joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423331
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x423394
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x4233a6
mov eax, dword [esi + 0xdc]
jmp 0x4233fe
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x4233fc
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x4233d4
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x4233af
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x423c74
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x423cc6
push eax
call fcn.00425de7
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x423cc6
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x43c004
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x423cca
xor al, al
jmp 0x423d2b
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x423d29
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.00425de7
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x423d29
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x423d17
mov al, 1
pop ebx
leave
ret 4
Function at 0x42e6a6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x43fbb0
cmp edx, dword [eax]
je 0x42e6c8
add eax, 8
inc ecx
cmp eax, 0x43fc40
jl 0x42e6b9
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x43fbb0]
jne 0x42e7f6
mov eax, dword [0x443270]
cmp eax, 1
je 0x42e7d0
test eax, eax
jne 0x42e6f9
cmp dword [0x43d1b4], 1
je 0x42e7d0
cmp edx, 0xfc
je 0x42e7f6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42e730
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00425900
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00426130
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x42e773
lea eax, [ebp - 0x1a4]
push eax
call fcn.00426130
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x435538
push edi
call fcn.00426030
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00425900
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00425910
lea eax, [ebp - 0xa0]
push 0x435518
push eax
call fcn.00425910
push dword [esi + 0x43fbb4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00425910
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00430448
add esp, 0x2c
pop edi
jmp 0x42e7f6
lea eax, [ebp + 8]
lea esi, [esi + 0x43fbb4]
push 0
push eax
push dword [esi]
call fcn.00426130
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x605579
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9ac500
push esi
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
pop esi
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], edi
mov dword [esp], ebx
jmp 0x9a0783
jmp 0x9b1a57
push eax
push edi
mov dword [esp], ecx
push 0x5a15721
jmp 0x9ac50f
pop ecx
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], ebp
jmp 0x9ac614
jmp 0x9b7aeb
jmp 0x9b1b2e
xor edx, 0xffbe560c
add ebp, edx
pop edx
sub ebp, 4
push ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
mov dword [esp], ecx
jmp 0x9b1ba3
push edx
mov dword [esp], ebx
mov eax, dword [esp]
push edi
push esp
pop edi
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push ebx
mov dword [esp], 0x66342df3
mov dword [esp], ebx
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push edi
mov dword [esp], 0x8ebd049
mov dword [esp], ebx
mov ebx, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
jmp 0x9b1b2e
push ebx
push dword [esp]
pop eax
push ebp
push esp
pop ebp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push ebp
mov dword [esp], ecx
mov edx, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
push esi
mov esi, esp
add esi, 4
sub esi, 4
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
mov dword [esp], esi
mov dword [esp], ebx
pop ebx
jmp 0x9b1a7d
push ebp
push esp
pop ebp
push edx
mov edx, 0x7fdf2b04
shl edx, 1
jne 0x9b1a5c
jmp 0x9b1ad8
jmp 0x9b2c39
jmp 0x9b68d2
push edi
mov dword [esp], edx
mov dword [esp], 0x34dd4045
mov dword [esp], ebx
mov eax, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], ebx
push dword [esp]
pop ebx
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push 0x7c6f398d
mov dword [esp], eax
mov eax, dword [esp]
push 0x3eca8181
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0x9b68d2
push ecx
mov ecx, esp
add ecx, 4
push ebp
mov ebp, 0x14
add ecx, 0x1d3f1f4b
sub ecx, ebp
push edi
mov edi, 0x7aaf921d
add edi, 0x7cb3ac8e
jo 0x9b6938
jmp 0x9b6927
sub edi, 0xeb868e04
sub ecx, edi
pop edi
pop ebp
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
jmp 0x9b69eb
neg edi
dec edi
jp 0x9b6949
jmp 0x9b6927
sub edi, 0x769bf39a
jle 0x9b6874
jmp 0x9b6900
xor edi, 0x77fd61bd
jo 0x9b68d2
jmp 0x9b6919
push 0x7d478e57
mov dword [esp], esi
mov dword [esp], edx
mov dword [esp], ecx
mov edx, dword [esp]
add esp, 4
push ecx
mov dword [esp], eax
push dword [esp]
pop eax
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
push 0x3b78dd77
mov dword [esp], eax
mov eax, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
jmp 0x9b6919
jmp 0x9a067f
jmp 0x9b7bd4
push esp
push dword [esp]
pop ebp
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
jmp 0x9b7bf4
jmp 0x9b686f
Function at 0x1000146a
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebp
mov edi, 0xe580d223
not dl
lea esi, [esi - 0x5f483beb]
jne 0x101ff710
bswap edi
sub edi, dword [esp + 0x10]
sub ebp, 0x4aa7693b
or bp, di
or edx, dword [esp + 0x10]
add dword [esp], 0xefe7d3ef
xchg dword [esp + ebp - 0x5af9efc9], esi
mov ebp, dword [esp + 0x18]
shr edi, 1
and dword [esp + 0x10], 0x393cc933
or byte [esp + 0x10], 0xa7
sub edi, edx
sub word [esp + 0x10], 0xaa8c
ja 0x101bee9e
mov edi, dword [esp + 4]
jg fcn.100a3eb4
sub dword [esp + 0x10], 0xb18d6b2c
setae byte [esp + 0x10]
shr byte [esp + 0x10], 0x87
test word [esp + 0x10], 0x1a9b
call fcn.1017479e
Function at 0x10010c70
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x10096098]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x10010d3b
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.10029a10
add esp, 0xc
test eax, eax
jne 0x10010d3b
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.10029a10
add esp, 0xc
test eax, eax
jne 0x10010d3b
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10010cc4
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.100299e0
add esp, 0xc
test eax, eax
je 0x10010cf8
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100299e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10010cfa
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10010d26
mov al, byte [esi]
push eax
call fcn.1001e2e0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10010d08
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1005408c
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1005408c
add esp, 0x18
ret
Function at 0x1004f0e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1004f107
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x1004f152
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x1004f156
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1004f1b6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x1004f175
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x1004f1e7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x10085b9e
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x10085b9f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x1004f1c0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x10064fcc
Capabilities:
Parse pe header

Disassembly:
push 0
push edx
call fcn.100cfaed
test eax, eax
je 0x1006500c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1006500c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006500c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1006500c
cmp dword [ecx + 0x74], 0xe
jbe 0x1006500c
cmp dword [ecx + 0xe8], 0
je 0x1006500c
mov al, 1
ret
xor al, al
ret

Function at 0x1006c64b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006c4c1
Function at 0x1009c130
Capabilities:
Check for software breakpoints
Packed with generic packer

Disassembly:
xor edx, dword [esp + esi - 0x4ab48144]
mov esi, dword [esp + esi - 0x4ab48140]
shl dword [esp + 0x1c], 0xc
jae 0x101b9cac
not word [esp + 8]
jb fcn.1021e103
shl word [esp + 8], 0x74
movzx dx, dl
sub byte [esp + 8], 9
or dword [esp + 8], 0x45b1b2ad
mov edx, dword [esp + 0x18]
add byte [esp + 0x1c], 0xb
js 0x10250bff
not dword [esp + 0x1c]
not byte [esp + 0x1c]
ja 0x10201449
mov word [ebp], di
push 0xa39c0818
lea esp, [esp + 0xc]
jmp fcn.10168598
call fcn.1022e91e
dec dword [edi]
invalid
add dword [esp + ebx*2 + 0x459d12ac], 0x1015cd99
add dword [esp + ebx + 0x22ce8952], 0xefdde026
pop esp
lodsb al, byte [esi]
adc bl, byte [ebp + 0x15cd9945]
adc byte [ecx - 0x76ade37c], al
into
and ah, byte [esi]
loopne 0x10250bf1
out dx, eax
push ecx
call fcn.1011f0d6
mov byte [ebx + ebx - 0x444fe472], bl
inc edi
pop ss
xchg edx, eax
mov bh, 0xd0
salc
wait
dec edx
movsb byte es:[edi], byte [esi]
jne 0x10250c01
lock xor dl, byte [esi + 0x3564efed]
popfd
pop ebp
aam 0x92
stosd dword es:[edi], eax
lds ecx, [ebx - 0x34]
cmp esi, ecx
mov eax, 0xefa4e3ee
mov ch, 0x4b
mov al, byte [0x9e8881be]
or eax, 0xca9b1051
cmp dword [edi - 0x3f], eax
ljmp 0xf4bd

Function at 0x1009dab0
Capabilities:
Encode data using base64

Disassembly:
push edi
pushfd
mov ebp, dword [esp + 0x10]
sub word [esp + ebp - 0x30a4d921], 0xee09
xchg dword [esp + ebp*2 - 0x6149b24a], ebx
mov edi, ebp
xor edi, edi
push esi
jbe 0x10130c28
call fcn.10224891
movzx cx, al

Function at 0x1009db3c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push ebx
xchg dword [esp + 0x3c], edx
mov ebx, dword [esp + ebx*2 - 0x2022fd8]
ja 0x100a78b4
js 0x100f54ab
test dword [esp + 0x38], 0x183d4088
mov dword [esp + 0x38], 0x6fb0afab
ja 0x100add79
add dword [esp + 0x20], 0xefe12d74
xor dword [esp], 0x8da2a21b
call fcn.100fd3df

Function at 0x1009f795
Capabilities:
Packed with generic packer

Disassembly:
push 0x8002f997
jns 0x1010b699
mov dword [esp + ebp + 0x28572d76], edi
jae 0x10169b99

Function at 0x100a1160
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + ebx - 0x5f00001f], 0xefebab0f
shr dword [esp + 0x14], 0x5e
mov ebx, dword [esp + ebx - 0x5efffff7]
shr dword [esp + 0x24], 0xc5
jae 0x100a5045
shl dword [esp + 0x24], 0x4b
and byte [esp + 0x14], 0x12
mov esi, dword [esp + 0x34]
jle 0x1022f2d2
lea eax, [eax + esi*2 - 0x17e9ce40]
not esi
call fcn.1013b1de
aad 0x43
cmp al, 0xbb
iretd
Function at 0x100a3ea3
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
push ebp
mov ebp, 0xd6ae5110
bswap edi
mov dword [esp + 0x1c], ebx
call fcn.101441de

Function at 0x100a6f4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x5e87a20f
lea esp, [esp + 0x1c]
je 0x101dd351
push 0xa43b52b0
movzx edi, byte [edx]
not word [esp + 1]
jmp 0x100aef15
xor edi, eax
and byte [esp + 2], 6
push 0xaa006f08
and edi, 0xff
call fcn.101cb4b8
call fcn.1020b99a

Function at 0x100a7300
Capabilities:
Packed with generic packer

Disassembly:
xor dl, 0x1d
mov ebp, 0x46ab8a37
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + edi + 0x47c7c9dc]
test edx, 0x408cd023
ja 0x101d3244
jae 0x1024a922
shl ebx, 0xff
movzx cx, bl
lea ebp, [ebp - 0x61c23d63]
call fcn.101342df
ja 0x100f55c1
add dword [esp + ebp - 0x46ab8a2f], 0xfff9cd73
mov edx, dword [esp + 0x1c]
mov bp, 0xf31a
sub ebp, 0x591f91b8
cmovle ecx, ebp
lea ebp, [ebp + ecx*8 + 0x7d064bb9]
mov ebp, dword [esp + ecx*4 + 0x49ce7a7c]
jg 0x1018bef7
je 0x10179982
neg ecx
neg ecx
shr ecx, 0x5a
call fcn.1011bb3b

Function at 0x100adeb0
Capabilities:
Authenticate hmac

Disassembly:
shr esi, 0xa5
lea edi, [edi - 0x7cc4375c]
shr esi, 0x38
bswap esi
shl esi, 0x2b

Function at 0x100ae758
Capabilities:
Encode data using xor

Disassembly:
test dword [esp + ebx + 0x74fc7565], ebx
mov dword [esp + 0x14], edi
push ecx
mov ecx, ebx
jge 0x101267a1
mov eax, 0xe4898e93
ror ax, 0xc9
movzx eax, byte [esi]
push 0xaf93649e
call fcn.10140c2d

Function at 0x100cea17
Capabilities:
Authenticate hmac

Disassembly:
jne 0x1021398f
push ds
retf 0x238f

Function at 0x100cee6e
Capabilities:
Packed with generic packer

Disassembly:
sub word [esp + 5], 0xca3d
add eax, edx
jmp fcn.100076a0

Function at 0x100cef45
Capabilities:
Packed with generic packer

Disassembly:
push edi
mov dword [esp + 0x10], 0x900251aa
jle 0x10116d4d
test byte [esp + 0xc], 0x86
push 0x15867e39
xchg dword [esp + 0x1c], edx
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x1c]
ret
call fcn.100eefb4

Function at 0x100cf268
Capabilities:
Authenticate hmac

Disassembly:
pushfd
add dword [esp + 4], 0xefee011f
push ecx
mov ecx, 0xaa34139c
shl cl, cl
shl ecx, 0x61
cmp ecx, 0xf93e8030
mov ecx, dword [esp]
xchg dword [esp + 0xc], ecx
mov dword [esp], 0xcc9c31ac
push edi
mov edi, dword [esp + 4]
seta byte [esp + edi*2 + 0x66c79cac]
shl dword [esp + edi + 0x3363ce58], 0x5c
ja 0x10155af7
mov dword [esp + 0xc], ecx
jae 0x100f3840
push ecx
push edx
call fcn.10222525
call fcn.101d1fd2

Function at 0x100d3b93
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
pop esi
call fcn.101222b7
sysenter
call fcn.1018e858
mov ecx, 0xc6b6e720
bt ecx, ecx
movsx eax, cl
mov cl, byte [eax + ebp - 0x20]
jae 0x101758b7
push 0x7f16af15
mov word [ebp], ax
jmp 0x101a4d49
push 0xcda3e531
push 0x41146023
add ebp, 2
shl dword [esp + 2], 0x3d
jp 0x10219992
bswap eax
or al, byte [ebp + eax*2 - 0x3ffffffe]
jmp 0x1012b2ac
mov dword [esp + 0xa], 0x378ded1f
push 0xdd3ff4a2
lea esp, [esp + 0x18]
jmp fcn.1018295a
Function at 0x100d4095
Capabilities:
Packed with generic packer

Disassembly:
jae 0x1015bd1b
lea eax, [eax + 0x412b2b22]
add dword [esp + ebp + 0x429b0020], 0xefec62ce
neg word [esp + edx + 0x5f546705]
jge 0x10145e86
sub bp, 0x9438
seta byte [esp + edi + 0x5f54671d]
xchg dword [esp + edx + 0x5f546745], eax
mov ebp, dword [esp + edx + 0x5f54673d]
xor word [esp + edi + 0x5f546725], 0x639c
shr edx, 8
neg byte [esp + 0x24]
and dword [esp + edi + 0x5f546711], edi
jo 0x101d7c74
mov edx, dword [esp + 0x14]
jg 0x1012f3e3
call fcn.1018c96a
lea esp, [esp + 0xc]
jbe fcn.100aa4cf
les eax, [esi + 0x19]
mov dl, 0x64
xchg esp, eax
xchg ebx, eax
inc eax
invalid
mov edx, dword [esp + edx - 0x1b0]
xor dword [esp + 0x10], 0x27a77e93
call fcn.100b1d87
xor ebp, ebp
lea edi, [edi - 0x4e6c79d9]
sub ebp, 0x58b29089
mov esi, edi
shr ebp, 0x97
call fcn.1024bfdf

Function at 0x100d85fa
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, 0x7e0cd43a
mov dword [ebp + ebx - 0x7e0cd436], ecx
xchg dword [esp + ebx - 0x7e0cd42c], ebx
mov dword [ebp + ebx - 0x4e2589b0], edx
mov dword [esp + ebx - 0x4e2589a8], 0xe28aa628
mov ebx, dword [esp + ebx - 0x4e25899c]
jmp 0x10101f93
push 0x7f216818
jmp 0x100f0282

Function at 0x100d8a5a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edi*4 - 0x1001988], 0xd7ad9888
call int.10172370
sub dword [ebp - 0x4e385b68], ebx
std
push esi
jnp 0x100d8aab
adc al, 0x3d
mov al, byte [0x25d147fc]
sar dword cs:[edi + 4], cl
sub eax, 0xf107c4f8
aad 0x3e
pop ds
inc esp
or eax, 0xb1479488
xor eax, 0x5279214d
idiv eax
jne 0x100d8a89
out dx, eax
mov ebx, 0x7362317c
jno 0x100d8b12
push 0x89796f3e
add eax, 0xa513f89b
or eax, 0xd196db4a
and ebp, eax
sahf
fist dword [esi - 0x6117dc2f]
invalid
lodsb al, byte [esi]
invalid

Function at 0x100dc2f5
Capabilities:
Encode data using xor

Disassembly:
test ebx, esi
not edi
movsx edi, bx
mov edi, dword [esp + 0x24]
sete byte [esp + ebx*2 + 0xfcd8]
add dword [esp + ebx + 0x7e6a], 0xfff017e0
add dword [esp + esi - 0x51a8fff0], 0xefe65605
test byte [esp + esi - 0x51a8fff8], 0x16
setle byte [esp + esi - 0x51a8ffe0]
mov esi, dword [esp + ebx + 0x7e7e]
sub ebx, dword [esp + ebx + 0x7e8a]
movzx ebx, word [esp + ebx + 0x51a97e73]
seta byte [esp + 8]
jb 0x1016b239
js 0x100f6fe3

Function at 0x100dc857
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, 0xba85bad
pushfd
push ebx
call fcn.1021a89b
mov edi, 0xbbb54dbc
sal edi, 0x1a
mov ax, word [esi]
lea edi, [edi + edi*2 + 0x7d36c113]
add edi, edi
btc di, di
mov di, word [esi + 2]
adc esi, 2
push 0xa9067309
push 0xc10b95a6
not dword [esp + 4]
not ax
jmp 0x101fef5d

Function at 0x100dd291
Capabilities:
Packed with generic packer

Disassembly:
add bl, bl
add dword [esp], 0x96237
not ebx
sub ebx, ebx

Function at 0x100dd2f0
Capabilities:
Packed with generic packer

Disassembly:
jb 0x101273ad
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x24]
ret 4

Function at 0x100ddaf3
Capabilities:
Packed with generic packer

Disassembly:
push edx
pushfd
and byte [esp + 0xc], 0xb5
mov edx, dword [esp + 0xc]
lea edi, [edi + edx + 0x54d43bdc]
push ebx
mov ebx, 0x123a8712
and word [esp + edx + 0x54d43beb], bx
call fcn.1010e283
Function at 0x100e3404
Capabilities:
Authenticate hmac

Disassembly:
adc cl, 0xa2
cwde
cdq
lea edx, [eax + edx*2 + 0x358a06bf]
ror cl, 1
xor bl, cl
mov dword [esp + edx - 0x358a00c0], edx
mov dword [esp + edx - 0x358a00c0], edi
and al, 0x1a
not edx
push ebx
movsx ebx, dl
call fcn.1016677d

Function at 0x100e3992
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov cl, 0xa2
pushfd
invalid
mov dword [esp], 0x201fbeb1
call int.10190b82
dec edx
inc edx
dec ecx
sub ch, 0x51
cli
lodsb al, byte [esi]
js 0x100e393c
push esi
sbb dh, byte [ecx - 0x558e9228]
pop esp
clc
adc ebx, esi
xchg edx, eax
mov cl, 0xf8
jge fcn.100e39fa
mov byte [0xae2bc034], al
ret 0xd2d9

Function at 0x100e4334
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor word [esp + ebp + 0x531f4f08], bp
lea edx, [edx + ebp*2 + 0x4b6e902d]
neg byte [esp + ebp + 0x531f4f08]
mov dword [esp + ebp + 0x531f4f20], ebp
movzx bp, byte [esp + ebp + 0x531f4f08]
not byte [esp + ebp + 0x531fff22]
push 0xd1379a9f
jb 0x100fa57f

Function at 0x100e44a5
Capabilities:
Authenticate hmac

Disassembly:
pop ebp
push edx
push ecx
pushfd
mov edx, 0x2dbee520
xor dl, dh
mov ecx, 0xbc36f194
je 0x101d4576
neg edx
cmp cx, 0x5b3d
xchg dword [esp + ecx + 0x43c90e78], ebp
call fcn.101042b3
and word [esp + esi + 0x2ae334eb], si
push ebx
push esi
add dword [esp + 0xc], 0x11c768
mov esi, dword [esp]
test dword [esp + esi + 0x2ae334df], esi
sets byte [esp + esi*2 + 0x55c669d2]
mov ebx, esi

Function at 0x100e595d
Capabilities:
Packed with generic packer

Disassembly:
push eax
push ebx
pushfd
mov ebx, 0x42b9c3af
add bl, 0xbe
bswap ebx
movzx bx, bl
mov eax, dword [esp + ebx - 0x6dc30036]
lea ebx, [ebx*2 + 0x72bdf294]
call fcn.10148a74

Function at 0x100e5e87
Capabilities:
Packed with generic packer

Disassembly:
push 0x80bdb4a1
mov dword [esp + ebp + 0x5218ac4d], 0xa1aedca6
add dword [esp + ebp + 0x5218ac65], 0xefda89a9
or byte [esp + ebp + 0x5218ac55], 0x3e
call fcn.1017b11a
and edi, ecx
mov dword [esp + ecx - 0x3c14f1d4], edi
lea eax, [eax + ebp + 0x2cac3f33]
jge 0x10154bab
invalid
and dword [ebx], esi
cmpsd dword [esi], dword es:[edi]
dec edi
pushfd
xchg esi, eax
push ss
dec esi
jne 0x100e5efe
xlatb
aaa
call 0x41b49520
fld xword [esi - 0x5e]
mov eax, dword [0xf6432ff1]
scasd eax, dword es:[edi]
cmp ch, ah
pop esp
adc dword [eax], edx
not ebx
sar dword [esi], 1
push ds
or esi, 0x5e
push cs
nop
out 0x55, eax
stosb byte es:[edi], al
push esp
out dx, al
jg 0x100e5f5c
fst dword [eax]
dec eax
wait
sbb eax, 0xd45f2687
jge 0x100e5f22
aam 0x7d
and edx, esi
push eax
push eax
sbb byte [eax], dh
inc ebx
mov ecx, 0xaa19b1
jo 0x100e5f4d
daa
in eax, dx
int 0xbd
mov edx, 0x56241ce8
push ebx
mov al, byte [0x3f9a1031]
mov ah, 0x70
pop esp
push edi
lodsb al, byte [esi]
jbe 0x100e5fa2
jg 0x100e5ec0
pushfd
arpl word [ebx - 0x56], bp
inc esp
hlt
sub byte [edi], dl
mov ch, 0x27
mov eax, dword [0xd083514]
fdivr qword [eax - 0x20]
mov ch, 0x22
stosd dword es:[edi], eax
invalid
lodsd eax, dword [esi]
inc esi
out dx, eax
invalid

Function at 0x100e8933
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x78556a59
call fcn.101af011