joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x40244b
cmp byte [ebx + esi - 1], 0xa
je 0x40241f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x402c90
mov eax, dword fs:[0x18]
mov edi, dword [0x4060a4]
cmp dword [eax + 0x24], edi
je 0x402c82
test byte [0x4040ac], 8
jne 0x402c30
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x4040bc], 8
jne 0x402bf0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402b83
cmp esi, 3
ja 0x402b83
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x405388]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x402b94
mov esi, edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
shr esi, 0x10
test edx, 0x8080
mov dword [esp], ebx
cmove edx, esi
lea esi, [ecx + 2]
mov eax, edx
cmove ecx, esi
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x4040bc
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x402b1e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x402b1e
mov dword [esp], 0x4040ac
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x402b0b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov ecx, eax
lea ebx, [esp + 0x28]
mul edx
mov dword [esp + 4], str._3u._03u:
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x402b11
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x402be1

Function at 0x402f60
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x10025600
Capabilities:
Packed with generic packer

Disassembly:
cmp word [esp + 0x24], 0x87a6
not dword [esp + 0x24]
mov esi, dword [esp + 0x10]
jg 0x10103d7d
push edx
mov edx, 0x748230a0
push edx
pushfd
add dword [esp + edx - 0x7482309c], edx
or edx, 0xa6a84b2e
mov edx, dword [esp + 8]
mov dword [esp + 8], 0xec9f3ca4
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1008aa86
call fcn.100efee2

Function at 0x100267ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea eax, [eax + esi - 0x5d01eaf6]
shr esi, 0x77
and bl, byte [esp + 6]
shl ebx, 0xd
add dword [esp + ebx + 0xc00018], 0xefeb60f8
sub word [esp + 0x2c], 0x6503
push edi
je 0x10120526
neg dword [esp + 8]
xchg dword [esp + ebx*2 + 0x180003c], eax
mov esi, dword [esp + ebx*2 + 0x1800038]
mov dword [esp + ebx + 0xc00014], 0x6cba33a8
call fcn.10028663

Function at 0x10029f1c
Capabilities:
Encode data using xor

Disassembly:
jno 0x10129ad0
cld
int3
not ebx
xchg dword [esp + ebx + 0x1d], ebp
mov ebx, dword [esp + ebx + 9]
setg byte [esp + 0x14]
xor byte [esp + 0x14], 0xad
neg byte [esp + 0x14]
call fcn.10031aa6
invalid
Function at 0x1002f540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test cx, 0x9295
jb 0x1017ab42
add dword [esp + 4], 0xeffc5480
xchg dword [esp + 0x38], eax
mov ecx, dword [esp + 0x2c]
mov ebp, 0xfd3728ab
not dword [esp + ebp*2 + 0x591aebe]
call fcn.1013a8a0

Function at 0x10085a63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
je 0x100f6e6f
jbe fcn.1009cb64
xor cx, di
shr di, 0xa8
add dword [esp + 4], 0xfff2d2b7
mov esi, 0xd627f328
mov ecx, 0x8c22af18
mov dword [esp + esi + 0x29d80cd8], esi
push edx
neg cl
not cl
mov esi, dword [esp + edi + 0x7a75ffbf]
mov esi, dword [esi + ecx + 0x73dd50e9]
cmovne edi, ecx
test cx, di
ja 0x101582da
and word [esp + 8], 0x3a86
setne byte [esp + 0x24]
lea edx, [edx + 0x5415ecb4]
call fcn.101050f4
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x1c]
ret
invalid
invalid

Function at 0x100872cb
Capabilities:
Encode data using xor

Disassembly:
je 0x100f32af
lea eax, [eax + 0x4330adb5]
sete byte [esp + 0x10]
mov dword [esp + 0x30], ecx
call fcn.1002f540
mov dl, dh
out 0x2c, al
sbb al, 0x47
push esp
sbb dword [edx - 0xf], esp
xchg ecx, eax
xchg ebx, eax
insd dword es:[edi], dx
add dword [ecx*2 - 0x5fe2d6d2], esp
ficomp word [ecx - 0x607d824f]
mov bh, 0x7b
in al, dx
sahf
daa
pop fs
jmp 0x10087385
leave
jmp 0x1008737a
xchg esp, eax
imul edx, dword [esi], 0x6f18adb2
shr dword [esi + esi*2 + 0x3f1829fc], 1
inc eax
jno 0x100873d9
sbb dword [ecx], esi
std
push 0xffffffffffffff85
cmp eax, 0x1dc81fcc
stosd dword es:[edi], eax
or edi, eax
into
invalid
aaa
push ecx
and esi, dword [esp + edi*8]
movsd dword es:[edi], dword [esi]
jge 0x10087354
mov edx, 0x5374d7d9
je 0x100873da
das
and ch, ah
pop ebx
jmp 0x8260477
jecxz 0x1008733e
loopne 0x100873ac
cli
imul ebp, dword [eax - 0x43821a8], 0x215029d3
loop 0x1008738a
cmp eax, 0xf908a2a5
push eax
jnp 0x100873dc
sbb dword [eax], ebx
sub esp, dword [eax + 0xa0f5e6c]
outsd dx, dword [esi]
lahf
xor byte [0xfbf1ec8d], dl
inc ecx
xchg esi, eax
scasd eax, dword es:[edi]
out dx, eax
daa
push 0x203ad5bd
cmp ah, byte [eax]
and byte [ebp - 0xa7cc48a], bh
mov ebp, 0xf5833b76
jbe 0x10087419
xor ebp, 0xffffffc1
xchg edi, eax
mov al, 0x12
pushfd
rcl dword [edi + 0x279c12b0], 0xe3
std
daa
jecxz 0x100873e5
out dx, al
daa
in al, 0x6f
mov ebp, 0x29549664
mov cl, 0xcd
jecxz 0x100873c3
xor byte [edi - 0x5138102a], ah
into
push esi
mov byte [0xcc3753c5], al
scasb al, byte es:[edi]
xor al, 0xd2
and dword [esi + 0x2beaf703], 0x5ca6fb0e
xor byte cs:[edx - 0x3ddc6b55], 0x2c
mov ah, 0xe3
push esi
jecxz 0x10087471
das
sti
jne 0x100873a8
movsd dword es:[edi], dword [esi]
inc ecx
cmpsb byte [esi], byte es:[edi]
push ebx
movsd dword es:[edi], dword [esi]
ret
xor al, 0xd2
add ah, byte [0xfe9d98a0]
rcl byte [ebx], 0xdc
out dx, al
call 0x3c875189
inc ecx
mul dword [ebx]
ret 0x49d1
Function at 0x1008948f
Capabilities:
Encode data using xor

Disassembly:
push ecx
xchg dword [esp + edx - 0x210b8486], esi
mov edx, dword [esp + edx*2 - 0x42170960]
mov cl, byte [esp + ecx + 0x73dd50eb]
neg edi
and dword [esp + 0x14], 0xbabbdba4
neg edi
neg edi
not edi
cmovno di, word [esp + edi + 0x73dd50fc]
mov edi, dword [esp + edi + 0x73dd29f1]
shr cl, 0xf6
sub dword [esp + ecx + 0x73dd5110], 0x7f2031b1
bswap ecx
jne 0x1003238e

Function at 0x1009863c
Capabilities:
Authenticate hmac

Disassembly:
push 0xa5109510
pop esi
push ecx
pushfd
sub bp, word [esp + ebp*2 + 0x519e114a]
add dword [esp + 0x14], 0xffeef271
cmp ebp, dword [esp + ecx + 0x4dc6cbe3]
jns 0x1012eec0

Function at 0x1009cb64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg word [esp + edx + 0x72fc960e]
shr ebp, 0x48

Function at 0x1009d1fe
Capabilities:
Encode data using xor

Disassembly:
jne 0x100eff33
dec ecx
and bl, byte [esi + 0x6fe89e1]
inc ecx
std
out dx, al
xchg byte [ecx - 0x7271cd8f], cl
in eax, 0xaa
push edx
xor eax, 0xc182ea89
cmp dword [edx], esp
sahf
leave
mov eax, dword [0xd9653ac2]
mov dh, 0x9b
cmp ebx, dword [esi - 0x61]
adc dl, bl
and bh, dl
cmpsd dword [esi], dword es:[edi]
imul esi, dword [edi], 0xffffff99
out 0x38, eax
out 0x1b, al
or bl, bh
daa
lds eax, [eax + 0x49de1c5a]
fcomi st(2)
stosd dword es:[edi], eax
jae 0x1009d217
push cs
out dx, al
push esi
ret 0xe2f2

Function at 0x100a2633
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx esi, bx
test bl, 0xf
lea esi, [esi + ebx - 0x1cc98a5a]
movsx esi, bl
not bx
mov esi, 0x73c0f21
mov dword [esp + ebx - 0x24b79fdf], edi
call fcn.10130f44
mov eax, 0x715783f
lea edi, [eax + 0x39b8ca2d]
mov edx, dword [ebp + eax*4 - 0x1c55e0fc]
xadd ax, di
sal al, 0x45
ror eax, 0x45
lea ebp, [ebp + eax - 0x38adcf]
movsx esi, ax
xchg edx, ebp
not di
dec edi
mov esi, edx
ja 0x100b8991

Function at 0x100a268b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.101453b8
mov eax, 0xb73f7eba
dec ebp
mov edx, dword [edi]
dec eax
add eax, eax
dec ecx
mov eax, dword [edi + 8]
push 0x38acb3bf
dec ecx
adc edi, 0xc
xor ebp, ebp
dec eax
test eax, eax
jmp 0x101536bc
inc ecx
mov dword [edi], ebp
dec eax
lea esp, [esp + 8]
jmp fcn.100fb71f
inc ecx
pop ebp
inc ecx
pop ecx
push 0xe591d919
not ebp
jmp 0x100def65
push 0x852283
inc esp
xor ebp, ebp
inc ecx
and ebp, 0xff
inc edi
mov ebp, dword [ecx + ebp*4]
shr ebp, 8
inc ecx
xor ebp, ebp
dec ecx
inc edx
dec byte [esp + 1]
dec word [esp + 1]
xor ebp, 0x213fa107
sub byte [esp + 5], 0x38
dec eax
dec eax
dec eax
lea esp, [esp + 8]
jne 0x101536d8
jmp 0x10137ad0
dec eax
lea esp, [esp + 8]
je 0x10137ad4
inc ecx
push ecx
inc ecx
push ebp
inc ecx
mov ecx, 0x6e0653bb
dec esp
lea ecx, [0xbdd0]
inc ecx
mov ebp, 0x76204e3e
inc edi
movzx ebp, byte [edx + ebp - 0x76204e3e]
jmp 0x101528d5
Function at 0x100a87bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
pushfd
mov ebp, 0x8da6ac36
lea ebp, [ebp + ebp*2 + 0x79b74ebe]
mov bh, 0x79
xchg dword [esp + 0xc], eax
call fcn.100d051c
sub ebp, dword [eax + 0x53]
sbb al, 0x7f
inc edi
out dx, al
mov esp, 0x6f2630f0
inc edx
pop ds
push edx
push esi
mov ebx, 0x4b35cdd5
xor al, 0x5a
sbb al, 0xbc
mov edx, 0x63208735
dec edx
xor eax, 0x4a632087
and eax, 0x3470e7df
salc
mov al, cl
dec ebx
jecxz 0x100a87ed
aad 0x72
add byte [edx + ebp*8], ch
into
test dword [ebp - 0x7a], esi
xrelease xchg dword [eax - 0x1276cd6d], edi
leave
leave
int1
push ds
loopne 0x100a883b
push es
inc ecx
clc
pushfd
salc
stosd dword es:[edi], eax
jb 0x100a87c8
nop
xchg ecx, eax
push ss
and al, 0x31
in eax, 0xf9
mov ebp, 0xade4bf5b
test al, 0x80
dec esi
jbe 0x100a8892
pop ebx
loopne 0x100a8856
push ecx
adc bh, byte [ebx + 0x5080f452]
add al, 0x82
sar byte [edi + 0x7d], 1
adc ecx, eax
pop ecx
faddp st(7)
invalid
push cs
cdq
push 0x66
loopne 0x100a880f
inc esp
sbb edx, esi
pop esi
fcomp dword [esi + ebp*8]
out dx, al
mov eax, dword [0xe7e68474]
jno 0x100a8863
outsd dx, dword [esi]
std
mov byte [edx], dl
xor byte [0x741a8442], ch
cdq
js 0x100a88e4
pop eax
fild qword [esi]
cwde
adc cl, byte [edi + 0x37c0f4f]
sub byte [ebx + esi*2 + 0x5373ee4], bh
mov al, 0x61
sbb ecx, dword [eax - 0x4b]
lea ebx, [eax + 0x1633bd81]
xor edx, dword [esi]
jne 0x100a8841
xchg ecx, eax
outsb dx, byte [esi]
xor esp, dword [esi - 0x2f]
adc edi, dword [eax - 0x19]
test al, 0x18
pop eax
xor esi, dword [ecx + eax*4 + 0x4d254831]
daa
invalid
and eax, 0xf03e274d
invalid
push es
mov byte [edx], bh
xor al, 0x5c
lodsd eax, dword [esi]
jbe 0x100a88a6
pop ss
cdq
invalid

Function at 0x100b058e
Capabilities:
Encode data using xor

Disassembly:
add cl, 0x36
jns 0x10038df3
shl ecx, cl
test ecx, ecx
call fcn.10168d79
daa
push cs
invalid

Function at 0x100d051c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x18]
ret
or bp, 0x9aaf
jb 0x100d4117
mov dword [esp + 0xc], eax
add ebp, 0xe3bfafb2
xor ebp, 0xf98a5704
neg ebp
add dword [esp], 0x67e2f
and ebp, 0xe9204024
jl 0x10105ed4
mov eax, ebp
jb 0x10106c6d
jae 0x1017b720
in al, dx
mov ebp, 0x1b79dee4
pop es
jecxz 0x100d050d
fidiv dword [ecx + 0xd1c1dc]
push 0xdd80bc72
fdiv qword [ebx - 0x66415150]
cmp edi, dword [edi + 0x39]
invalid
push edi
call fcn.100a6022
dec eax
mov dword [esp], 0xecfbc31c
call fcn.100f33e1
push ecx
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov ecx, ebp

Function at 0x100d3b5b
Capabilities:
Packed with generic packer

Disassembly:
jno 0x101733a8
call fcn.101118b6
add dword [esp + edx + 0x27], 0x501adb09

Function at 0x100d903a
Capabilities:
Packed with generic packer

Disassembly:
jg 0x10101bf4
je fcn.100f5cde
add dword [esp], 0xa4d8c
push esi
add dword [esp + 0x18], 0xeff62096
shr byte [esp + 0x20], 0x9f
mov ebp, dword [esp + 0x28]
mov esi, ebp
add dword [esp + ebp + 0x7d410010], 0xa4cea
mov ebp, dword [esp + esi + 0x7d410004]
mov ebp, dword [ebp + esi + 0x7d410000]
call fcn.100a1f18
push 0x4435edb0
pushfd
sub byte [esp + 4], 0x38
jl 0x100f6748
Function at 0x100e3ec9
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xa2ebd915
invalid
mov edi, 0xcae51116
fstp qword [edi - 0x53]
inc edx
mov edi, 0x1fe15d10
add al, 0x14
xlatb
cmp dword [ebp - 0x17], ebx
jbe 0x100e3e6e
retf 0x5fdd
or edi, ebx
adc al, 0x11
add ecx, esi
fidivr word [ebx]
sbb esp, dword [ebx - 0x2226dee4]
cli
sbb eax, dword [ebx]
mul dword [eax + 0x79]
and ecx, esi
sbb edx, dword [ebp + 0x14]
and dword [ecx + edx*2 + 0x61], ecx
invalid
dec esp
push ecx
popal
sal byte [eax + 0x6f344ab2], 1
jl 0x100e3e92
sbb al, 0xe
sal dword [edi - 0x356be49], 1
inc eax
cmp al, 0xd9
call 0x10c5b27c
lahf
or bl, byte [ebp + 0x7f]
ja 0x100e3e6f
mov bh, 0xb7
inc ecx
test eax, 0x826640fc
clc
fld1
int1
jae 0x100e3e41
add byte [edi + 0x777f5d0a], bl
fsubp st(6)
out dx, al
xchg ebp, eax
jno 0x100e3e33
wait
xor dword [edi - 0x48], 0xffffffad
movsd dword es:[edi], dword [esi]
pop ecx
jle 0x100e3e3d
mov edi, 0x11e9d007
adc eax, 0xbab9b82
aam 0xd9
sal dword [ecx], 0x2f
mov ch, 0x21
shr cl, 0xc5
jne 0x100f9e4c
js 0x100e3efa
jo 0x100e3f1b
loope 0x100e3e60
out dx, eax
jg 0x100e3f31
dec ecx
and al, 0x39
and eax, 0x6a8a84e0
sbb al, 0x6f
add al, 0x51
cmp byte [0x7ff50866], al
jle 0x100e3e7c
stosb byte es:[edi], al
invalid
inc edx
pop edi
mov cl, 0x96
arpl word [esi + ecx*8], si
aad 0xa3
mov byte [0x5ae4644c], al
cmc
cmp al, 0x4f
enter 0xe28, 0x4c
arpl word [0x49ae7a22], bx
jmp dword [eax + 0x38]
ret
and byte [ebx], bh
lds edi, [edx]
and al, 0x1c
mov eax, 0x97a8fe8f
xchg dword [edi - 0x40], esi
xchg byte [esi + 0x2d], ch
dec ebp
xchg ebp, eax
dec edx
sub al, 0xb
and cl, dh
xchg ebx, eax
add dword [ebx - 7], ecx
pop es
fimul dword [esi + 0x38]
xor esp, ecx
lodsb al, byte [esi]
mov byte [0x5b89f474], al
jecxz 0x100e3f3f
mov edi, 0x3cd705ab
in al, dx
insd dword es:[edi], dx
sub ah, cl
sbb eax, 0xa6ae21a
xchg edx, eax
lodsd eax, dword [esi]
adc al, 0x84
stosd dword es:[edi], eax
imul esp, dword [edx - 0x43af6329], 0x951a60f5
adc eax, 0xc63beb5e
add dword [esi - 0x11e070e4], ecx
cmp al, byte cs:[edi + 0x2c]
adc esi, dword [eax + 0x60]
mov ah, 0x89
test eax, 0xdc50cf87
mov cl, 0x40
sub ebp, 0xfffffff4
invalid

Function at 0x100e42c3
Capabilities:
Encode data using xor

Disassembly:
jae fcn.1014d898
call fcn.101029c0
mov ecx, 0xb933da0e
bswap ecx
pushfd
or cl, ch
sub ecx, 0x1799c8b8
shr cx, 0x6d
xchg dword [esp + ecx + 0x8c0000d], edi
shl ecx, cl
jb 0x100310c0
stosd dword es:[edi], eax
inc eax
mov ebp, 0x770a334c
sahf
inc ebx
cwde
mov byte fs:[ebp + 0x6f70b3ee], dh
invalid
Function at 0x100e97e9
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xfff306cf
mov eax, dword [esp + 0xc]
call fcn.100d96b7
nop
js 0x100e9832
iretd
pop eax
adc eax, 0x83c68534
add al, 0x82
mov cl, 0x39
push ebp
mov ebp, dword [eax]
scasd eax, dword es:[edi]
xor byte [ecx + 0x288b5539], 0xaf
mov word gs:[edi + 0x5a], ds
push 0x58ccd284
and dword [ebp + 0x3c8a0976], 0xffffffe0
cmp dword [ebp - 0x1653bcb5], ecx
aad 0xd5
pushfd
out dx, al
mov byte [0x3be7cd6f], al
stc
std
loopne 0x100e98a8
push 0xfedc5fe0
rcr byte [eax - 0x55], 1
inc esp
adc dword [ecx + 0x32], 0x4556b1d2
jno 0x100e9892
xor bl, bl
out 0x14, eax
xor eax, 0x3c455dac
xor eax, 0x423b75cb
neg byte [eax + 0x5d]
hlt
aaa
test bl, al
std
sbb eax, 0x6a39cd55
invalid
jle 0x100e982b
invalid
Function at 0x1010f163
Capabilities:
Encode data using xor

Disassembly:
not di
and edi, 0xa32cbbaa
call fcn.10037663
js 0x1010f1c6
cmp ebp, dword [eax]
rcl bl, 1
outsd dx, dword [esi]
or byte [eax + 0xb], ah
mov ah, 8
jnp 0x1010f193
push eax
test al, 0xdf
arpl word [eax], ax
push 0x64c0c73f
lahf
mov byte [esi + 0x40], al
cmc
cdq
movaps xmm3, xmm2
xor byte [edx], dh
jae 0x1010f1f8
sahf
inc eax
mov ch, 0xc3
cmp eax, 0x61a2c257
adc al, 0x90
pushal
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
retf
pop ebx
and esi, dword [esi - 0x116f53c6]
mov ss, word [esi - 0x7d]
xchg ebp, eax
add al, 0xd8
push ecx
xor ch, byte [ecx + ecx*4]
mov esi, 0x3a2274b4
cmc
push eax
xor eax, dword [edx - 0x1124f8ba]
hlt
jae 0x1010f1ae
fidivr dword [ebp + 0x5413cd24]
fcomp dword [ecx - 0x39edf7cd]
adc edx, dword [eax + ebx*8 - 0x67]
xor ecx, dword [eax]
adc al, dh
xchg esi, eax
popfd
shl byte [eax - 0x1f1e5d46], 1
pop ebp
push ebp
push edi
adc al, 0x32
add al, 0x1a
sub eax, dword [edi + 0x1a]
imul esp, dword [esi - 0x26], 0xef96cda5
daa
mov ebx, 0x5f00b537
jb 0x1010f1fe
adc esi, dword [0x7de569bd]
cmp dword [ecx], 0xfa3e86ec
push ss
into
xor bh, dl
xor ecx, esi
ljmp 0x334d

Function at 0x1014215f
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x2c]
ret
sete byte [esp + 0x20]
not dword [esp + 0x20]
test dword [esp + 0x20], 0x331dfc99
jae 0x100d1e23
jo 0x1014d8bc
and ecx, 0x9901f619
mov ecx, dword [esp + 0x28]
call fcn.100b2a20
call fcn.10168d9f
xor cl, 0x3d
jno 0x1010b42c
mov esi, dword [esp + esi*8 + 0x401c]
lea ecx, [ecx*4 - 0x16f5a8de]
je 0x100f030e
and dl, byte [edi + 0xa]
jmp 0xf1a6a589
shl dword [esp + ecx + 0x16f268d6], cl
setb byte [esp + ecx*4 + 0x5bc9a378]
mov ecx, dword [esp + ecx + 0x16f268ea]
ja 0x10102fa2
aad 0x9a
jne 0x101421ba
push cs
mul cl
pop ebp
sbb dh, byte [edx + 0x25]
fstp qword [esi + 0x42254d22]
mov edx, 0x376a01bd
neg dword [ebx]
neg byte [edx]
std
add bh, ch
popfd
je 0x10142172
scasd eax, dword es:[edi]
mov eax, dword [0xf4f80e5c]
retf 0x6afe
Function at 0x10146e49
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx + 0x360f0c84], al
push 0xf31d1ab1
invalid
add dword [esp + ecx - 0x4e97c9f1], 0xfff31d1a
mov eax, 0x129c2913
push ecx
push ecx
push 0xebb2b881
and eax, dword [esp + edx - 0x4e97c9ed]
jg 0x10146dd9
sysenter
push edx
call fcn.10029e23
add dword [eax + 0x55], edx
or al, 0x4d
jge 0x100d50cc
xchg edx, eax
ficom dword [esi]
and al, 0x69
pop eax
adc ebp, dword [edx + esi*2 - 0x57]
iretd
mov ebx, dword [esp + ecx*2 - 0x46c15fe8]
mov ebx, dword [ebx + ebp - 0x35245803]
mov ecx, dword [esp + ebp*2 - 0x6a48afe2]
mov ebp, dword [esp + ebp - 0x352457e3]
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x28]
ret
mov eax, dword [esp + eax - 0x29408f1]
mov eax, dword [eax + edx - 0x4e97c9f5]
mov dword [esp + edx - 0x4e97c9d5], edx
setg cl
test word [esp + ecx - 0x4e97c8e1], 0x7497
lea eax, [eax - 0x78414ae2]
call fcn.1010e056
mov cl, 0x86
lea ebx, [edi - 0x21d5dbc0]
movsb byte es:[edi], byte [esi]
sal dword [edi + ebx*8 + 0x2551f8c0], cl
sbb ebx, ebx
int 0x84
test eax, 0xf74920e8
leave
pop ebp
cmp byte [eax + 0x7611572e], 9
push esp
xchg byte [esi], bh
mov dword [0x97a52363], eax
stosb byte es:[edi], al
mov edi, 0xfd1c3bd7
cmp eax, 0xcbd3d235
aas
nop
mov ch, 0x85
and eax, 0xbf7ffea
xor al, 0xc9
cmp dword [0x246cc166], edi
shr word [esp + 0x10], 0xd0
push 0x43976535
je 0x1010bb25
aaa
pop ebp
cmp ebx, edi
rol dword [ebx + eax*4 + 0x3281e7e0], cl
pop esi
dec eax
xor byte [edx - 0x494a2507], 0xa0
inc ebx
aas
sbb ecx, esi
mov edi, 0xafb0dbf6
mov bh, 0x7e
adc al, byte [edx]
jle 0x10146e37
test al, 0xd0
jbe 0x10146e85
aas
dec esi
into
cmp esp, dword [edx - 0x11]
xchg byte [eax - 0x3aa39c5a], ah
mov al, byte [0xc55c63a6]
imul edi, dword [ecx + 0x514c7861], 0x7a
loope 0x10146e89
jp 0x10146e77
inc eax
inc eax
je 0x10146e94
invalid

Function at 0x10148aeb
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xd333b41b
pushfd
and esi, 0xbaeb796
or si, 0x70a1
jno 0x100f6f1b

Function at 0x101509d1
Capabilities:
Encode data using xor

Disassembly:
js 0x10098b49
call fcn.101288c6
mov eax, 0x54acdfb7
aaa
mov eax, eax
test al, 0xf3
or esi, dword [eax + ecx*8 - 0x79]
out dx, eax
clc
add byte [ebx], dl
scasd eax, dword es:[edi]
aam 0xbc
jecxz 0x1010b613
push edx
pop esp
pop eax
or edx, esi
inc ebp
pop ss
ljmp 0x8cec
jo 0x1010b632
sbb dh, byte [edx + 0x2d]
aad 0xd6
push 0x41
sub dword [esi - 0x4a], ecx
aad 0x69
push cs
jns 0x1010b5a6
sahf
and dh, byte [ecx + 0x19]
dec esi
ljmp 0x81b
mov edi, 0xac70619f
mov esi, esi
xchg ebx, eax
aaa
shr dword [esp + edx + 0x74], 1
test al, 0x7d
outsd dx, dword [esi]
inc ebp
xchg esp, eax
out 0xa8, eax
rcr dword [ecx - 0x3b], 1
pop ebp
xchg edx, eax
test eax, 0x2c8936c2
mov esi, 0x1dd30666
loope 0x1010b64d
mov dword ss:[esi + edi*4], ebp
push es
rcr dword [0xa246f6e1], cl
xchg ebx, eax
mov cl, 0xe
mov dl, 0x97
inc esi
mov byte [0xb20eb193], al
xchg edi, eax
nop
call 0x80bbebab
xor eax, 0xe4cee6e2
pop esi
test byte [ecx - 0x110c6cbd], dh
xor dword [ecx + ecx*8], 0xffffff85
cdq
das
dec ebp
xchg edx, eax
jns 0x1010b657
cmp esi, dword [edi]
into
imul byte [edx + 0x1c]
sbb ah, cl
add edx, dword [ebx]
ljmp 0x7e2b
push edi
jns 0x1010b5ac