dword [esp + ecx - 0x2ff8e74c]
push edx
add word [esp + ecx - 0x2ff8e748], cx
jbe 0x10154b95
mov word [ebp], di
lea esp, [esp + 4]
jmp fcn.1024b59c

Function at 0x10185282
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp], 0x43a317b2
not word [esp + 0xf]
mov ecx, dword [esp + 0x14]
jmp 0x101ffce1
call 0x1021a8b8

Function at 0x10187acb
Capabilities:
Packed with generic packer

Disassembly:
outsb dx, byte [esi]
push esi
ljmp 0x4424
push dword [esp + 0x44]
lea ecx, [ecx + esi + 0x38db4492]
mov edx, dword [esp + esi - 0x2533edeb]
push edi
cmp esi, 0x4526ebb4
mov edi, esi
jbe 0x1025708f
inc ebx
stosb byte es:[edi], al
pop ds
jg 0x10187aa6
bound eax, qword [ecx + 0x33ec23e3]
pop ebp
mov dword [edx - 0x5f], ebx
shl dword [edi], 1
daa
shl byte [ebp + 0x36b04a6f], cl
mov eax, 0x53d5bb95
dec esi
enter 0xffffffffffffcc16, 0xffffffffffffffc9
invalid
invalid

Function at 0x101892be
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], eax
push ebx
push edi
jb 0x101e6b2c
add dx, word [esp + edx - 0x80d78f0]
mov dword [esp + 0x10], eax
push edi
mov edi, 0x101ed903
and bl, 0x23
test edi, 0xffb41703
jbe 0x1011a2a7
lea esi, [esi + ebx - 0x6d6e265c]
call fcn.102043e1

Function at 0x1018a95c
Capabilities:
Packed with generic packer

Disassembly:
enter 0x3f5c, 0x64
imul esi, dword [edx], 0x14
or edx, dword [ebx + 0x67562f88]
or byte [ecx + esi*2], cl
test dword [ebx + edi + 0x586c1352], 0x54f75933
and al, 8
add dword [esp], 0xefdace7b
mov cl, 0x17
ja 0x101ef3ad
mov dl, 0xad
mov byte [esi + ebp*4], ah
xchg esp, eax
mov esi, 0xe398b987
sbb eax, 0xda562732
dec esi
jl 0x1018a9cb
jae 0x1018a9b5
jp 0x1018a904
int3
add ch, ah
inc edx
or esp, dword [ecx + 0x824648d]
jmp fcn.1011bbab

Function at 0x1018fc0d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, 0x662cc527
mov edx, dword [esp + ebp - 0x662cc513]
call fcn.10130e82

Function at 0x10191951
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0x24]
jmp fcn.1018295a

Function at 0x10191c08
Capabilities:
Packed with generic packer

Disassembly:
jbe 0x1014682b
shl word [esp + ebp - 0x4a67282f], 0x81
call fcn.100feac3