joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102f1f2a
Capabilities:
Authenticate hmac

Disassembly:
adc edi, eax
jmp 0x10005015
mov edx, dword [edx + ebp - 0x2f32c]
push 0x1fbc893c
mov ecx, dword [esp + 5]
jae 0x10091e6d
inc ecx
mov edx, eax
xor dword [esp + edi - 0xa0], esi
dec eax
shl edi, 0x33
inc ecx
pop esp
inc ecx
mov eax, eax
inc esp
movzx ebp, ax
dec eax
arpl si, si
dec eax
adc ebx, esi
inc ecx
xchg eax, edi
inc bp
movzx esi, byte [eax + ebp]
inc ecx
sub eax, 0xfa8282e
inc edx
mov cl, byte [ebp + edi*2 - 0x13e]
dec esp
cmovle edx, edi
dec edx
lea edi, [edx*2 + 0x3c0875b1]
dec edx
lea ebp, [ebp + edi*2 - 0x13e]
inc ecx
sal dh, cl
inc bp
mov dword [edi + ebp - 0xa0], esi
dec eax
shl eax, 0xd3
jmp ebx
lea ebp, [ebp + ecx*2 - 0x5e2]
sub cx, cx
mov byte [esp + ecx*2 + 2], cl
not eax
not edx
and eax, edx
inc cl
pop ecx
mov dword [ebp + ecx*4 - 0x7c0224f0], eax
je 0x101b1c79
mov dword [esp + ecx - 0x1f00893c], esi
ret 4
setns byte [esp + ecx - 0x140c]
jle 0x10525f47
xor eax, eax
test edx, edx
push 0x5c884333
lea esp, [esp + 0x14]
je 0x102ddcf4
call fcn.100e535e
mov ecx, dword [edi]
mov edx, 0xc93dcba8
lea edx, [edx + edx*2 + 0x6112a983]
shr edx, 0x2a
lea edi, [edx + edi - 0x2f32ff]
xor ecx, ebx
mov eax, edx
add dl, al
or al, dh
neg ecx
xadd al, ah
rol ecx, 1
jmp 0x106bbe74
mov edx, 0xabe6f31
not eax
jmp 0x10304c23
push 0x3b29d6b5
add ebp, 4
jmp 0x102b24bd
movzx edx, byte [esp + ecx - 0x140c]
mov eax, dword [ecx + esi - 0x140c]
sal dword [esp + ecx - 0x140c], cl
lea esi, [esi + ecx*2 - 0x2814]
xor eax, ebx
pop ecx
neg edx
lea eax, [eax + edx - 0x1e0a45b9]
rol eax, 1
xchg ch, cl
bswap eax
sub dl, dh
sbb ecx, ecx
xor ecx, ecx
dec eax
not dl
xor ebx, eax
sub edx, 0x3db27128
xadd dl, cl
jno 0x100177b0
mov eax, dword [esi]
mov edx, 0x9152723
jmp 0x10385713
mov eax, dword [ebp + edx - 0x2f330]
jp 0x100653a9
inc ecx
rol al, 0x86
adc eax, edx
bswap ecx
push edx
shl eax, 0x9b
sar dword [esp + edx*2 - 0x5e660c], 0xb1
xor ebx, ecx
sar edx, 0xa4
adc eax, 0x58abf41f
adc esi, ecx
push edx
shl dword [esp + edx - 0x2f32c], 0xa9
ja 0x106284f4
inc ebp
mov byte [edx], bh
inc ecx
pop eax
inc edi
mov esi, dword [ecx + eax - 0xd84b69e]
inc esp
mov ebx, edi
dec edi
lea ecx, [ecx + eax - 0xd84b69a]
inc ebp
xor esi, esp
inc ebp
movzx ebp, bl
inc ecx
dec esi
dec esi
lea ebx, [ebx*4 - 0x4d6ddbe2]
inc ecx
neg esi
call fcn.106dbe54
mov eax, 0xce8818b4
mov ecx, dword [esi]
call fcn.10149d35

Function at 0x102fbc9c
Capabilities:
Execute syscall

Disassembly:
sbb eax, 0xffb1d79a
mov dword [esp + edx*4], edx
xor eax, 0x56b1e4ad
call fcn.104984b8
mov esp, ebp
pop ebx
mov esi, 0xc19d660e
pop edi
movzx edx, si
pop ecx
jmp 0x1039f1a0
Function at 0x103033de
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
dec edx
mov dword [esp + edx - 0x2018001a], ebx
ret
dec ecx
adc ebx, ebx
inc esp
movsx edi, bh
inc cx
movzx ecx, byte [ebp + ebp - 0x6ebf883f]
inc ecx
mov al, byte [ebp + ebp - 0x6ebf883d]
dec edx
mov dword [esp + ebp - 0x6ebf883f], 0xb993261b
dec edx
lea ebp, [ebp + ebp - 0x6ebf883d]
inc ebp
sub al, al
not cl
inc esi
xchg byte [esp + ebp - 0x6ebf883f], al
not al
inc ebp
movsx ebx, ax
inc ecx
dec bl
inc ecx
xor edi, 0x4799f2a9
and cl, al
inc ecx
rol bh, 0x42
dec edx
sub dword [esp + edx - 0x2018001a], edx
inc cx
mov dword [edx + ebp - 0x2018001a], ecx
js 0x1000c066

Function at 0x10303445
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
inc sp
mov ebx, dword [ebp + esi - 0xffb8]
inc esp
movsx edi, cx
mov cl, byte [ebp + esi - 0xffb6]
push eax
inc ecx
mov eax, 0x7f130389
sar al, 0xe2
dec eax
lea ebp, [ebp + esi - 0xffb6]
dec esp
mov dword [esp + esi - 0xffa8], edi
neg word [esp + esi*8 - 0x7fdbe]
inc cx
shl ebx, cl
dec eax
mov dword [esp + esi*4 - 0x3fed8], esi
call fcn.10249396
jmp 0x1056cab3
mov esp, esi
call 0x103a6c28

Function at 0x103093b2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ebp
sub ebp, 2
mov word [ebp], cx
sub edi, 4
mov dword [esp], 0x33065922
mov ecx, dword [edi]
not word [esp]
mov eax, dword [esp]
xor ecx, ebx
call fcn.10308d28
invalid
Function at 0x10325b26
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov ebp, 0x6216bc8d
push 0x691a9a8a
call fcn.1024f9b8
inc ecx
pop edx
dec ecx
add edx, 0xffd8fe2a
inc ecx
jmp edx
neg dword [esp + edi - 0x4fa1f68a]
call fcn.106c5f90
mov edx, 0x6d14173f
inc ebp
mov ebx, dword [ecx + edx - 0x6d14173f]
dec eax
lea ecx, [edx + edx*4 + 0x3aa74728]
jmp 0x102a6fa4
inc esp
movzx ebp, cl
dec edi
lea ecx, [ecx + ebp*2 - 0xc2]
inc ecx
push ebp
inc esp
movzx eax, byte [esp + edx - 0x6d14173f]
inc ebp
xor ebx, esp
inc ecx
dec ebx
inc cx
inc ecx
neg ebx
mov dword [esp + edx - 0x6d14173f], 0x63e8ea0
inc ecx
inc ebx
call fcn.101fb149
sub edi, 4
mov edx, 0x8311b8b0
mov ecx, dword [edi]
lea eax, [edx + edx*4 + 0x3718c430]
xor ecx, ebx
sar dl, 0xa3
not ax
dec ecx
rol ecx, 1
inc ecx
rol dl, 0xa3
neg ecx
dec ax
lea edx, [eax + edx*2 - 0x1af197c9]
ror ecx, 1
inc ecx
shl eax, 0xd8
xor ebx, ecx
add esi, ecx
mov eax, dword [ebp + eax - 0x5e000000]
jmp 0x101f957c
mov dword [esp + 0x2c], ebp
sub ecx, dword [esp + 0x2c]
push edi
je fcn.1059b9a2
lea ebx, [ebx - 0x5f53deda]
test dword [esp + ebp*2 + 0xca980a8], 0x62bedf12
push esi
not dword [esp + 4]
lea edi, [ebp*4 - 0x5c656767]
push edx
xchg dword [esp + ebp*4 + 0x1953012c], ebx
mov ebp, dword [esp + 0x1c]
jb 0x10284a92
add dword [esp + 0x2c], 0xeff5bbed
mov esi, 0xecb55f27
not dword [esp + 0x38]
test byte [esp + 8], dh
movsx si, byte [esp]
setae byte [esp]
mov edx, dword [esp + esi + 0x134affdb]
add dword [esp + esi + 0x134affbf], 0xefc4dcee
neg word [esp]
jne 0x103937a9
mov edx, dword [esi]
mov ecx, 0xf288f3b0
and cx, 0x31bd
adc esi, 4
lea ecx, [ecx + ecx + 0x521cf2b8]
xor edx, ebx
bswap edx
push ecx
ror edx, 1
sal ecx, cl
not edx
mov eax, ecx
setns cl
sbb edx, 0xa00632b4
sal al, cl
xor ebx, edx
add edi, edx
mov edx, 0x802adb12
mov dx, word [ecx + ebp - 0x18000001]
mov cl, byte [ebp + ecx*4 - 0x60000002]
and word [esp + eax*4 - 0x5fffffff], ax
lea ebp, [ebp + eax*4 - 0x5ffffffe]
call fcn.1032af2d
setne byte [esp + 8]
add dword [esp + esi*2 + 0x2695ff4e], 0x4db92907
add dword [esp + 0x14], 0xeffde6c6
mov dword [esp + 8], edi
mov edi, dword [esp + esi*2 + 0x2695ff6e]
shr dword [esp + esi + 0x134affa7], 0x7d
shl dword [esp + esi*4 + 0x4d2bfed4], cl
cmp dword [esp + 8], 0xd884fab7
jg fcn.101965f2
mov esi, dword [esp + esi*2 + 0x2695ff52]
cmp dword [esp + 0x24], 0x99313e2c
not dword [esp + 8]
jno 0x10268b1a
and word [esp + 8], 0x440b
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0x28]
ret 4
Function at 0x10335c91
Capabilities:
Encode data using base64

Disassembly:
shl esi, 0xda
jae 0x1062bada
add dword [esp + ebp - 0x6e9fb79b], 0xefbda21f
mov edi, dword [esp + ebp - 0x6e9fb787]
mov dword [esp + edi - 0x44de], ecx
push ebp
neg di
push ebp
add dword [esp + 8], 0xffb98137
mov edx, 0xe3a5fa3e
and di, 0x789c
jl 0x102e28d7
push esi
mov esi, dword [esp + ebp - 0x6e9fb797]
mov ecx, dword [esp + esi - 0x6e9fb793]
mov ecx, dword [ecx + esi - 0x6e9fb79f]
and dword [esp + esi - 0x6e9fb79b], 0xef93d333
jae 0x102180bc
movaps xmmword [esp + 0x40], xmm1
push ebx
pushfd
mov ebx, 0x402f3935
shl bl, 0x8d
mov ebx, dword [esp + ebx - 0x402f38fc]
mov dword [esp + 4], 0x43b17948
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10674e81
lea edi, [edi + eax - 0x29275c6e]
movsx edx, al
jmp 0x104e1b82
mov eax, dword [edi + eax - 0x29275c6a]
lea edx, [edx + edx*4 - 0x7248fa60]
xor eax, ebx
or dx, 0x3418
or edx, edx
jl 0x105d8b48

Function at 0x1033ae06
Capabilities:
Encode data using xor

Disassembly:
iretd
fcos
je 0x1033ad6a
lea ebp, [ebp + eax - 0xb0]
call fcn.105391fe
jbe 0x1033ada9
aam 0xd
and al, 0xa7
jecxz 0x1033ae56
adc byte [edi - 0x38], bl
add eax, 0x21b3dd11
pop ebp
das
out dx, eax
xor eax, 0xcdee954d
xchg ebx, eax
movsd dword es:[edi], dword [esi]
test eax, 0xdc313510
mov word [edx + 0x11], cs
cmp ch, 0x62
out dx, eax
push es
adc al, 0xbf
out dx, ax
jae 0x1033ae22
xlatb
out dx, al
cdq
lcall 0x42ac, 0xbaf810d6
cdq
adc byte [eax - 9], cl
clc
adc byte [bx], cl
rcr dword [esi + 0x11], cl
in eax, 0xb7
or dword [esi + 0x74], eax
out dx, eax
sbb eax, 0x93eece56
xchg edi, eax
mov esi, 0x4d7b10f2
cmp byte [ebx + 0x34], 0x11
jmp 0x3f0882a3

Function at 0x10347e56
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
neg ebx
call fcn.104e975b
call fcn.100f0537
Function at 0x1034d68a
Capabilities:
Encode data using base64

Disassembly:
dec ecx
inc eax
xor eax, 0xe79ef224
bswap ecx
shl eax, 0x55
mov dword [esp + eax - 0x52600000], eax
xor ebx, ecx
pop eax
dec ax
add edi, ecx
movsx ecx, ax
xadd ecx, eax
mov ecx, dword [ebp + ecx - 0x5260fffe]
or al, 0x23
sal eax, 0x93
sal eax, 0xc6
mov eax, dword [ebp + 4]
jbe 0x103b456e
bswap ecx
or eax, edx
movsx edx, cx
not eax
inc dx
mov dword [ebp + ecx*4 - 0x23a18], eax
lea edi, [ecx + edi - 0x8e8a]
xchg ecx, edx
movsx eax, dl
mov edx, dword [edi + edx - 0x8e86]
jne 0x106abc8f
mov eax, 0x53fe10a
lea ecx, [eax*4 + 0x5f81f30a]
call fcn.1037c80b
mul ecx
mov dword [ebp], edx
lea ecx, [ecx + ecx*4 + 0x7306a733]
call fcn.10425e92
mov dword [edx + ebp - 0x6923d7ff], edi
xchg esi, eax
inc ecx
sar ch, 1
dec edx
mov dword [esp + edx - 0x6923d7ff], ebx
ret
xor edx, ebx
shr eax, cl
not edx
jne 0x10460182
inc esp
invalid
lea ecx, [edi + 0x782a2af7]
jle 0x106abcfb
inc ebp
sbb dword [eax + 0x1c515b21], ecx
mov cl, ah
rcr byte [ecx - 0x37], 0x75
out 0x92, al
jne 0x106abc98
xchg edx, eax
jp 0x106abc7c
and ah, ch
mov al, cl
dec eax
ror cl, 0x8a
mov esi, dword [ecx - 0x7c]
lodsb al, byte [esi]
scasb al, byte es:[edi]
out dx, al
adc bh, cl
adc bl, byte [ebx]
push 9
mov edx, 0x5cc31f77
jg 0x106abc82
lodsd eax, dword [esi]
jmp 0x2468e7e7
adc edi, dword [edx]
mov esp, 0x6d7da7d5
movsb byte es:[edi], byte [esi]
and al, 0x8a
movsb byte es:[edi], byte [esi]
jns 0x106abcba
and ebx, dword [esi]
in al, 0x69
or eax, 0x5aae19de
jmp esp
mov ch, 0x2f
push ebx
jb 0x106abcb0
mov dword [0xbd1e288b], eax
ret
mov ebp, dword [eax]
push ds
mov ebp, 0xe9ffc366
enter 0x2797, 0xfffffffffffffff4
repne insb byte es:[edi], dx
scasd eax, dword es:[edi]
adc byte [edx], ah
mov dl, 0x3f
mov bl, 0xe1
sbb byte [ebx], dl
rcr dword [eax + 0x4f], cl
mov cl, 0x1d
lcall 0x4437, 0xff517610
push ecx
push dword [edi]
inc esp
add edi, ecx
int1
into
jecxz 0x106abcad
add eax, 0x8cdf5c12
or al, 0xcd
not byte [edi + 0x4a]
das
mov esp, fs
jns 0x106abd57
popal
push cs
jno 0x106abcf5
jae 0x106abcd5
sub dword [edx - 0x75514075], 0x28
pop ebp
in al, 0x35
mov bh, 0xfd
dec esi
cmp eax, 0x1adc3bed
push esp
mov ebx, 0x385156c3
dec edi
add ebx, dword [ebx]
invalid
in eax, dx
cmp ebx, esp
sbb dl, byte [ebx + edi*4 - 0x3d]
push esi
push ecx
cmp byte [edi + 3], cl
sbb esp, dword [edx - 0x2e]
sahf
jae 0x106abd68
jno 0x106abd1a
jae 0x106abd90
movsd dword es:[edi], dword [esi]
add dword [ebx], ecx
clc
xchg edi, eax
push ebx
aaa
cmp ah, byte [ebx + 0x19]
push es
inc eax
push 0x24
sub eax, dword [0xd88b93d8]
salc
or eax, 0xa35bc9e4
or byte [eax - 0x44], dh
or dword [ecx - 0x62], ebx
outsb dx, byte [esi]
out dx, al
add eax, 0x6d5cb07c
loop 0x106abdb7
push cs
jno 0x106abd48
xor ecx, dword [esi]
mov gs, word [edi + 0x79]
jns 0x106abdd1
inc eax
neg byte [edi]
xchg edx, eax
xlatb
and eax, dword [ebx - 0x64bd97b9]
lahf
salc
fbstp tbyte [ebp + 0x2e]
dec esp
sub dword [eax - 0xe], ecx
dec esi
sub al, 0xdd
out 0x31, eax
scasb al, byte es:[edi]
xchg ecx, eax
push esp
xor eax, 0x7f756189
pop ss
int 0xb2
xchg cl, dh
int1
int3
dec edx
mov dl, 0xbc
xchg al, bl
invalid
Function at 0x1035560c
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
xor ebx, ecx
xadd word [esp + edx*2 - 0x1cfc], dx
adc ebp, ecx
inc al
pop eax
pop ecx
jno fcn.10616578
bswap ecx
xchg dword [esp + edx*2 - 0x1cfc], eax
xor ecx, 0x9d32341d
pop edx
dec eax
rol ecx, 1
movzx edx, ax
xchg byte [esp + eax - 0x40e80e7a], al
lea ecx, [ecx + eax - 0x7da03e78]
and dl, dl
ror ecx, 1
jmp 0x102b79fe

Function at 0x1035aa90
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp + 0x18], ebx
jo fcn.1069113f
bswap edi
push 0x3712c4b3
neg edi
lea edi, [edi + edi*2 - 0x149a0fa]
jns 0x1001e85a

Function at 0x1036c90b
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + edx*2 - 0x130], edi
dec esp
lea esp, [edx + eax + 0x60383c27]
dec ecx
shr esp, 0xea
dec eax
mov dword [esp + eax - 0x5182f9ae], edx
dec esp
mov esp, dword [esp + edx*2 - 0x130]
dec esi
lea ebx, [edx + ebx*8 + 0x3cb69813]
inc cx
dec eax
arpl di, di
dec eax
adc ebx, edi
dec eax
mov esi, dword [ebp + edx*8 - 0x500]
inc ebp
movzx ebp, bl
dec esp
lea edi, [edx + edx + 0x6d192fa5]
dec esp
mov eax, dword [ebp + edx - 0x98]
dec ecx
shr ebp, 0x2c
xor cl, byte [ebp + edx - 0x90]
dec eax
lea ebp, [eax + ebp - 0x5182f9a4]
dec esp
shrd esi, eax, cl
dec esi
lea edx, [ebx*2 + 0x6d8cb922]
inc esp
movsx eax, dx
dec eax
mov dword [eax + ebp - 0x5182f9ae], esi
call fcn.102e6996
pop edi
jb fcn.102e94b3
mov edx, 0x433ffa08
lea ecx, [edx + edx*4 - 0x39ff0fff]
lea edi, [edi + ecx*4 - 0x590348a8]
lea ecx, [edx*8 - 0x2d4c0cdc]
shr cl, 0x65
ja 0x10142a6e
mov ecx, 0xdd1096a1
or ecx, ecx
mov eax, dword [ebp]
jno 0x10461740
jp 0x1036ca11
ltr word [ebp + 0x5b]
pop ebp
pop ebx
fimul word [0x11773295]
xor edi, edx
dec edx
jbe 0x1036c9c2
adc byte [esi + edx], ch
xchg edx, eax
cmp edi, ebp
sub byte [0xd5efc728], 3
invalid
mov ah, 0x47
inc edi
inc esi
sub edi, dword [ebx]
cmpsd dword [esi], dword es:[edi]
test edi, esp
mov ah, 0x4e
sub dword [edi - 0xc], ebx
dec eax
loopne 0x1036ca13
xor eax, 0x29ea1070
invalid
adc ebp, 4
call fcn.104f23ec
mov cl, byte [ebp + ecx - 0x4ba71325]
push 0x909a83ba
inc dword [esp]
add ebp, 4
call fcn.104d03c9
and esi, 0x2e3a13bd
test si, si
call fcn.105e9e9e

Function at 0x1037013a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xec80af99
sub ebp, 4
movsx eax, byte [esp]
mov dword [ebp], edx
not ax
pop ecx
sub edi, 4
ror ax, 0xa
movzx edx, al
mov edx, dword [edi + edx*2 - 0x100]
call fcn.10320b4e
mov eax, 0xef08dc33
mov ecx, eax
mov edx, dword [esi]
push eax
and eax, dword [esp]
xor ecx, dword [esp]
add cx, word [ecx + esi + 4]
neg eax
shr eax, 0x9b
lea esi, [esi + eax + 4]
not byte [esp + eax*2 - 4]
mov word [edx + eax*4 - 8], cx
ja 0x104b7656
dec eax
rol dword [esp], cl
call fcn.1064c032
shl eax, 0xc8
movsx edx, byte [esp + eax*2 - 0x400]
mov eax, dword [ebp + eax*4 - 0x800]
movzx ecx, byte [esp]
lea ebp, [ebp + ecx*8 - 0x65c]
or edx, ecx
adc ecx, 0xa6269f18
xor eax, ebx
jmp 0x103c2227
Function at 0x10371c3c
Capabilities:
Encode data using xor

Disassembly:
call fcn.10142a5e
xchg dword [esp + ecx - 0x17], edi
mov ebx, dword [esp + ebx*2 + 0x5ebb058e]
je 0x105dc755
lea edx, [edx + ecx*4 - 0x2afa3de1]
xor cl, byte [esp + ecx*4 - 0xd6]
test dword [esp + ecx - 0xa], edx
mov ecx, dword [esp + 8]
mov word [esp + 0x10], 0x2c34
not byte [esp + 0x24]
mov dword [esp + 0x24], 0x2c874f03
mov edx, dword [esp + 0x1c]
jbe 0x10154b6e
mov dword [esp + 0x24], 0x5001f6bd
xor byte [esp + 0x24], 0x2c
shr byte [esp + 0x24], 0xbb
call fcn.10078a48
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0x1294dd39
movzx edi, cx
lea eax, [edi*4 + 0x47a6d209]
mov edi, edx
xor eax, ecx
jno 0x1058b0f2
neg ebx
mov ecx, 0xfe268b93
cmp ebx, 0x9a2961ba
lea esi, [esi + ecx + 0x1d9746e]
mov bl, 0x34
push esi
push ebx
movzx bx, byte [esp + ecx*8 + 0xecba369]
call fcn.104fa3f3
Function at 0x1038a19d
Capabilities:
Packed with generic packer

Disassembly:
neg edx
xor cx, ax
bswap edx
jge 0x10272910
neg ecx
not edx
call fcn.101112f2
inc ecx
mov edi, dword [ecx]
dec ecx
add ecx, 4
inc ecx
mov esi, 0x3930c131
inc ecx
xor edi, esp
inc edx
lea edi, [edi + esi - 0x745399d9]
inc cx
neg esi
inc ecx
mov edx, esi
rol edi, 2
dec edi
lea ebp, [esi + esi*8 + 0x2606c63c]
call fcn.103dc660
inc ecx
xor eax, esp
inc cx
rol ebx, 0x2f
dec esp
lea edx, [esi*4 + 0x5304b30c]
dec esi
lea edi, [edi + ebx*8 + 0x560e5d0e]
rol eax, 1
inc eax
call fcn.10089284
add ebp, edx
or byte [esp + eax*8 - 0x1ffffffe], 0x1e
call fcn.1061addb
mov ecx, 0x183a8d17
mov eax, ecx
lea edi, [edi + ecx*4 - 0x60ea3460]
mov ecx, dword [edi + ecx - 0x183a8d17]
neg al
xor ecx, ebx
movzx edx, al
xor ecx, 0x660ff12e
sal eax, 0x8b
lea eax, [edx + edx*2 - 0x22632cd2]
lea ecx, [ecx + eax - 0xb83b4b2]
not dx
xor edx, 0x5b2d64ab
bswap ecx
or edx, edx
dec ecx
jmp 0x1065c1ee
inc ebx
mov eax, dword [ecx + esi*2 - 0x4a]
inc esp
movsx ebx, bh
dec ecx
sal esi, 0x90
dec ebp
xor ebx, ebx
dec edi
lea ecx, [ecx + esi*4 - 0x93fffc]
jns 0x10181a5f
mov edx, 0x9807f6a8
movsx ecx, dl
sub edi, 4
mov edx, dword [edi]
mov eax, 0xe7103d84
xor edx, ebx
jmp 0x100de049
adc esi, 4
pop edx
mov ecx, edx
xor eax, ebx
rol dx, 0xec
rol edx, cl
sar dl, 0xe1
bswap eax
not edx
and byte [esp + edx*2 - 0x59ea400], dh
add ecx, ecx
rol eax, 1
xchg dword [esp + edx*2 - 0x59ea400], edx
and dword [esp + ecx - 0x4c2bfff6], ecx
call fcn.104f813e
mov dword [esp + edx], ebp
ret 4
not ecx
movzx eax, byte [eax + esi - 0x85a6f23]
call fcn.100f64b7
xor ecx, ebx
rol ax, 0x82
push eax
ror dword [esp + eax - 0x5915fffb], 0xfc
xor ecx, 0xd4b5ce06
push eax
lea edx, [eax - 0x22ee1e52]
rol ecx, 2
shr dword [esp + edx*2 - 0x6c4fc34e], 0x89
sub ecx, 0xffb1d79a
shr ax, 0xea
xor ecx, 0x56b1e4ad
add edx, edx
dec eax
sub dword [esp + edx - 0x6c4fc34e], 0x6bb3b9a8
xor ebx, ecx
sar edx, 0x63
sar dword [esp + edx*8 - 0x6c4fc34c], 0xdf
lea ebp, [ebp + edx*8 - 0x6c4fc354]
mov dword [eax + ebp - 0x5915003e], ecx
not byte [esp + eax - 0x5915003b]
sub dx, ax
mov eax, dword [esi + eax - 0x5915003e]
jb 0x102064af
lea edx, [edx - 0x6d45a1e8]
jne 0x101c02ae
inc cx
not esi
inc sp
mov dword [ebp], esi
inc ecx
mov edx, dword [ecx]
inc ecx
movsx edi, ax
inc ebp
movzx edx, al
dec edi
lea ecx, [edx + ecx - 0x8f]
inc ecx
xor edx, esp
ror edx, 1
dec edx
inc ecx
dec eax
not edx
inc ecx
inc eax
bswap edx
dec edx
mov dword [esp + edx - 0x93], edi
inc ecx
lea edx, [eax + edx - 0x7bacc0f6]
inc ebp
movsx ebp, dx
dec esi
mov dword [esp + edx*2 - 0x126], esp
movsx ecx, di
je 0x101a4dad
inc esp
movsx edi, cx
inc edx
xor dword [esp + edx*2 - 0x126], edx
ror ecx, 0x8e
inc ecx
sal al, 0xe6
inc ecx
pop esp
dec eax
arpl dx, dx
dec ebp
lea ebx, [ebp - 0x35494271]
dec eax
adc ebx, edx
jmp ebx
xor ebx, ecx
call fcn.10463b91
sub edi, 4
mov edx, dword [edi]
mov eax, 0xe684d387
xor eax, eax
dec eax
xor edx, ebx
lea eax, [eax + eax - 0x5f47ffe]
xadd al, ah
inc edx
movzx ecx, ax
push ecx
ror edx, 1
jmp 0x101751e4

Function at 0x1038c1da
Capabilities:
Encode data using xor

Disassembly:
dec ebx
lea esp, [esp + 4]
jne 0x104f4afe
Function at 0x10395640
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
not dx
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp + edx*2 - 0x2e3e33fe]
jne 0x103dc534
lea ecx, [edx + edx*8 + 0x10923bb7]
call fcn.10465138
mov edx, dword [ebp]
mov eax, 0x7f89e929
inc ax
sub ax, ax
mov eax, dword [ebp + eax - 0x7f88fffc]
push 0x983b6e20
adc ebp, 4
not edx
inc word [esp + 2]
not eax
mov ecx, 0xe52c5605
or edx, eax
sar dword [esp], 0xb8
lea eax, [ecx*8 + 0x7b92bc3b]
mov dword [ebp], edx
jae 0x101f20a5

Function at 0x10397a70
Capabilities:
Encode data using xor

Disassembly:
xor byte [esp + esi + 0x724581ef], 0xa5
call fcn.10170f10
mov edx, 0x372ada98
mov eax, dword [ebp + edx*2 - 0x6e55b530]
push ebx
movsx ecx, dl
shr cx, 0x6a
cpuid
jb 0x1039ae0f
cmp dx, 0x849b
xchg dword [esp + esi + 0x72458203], edi
mov ebp, dword [esp + 0x24]
not dword [esp + edx*2 - 0x6066c3f4]
jne 0x10099ed1
jmp 0x103302bc
call 0x1034f28c

Function at 0x10398b86
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp], eax
call fcn.103b43c4
add ax, ax
not ecx
jo 0x102f9b51
dec ecx
call fcn.10349a24
mov ecx, 0xe0a2fe28
sar cl, 0xa1
mov edx, dword [ebp]
not cl
mov ax, word [ebp + 4]
adc ebp, 6
call fcn.10366472

Function at 0x10414307
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc esi
dec edx
lea ebp, [ebp + ebp*2 + 0xa]
inc cx
inc ebx
dec ecx
lea edx, [edx + edx*4 + 0x7959315]
dec ecx
shld edi, edi, cl
dec esi
mov dword [ebp + ebp], edi
inc eax
movzx ecx, dh
inc ecx
bswap edx
inc ebp
xchg dl, ch
dec esp
xor ebp, ebx
inc ecx
jmp ebp
inc ebp
movsx esi, bx
inc esp
xor dh, byte [esp + edx - 0x48307b25]
inc ecx
bswap edi
dec ecx
ror edx, cl
inc edx
mov dword [esp + ebp - 0x48307b23], 0xa89e0b30
dec eax
inc dword [esp + edx - 0x48307b25]
dec esi
mov dword [esp + ebp - 0x48307b25], esp
inc ecx
movsx esi, ch
dec eax
rol esi, cl
inc esi
xor dword [esp + ebx - 0x34b76182], edi
inc ecx
sal edx, cl
inc ecx
pop esp
dec ebp
arpl di, di
dec ecx
inc ebx
dec ecx
add ebx, edi
dec esi
mov edi, dword [ebp + ebp - 0x48307b25]
dec eax
neg ecx
inc cx
shr eax, 0x2b
dec eax
mov edi, dword [ebp + edx - 0x48307b1d]
inc ecx
neg ebp
dec ecx
sar ebp, 0x6d
mov cl, byte [ebp + edx - 0x48307b15]
inc ecx
xadd bl, dh
jne 0x1006533b
dec edx
mov dword [esp + ebp - 0x48307b25], 0x469a9890
dec edi
lea ecx, [ecx + ebp - 0x48307b21]
dec byte [esp + edx - 0x48307b20]
dec esp
lea edx, [edx*8 - 0x256f8657]
inc ecx
mov ebx, 0x34b76182
inc ebp
xor edi, esp
inc ecx
inc edi
inc ecx
not edi
inc ecx
bswap edi
inc ecx
mov ecx, ebp
inc ecx
xor edi, 0xc6916cb1
inc esp
movzx eax, dx
inc ecx
movsx edi, bp
sub dl, byte [esp + ecx - 0x48307b1f]
inc ecx
ror edi, 1
jmp 0x10233e7e
Function at 0x1045f0bd
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + ebx - 0x68e42e0a]
mov dword [esp + 4], eax
jbe 0x102c2fdd
call fcn.1066205f
call fcn.1040ddb8
mov ecx, dword [esp + 4]
mov ecx, dword [ecx]
jne 0x104dd719
mov byte [0x7a6edb57], al
ja 0x102c3025
xor eax, 0xb048c2b9
jne 0x102c3034
mov ecx, 0x67b048c2
jne 0x102c3034
test eax, ebx
jge 0x102c301e
sahf
adc al, 0xe6
pop ds
push eax
int3
add al, 0xe6
or edx, dword [ebp + 0x6c]
fbld tbyte [esi]
leave
jle 0x102c2fef
scasd eax, dword es:[edi]
inc edi
mov ebp, 0xfbe5b3aa
mov ebp, 0x6bce528e
ret
pop eax
push ebx
pushfd
mov ebx, 0x5e8ad810
sub ebx, ebx
setge bl
xchg dword [esp + ebx*2 + 6], eax
sub ebx, 0x971bd1a1
add bl, 0xae
test bx, 0x6a9
jne 0x100fd927

Function at 0x1045f46d
Capabilities:
Encode data using xor

Disassembly:
jne 0x106680a6
xor di, 0xd3a4
and si, 0xab1
add dword [esp + edi - 0xd32d3a4], 0xefa06888
mov ebx, 0x459c529b
lea ebp, [ebp + ebx - 0x459c529a]
mov si, 0x2ba5
push 0x23ad2582
lea esi, [edi + esi*8 - 0x8e87dcb]
add dword [esp + ebx - 0x459c528b], 0x417538
mov dword [esp + 0x24], ebp
push edx
cmp edi, dword [esp + 4]
not esi
mov edx, dword [esp + ebx - 0x459c527b]
jae 0x1069050c
test word [esp + ebx - 0x459c527b], 0xa8a8
nop
jbe fcn.100e97a2
xor dword [esp + esi + 0x693b306], 0xb32d723e
setns byte [esp + ebx - 0x459c5297]
call fcn.105d8b42

Function at 0x1047f273
Capabilities:
Execute anti-debugging instructions

Disassembly:
and eax, eax
mov dword [esp + edx*2 - 0x175fdea], edi
ret
ror dl, 0x87
push edx
xor ebx, eax
bswap ecx
pop edx
neg dword [esp + edx - 0xbafef5]
add edi, eax
movsx eax, cl
jmp 0x1000d391
lea esi, [esi + edx - 0x5aded3f8]
mov dword fs:[ecx + edx - 0x5aded400], eax
lea edi, [edi + edx - 0x5aded404]
jne 0x10489df7
dec dl
movzx eax, dx
mov eax, dword [edi + edx - 0x5aded4ff]
xor eax, ebx
inc eax
push edx
ror eax, 1
neg eax
bswap eax
neg edx
call fcn.1042d9d3
sub dword [esp + 0x18], 0x4bb23fb7
call fcn.101f96cd
mov dword [esp + edx - 0x177e9460], 0x2ebfbd94
lea ebp, [edx + ebp - 0x177e945c]
js 0x104f37f3
mov edx, 0xa5212b2f
mov ecx, dword [esi]
not edx
mov eax, dword [esi + edx - 0x5aded4cc]
sal dl, 0x27
jae 0x1020b77b
inc byte [esp + edx*2 - 0x2efd28bf]
xor eax, ebx
xor eax, 0x5b20a30e
shr dword [esp + ecx*4 - 0x318], cl
add cx, dx
xchg dword [esp + edx - 0x177e9460], edx
bswap eax
dec eax
neg ecx
not eax
jb 0x1001d9a2