joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002430
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x1000244b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x100024b7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1000248f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x10002496
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x10002442
jmp 0x100024c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x1000252e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x10002506
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x1000250d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x100024b9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x1000256c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x10002573
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x100025b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x100025cb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x10002637
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1000260f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x10002616
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x100025c2
mov esp, ebp
pop ebp
ret
Function at 0x100738ea
Capabilities:
Encode data using base64

Disassembly:
adc ebp, eax
movsx eax, dl
mov ax, word [edx + esi - 0x2943519]
bt edx, 0x9e
rol edx, 0x52
neg ecx
mov cx, word [esi + 4]
mov dword [esp], 0xb5aeb019
jp 0x100a32f7

Function at 0x10092854
Capabilities:
Encode data using base64

Disassembly:
jns 0x101dd71f
mov ecx, dword [ebp]
mov edx, 0x4a0dbcae
movzx eax, dl
lea ebp, [ebp + edx - 0x4a0dbcaa]
imul ax
movzx edx, byte [esi + eax*8 - 0x3b220]
or eax, 0xec99e683
adc esi, 1
ror eax, 6
xor dl, bl
neg al
sbb dl, 0x9d
and ax, ax
add ax, 0xbd9d
sbb eax, eax
xor dl, al
and eax, eax
sbb eax, eax
inc dl
inc eax
lea eax, [eax*4 + 0x5e3b5d32]
neg dl
shr eax, 0xda
cwde
sub al, ah
inc dl
ror dl, 1
not eax
or eax, eax
xor dl, 0xb2
jmp 0x10269061
inc esp
or eax, edi
movzx ecx, byte [esp + 4]
dec esp
lea ebx, [ecx*2 - 0x4367c851]
mov esi, dword [esp]
dec ecx
add edi, 4
shr dword [esp + 4], 0x81
adc dword [esp], 0xf39d4698
jl 0x10097f51
not byte [esp + 2]
sar dword [esp + 8], 0xa7
test ebx, ebx
not word [esp + 7]
jmp 0x101ecdb3
add eax, edx
mov dword [esp], 0x5033a6b1
inc dword [esp + 1]
push 0xcc2a6f38
mov dword [ebp - 4], eax
jns 0x1017cee5
push 0xc4a47f98
inc ebp
mov eax, dword [edi]
inc word [esp + 4]
inc ecx
mov edi, dword [edi + 4]
jle 0x1010d5c8
push ebx
mov ebx, 0x401e212a
mov ebx, dword [esp + ebx - 0x401e212a]
mov dword [esp], 0x880d027b
call fcn.1013e1a2
xor dl, bl
bt eax, eax
not dl
btc eax, eax
xchg ah, al
inc dl
ror eax, 0xbf
call fcn.101290d8
mov ecx, 0x4dbfdd9e
mov edx, dword [edi + ecx - 0x4dbfdd9e]
sal cl, 0xe6
mov ecx, dword [edi + ecx - 0x4dbfdd7c]
mov eax, 0xf6153e9c
shr eax, 0xaf
adc edx, ecx
add al, 0xa7
setno al
mov dword [eax + edi - 0x1ebfd], edx
mov edx, dword [ebp + eax*4 - 0x7b004]
lea ebp, [ebp + eax*2 - 0x3d7fe]
btr eax, eax
xor edx, ebx
mov ecx, eax
sal al, 0x87
neg al
xor edx, 0x3594ebbb
and eax, 0xcf20b215
sub ax, 0x851d
rol ax, 0xca
rol edx, 2
cwde
inc ecx
sar al, 0x66
not edx
neg edx
add ax, cx
lea edx, [ecx + edx + 0x3e1527ba]
shl ecx, 0xd4
sar cl, 0x61
not edx
cbw
xor ebx, edx
add eax, 0xc8398d19
adc al, 0xab
adc esi, edx
add ecx, 0x6700429c
push ecx
mov eax, dword [ecx + edi - 0x27204298]
inc cx
mov cl, byte [edi + ecx*2 - 0x4e408532]
mov edx, dword [esp]
inc edx
sal dword [esp + edx - 0x2720429d], 0x21
shr eax, cl
and edx, edx
call fcn.1025e869
mov dword [esp], 0x50e1d02
lea esp, [esp + 0xc]
je 0x100bfc16
ror dl, 1
dec eax
lea eax, [eax + eax*4 - 0x5960f2ed]
xor dl, 0xa
sub al, 0x13
imul eax, eax
or ax, 0x6bbd
dec dl
not al
xor bl, dl
btr eax, eax
shr eax, 0xb9
add edx, esp
dec ax
btc eax, eax
sbb eax, eax
mov dword [edx + eax*8], ecx
shr eax, 0x9b
xor eax, dword [esi + eax*8]
add esi, 4
mov edx, 0x32b904bf
xor eax, ebx
bswap edx
sal dl, 0x21
neg eax
movsx ecx, dx
push ecx
bts ecx, edx
inc eax
xor eax, 0x7f857f1d
btr cx, cx
and edx, 0xabb3e721
bswap eax
sbb eax, 0xda2bb52c
xchg byte [esp + 1], dh
xor ebx, eax
and edx, edx
adc edi, eax
sar dx, 0xe
xor dl, ch
jo 0x102915cf
pop ecx
jmp edi
Function at 0x1009cd30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [esp + eax*4 - 0x29c], eax
sub dl, 1
not dl
mov dword [esp + eax*4 - 0x2a0], eax
not word [esp + eax*2 - 0x14b]
ror dl, 1
xchg dword [esp + eax - 0xa5], eax
sub dl, 0x9c
imul eax, eax
cwde
not dl
jb fcn.1026ea15
test byte [ebx + ebx*2], al
invalid
xor bl, dl
lea ecx, [eax + eax*8 + 0x799392be]
btc ecx, ecx
lea edx, [esp + edx + 8]
call fcn.101d84de
and eax, 0x28eff7b4
mov eax, es
mov esi, 0xf799392
mov ebx, 0x14548dc9
or al, ch
mov bh, 0x13
add byte [0x28eff7b4], ah
daa
imul eax, ebp, 0xffffffbc
mov ebx, 0xc56b3b2c
mov esp, 0x6b133caf
lds edi, [ebx + edi*4 + 0x58785f10]
pop ebx
push cs
insb byte es:[edi], dx
push 0xb739549c
or ebp, 0xa862017c
sub dword [esi + ebp*2], esi
mov dl, 0xaf
and dword [edi + 0x66ac210c], eax
push edx
outsb dx, byte [esi]
sti
mov word [ebp + 0x44], cs
pop ecx
push esi
or dword [edi], esp
xor bh, byte [ebp + 0x34]
les ebx, [ebx - 0x29]
mov bl, 0x1a
in eax, dx
push ds
jo 0x1009cd66
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
sub byte [ebx + eax*2], 0x1b
int1
nop
jns 0x1009cd4e
dec ebp
invalid

Function at 0x100ae237
Capabilities:
Encode data using base64

Disassembly:
pop ecx
pop ecx
pop ecx
pop edx
jmp fcn.101b9510

Function at 0x100af627
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x41bd8296
mov cl, byte [ebp + edx - 0x41bd8294]
sub byte [esp + edx - 0x41bd8290], 0xb3
mov dword [esp + edx - 0x41bd8296], 0xef1c65aa
seta dl
sal al, cl
mov word [ebp + edx - 0x41bd81fe], ax
movsx eax, word [esp + edx - 0x41bd81fc]
movzx ecx, dx
ror dword [esp + edx - 0x41bd81fc], 0x3f
mov eax, dword [edx + edi - 0x41bd8200]
sub ecx, 0xba2f2c07
adc dword [esp + ecx - 0x45d155f6], edx
not edx
xor eax, ebx
sub dword [esp + ecx - 0x45d155f7], 0x5d930b13
imul edx, edx
bswap eax
sar dword [esp + ecx - 0x45d155f5], cl
imul edx, dword [esp + ecx - 0x45d155f9]
ror eax, 3
ror cl, 3
xor dword [esp + ecx - 0x45d1553f], edx
adc cl, byte [esp + edx - 0x53f60da8]
xor eax, 0xb43fad
ror cx, 0x88
rol eax, 2
add dword [esp + edx - 0x53f60da8], ecx
not dx
not eax
pop edx
rol ecx, 0x15
rol eax, 1
bswap eax
and cl, byte [esp + 2]
or edx, dword [esp]
lea edx, [edx*4 + 0x26314d9c]
neg eax
shr ecx, 0x82
xchg byte [esp + ecx*2 - 0x65545cfe], dh
lea eax, [eax + ecx*2 - 0x20cc6bfc]
sal edx, 0x10
xor ebx, eax
add edx, edx
adc esi, eax
pop edx
or edx, 0x293bb0a0
movsx eax, dx
mov cx, word [ecx + ebp - 0x32aa2e7e]
cbw
cwde
adc ebp, 4
push eax
cwd
xor eax, eax
add al, byte [edi + eax*2 + 4]
not dword [esp]
shl dl, 0x21
adc edi, 4
shl byte [esp + 2], 0xa6
sal dx, 0x24
xor al, bl
xchg dword [esp], edx
push edx
ror al, 1
rol dx, 0xae
rol edx, 0xe1
xor al, 0x9d
ror dl, 0xa5
rol al, 1
sar edx, 0x75
shl dx, 0x2a
jp 0x1014430d
or dword [esi + 0x6720eff4], ecx
push ecx
invalid
Function at 0x100c3b82
Capabilities:
Encode data using base64

Disassembly:
ror dl, 1
mov dword [esp + eax - 0x1fd5], 0x1a3d11be
cwde
xor dl, 6
bswap ecx
xor bl, dl
inc cl
xor cl, ch
mov word [ebp + eax - 0x1fd5], dx
shr cl, 0x85
mov eax, dword [eax + esi - 0x1fd3]
call fcn.101e1bf5
adc edi, 4
inc dword [esp]
jne 0x100ca03c
mov edx, 0xf5219b8b
lea ecx, [edx*4 - 0x63e1b9da]
mov eax, dword [ebp + ecx - 0x70a4b452]
bswap edx
imul edx, ecx
and ecx, edx
mov edx, dword [ebp + ecx*2 - 0x610848a0]
sahf
not cx
lea ebp, [ebp + ecx*2 - 0x6109b756]
and ecx, 0x5f124dad
btr ecx, 0xa0
btr cx, cx
and eax, edx
sar ecx, cl
lea edx, [ecx + ecx*4 + 0x280eff95]
not eax
ror dx, cl
mov dword [ebp + ecx*4 - 0x40010], eax
bswap ecx
call fcn.1008a416
mov al, byte [0xf856bd40]
mov bh, 0xcf
or al, 0xd4
leave
idiv dword [ebx]
mov bl, 0x48
aam 0xc9
idiv edi
mov bl, 0xf6
jbe 0x100c3be2
out 0x69, al
mov cl, 0x16
fdivr st(7)
jmp 0x100c3ca1
adc al, byte [eax]
add byte [eax + 0x63], cl
dec eax
arpl dx, dx
dec edi
lea ebp, [esi + eax - 0x4573655b]
dec edx
invalid
mov esp, 0xed570024
ret
xor eax, ebx
jmp 0x10100214
rol eax, 3
bswap eax
shl word [esp + 1], 0x49
push 0xe5b7b691
jb 0x101dbae2
lea ecx, [edx - 0x625da94c]
dec eax
dec dl
rol dword [esp + edx - 0xfc], cl
push ecx
xor ebx, eax
or byte [esp + edx*4 - 0x3f5], dl
adc edi, eax
rol edx, 0x5e
jae 0x1022689a
pop ecx
pop eax
pop edx
pop ecx
jmp edi
dec esp
lea esi, [edx*2 - 0x39f42fe0]
dec ecx
adc edi, 5
jmp fcn.10092292
sal dword [esp + 4], 0x84
ror eax, 3
xor eax, 0xbc24c5a2
sub eax, 0xe7b4aeb2
neg eax
jmp 0x1022b8fc
sbb eax, 0x468c2daf
jmp 0x10126465
xor dl, cl
xor bl, dl
add edx, esp
not cx
bts ecx, eax
adc al, 0xa1
mov ax, word [ecx + edx - 0x626e7700]
lea edx, [ecx + ecx - 0x2757865d]
lea ebp, [ebp + ecx - 0x626e7702]
mov word [ebp + ecx - 0x626e7700], ax
xor cx, dx
movzx eax, cx
jns fcn.101684c6
dec ecx
mov eax, dword [edi]
inc ecx
mov ebx, 0x45b440b5
inc bp
bts ebx, ebx
inc si
mov ebx, dword [eax + ebx - 0x45b440b5]
mov edx, 0xcdbf37a6
jb 0x10101141
mov ecx, dword [esi]
mov eax, 0xa30c843d
movsx edx, ax
call fcn.1011d5a1
xor ecx, 0x3e9ac199
xor dx, 0xe796
neg dx
setp al
bswap ecx
push edx
neg ecx
imul eax
cwde
jno 0x1020a26c
xor eax, 0x901fdba8
notrack jmp 0x101f8f47
push cs
lcall 0xc363, 0xc9ec453
jmp 0x80e9c20a
xor ebx, ecx
add esi, ecx
mov dword [esp + edx], esi
ret
xor ebx, edx
and dword [esp], 0x923af813
adc edi, edx
movzx edx, word [esp]
shl edx, 0x26
xadd al, cl
movzx edx, byte [esi + edx*8 - 0x1100000]
pop ecx
adc esi, 1
xor dl, bl
btc ecx, eax
sbb dl, cl
inc eax
ror dl, cl
not cl
cbw
sub dl, al
xadd ecx, eax
jb 0x101f8e9f
xor ebx, eax
shr word [esp + 4], 0x45
call fcn.1004b8e0

Function at 0x100da291
Capabilities:
Encode data using base64

Disassembly:
ror eax, 1
lea ecx, [edx + edx - 0x554b15fa]
mov dword [esp], ecx
neg eax
add word [esp + 1], cx
jb 0x10182cd5

Function at 0x100db756
Capabilities:
Encode data using base64

Disassembly:
ror dword [esp + eax - 0x5b1df775], 8
xor dx, 0x440d
push eax
neg dx
add ax, word [esp + eax - 0x5b1df770]
Function at 0x100f3622
Capabilities:
Encode data using base64

Disassembly:
xadd ecx, edx
movzx ecx, byte [edi]
mov dword [esp], edx
movzx eax, dl
neg edx
xor cl, bl
sub dword [esp + eax*2 - 0x30], 0xf9aeadac
btr eax, edx
adc cl, 0x98
mov word [esp + edx - 0x5ac923e7], ax
rol edx, 0x99
not cl
xadd byte [esp + eax - 0x18], dl
adc cl, 0xf
rol cl, 1
jmp 0x1020dfeb

Function at 0x100fb0ce
Capabilities:
Encode data using base64

Disassembly:
push 0x16bd8923
lea esp, [esp + 0x18]
je 0x101e06ef

Function at 0x100fb86c
Capabilities:
Encode data using base64

Disassembly:
neg ecx
xor ecx, 0xbf8504a0
jmp 0x1027adc1
xor edx, ebx
mov dword [esp + eax - 0x1315b4a1], 0x728850e
xor dword [esp + eax*2 - 0x262b6942], eax
setae byte [esp + eax - 0x1315b4a0]
not edx
pop eax
ror eax, 0x56
xor edx, 0x4125b2bb
inc edx
sal al, 0xc6
rol al, 3
or eax, eax
rol edx, 1
shl ax, 0x61
dec eax
inc eax
adc edx, 0x722e8bbe
inc eax
xor ebx, edx
xor ax, 0xa88a
dec ax
adc edi, edx
movzx edx, byte [esi]
add esi, 1
xor dl, bl
bswap eax
sub al, 0x35
cwde
adc dl, 0x3f
xor al, ah
not dl
xor dl, 0x31
add al, ah
neg dl
xor dl, 0x89
cbw
inc dl
xor bl, dl
push esi
push edi
shl ax, 0xee
push ebx
mov ebx, edx
mov edx, ebx
jp 0x102b2eda
sbb edx, 0x951d5490
neg eax
not cl
sar eax, cl
xor edx, 0xc6293e8e
ror ecx, cl
lea ecx, [ecx*8 - 0x4e50dace]
lea ecx, [eax*4 - 0x2cdf4be9]
rol edx, 1
shl cx, 0x2d
sal cx, 0xe3
xor ecx, 0xce8708af
adc edx, eax
neg edx
xor ecx, 0xd70b9c2d
add ecx, eax
lea ecx, [eax*2 + 0x583e81ba]
add edx, eax
sal cl, 0x44
xor ebx, edx
add edi, edx
btc eax, ecx
jmp edi
xor ebx, ecx
add eax, edx
add esi, ecx
call fcn.10169b54
shl edx, 2
add eax, eax
mov eax, ebp
call fcn.1018431e
push edx
neg eax
xor dword [esp + edx - 0x751c6060], 0x6901279a
xor ebx, eax
add edi, eax
not ecx
add word [esp + edx - 0x751c6064], dx
jno 0x1005094e
and eax, edx
xor ecx, 0xb1aa388d
ror ecx, 3
rol edx, 0xe1
jo 0x100400f5
mov ecx, 0x74334335
movzx eax, cl
mov eax, dword [ecx + edi - 0x74334335]
lea edx, [ecx + ecx + 0x25040bac]
lea edi, [edi + edx*2 - 0x1ad52428]
dec dl
xor eax, ebx
call fcn.10145acc
Function at 0x101001e9
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], eax
dec bx
call fcn.1017d621
push 0x512528b9
imul ecx
mov ecx, 0x5419f519
mov dword [esi + ecx - 0x5419f519], edx
mov dword [ecx + esi - 0x5419f515], eax
call fcn.1016bb76

Function at 0x10106cfc
Capabilities:
Encode data using base64

Disassembly:
sub cx, cx
mov dword [esp + ecx - 0x758e0000], ecx
and ax, dx
movsx edx, cl
btc dx, 0x88
mov word [esi + edx - 0x100], ax
mov eax, dword [ecx + edi - 0x758e0000]
imul edx, dword [esp + edx - 0x100]
cmovno edx, ecx
lea edi, [edi + ecx - 0x758dfffc]
and edx, 0x689eda85
btr ecx, edx
rol dx, 0xea
xor eax, ebx
call fcn.1017e6df

Function at 0x101119bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
xor al, 0x19
mov dword [esp + edx - 0x575da5fc], edx
neg dl
jge 0x101cbed9
shr byte [esp + 2], 0xa3
mov dword [esp], edi
movzx edi, byte [edx]
jmp 0x101c4fd6
xor edi, eax
push 0x7a88cca9
and edi, 0xff
sar dword [esp], 0x79
shl dword [esp], 6
rol dword [esp], 0x69
mov edi, dword [edi*4 + 0x102418f0]
ror word [esp + 1], 0x65
adc dword [esp], 0x8e8c6725
shr eax, 8
ror word [esp], 0x45
push 0xa117831
xor eax, edi
mov dword [esp + 3], 0x101b6513
inc dword [esp + 4]
shl dword [esp + 2], 0x43
inc edx
shl byte [esp], 0x21
xor eax, 0x67a159b7
shl word [esp + 4], 0x61
sar byte [esp + 4], 0xc4
dec ecx
push 0x63a5f0b
jmp 0x1020f563
lea esp, [esp + 0xc]
jne 0x101119da
mov ecx, 0x4423cd85
lea edi, [ecx + ecx*8 - 0x376490fe]
not cx
pop edi
mov edx, 0x630378aa
neg edx
not eax
rol dl, 0xe3
lea ecx, [edx + 0x2315d3f]
mov dword [ebp], eax
imul cx, cx
lea eax, [ecx*2 - 0x377d656f]
cbw
jmp esi

Function at 0x1011435d
Capabilities:
Encode data using base64

Disassembly:
pop edx
lea esi, [esi + eax - 0x40400002]
mov word [esi + eax - 0x40400000], cx
pop edx
push edx
jb 0x1009890e
pop ecx
pop eax
js fcn.10232a4d

Function at 0x1011d2a4
Capabilities:
Encode data using base64

Disassembly:
not dl
xor ebx, eax
call 0x1010bf4a
imul ecx, ecx
xor ebx, eax
and cl, 0x8f
sar cx, 0xeb
adc ebp, eax
mov eax, ecx
and cl, al
sub eax, 0xf4bb0906
jge fcn.101b9510
lea esi, [ecx + esi - 0xfefc]
imul ecx, edx
adc ecx, ecx
sar dl, 0x22
xor eax, ebx
ror eax, 1
bt edx, 0x96
or ecx, 0xd9b8620
adc eax, 0x45b9b297
jmp 0x101e54eb
call fcn.10266152
movzx ax, al
mov edx, 0x3a1f57bc
rol dx, 0x4b
movzx ecx, dx
mov dl, byte [esi + edx*2 - 0x743fc57a]
sar ecx, 0x64
xchg ch, cl
or al, dl
not al
push ecx
pop ecx
mov word [esi + ecx*2 - 0x561c], ax
jmp ebp
Function at 0x1011d966
Capabilities:
Encode data using xor

Disassembly:
bswap eax
neg dword [esp + edx*4 + 0xc]
dec ecx
rol eax, 2
mov dword [esp + ecx*8 - 0x7fd64], ecx
mov dword [esp + edx + 7], ecx
neg cx
adc eax, edx
push edx
rol eax, 1
sar word [esp + edx*2 + 0x12], 0xe8
shl byte [esi - 0x3f], 0x7c
push esp
adc ch, al
rol dword [esp + edx + 0xb], 0xe
not dword [esp + edx + 9]
xor ebx, eax
shr edx, cl
shr cl, 0x65
add dword [esp + edx*4 + 0x10], 0x4b8c172a
add edi, eax
mov cl, byte [esi + edx*2]
lea edx, [edx*2 - 0x2e511864]
add esi, 1
movsx eax, dl
sal edx, 0x3c
js 0x1021a5c6
cli
stosb byte es:[edi], al
mov dword [0x1a40e18], ebp
sub al, 0x41
inc edx
pop ecx
mov eax, 0x5a412c01
cmp ebx, esp
add dword [ecx + eax*2], ebp
sub al, 4
mov esi, 0x29bec8a4
dec eax
salc
enter 0x7d30, 0x4a
jg 0x1011d982
pop eax
rcl byte [edx - 1], cl
dec edi
invalid
xor cl, bl
xchg dword [esp + 4], eax
add eax, 0x1399af
jmp eax

Function at 0x1011e5f9
Capabilities:
Encode data using base64

Disassembly:
shr eax, 0xb5
jne 0x10114286
xor ebx, ecx
bt eax, eax
adc ebp, ecx
or ax, dx
mov si, word [eax + esi - 0x172]
neg edx
jp fcn.101b9510
mov eax, 0xe4ae5f31
mov ecx, dword [esi]
call fcn.100ae99b
movzx ecx, ax
mov ecx, dword [edi + ecx*4 - 0x14874]
neg eax
inc eax
xor ecx, ebx
lea ecx, [eax + ecx + 0x28597a24]
ror ecx, 1
lea edx, [eax + eax*8 + 0x19200b83]
sal edx, 0x7d
neg ecx
ror ecx, 2
jmp 0x100aed79

Function at 0x10128fa0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0xe0dfecfa
lea esp, [esp + 4]
call fcn.102088ad
mov edx, 0x85280781
call fcn.10230665
inc ecx
mov eax, 0xf98e0d87
inc ebp
movzx esp, ax
inc ecx
mov eax, eax
dec edi
mov edx, dword [edi - 0x361c]
movsx esi, al
dec ebp
lea ebp, [eax + eax*4 + 0x41015d23]
dec ecx
xchg esp, eax
dec edx
mov edi, dword [eax + edi - 0xd7f]
inc esp
movzx esi, ax
dec esp
add edx, edi
dec eax
bswap esi
inc ecx
dec esi
dec ebp
mov dword [edi + eax*2 - 0x1b06], edx
inc ecx
mov ecx, dword [esi + ebp - 0xd8a]
dec eax
lea ebp, [ebp + eax*2 - 0x1b12]
inc ecx
xor ecx, ecx
sal ax, 0xeb
dec ecx
and eax, ebp
inc bp
sbb ebp, eax
lea ecx, [ecx + eax + 0x33157407]
dec ebp
sbb esp, eax
xor ecx, 0xc99710a
inc cx
sar ebp, 8
dec ecx
imul ebp
sbb ecx, 0xab2cba18
bswap ecx
call fcn.1012bd4a
xor ebx, eax
push ecx
mov dword [esi + ecx*2 - 0x43782172], eax
lea eax, [ecx + ecx*4 - 0x21f35562]
add dl, ch
mov ecx, dword [edi + ecx - 0x21bc10b3]
bt edx, edx
sbb edi, 0xfffffff7
xor ecx, ebx
imul word [esp]
shr edx, 4
xor ecx, 0x3c0e7803
dec ecx
bts edx, 0xe
or ax, 0xbc9a
bswap ecx
xor dl, al
bt edx, eax
rol ecx, 2
not eax
xchg dword [esp + eax - 0x79470260], eax
xor ebx, ecx
add ebp, ecx
mov ecx, dword [esp + edx - 0xf63ef61]
mov eax, dword [esi + edx - 0xf63ef65]
dec cx
neg dx
sub cx, 0xd282
mov edx, dword fs:[edx + eax - 0xf63109f]
bt ecx, ecx
btr cx, cx
movzx eax, cx
mov dword [esi + eax*2 - 0x1fbe], edx
mul ecx
sal dl, 0x26
lea esi, [esi + ecx - 0x79470fe1]
push edx
inc eax
shr cl, 0x24
pop eax
pop edx
jnp fcn.10232a4d
Function at 0x101290d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dl, 1
mov dword [esp], eax
call fcn.1016a3ed
mov edx, 0xfa79812
mov edx, dword [ebp + edx*2 - 0x1f4f3024]
add ebp, 4
mov eax, 0xc0993022
xor edx, ebx
rol edx, 3
inc edx
neg edx
bswap eax
add eax, eax
rol edx, 2
lea ecx, [eax + eax*8 + 0x20097f09]
imul cx, ax
setb al
xor ebx, edx
rol eax, 0x53
lea eax, [eax + ecx*8 + 0xa940dad]
add cl, 0x2e
adc esi, edx
movzx dx, byte [edi]
btr cx, cx
mov cl, byte [edi + 2]
or al, ah
adc edi, 2
shr eax, 0x1b
call fcn.10084487
mov edx, 0xa62e2d17
lea ecx, [edx*8 + 0x1223b984]
mov ecx, dword [ebp + ecx - 0x4395223c]
dec dx
push edx
pop eax
add ebp, 4
btc edx, 0x97
ror eax, 0x97
Function at 0x1013e1a2
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10176b6a
push ecx
mov ecx, 0x51a6c339
push edx
movzx edx, cl
not ecx
pushfd
sal edx, cl
push eax
sbb ecx, edx
push esi
push ebp
movsx esi, dx
lea eax, [ecx*8 + 0x592a5021]
push edx
mov eax, 0
btc cx, 0x86
neg word [esp + edx*2 - 0x1c80]
sub ecx, 0x1aee2a1
mov dword [esp + edx*4 - 0x38fc], eax
setle cl
or byte [esp + edx*2 - 0x1c7e], cl
mov dword [esp + edx - 0xe40], edi
sal esi, 0x1d
mov edi, dword [esp + edx - 0xe20]
btc dx, 0x85
sar esi, cl
imul ecx, ecx
not edi
jo 0x1016c1bb
jmp 0x1021b47f
call fcn.1010cb69
mov eax, 0x3110e315
mov eax, dword [edi + eax*2 - 0x6221c62a]
jmp 0x101b49c4

Function at 0x10144245
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jle 0x1019dda7
xor bl, cl
inc edx
ror edx, 0x31
adc ecx, esp
and dx, dx
btc edx, edx
jae 0x102446b1
jae 0x10299b71
mov byte [ecx + edx - 0x4800b366], al
jmp esi
Function at 0x10146e07
Capabilities:
Packed with generic packer

Disassembly:
jmp esi
mov dword [esp + eax + 4], 0x121ac407
add esi, ecx
movzx edx, byte [ebp + eax*2]
mov ecx, eax
btc ecx, 0x84
lea ebp, [ebp + eax + 1]
adc dword [esp + eax*2 + 5], 0xc9bc479c
xor dl, bl
dec ax
dec ecx
add dl, 0x1b
ror dl, 1
xor dl, al
shl eax, cl
rol eax, 0x2f
add dl, al
push ecx
xor eax, dword [esp + ecx*4 - 0x30]
xor bl, dl
sub byte [esp + ecx - 0xc], al
lea edx, [esp + edx + 0x10]
jg 0x1024181d
mov eax, dword [edx + ecx*4 - 0x3c]
mov edx, dword [esp + ecx*8 - 0x6c]
inc edx
lea edi, [edi + ecx - 0x13]
inc word [esp + ecx*2 - 0x1e]
add ecx, 0xd9992f13
mov dword [edi + edx*4 - 0x328], eax
inc ecx
pop ecx
pop eax
pop eax
pop edx
jle fcn.1023c514
mov edx, dword [ebp]
mov ecx, dword [ebp + 4]
add ebp, 4
or edx, ecx
mov ecx, 0xba922914
xor ecx, ecx
movsx eax, cl
not edx
jns 0x1024b303
add esi, 4
mov eax, dword [esp]
movsx edx, ax
not edx
xor ecx, ebx
not ecx
cwde
pop eax
cwde
neg ecx
neg al
rol ax, 0x86
ror dx, 0xec
dec ecx
bt edx, edx
btr eax, 0x36
not edx
xor ecx, 0xf8360983
rol ax, 0x23
xor edx, edx
inc eax
xor ebx, ecx
btr dx, 0x3d
adc edi, ecx
cwde
mov ecx, dword [ebp + edx*4]
shr ax, 0xa9
rol edx, 0xf7
or edx, dword [ebp + edx + 4]
add ebp, 8
btc ax, ax
neg eax
mov dword fs:[eax + ecx - 0xffbd], edx
lea ecx, [eax + eax*8 - 0x39c234e9]
jmp edi
mov dword [ecx + ebp], edx
mov edx, eax
adc ecx, dword [esi + ecx*2]
lea esi, [esi + eax*2 + 4]
xor ecx, ebx
bswap edx
mul edx
ror ecx, 1
or edx, eax
je 0x1026363f
mov eax, dword [edi]
mov ecx, 0x4d29120c
xor cl, cl
lea edx, [ecx + 0x609dc406]
mov ecx, dword [edi + ecx - 0x4d2911fc]
btc edx, edx
adc edi, 8
xchg dh, dl
rol dl, 0x47
mov dword [eax], ecx
bts edx, 0x85
mov ecx, dword [ebp]
bts edx, edx
movsx eax, dl
inc ax
lea ebp, [ebp + eax*4 - 0x1ac]
btc dx, 0x1c
rol edx, 0xaf
bt dx, 9
xor ecx, ebx
not ecx
btr eax, eax
not dx
mul ax
sbb ecx, 0xa3b2b78c
xor eax, 0x280d22a5
bt ax, ax
imul eax
neg ecx
imul eax
cwde
rol ecx, 2
mov bh, 0xb2
mov dword [0xd22a535], eax
sub byte [esi + 0xf], ah
mov dword [0xf7e8f7c0], eax
fincstp
call 0x12e67529
xor ebx, ecx
add esi, ecx
int1
bts eax, eax
mov ecx, edx
jae 0x1004425d
popal
pop ebx
and dword [edx + 0xa0d46f], edx
sub dword [ebp + 0x61e8a6f3], ebp
fldcw word [ebp - 0xf87590d]
sbb dword [ebp + 0x6178a6f3], ebp
leave
lodsd eax, dword [esi]
repe cmpsb byte [esi], byte es:[edi]
enter 0x41c8, 0xffffffffffffffad
repe cmpsb byte [esi], byte es:[edi]
pushal
call 0xb718614b
add byte [eax], bh
loope 0x1024b37b
repe cmpsb byte [esi], byte es:[edi]
add byte [eax], 4
pushal
leave
out dx, eax
call 0xeea8a8a4
jg 0x1024b394
xor dl, byte [eax]
add byte [eax], al
add byte [eax], al
sbb dword [ecx + 0x425f177], esp
and ecx, dword [esi - 0x6a]
sub dword [ebx - 0xa], eax
inc ebx
inc ebp
push 0x834e2b7d
inc ebp
push 0xbfe7b7d
inc ebp
push 0xdb66427d
inc ebp
push 0x1b16737d
inc ebp
push 0xeb7e6a7d
inc ebp
push 0xe346e37d
inc ebp
push 0x4be09a7d
fld qword [ebp + 0x6f92fed4]
aam 0xdf
iretd
sbb ecx, 0x883cafb9
ror ecx, 3