joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101edfcd
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp], edx
lea esp, [esp + 0x10]
jmp fcn.100aa4cf

Function at 0x101ef3a8
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + 0x20], 0x1a2bb38a
not dword [esp + 0x20]
call fcn.10118183
push ecx
pushfd
pop ecx
mov dword [esp], ecx
pop ecx
mov dword [ebp + 4], edi
call fcn.101d1cce
call fcn.1023eb2e
js 0x10198485
call fcn.101e408f
sub edi, ecx
mov ecx, 0xef84cbb6
jmp 0x1019ce5d

Function at 0x101ef564
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + 0x14], 0xfff4d804
sub bp, 0xedaf
add bp, bp
xor bp, 0xa96
nop
mov dword [esp + 0xc], ebp
mov edx, dword [esp + 0xc]
or dword [esp + 0xc], 0x6009ed35
js 0x1013fa23
push ebx
call fcn.101c5267

Function at 0x101f08e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [esp + ebp - 0x5b962f1], 0xff3b550a
add dword [esp + 0x10], 0xfff27157
mov eax, ebp
neg word [esp + ebp - 0x5b962f1]
neg dword [esp + eax - 0x5b962f1]
and ax, ax

Function at 0x101f1352
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, 0x7b95181c
pushfd
and bx, 0xb992
neg ebx
mov dword [esp + 0xc], ecx
push esi
push edx
cmp bx, 0x3d9f
push ebx
add dword [esp + 0x14], 0xf0a74
mov ecx, 0x5f90ca01
xor ecx, dword [esp]
mov esi, ecx
add word [esp], 0xdd2c
push ebx
je 0x10172609
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
neg byte [esp + 4]
shr si, 0xb8
sets bl
mov edx, dword [esp]
and byte [esp + 4], 0xae
lea ecx, [ecx + ebx - 0x3bdbb0f3]
jge 0x101e0e42
mov dword [esp + 0x18], ebx
shl ebx, 0xb8
call fcn.100d5530
push edx
xchg bl, cl
xchg dword [ebp - 0x4690b310], ecx
sub eax, 0x74670bc6
cmp eax, 0x41b7a438
dec ebp
invalid
Function at 0x101f98ac
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x91af7cab
mov dl, dh
pushfd
add dword [esp + 4], 0xbd820

Function at 0x101f9fef
Capabilities:
Packed with generic packer

Disassembly:
neg ebx
call fcn.101ef17b
mov eax, 0xf53a972a
movzx ax, byte [ebp]
mov edx, 0xc102bd08
dec edx
and edx, 0x2030e2a9
mov dl, byte [ebp + edx - 0x9fff]
sbb ebp, 2
jmp 0x1024b3ee
push 0xab12e386
call fcn.101de7fc

Function at 0x101fa055
Capabilities:
Encode data using xor

Disassembly:
call fcn.1017707c
sysenter
push 0x11846cb7
mov ecx, 0x24648dc3
adc al, 0xe9
sbb bl, cl
add eax, 0x83c18100
add ecx, 0x5a8be583
add ecx, 0x5a8be583
mov ebx, 0x64a3aa84
add dword [esp + 0x14], 0xbb8f8
or eax, dword [eax]
add dword [esp], 0xefdc7e92
mov eax, 0xdd8a782f
shr ebx, 0x8e
shr ebx, 0x23
jb 0x1012a542
movzx ax, byte [ebp]
mov edx, 0x11a1c22
sub edx, 0xdd00a015
sar edx, 0x62
adc eax, 0xc1dd00a0
cli
bound ecx, qword [edx - 0x7c096a6c]
out 0xdb, al
mov dl, byte [ebp + edx*4 - 0x24197c0a]
jne 0x1023eaaf
xlatb
je 0x101fa095
sbb ebx, dword [esi]
and dword [eax], ecx
sbb eax, 0xf84cda01
sar dword [esi], cl
sbb eax, edx
xchg ebp, eax
test eax, 0x13383cca
jle 0x101fa08e
loope 0x101fa066
lodsd eax, dword [esi]
mov cl, 0xea
cmp al, 0x28
mov eax, 0x8271c324
jno 0x101fa04a
and al, 0xfc
fcomi st(3)
out dx, eax
add dword [edx], eax
push 0x59d84fdf
xor al, 0xb
sub edx, eax
je 0x101fa0c6
dec ebx
mov ebx, 0x18827037
dec edi
iretd
call fcn.1017328c
sub edi, 1
mov edx, 0xda844902
shr edx, 0xa4
rol dl, 0x24
movzx edx, byte [edi + edx*2 - 0x1b508812]
mov ecx, 0x9a386f94
add ecx, ecx
xor dl, bl
ror dl, 1
lea ecx, [ecx + ecx*2 - 0x18de1f7b]
dec dl
neg dl
btc ecx, ecx
xor cl, 0x10
inc dl
call fcn.10235cc2

Function at 0x101fa17b
Capabilities:
Encode data using xor

Disassembly:
push esi
lea ebx, [ebx - 0x4d6aa65c]
shl dword [esp + 0xc], 0x47
lea edi, [edi + ecx*2 + 0x55a86f9d]
or ecx, ebx
push edx
mov ecx, dword [esp + ecx + 0x1013c917]
mov dword [esp + 0x10], ecx
je 0x1018c80b
jle 0x102506d2

Function at 0x101fc0b2
Capabilities:
Encode data using base64

Disassembly:
call fcn.101bfeaf
mov dword [esp + ebx*2 + 0x3f91d7de], esi
push ebp
jns 0x101ac903

Function at 0x101fef34
Capabilities:
Packed with generic packer

Disassembly:
not dword [esp + 0xc]
add dword [esp + 4], 0xc360c
mov edx, edi
neg dword [esp + 0xc]

Function at 0x101fef6a
Capabilities:
Packed with generic packer

Disassembly:
sub edx, 0xa82eab9b
not edx
mov edx, dword [esp + 4]
call fcn.100ad590
mov dword [esp + 0x10], 0xceff56ed
mov ebx, dword [esp + ebx + 0x586b1bdc]
mov edx, 0xb93d33ad
movzx dx, dl
or dx, 0x4313
and dx, 0xe6ab
lea edx, [edx + edx*4 - 0x254125c7]
setge dl
jne 0x100ed40a
Function at 0x10202986
Capabilities:
Encode data using xor

Disassembly:
jb 0x100de8ea
mov esi, 0xdca74a9a
mov edi, dword [esp + esi + 0x2358b57a]
mov dword [esp + 0x14], eax
test word [esp + esi + 0x2358b572], si
push ebx
mov si, word [esp + esi*2 + 0x46b16ade]
mov ebp, esi
je fcn.100feac3
add dword [esp + 0x14], 0xfff37323
mov ebx, dword [esp + esi*2 + 0x46b19010]
lea ebx, [ebp + esi + 0x2d19bb94]
bswap ebx
mov eax, dword [esp + esi*2 + 0x46b19010]
mov eax, dword [esp + eax - 0x3800bbec]
mov eax, dword [eax + ebp + 0x2358c800]
shl ebp, 0x6a
call fcn.101474a5
mov eax, 0x9a221b0e
lea eax, [eax + eax*4 - 0x4975c261]
neg eax
mov eax, dword [ebp + eax - 0x46cb3b1b]
mov edx, 0x63a6793d
movzx dx, byte [edx + eax - 0x63a6793d]
call fcn.10100da5
mov ebp, 0x8b904389
xor bp, bp
mov edx, ebp
mov ebp, dword [edi]
jno 0x1023f765
jl 0x10173ec2
not dl
mov edx, 0x901c4b88
neg edx
push ebx
call fcn.101d9e94
and byte [esp + 0x10], 0xb6
mov dword [esp + 0xc], ebp
cmp byte [esp + 0x10], 0x27
movzx ebp, bp
lea esp, [esp + 0x18]
ret
lea ebp, [ebp + edx - 0x43a37f8f]
test edx, 0x858aad02
jne 0x1022401c
call fcn.10136b8f
js 0x100b1bf0
call fcn.1024e22c
mov edx, 0x640f0905
or dl, dh
mov edx, dword [esi + edx - 0x640f090d]
push 0x6f03de2c
push 0x34234a30
adc esi, 4
push 0x9bb67b08
xor edx, ebx
rol byte [esp + 8], 0xc7
call fcn.10228df8

Function at 0x10202ca6
Capabilities:
Packed with generic packer

Disassembly:
jg 0x102413ae
call 0x100f9b5a

Function at 0x10204f88
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + edx*2 - 0x20239bcc], ebp
mov ebx, dword [esp + 0x20]
not esi

Function at 0x1020c8b3
Capabilities:
Packed with generic packer

Disassembly:
push esi
call fcn.101a3fec
shr dword [esp], 0x81
push ecx
mov ebp, dword [esp + ebp - 0x14012a00]
mov dword [esp + 0x10], edi
lea ecx, [ecx*2 - 0x7e5658d8]
push ecx
jns 0x10105ae9
mov edi, 0x2f9ab8bc
mov dx, word [esi + edi*2 - 0x5f357178]
mov di, word [esi + edi - 0x2f9ab8ba]
mov ecx, 0x39121aab
rol ecx, cl
add ecx, 0x4f3029b8
mov cl, byte [esi + 4]
adc esi, 4
jmp 0x102560d8
jg 0x101789e0
inc ecx
mov ecx, 0xfe1a0309
inc ebp
or ecx, ecx
dec ebp
mov ecx, dword [esi]
push 0x2eb9ca94
push 0xe3b500f
call fcn.1014f503
jbe 0x101cdd7c
or word [esp + 0xc], si
xor dword [esp + 0xc], 0xfa8d886
test esi, esi
mov esi, dword [esp + 0x1c]
not byte [esp + 0xc]
call fcn.101f40c2
mov eax, 0x4b3ba405
movzx edi, al
add ax, di
movzx eax, byte [ebp + edi*2 - 0xa]
js 0x10235702
shrd dx, di, cl
call fcn.10227791
Function at 0x102124b5
Capabilities:
Packed with generic packer

Disassembly:
and al, 0xc
sbb al, 0x11
cdq
xchg esi, eax
add bh, bh
loop 0x1021251c
invalid
inc dword [esp + 6]
jge 0x10221ddb
call fcn.101624f2
fisttp word [eax - 0x49]
adc dh, byte [edx]
popal
mov bl, 0x5a
insd dword es:[edi], dx
inc ebp
jp 0x1021252f
stosd dword es:[edi], eax
fsub qword [esi]
cmpsd dword [esi], dword es:[edi]
shr byte [ebx + edi*4 - 0x2dc6a142], 0x69
push cs
pop esp
div byte [eax + ebx*2 - 0x49]
in eax, dx
mov esi, 0xc5c38d57
and bh, byte [eax]
stosd dword es:[edi], eax
and eax, 0xea8e3517
jnp 0x1021249d
mov bl, 0x89
cmp dl, byte [edx - 0x737400f8]
jge 0x1021251d
mov cs, word [ecx + ecx*8 - 0x53ae51da]
cld
cmpsd dword [esi], dword es:[edi]
and eax, 0xb88fb374
imul ebp, eax, 0xa6818946
mov dl, 0x42
inc edx
mov dl, 0x35
cmpsd dword [esi], dword es:[edi]
sub dword [edi + 0x25cd2810], 0xfaf41f0d
jne 0x102124b2
hlt
movsd dword es:[edi], dword [esi]
xor dword [eax], 0xa74de106
xor byte [esi], al
loope 0x10212580
cmpsd dword [esi], dword es:[edi]
lds esi, [eax + 0x93c1b3f]
leave
pop edx
or byte [ecx - 0x4a], al
into
xchg ecx, eax
jl 0x1021254f
mov dword [0xe7d49ec9], eax
aas
loope 0x10212529
pushal
push ss
push edi
mov ah, al
xchg ebx, eax
in eax, dx
inc ebp
dec ecx
pop esi
les edx, [ebx + 0x5e4945ed]
and esi, dword [ebx - 0x35]
mov ebx, 0x18873f49
adc bh, byte [edx + 0x769c70c3]
popal
hlt
fcmovnu st(0), st(4)
invalid
test al, 0x9f
xchg ebp, eax
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
jp 0x10212549
xor eax, 0xa8d4e49d
out 0x86, eax
xchg cl, cl
dec ecx
push edi
mov bl, 2
xchg esi, eax
and ch, bh
jbe 0x10212611
inc esi
and al, 0xce
fdiv dword [ebx + 0x12]
sbb eax, 0xef9c5492
or byte [ebx + 0xcab8af0], dh
jo 0x10212571
dec ebx
jne 0x102125f6
hlt
ja 0x10212605
lds edx, [ebx - 0x76512b5e]
xchg dword [ecx + 0x34], ecx
lcall 0xeb90, 0x319ca8ab
cmp dword [edi + ebx], esi
xor dword [eax + 0x1f3439eb], edx
sbb eax, dword [ebx + 0x2c]
mov bl, 0xe
scasb al, byte es:[edi]
adc al, 0xc2
jnp 0x102125b1
bound ecx, qword [ecx - 0x7b]
jmp edi
sub esi, 4
push 0x86aecdbe
call fcn.101de1b6

Function at 0x102131dd
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx + 0x44], cl
sbb byte [ebx - 0x6b], ah
xor edx, ebx
pop ss
pop ebx
invalid
dec ecx
lahf
mov esp, ebx
movsd dword es:[edi], dword gs:[esi]
xchg edx, eax
jp 0x10213134
wait
adc eax, 0x4d
push 0x8bfce35d
test byte [esi], al
xchg edx, eax
pop ss
retf 0x2084
and al, 0x23
push ecx
inc ebx
movsb byte es:[edi], byte [esi]
fnstsw word [ebx + 0x22f0a76a]
sub bh, bl
jle 0x10213145
call 0x8b2a7c86
fsub st(0), st(0)
add al, 0xcb
jmp 0x2c26f9ca
neg dword [esp + 0x10]
xor bx, dx
sub esi, 2
call fcn.101ce3ce
mov ah, 0xe
inc ecx
mov eax, 0x3c195be0
xchg ebx, eax
jmp 0x102131ae
Function at 0x102195fa
Capabilities:
Packed with generic packer

Disassembly:
and dword [esp + ebp + 0x1b743b62], 0x2f10ee8e
lea eax, [edx + edi*2 - 0x62f0d1d0]
not word [esp + edx + 0x4a73df51]
mov eax, dword [esp + ebp + 0x1b743b7a]
mov eax, dword [eax + edx + 0x4a73df45]
jg 0x101e6e76

Function at 0x1021c315
Capabilities:
Encode data using base64

Disassembly:
push edx
mov edx, 0xf190b0aa
test edx, 0xa8050103
mov dword [esp + edx*4 + 0x39bd3d6c], eax
call fcn.100e6a2a

Function at 0x1021ca5e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
pushfd
mov edx, 0x9f1282b1
lea edx, [edx*2 + 0x692c92b9]
neg dx
mov esi, dword [esp + edx + 0x58ae982b]
push 0xb83c708f
je fcn.1020d8b6
call fcn.101a8bc1
push edx
add cl, 0x88
je 0x101cc96e
jl 0x1013bbdc
pushfd
mov dword [esp], 0x875883f0
call fcn.10197188

Function at 0x1021d933
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], ebp
push ebx
push dword [esp + ebp - 0x61353d04]
popfd
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + ebp - 0x61353d20]
lea esp, [esp + 0x28]
ret
movzx edx, byte [ebp + edx*2 - 0x273e472a]
add ebp, 1
lea edi, [edi*8 - 0x2aed4d6a]
xor dl, bl
not dl
ror edi, 0xdb
inc dl
ror di, 0xed
not dl
push edi
ror dl, 1
rol byte [esp + 3], 0xa6
inc dl
inc edi
bt edi, edi
adc edi, edi
not dl
xadd word [esp + edi - 0x44aa7db0], di
mov dword [esp + edi - 0x44aa3ed7], edi
xor bl, dl
shr edi, 0xaa
call dword [ebx]
push esi
shl byte [esi + 0xf], cl
sar dword [esp + edi - 0x44aa7db0], 0x89
mov esp, 0x55c1293c
mov ebx, 0xefc1da32
stosb byte es:[edi], al
lea edx, [esp + edx + 4]
call fcn.101a58cb
jnp 0x101f6a39
neg ax
xor dword [esp + 4], 0xdfb4b234
call fcn.101ea874
push eax
test dword [ebp - 0x7f], 0xb3cc813a
scasd eax, dword es:[edi]
out dx, eax
loop 0x101b9daa
push esi
in eax, 0x3f
sub edi, 0x3d
xor ch, byte [ebp + 0x51bfc5ca]
lahf
add esi, 0x21
je 0x101b9d67
lds edx, [eax]
das
cmp ch, ch
mov al, byte [0x1f2f2675]
enter 0x14c1, 0x23
sub dl, byte [edx - 0x7b]
mov al, 0xa9
jnp 0x1024a259
sbb al, dl
ror al, 1
xor bl, al
push edi
xchg bp, dx
push ebx
mov ebp, esi
and edx, edx
movsx ebx, dl
mov ebx, eax
mov eax, 0xd33a048e
mov edx, ebx
call fcn.100f43e3
mov ch, 0x81
int3
mov ebx, 0x510c1114
lea ebx, [ebx + ebx - 0x4f45be69]
add dword [esp + 8], 0xefed1951
shl ebx, 0x13
push ebp
mov ebp, 0x61353d28
add dword [esp + 0x10], 0x4afb4
shl ebx, 0xd4
mov edi, 0x5f878e17
and ebx, 0xc397a191
add dword [esp + 0x18], 0xefe6729f
push ebx
not ebx
mov edi, dword [esp + edi - 0x5f878e03]
mov edi, dword [edi + ebx + 1]
and word [esp + ebx + 1], bp
sub bx, bp
jb fcn.10223fdb
not ebx
mov dword [esp], 0xb53b0801
cmp word [esp + ebp - 0x61353d28], 0xf494
lea edi, [edi + ebp - 0x49855e09]
setle byte [esp]
jno 0x10138d9f
mov edx, 0x139f2395
movsx edi, dl
jmp 0x101b9d36
push 0x56372f0b
mov dword [edi], ebp
call fcn.10185075
Function at 0x1021e57c
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jg 0x1015ae73
shl byte [esp + 0x18], 0x67
mov esi, dword [esp + edi - 0x42ff00e8]
jbe fcn.101f78f3
mov esi, dword [esp + edi - 0x42ff00f8]
neg byte [esp + edi - 0x42ff00f4]
sub di, 0xa10e
bswap edi
sub dword [esp + 0x18], edi
neg dword [esp + 0xc]
mov edi, dword [esp + 0x20]
test byte [esp + 0x18], 0x33
mov word [esp + 0xc], 0x543d
jg 0x10124aed

Function at 0x1021ff58
Capabilities:
Authenticate hmac

Disassembly:
pop edi
call fcn.100ee04f
sysenter
push ebx
call fcn.100fc3e3
sub esi, 1
mov edi, 0xe300af9a
movzx edx, byte [esi]
sar di, 0x2e
bts di, di
xor dl, bl
push edi
inc word [esp + 1]
xor edi, edi
ror dl, 1
ror dword [esp + edi], 0x7b
and dword [esp + edi*2], edi
xor dl, 0xbd
btc edi, edi
sal word [esp + edi - 1], 9
sal word [esp + edi + 1], 0x6b
not dl
and byte [esp + edi + 1], 0x20
rol dl, 1
xor dl, 7
sar dword [esp + edi*8 - 8], 3
push edi
xor bl, dl
sub di, di
xor word [esp + edi + 3], 0xe7bc
lea edi, [edi + edi*8 - 0x697ae660]
lea edx, [esp + edx + 8]
not edi
mov edi, dword [edx + edi - 0x697ae65f]
jp 0x100a5f09
jno 0x1015522b

Function at 0x10220c3f
Capabilities:
Packed with generic packer

Disassembly:
xor byte [esp + 0x24], 8
js 0x10252e25
shr dword [esp + 0x24], 0xc2
push dword [esp + 0x30]

Function at 0x10221e52
Capabilities:
Packed with generic packer

Disassembly:
sub ebp, 0x53aff0bc
or ebp, 0xe0923a23
call 0x10254060
add dword [esp + 4], 0xaabe1
shr ecx, 0xeb
shr cl, cl
neg cx
jbe 0x10166f2e
add cl, 0x8c
push esi
mov ebp, dword [esp + ecx - 0x26680080]
mov ebp, dword [ebp + ecx - 0x2668008c]

Function at 0x102234f4
Capabilities:
Packed with generic packer

Disassembly:
not byte [esp + edx - 0x6a05132c]
not word [esp + edx - 0x6a05132c]
and dword [esp + edx - 0x6a051330], edx

Function at 0x1022375d
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x10], esi
push edx
mov edx, 0xef289929
call fcn.100d6104
push 0x33022e32
push 0x22235d12
lea esp, [esp + 0x14]
jmp fcn.100aa4cf

Function at 0x10223fe0
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
add esi, 2
not cl
call fcn.101b5658
jmp 0x100fce8d
pop eax
mov al, byte [esi + 2]
jmp 0x1021b098

Function at 0x10226687
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 0x10]
pushfd
mov edx, 0x928aef3f
and dl, 0x1f
jg 0x10230937
xor byte [edi + esi - 0x33], ch
push 0x406c7795
lodsd eax, dword [esi]
pop ebx
push eax
push 0x1cb57ff5
xchg esi, eax
push cs
cmpsd dword [esi], dword es:[edi]
sbb eax, ecx
inc ebx
rcr byte [esi], 1
xchg ebx, eax
xchg ecx, eax
lodsb al, byte [esi]
sbb word [edx - 0x20c6d29], sp
mov dh, 0x22
pop edi
fidiv dword [ebp - 0x97a4a3a]
dec edx
aas
xor ch, 0xe1
and edx, 0x798b63a1
not dl
lea eax, [eax + 1]
call fcn.100dd2f6
mov ebp, dword [esp + ebp - 0x5bbe0c65]
cmp byte [esp + 0x44], 0x8e
sete byte [esp + 0x44]
mov word [esp + 0x28], 0xdba
setno byte [esp + 0x44]
add byte [esp + 0x28], 1
test word [esp + 0x28], 0x2b97
call fcn.101ecf5d
Function at 0x10227bb9
Capabilities:
Packed with generic packer

Disassembly:
cmp dx, 0x780b
jb 0x101c5f21
lea ecx, [ecx + 0x62bbedb4]
or esi, 0x1d8f3b8a
neg esi
mov dword [esp + esi + 0x1d8f3c02], esi
mov dword [esp + esi*4 + 0x763cefd4], esi
jae 0x101b9203
shl byte [esp + esi + 0x1d8f3c16], 0xd4
shr esi, 0xb4
or si, si
xchg dword [esp + 0x34], ecx
mov esi, dword [esp + 0x20]
add dword [esp + 4], 0xeff10c75
shl dword [esp + 0x2c], 0xf
test dword [esp + 0x2c], 0xbbaa91c
call fcn.1024bbcf

Function at 0x10228d56
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
lea esi, [esi + ecx - 0x482b3792]
jns 0x10197cc0
jmp 0x1024b9d8
add esi, 2
call fcn.102416bf

Function at 0x10231c39
Capabilities:
Authenticate hmac

Disassembly:
add edi, 2
not al
push 0xedab4729
sal word [esp + 1], 0xe5
not cl
push 0x9520743e
call fcn.1022b1dc
pop edx
pop edx
pushfd
pop edx
mov dword [esp + 8], edx
push 0x8b3e1c1c
call fcn.10203d01
aaa
std
fisttp qword [0xdc1438fa]
aas
test ebp, ebp
mov ebp, 0x7c44088a
pop ss
popfd
jne 0x10197e59
and bl, byte [edi]
xchg esp, eax
inc edx
not byte [edx]
pop es
invalid
pop es
fidiv dword [ecx - 0x28]
test byte [ebx + 0x7e3d6ee6], bh
out 0x65, eax
invalid
and word [esp + ebp + 0x65b97e2], 0x9398
xor ebp, dword [esp + 0xc]
not dword [esp + ebp*2 + 0x553f0db8]
jb fcn.1011cf8f
add ebp, dword [esp + 0xc]
lea edx, [edx + 0x5f3c6b04]
and ebx, dword [esp + ebp + 0x576397e3]
call fcn.102587e9
movzx ax, byte [edi]
mov cl, byte [edi + 2]
jmp 0x10197da2

Function at 0x1023264e
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101e957f
setg byte [esp + edi - 0xa97f337]
jle 0x101243c2
xchg dword [esp + edi - 0xa97f307], edx
mov edi, dword [esp + 0x24]
mov word [esp + 8], 0xfc23
jne 0x10169c25
mov edx, 0xd81d4db4
mov eax, edx
rol dx, 0x27
mov eax, dword [esi]
jae 0x1013957e
ja 0x101d3036
cmp al, 0x8f
cmpsb byte [esi], byte es:[edi]
in eax, 0x89
mov word [eax + ebp*4 + 0xf], ds
jecxz 0x102326b3
mov al, byte [ebp - 0xfe2bcd2]
push es
mov esp, 0xf30e1249
adc dword [esi + eax + 0x76bb21db], ecx

Function at 0x102341c0
Capabilities:
Packed with generic packer

Disassembly:
mov esi, dword [esp + 8]
call fcn.101cc8f3

Function at 0x10234e2e
Capabilities:
Packed with generic packer

Disassembly:
jge 0x10145ece
imul edx, dword [ecx], 2
retf
Function at 0x102356e5
Capabilities:
Packed with generic packer

Disassembly:
xor ebp, dword [edi]
xchg esi, eax
inc si
push es
wait
wait
push ss
mul dh
test al, 0x37
pop ss
cli
cmp byte [esi], bl
jmp dword [ebx]
xor edi, dword [esi - 0x40]
jecxz 0x1023560e
outsb dx, byte [esi]
mov esi, 0x4a0df1a9
mov eax, 0xc215e553
sbb esp, esi
cwde
cmp edi, eax
outsd dx, dword ds:[esi]
jns 0x102355f2
add eax, 0xec7050e2
push edx
push ds
xor eax, 0xf61529dc
and byte [edi + edi*4 + 0x446dae62], dh
push ecx
insd dword es:[edi], dx
xchg al, dl
mov word [edi + 0x7c55e64a], fs
test eax, 0x64609615
out dx, eax
cmp eax, 0xdca9f37b
out dx, eax
mov ebx, 0x39ca317c
jecxz 0x10235650
add dword [ebx], ebp
jmp 0x96fb31b4
fist word [edx]
and edx, dword [0xdcfec19c]
sahf
pop ecx
mov dword [esi - 0x10127db1], ebx
inc esp
jb 0x10235693
sub eax, 0xdcef4935
outsd dx, dword [esi]
dec ecx
sal dword [esi + 7], 1
mov ah, byte [ebx + 0x510db4ba]
pushfd
mov ecx, 0xd4885a1d
pop edx
mov ah, dl
bswap ecx
leave
call fcn.101b5a6e
xchg dword [esp + esi - 0x9a3b8a9], edi
shr esi, 0xf4
xor esi, 0x64944cab
lea esi, [esi + esi*4 - 0x617b75df]
jne 0x1016ccb8
bt di, di
lea ebp, [ebp + edi - 4]
jae 0x1022a6be
inc eax
je 0x102356b4
or eax, 0x9e82173e
lds esi, [ebx]
mov bh, 0x9c
jno 0x102356db
jbe 0x102356df
fisub dword [esi + 0x45]
mov bl, 0x17
sbb al, 0xc1
lodsd eax, dword [esi]
jg 0x10235725
out 0xb5, al
inc ebx
inc edi
dec esp
mov cl, 0x5d
push cs
inc edi
inc edx
int 0x1e
ror ebx, 1
call 0x1b
mov ebx, 0x1762317c
sub al, 0x8a
mov dl, 0x55
insd dword es:[edi], dx
sar dword [edi], 1
cmp al, 0xa6
int1
mov al, byte [0x448a86b6]
xchg ebp, ebp
pop edx
push ebx
aad 0xf5
pop ecx
cmp al, 0x66
mov cl, 0x98
fisubr word [edi - 0x13e81bde]
jp 0x102357b1
invalid
push eax
out 0x75, al
div dword [eax - 0x1c102067]
invalid

Function at 0x1023814c
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 4]
call fcn.100d3327
lea esp, [esp + 0x10]
jmp fcn.100aa4cf

Function at 0x10239315
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
not si
lea esi, [esi + esi*2 + 0x79161f35]
mov eax, dword [esp + 0x10]
and esi, 0x95bf3d2b
shl esi, 0xc9
lea esi, [esi + esi*8 - 0x53d238ca]
add esi, 0x66083588
neg esi
lea eax, [eax + 1]
neg esi
mov esi, 0x3db3fdaa
call fcn.1019c20c

Function at 0x10239a71
Capabilities:
Packed with generic packer

Disassembly:
xadd al, ah
mov edx, dword [esi]
and eax, eax
rol ax, 0x8d
mov dword [esp], eax
mov eax, dword [esi + 4]
jne 0x101116fd

Function at 0x10239eea
Capabilities:
Encode data using base64

Disassembly:
adc ebp, 4
mov dword [esp], 0x490d78b1
xor edi, edi
test ecx, ecx
not byte [esp + 3]
push 0x8b338a90
call fcn.101542f3

Function at 0x1023bb93
Capabilities:
Encode data using xor

Disassembly:
sub esi, 2
ror byte [esp + 7], 0xa6
not ax
not dx
inc dword [esp + 0xc]
neg dword [esp + 0xc]
jl 0x101d1ff0
Function at 0x10240d36
Capabilities:
Encode data using xor

Disassembly:
push ebp
pushfd
mov ebp, 0xe081ac2e
add dword [esp + 0xc], 0xfff49611
push edi
push edx
mov eax, ebp
mov edx, eax
cmp ebp, 0x5128ef0a
push 0x739d0816
push ecx
mov eax, dword [esp + eax*4 + 0x7df94f64]
mov eax, dword [eax + ebp + 0x1f7e53d2]
call fcn.101a990c
mov ecx, 0x8f1df52d
sar ecx, cl
movzx ecx, byte [ebp]
push 0x811991bf
call fcn.1019e41f
cmp dword [esp + ecx + 0x6ef02da9], 0xbe43d7eb
jae 0x10240d82
or al, 0xa9
sub eax, 0xd7eb6ef0
inc ebx
mov esi, 0x20b8f573
insd dword es:[edi], dx
sbb eax, 0x950a8080
mov eax, 0x801d6d20
or byte [edx], 0x95
xor eax, 0x84953a6c
adc eax, 0x8dbeb79d
pop ecx
mov ecx, 0x69c68b37
out dx, eax
mov al, byte [0x181b2135]
xlatb
rcr ecx, cl
out 0x76, al
jns 0x10240d95
push 0x969efbc8
cmp dword [ebp - 0x31], eax
push eax
das
jae 0x10240e26
invalid
cmp dword [edi], edx
lodsd eax, dword [esi]
push esp
mov dword [esi], edx
call fcn.100f9b89
stosb byte es:[edi], al
imul ebx, dword [edi], 7
mov ecx, 0xa73c96da
cmc
cmp dl, byte [edi + edx - 0x2c375de3]
or dword [esi], edx
daa
cvtps2pi mm0, xmm2
aas
sub eax, 0xd84993c3
xchg edi, eax
popal
das
cli
xor byte [eax - 0x72], ah
pop ds
dec eax
push 0xdd8c1cf3
mov dword [esi + ecx*4], edx
daa
sub ebx, esi
and bl, byte [esi]
sbb al, 0x8c
fisttp qword [ecx + 0x29278e14]
and bl, byte [esi]
enter 0xffffffffffffbec8, 0x70
fsubr qword [ecx]
sbb eax, 0x7bd8bd81
xchg ebx, eax
mov eax, dword [0xe17cdbd4]
mov byte [0x32ee1c48], al
cli
xchg edx, eax
sbb bl, ch
add edi, esi
mov eax, dword [0xac6a22b3]
cld
jbe 0x10240e66
shl ch, 1
xlatb
stosd dword es:[edi], eax
mov cl, 0x9c
fisubr dword [ebp + 0x2cb6e630]
mov edi, 0x5ffb444d
test al, 0x16
arpl word [edx - 0x7f], bp
mov ebp, 0x33d76f58
jne 0x10240ec7
sbb eax, 0xa1574407
mul ecx
invalid
mov ecx, 0x8fdf1971
adc eax, 0x98bffce6
outsb dx, byte [esi]
sub byte [eax - 0x7ee4b463], dh
push ss
inc esp
mov word [ecx - 0x2938a38e], gs
invalid
cld
mov edi, 0xb0286e98
popfd
dec ebx
sbb eax, dword [ecx - 0x5673bbea]
jb 0x10240f20
invalid
jae 0x10240f40
je 0x10240e4e
lock sub esi, dword [0xe67969b2]
lodsd eax, dword [esi]
loopne 0x10240f54
inc edx
cmpsd dword [esi], dword es:[edi]
xchg byte [ecx], ah
pop ebx
test eax, 0xa3a21cee
cmp byte [ecx], ch
jae 0x10240eb4
aam 0x2c
ja 0x10240f34
mov edx, 0xf9b7499c
mov cs, word [ecx + 0x2720b15f]
jmp 0x10240ead
invalid
xchg byte [ecx - 0x6acdeeb9], dh
jmp 0x2af15656
mov ebp, 0xe267427e
aaa
sbb byte [ecx - 0x118f785f], 0xd
pushfd
rol byte [edx - 0x57], 1
ror dword [edx + eax*4], cl
inc ecx
invalid

Function at 0x1024262d
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0xc], esi
jno 0x100f6740
mov byte ss:[eax], dl
lea esp, [esp + 0x10]
jmp fcn.10154f3a
mov eax, 0xc7862e2b
inc esp
and al, 0
nop
dec edx
xor byte [edx - 1], dh
inc esp
and al, 0
and dl, al
push 0xb51bd70f
call fcn.100d8f29
pop esi
push 0x2085e739
pushfd
xor dword [esp + 4], 0xac8b40ac
je 0x101bdd6c
cmp dword [esp + 4], 0x84020112
push ebx
ja 0x10174eb2