joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106467da
Capabilities:
Encode data using xor

Disassembly:
call fcn.10667763
mov edx, 0x63a20082
lea edi, [edi + edx - 0x63a20086]
movzx ecx, dx
mov edx, dword [edi + ecx*4 - 0x208]
lea eax, [ecx + ecx*4 - 0x7e44ca49]
sar ecx, cl
xchg ecx, eax
xor edx, ebx
and cx, 0x1810
neg al
inc edx
not cl
and ecx, ecx
xor edx, 0x581238a4
sub ax, cx
bswap edx
sbb ecx, ecx
sar cx, 7
lea eax, [eax + eax*4 + 0x79334785]
xor edx, 0x5f399e89
inc edx
and al, ah
or ecx, ecx
ror edx, 1
or ecx, 0x69a4ce00
shl ecx, cl
ror al, 0x47
xor ebx, edx
neg eax
js 0x105d6f96
bswap ecx
add esi, edx
xor cl, cl
adc al, al
sbb cl, ch
adc ecx, dword [ebp + ecx*4]
not eax
lea ebp, [ebp + eax - 0x7937ce25]
movzx edx, al
lea edi, [edx + edi - 0x2a]
neg eax
add dl, dl
push edx
movzx eax, byte [edi + edx*2 - 0xa4]
sar dx, 0xcd
xor al, bl
dec al
not al
inc al
xadd dword [esp + edx], edx
pop edx
rol al, 1
sar dx, 0xc3
xor bl, al
add eax, esp
lea edx, [edx + edx*2 - 0x3a44b152]
sub edx, edx
mov dword [eax + edx*2], ecx
call fcn.102520e3
mov dword [esp], 0x44a60913
mov ecx, dword [esi]
mov edi, 0xf939caab
add esi, 4
inc edi
mov edx, dword [esp]
mov edi, ecx
jl 0x10596082
mov dx, word [ebp]
mov ax, word [ebp + 2]
mov cl, byte [ebp + 4]
jmp 0x1005fbd1

Function at 0x1065957e
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + edx*2 - 0xd7cd725]
xor ecx, 0xbb3e2c1c
shl dx, 0xb
lea eax, [edx + edx*2 - 0x2d496f6d]
inc ecx
sar byte [esp + edx - 0x44805000], 0x82
xor ebx, ecx
add esi, ecx
shl edx, 0x81
inc dword [esp]
call fcn.10217b31
cli
xchg byte [edx], bh
sub al, byte [esp + edi*8]
js 0x104acbbc
in al, dx
xlatb
out dx, eax
inc ecx
pop eax
mov eax, 0x1e77f1a4
pop ebx
sub al, 0x8b
mov bh, 0xe1
mov ch, 0x34
pop esi
dec edx
out 0xa3, al
sti
mov edx, 0xa188d3b7
sbb eax, 0xde8af657
out 0xbb, al
lodsb al, byte [esi]
out 0x83, eax
test esi, eax
adc ah, byte [edx]
scasd eax, dword es:[edi]
sahf
test dword [edi - 0x2e], esi
push ss
retf
cmp al, 0x86
push ss
insd dword es:[edi], dx
and ebx, eax
out dx, eax
and eax, 0xa1a8c108
or edx, dword [edi - 0x10460e9e]
rcl si, 1
xlatb
adc al, byte [esi]
push ecx
xchg ebx, eax
sbb dh, byte [ebp - 0x6d]
pop eax
fild qword [edi + edx*2 - 0x212d774b]
adc al, 0x74
or al, 0x44
pmaddwd mm6, qword [esi - 3]
adc ah, dl
shl byte [ebx], 1
push ds
cmp eax, 0xb923ffdd
adc dword [edi - 0x23], ebx
mov dl, 0x25
invalid
mov dword [esp + ecx*2 - 0x3521fa26], eax
lea eax, [ecx + eax*2 - 0x7674f845]
xor ebx, edx
sal ecx, cl
add edi, edx
rol ax, 0x41
xadd byte [esp], ch
lea edx, [eax + eax*8 - 0x79e29fd5]
movzx cx, byte [esi + edx - 0x4b19b683]
mov dl, byte [esi + edx - 0x4b19b681]
not word [esp + 1]
call fcn.104635f7
jmp 0x104acb1a
Function at 0x10668736
Capabilities:
Encode data using xor

Disassembly:
call fcn.1008bd16
sub eax, 0x8a2afbb4
inc ebx
jb 0x1066879b
xor eax, 0xb42dffa2
sti
sub cl, byte [edx - 0x66a78dbd]
cdq
add eax, 0x5b2ddb5c
and dword [edi], 0x911ce184
bnd jns 0x10668738
cmp cl, byte [esi - 0x49]
sbb esp, eax
mov byte [eax - 0x753a04f8], ah
retf
push 0xffffffffffffffcf
clc
adc eax, 0xb67b6553
in eax, dx
scasd eax, dword es:[edi]
lcall 0xd538, 0xf91ac249
dec ecx
lodsb al, byte [esi]
sbb eax, dword [edx - 0x70b97b]
mov esp, 0x3587c5a0
or al, 0x99
add byte [edx - 6], cl
xchg edi, ebp
aam 0x70
push ecx
sub dword [eax], 0xb486af4f
add esp, dword [ecx - 0x21]
jb 0x10668834
dec ebx
sub dl, byte [eax]
sbb byte [ecx - 0x5f6ddbf4], al
dec eax
invalid
clc
sub eax, 0x3eadae21
mov al, byte [edi - 0x11e1f5f1]
sal dword [eax + 0x3d9eec9b], 1
and al, 0xae
mov eax, 0x572e20c3
fidiv word [esi]
aaa
daa
insb byte es:[edi], dx
sub byte [eax], dh
push cs
sbb eax, 0x76f6c0f8
xchg ebx, eax
int 0xd6
adc dword [ebx + 0x57], 0xd52e2cf3
pop eax
xor ebp, dword [ecx + eax*2 + 0x1c]
inc ebp
mov eax, 0xc61e47e1
mov edi, 0xd872fa13
pop esp
inc eax
pushfd
movsd dword es:[edi], dword [esi]
mov ebx, 0xa1f34977
stosb byte es:[edi], al
xor byte [edi + ecx*2 + 0x92d62e], 0x82
emms
invalid

Function at 0x1067330b
Capabilities:
Encode data using xor

Disassembly:
sub esi, 0xc
mov dword [esi + 0xc], eax
call 0x105edb13

Function at 0x1067467c
Capabilities:
Encode data using base64

Disassembly:
and ax, 0x5e94
sbb edx, 0x8a383c34
mov dword [esp + 8], 0x6b9e419a
rol cl, 0x86
rol edx, 1
bswap edx
xor ebx, edx
add esi, edx
not ecx
mov cl, byte [ebp + ecx*8 - 0x150]
movsx edx, word [esp + 0xc]
mov dl, byte [ebp + edx*2 - 0xe932]
shl dword [esp + 7], 0x21
not al
add ebp, 2
add al, al
pop eax
not cl
pop eax
call fcn.102e77b9

Function at 0x106746ea
Capabilities:
Encode data using base64

Disassembly:
movsx eax, dx
jb 0x1024908e
xor cl, byte [esp + ecx*2 - 0xce3cb]
adc edi, eax
sal dword [esp + ecx - 0x67130], cl
movsx eax, cx
not eax
pop edx
pop ecx
pop eax
je fcn.1043cc5d
dec cx
inc eax
add edi, edx
push eax
xor ecx, eax
dec dword [esp + eax - 0x360df7fa]
movzx edx, byte [esi + ecx*2 - 0x6c1a0ffa]
lea esi, [esi + ecx*2 - 0x6c1a0ff9]
push ecx
xor dl, bl
shl dword [esp + eax*2 - 0x6c1bf002], cl
or eax, 0x262d6ea0
xor dl, 0x2b
call fcn.1027f7e5
lea esi, [edx + esi + 4]
ja 0x104f4cc1
sbb cl, dl
xor eax, ebx
xor dl, dl
sbb dx, dx
mov dword [esp + edx], 0xf92e471a
neg eax
inc ecx
bswap eax
sar dx, 0xe3
dec eax
sal ecx, 7
call fcn.100bab3c
mov edx, 0x352c090c
sal dx, 0x2d
lea edi, [edx + edi - 0x352c8004]
jp 0x1032fa60
Function at 0x1067488f
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [esp + 0xc]
mov bp, 0x5a2d
push ebp
test dword [esp], 0xdd3b3981
call fcn.10524a8d
ror cl, 0xc6
jp 0x105f1696
jne 0x104a002d
jns 0x10081a7f
mov cl, byte [esi]
call fcn.104426c2
cmp eax, 0x5ad5819c
or dword [edx - 0x50e22249], ecx
into
pop es
jmp fcn.104a00b1
mov edx, dword [edx + eax - 0x610b0000]
setb cl
lea esi, [ecx + esi - 0x805]
neg dword [esp + ecx - 0x7fe]
lea eax, [ecx - 0x2247f1e9]
call fcn.10323f14
syscall
call fcn.10661808
mov dword [esp + edx - 0x610b9040], ecx
shl dx, 0xec
lea eax, [esp + eax + 8]
jp 0x101bad66
add edi, 4
xor eax, ebx
call fcn.1061d3e6
mov ax, word [ebp]
add ebp, 2
mov edx, 0x82cba21
lea esi, [edx + esi - 0x82cba22]
movsx ecx, dl
bswap ecx
movzx ecx, byte [esi + edx*2 - 0x10597442]
call fcn.101fb250

Function at 0x1067f79f
Capabilities:
Packed with generic packer

Disassembly:
sub edx, 0xde87caa2
mov eax, ecx
add ecx, eax
neg edx
sal cl, 0x24
dec ecx
js fcn.105f4aaa
dec edx
ror edx, 2
call fcn.1034184a
sar dx, 6
lea edi, [edi + edx*4 - 0x4c1bffc0]
pop eax
mov ecx, 0xa2b6fe97
mov edx, dword [edx + edi - 0x1306ffef]
ror cl, 0x22
jp 0x1032f6fd
dec cx
xor edx, ebx
sar cx, 0xc6
shl cl, 7
jb 0x105673f6
neg edx
mov eax, 0x2b3647ab
sar dword [esp + eax - 0x2b3647a7], 0x58
rol edx, 1
xor ebx, edx
add edi, edx
lea edx, [eax + eax - 0x236a26f4]
mov dword [esp + edx*2 - 0x6604d0c4], edi
ret 8

Function at 0x106915dd
Capabilities:
Encode data using xor

Disassembly:
sub cx, 0xa80e
xor eax, 0x3a0080a4
xchg edx, ecx
not edx
ror eax, 3
not cx
xchg edx, ecx
xadd dx, cx
xor ebx, eax
not edx
add esi, eax
inc ecx
call fcn.100baae9
sar ecx, cl
lea ebp, [ebp + ecx*2 + 2]
and dx, ax
movsx eax, cx
add al, cl
not dx
mov word [ebp + ecx*2], dx
lea edx, [ecx + ecx*2 + 0x1c197f10]
xor dx, 0xc93d
call fcn.104c9225
neg eax
not cl
bswap eax
sal cx, 5
lea eax, [eax + edx*2 + 0xdc0babd]
jp 0x103f58f8
mov eax, dword [ecx + edi - 0x5d31f731]
call fcn.1033e8dd
add ebp, 6
mov edx, 0x7f2b1893
not dl
mov word ss:[eax + edx - 0x7f2b186c], cx
mov ecx, edx
mov ecx, dword [edi + edx - 0x7f2b186c]
movsx eax, dx
lea edi, [eax + edi - 0x1868]
xchg ah, al
not dx
xor ecx, ebx
lea ecx, [ecx + eax*4 - 0x6289e6f8]
neg dx
rol edx, 0x4e
jp 0x1040a85d
rol ecx, 3
shl ax, 0x43
add eax, 0x5f128eaa
call fcn.10202c1d
lea edi, [edi + ecx - 0xb8da50f]
shr ecx, cl
call fcn.1067ed85
mov eax, dword [ebp]
mov ecx, 0xd00ba491
mov edx, dword [ebp + 4]
push ecx
bswap ecx
dec word [esp]
add ebp, 8
call fcn.1010d131
Function at 0x106a4b96
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
add al, 0x9a
sub ah, bl
popal
xchg ecx, eax
mov dword [esi - 0x3f], esp
sal cx, 0xa5
sal cx, 0xa5
xor dl, bl
mov dword [esp + ecx - 0x58cb2220], 0x48181802
call fcn.104b4626
loopne 0x106a4bab
jmp dword [ecx - 0x57]
popal
test eax, 0xdfc5fb4b
ficomp dword [ecx + 0x7f]
sti
loope 0x106a4c07
scasb al, byte es:[edi]
mov al, byte [edx + edx]
out 0xa3, al
sti
loopne 0x106a4b8d
rcr byte [ebx - 0x2f5b0405], 0xaf
add al, 0xde
dec edi
test al, 4
sbb bl, byte [ebx - 0x54044354]
wait
jae 0x106a4baa
sti
mov esp, 0x4d401b7
mov bl, 0x30
shl eax, cl
add al, 0x79
and byte [0xf33c6dfb], al
or cl, bl
scasb al, byte es:[edi]
shl byte [ebx - 0x2f], 1
wait
cdq
dec ecx
mov edi, 0x8d9b8604
jmp esp
adc byte [edx], ah
insb byte es:[edi], dx
push eax
xchg esp, eax
cdq
mov dl, dl
inc esp
scasd eax, dword es:[edi]
invalid

Function at 0x106ac760
Capabilities:
Execute syscall

Disassembly:
movsx edx, cl
xor eax, ebx
call fcn.103a6cd5

Function at 0x106c87bc
Capabilities:
Encode data using xor

Disassembly:
jge 0x1012afa3
inc dx
movzx ecx, byte [edi + edi - 0x7400]
neg ax
dec eax
lea ebp, [ebp + edi - 0x7402]
inc al
mov word [edi + ebp - 0x7400], cx
mov ecx, 0xf82607a8
jge 0x1028f366
ror ecx, 1
lea ecx, [edx + ecx + 0x5582ae37]
mov dword [esp + edx*2 - 0xc76500a], 0xdc2589bb
rol ecx, 1
xadd al, ah
add dx, ax
dec ecx
not edx
sal word [esp + eax - 0x5dafb033], 0xc7
xor ebx, ecx
ror dword [esp + eax - 0x5dafb034], 0x31
shl al, 6
lea edi, [edi + eax - 0x5dafb004]
mov dword [edi + eax - 0x5dafb000], ecx
ror al, 0x61
pop ecx
rol al, cl
mov ecx, dword [ebp + eax - 0x5dafb000]
lea ebp, [eax + ebp - 0x5dafaffc]
shr edx, 0xd
add edx, eax
shr eax, 0x87
xor ecx, ebx
xadd dl, ah
or eax, 0x52141b94
adc edx, 0xfd8ad231
neg ecx
not dl
xor ecx, 0x508ee7ac
inc dx
lea eax, [eax + eax*2 - 0x4fda087f]
rol edx, 0xcf
inc ecx
add eax, 0x1f8563bb
bswap ecx
xor ebx, ecx
push eax
add esi, ecx
xadd dword [esp + edx*2 - 0x504f5b42], edx
dec byte [esp]
cmovne edx, dword [esp]
pop ecx
jl fcn.1031df4e
push edi
push edi
inc ecx
add bh, 9
inc byte [esp + edi*8 - 0x39ff7]
push eax
inc ecx
not bh
inc ecx
inc bh
inc ebp
xor ah, bh
neg byte [esp + edi*8 - 0x39ffe]
inc eax
sar bh, 0x24
dec esi
lea edi, [esp + edi + 0x18]
inc ecx
pop esi
jae 0x102e2aef
mov edx, 0xa321f933
movsx ecx, dl
movzx eax, dl
mov ecx, dword [ecx + edi - 0x33]
call fcn.10668099

Function at 0x106ca640
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
bswap eax
not edx
xor edx, 0x9301e3a8
mov dword [esp], eax
add eax, 0xba09fa07
ror edx, 1
call fcn.106b666c
Function at 0x106ca659
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
ror ecx, 1
rol byte [esp + 1], 0x25
jb 0x102e114b
jmp 0x102adfbb
sal byte [ebx], 1
fsubr st(1)
push dword [edx + edx*8 - 0x8b7be01]
fld st(0)
ret 0xc165
neg ecx
rol dl, 0x65
shl edx, 0x8e
xor ebx, ecx
push eax
jmp 0x1040d8ad
not ax
not ecx
jb 0x1056f247
jecxz 0x102e10f3
imul edi, dword [esi + 0xb73495f], 0xb385d2b3
mov byte [ecx], bl
cwde
inc edi
add al, 0x56
fimul word [ebx + 0x59a116c]
jb 0x102e10fd
mov ah, 0xe7
pop ecx
lodsd eax, dword [esi]
fidivr word [eax + 0x18]
sal byte [ebp + 0x6dbb2ec4], 1
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
pop ebp
jmp 0x72d4c62c
add dx, word [esp + edx - 0xffffe]
adc esi, ecx
mov edx, dword [ebp + edx*2 - 0x20c11e]
mov cl, byte [eax + ebp - 0x608f35fd]
lea ebp, [eax + ebp - 0x608f35fb]
not word [esp + eax - 0x608f3600]
rol eax, 0x87
ror ax, 0xa6
mov byte ss:[edx + eax - 0x479bc002], cl
movzx ecx, word [esp + eax - 0x479bc002]
xor cl, byte [esp + eax - 0x479bc000]
shr byte [esp + ecx*2 - 0x192e0], 1
mov dword [esp + ecx - 0xc971], esi
ret
ror eax, 2
and cx, word [esp + edx - 0x825]
inc eax
jmp 0x10617abb
shr cx, 0xef
mov eax, dword [ecx + esi]
xor eax, ebx
sub eax, 0xb2aa4aa8
and edx, 0x72c8b2d
jge 0x10420649
sub eax, eax
add ecx, ecx
mov cl, byte [esi + ecx - 0xf46d04e]
lea esi, [esi + eax*8 + 2]
shr edx, cl
mov ecx, eax
mov dword [eax + esi], edx
call fcn.10537ac3
lea edx, [eax*2 - 0x65f19543]
sal edx, 0x6e
neg ecx
jmp 0x10640eb4
dec dword [esp + edx*2 - 0x104e]
xor eax, 0x1e08593f
shr ecx, 0xb6
inc dx
ja 0x101e89e2
xor ecx, 0x621d0f22
not ecx
lea ecx, [ecx + edx + 0x1f542013]
xor ebx, ecx
lea eax, [edx + eax*4 - 0x65d207fe]
and edx, eax
adc edi, ecx
not edx
mov ecx, 0xee336b8c
jmp edi
dec eax
push eax
sub ebp, 4
xor al, ah
movzx edx, word [esp]
jg 0x101575b8
mov dword [ebp + edx - 0x78bb], ecx
lea esi, [esi + edx - 0x78bf]
movsx ecx, dx
jp 0x104eb82f
xor ebx, ecx
jmp 0x106189e6
xor ecx, ebx
lea eax, [eax + 0x40dc3a2]
rol ecx, 1
mov dword [esp], eax
inc ecx
shr dword [esp], 0x9a
ror ecx, 2
inc ecx
ror ecx, 2
inc dword [esp]
jne 0x1061c1a6
jmp 0x10178fe9
Function at 0x106d4963
Capabilities:
Encode data using xor

Disassembly:
call fcn.100ded2f
shl eax, 0x1a
mov dword [esp], eax
adc ebp, 2
xor eax, eax
jp 0x10144631
mov ecx, dword [edi]
add edi, 4
mov edx, 0xcf95d48d
xor ecx, ebx
lea ecx, [ecx + edx + 0x9fb5321]
neg ecx
mov eax, 0x158bd813
sar dl, 0x84
not ecx
xor ecx, 0xb99fe2a8
dec ecx
shr dx, 0xe4
neg eax
ror ecx, 3
xor ebx, ecx
jmp 0x102bebea

Function at 0x106eb52a
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, 0x72071309
mov eax, dword [esp + ecx - 0x720712fd]

Function at 0x106eebd7
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
hlt
pop ebp
call fcn.10351c0b
jae 0x106eec3f
popal
sub bh, byte [ecx]
mov esp, 0xaf2ee219
xlatb
and eax, 0x3718bc77
add byte [ebp - 0x25], dh
xchg byte [ebp + 0x53], cl
loop 0x106eeb7c
in eax, 0x30
in eax, dx
xor eax, dword [edx - 0x34778c02]
push ebx
stosd dword es:[edi], eax
mov dh, 0x4d
cmp eax, 0x37dc7905
in al, dx
push edx
dec ebx
sbb al, 0x58
adc eax, 0x43d31c6d
pop ebx
shr dword [edi], 0xea
loope 0x106eec64
int1
cli
pop ss
out 0x62, al
dec esi
xchg dword [ebx], edx
mov cs, word [eax - 0x540ca760]
mov bl, byte [ebx - 0x415319be]
invalid
std
stc
xor bl, byte [ebx + edi*4 + 0x440fe49]
pop ds
cmp eax, 0x823e63f1
lcall 0x4736, 0x17bab24a
fucom st(0)
mov bl, 0x5e
push 0x21
mov dword [0xf16f87d9], eax
push cs
or eax, 0xd432f03
int3
inc ebx
or eax, 0xa6adf4cc
xor al, 0xa6
dec dx
mov ebp, 0xa96f6436
xor byte [edx], ch
sahf
rol bh, 1
adc dword [edi], eax
jns 0x106eecdb
and eax, 0xcebe01a6
test byte [edx], 0xac
cmpsb byte [esi], byte es:[edi]
add dword [esi - 0x53f50932], edi
pushfd
mov ecx, gs
lds ecx, [esi - 0xff005c]
outsd dx, dword [esi]
aas
mov dh, 0x37
imul esi, dword [esi + 0x31577b7a], 0x37
push 0x6a
sahf
xor dword [ecx + 0x737aed5a], eax
cwde
dec ecx
push eax
cmp esp, dword [esi]
lds ebx, [edx + 0x7b0f9849]
mov dh, 0x94
scasd eax, dword es:[edi]
inc esp
bound edx, qword [esi - 0x401063b7]
mov byte [0x9155f549], al
pop esi
mov dh, 0x7d
cmpsd dword [esi], dword es:[edi]
push 0xec8649a8
jp 0x106eec7d
invalid
invalid
test al, 0x30
scasb al, byte es:[edi]
test dword [ecx + ecx*2 - 0x49aab0f0], esi
insb byte es:[edi], dx
pop edi
fsub qword [edx]
mov eax, 0xff1fb449
mov word [ecx + 0x25], cs
aad 0xd1
jo 0x106eecab
ficom word [ebx - 0x51b65c30]
inc ebx
int 0x2a
fimul dword [ebx]
iretd

Function at 0x106f2d3e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
mov dword [esp], 0x3ebaa215
inc esp
adc dl, bh
dec ecx
add ecx, 4
dec esp
mov dword [esp + 8], ebp
inc ebp
xor eax, esp
pop eax
inc ecx
xor eax, 0x3183e10f
dec eax
sal dword [esp + eax*2 - 0x7d75442a], 0xf9
inc ecx
inc eax
inc ecx
xor eax, 0xcf19dda7
dec dword [esp + eax - 0x3ebaa212]
dec eax
mov dword [esp + eax - 0x3ebaa215], 0x8d29a40c
inc edi
lea eax, [edx + eax - 0x61120a4c]
sar dword [esp + eax*2 - 0x7d754429], 0x34
je fcn.101f2c3d
rol cx, 0xca
dec esp
mov dword [esp + eax*2 - 0x7d75442a], esp
neg ecx
inc esp
xor dword [esp + eax - 0x3ebaa215], eax
inc ecx
and ecx, ebp
inc ecx
mov esi, edx
call fcn.10244065
Function at 0x106f54cc
Capabilities:
Encode data using xor

Disassembly:
sub ecx, ecx
ror eax, 0x2a
xor edx, ebx
ror edx, 3
inc eax
neg cx
lea ecx, [ecx*8 - 0x655fa24b]
lea edx, [eax + edx + 0x658f8849]
cmovns ecx, eax
setge cl
dec eax
not edx
dec edx
ror edx, cl
rol cl, cl
xor ebx, edx
add edi, edx
xor ecx, 0x9e90e5bd
rdtsc
rol cx, 0x2d
sub ebp, 8
jmp 0x102177d5
ror cl, 0xa3
mov dword [ebp + 4], eax
mov dword [ebp], edx
or cx, cx
lea edx, [ecx*8 - 0x2a4ea842]
shr cx, 6
jp fcn.106263e2
movzx dx, byte [ebp]
mov ecx, 0x779bbf21
xor cl, cl
mov al, byte [ebp + ecx - 0x779bbefe]
rol cx, 0x8a
rol cl, 0xc7
lea ebp, [ecx + ebp - 0x779b027c]
inc cl
dec ecx
not dl
not al
call fcn.1019cb62
inc ecx
or ebp, 0x743ce332
inc edx
xor edx, 0x3e83dd8a
call fcn.10214e36
mov eax, 0x6e296ca6
lea esi, [esi + eax - 0x6e296caa]
movzx ecx, al
lea eax, [eax*4 + 0x193d2ebf]
add eax, ecx
mov edx, dword [esi + ecx*8 - 0x530]
jne 0x10158676

Function at 0x1071b379
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp + 4], eax
mov dword [ebp], edx
movzx eax, cl
mov dword [esp + eax - 0x31], 0xb73146b9
and word [esp + eax*8 - 0x187], cx
pop eax
pop ecx
jg fcn.10c14b67
lea ebp, [ebp + edx*2 - 0x490b1504]
dec dx
call fcn.1085ce31

Function at 0x107326cb
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi]
mov ecx, 0xcdb3042f
mov eax, dword [esi + 4]
call fcn.107d9a2f

Function at 0x1074fac1
Capabilities:
Check for software breakpoints

Disassembly:
lea ecx, [eax + ecx - 0x1e32db20]
loopne 0x1074faea
int 0xe1
rol ecx, 1
bswap ecx
call fcn.10bf93e6
mov esp, 0x55cb3e53
xor dh, byte [edx + ebx*4]
aas
fild word [esi - 0x55]
pop edi
pop es
js 0x1074fb08
dec ebp
lodsd eax, dword [esi]
fiadd dword [edx]
cmp byte [eax + 0x840f9a], 0xcc
add ah, cl
dec esp
loop 0x1074fb06
cmp dl, dl
jecxz 0x1074fac4
sub eax, 0x66027384
mov al, 0x3c
imul esp, dword fs:[edx - 0x5c], 0xdc8da42a
sbb dword [esi], ebx
push edi
inc byte [ebp + 0x58d64869]
test dword [ecx + 0x48], ebp
dec eax
salc
pop eax
leave
mov ecx, 0xcf9a4391
dec edi
sbb cl, byte [eax]
sub byte [edi], al
and al, 0x84
cmp ch, byte [ebp + 0x1b06dade]
in eax, dx
verr word [ebx - 0x1ca1b345]
cdq
movsd dword es:[edi], dword [esi]
jecxz 0x1074fb57
stc
add al, dl
jne 0x1074fb95
jo 0x1074fb61
loopne 0x1074fb86
xor al, 0x8c
bound esi, qword [eax - 0x626ce29d]
mov eax, dword [0x575180d9]
cmp eax, 0x418382
out dx, eax
mov bh, 0x10
push ecx
add bl, byte [edi]
not dword [ebx - 0x104a549b]
sub eax, 0x6149f2da
lahf
jg 0x1074fb6c
xor eax, 0xf0c8d035
enter 0x1470, 0x51
push ecx
sahf
int1
in eax, dx
aaa
cli
scasb al, byte es:[edi]
add bh, ch
cmpsd dword [esi], dword es:[edi]
rcl byte [ebx - 0x7a]
int3
push ebx
xchg ah, cl
mov eax, dword [0x7855d0f6]
sbb byte [edx], bl
in eax, 0x56
outsb dx, byte [esi]
mov eax, 0xd971188f
invalid
or esi, dword [edi]
mov dl, 0x5e
mov esi, 0xb0a7ef00
adc al, 0x57
push ecx
adc byte ds:[esi - 0x60], cl
or al, dl
adc ah, byte es:[ecx - 0x72]
push ebx
invalid
mov al, byte [0x1226d008]
popal
mov ss, word [ebx - 0x27]
aad 0x61
rcl dl, 0xf3
mov al, 0xcb
invalid
Function at 0x10766148
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, 0x6e9da41b
mov eax, dword [ebp + eax - 0x6e9da41b]
add ebp, 4
push 0xce968017
xor eax, ebx
inc eax
bswap eax
neg eax
add eax, 0xbf9cf8b6
call fcn.10adfa68
mov dword [edi + ecx], edx
xchg ecx, eax
or ecx, dword [ebp + ecx]
not ax
call fcn.10c050cd

Function at 0x107716be
Capabilities:
Execute syscall

Disassembly:
mov word [esp + ecx - 0x38], dx
mov edx, dword [esi + ecx*2 - 0x84]
lea esi, [eax + esi - 0x408cfffe]
sar word [esp + eax - 0x408cfffd], cl
pop eax
rol ecx, cl
movzx eax, byte [ebp + ecx*4 - 0x420]
sal ecx, cl
lea ecx, [ecx + ecx + 0x71a269a3]
dec cx
lea ebp, [ebp + ecx - 0x71a479a1]
not ecx
xor al, bl
ror word [esp + 3], 0xc7
xor dword [esp + 4], ecx
mov dword [esp + 4], ecx
rol al, 1
sub dword [esp + 1], ecx
adc cx, cx
add al, 0x16
call fcn.1070bcc5
syscall
push edx
dec eax
mov edx, 0x2eace31a
sbb dl, byte [edx + edx - 0x2509635b]
dec eax
mov edx, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xb035a6a7
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.10b263c8

Function at 0x10791578
Capabilities:
Encode data using xor

Disassembly:
add di, dx
cli
inc ebp
xor ah, bl
dec esi
lea ebx, [esp + ebx + 0x18]
call fcn.109b1ddc
loop 0x1079157a
xchg edx, eax
mov es, word [eax + 0x68]
scasb al, byte es:[edi]
fidivr dword [edi]
lodsb al, byte [esi]
out dx, al
add eax, 0xa0e04658
daa
inc edi
or esp, dword [0x3f967b17]
inc eax
nop
test eax, 0x7423f73b
cmp byte [edx + 0x16], 0xe7
xor dl, bh
push ebx
mov gs, word [esp + eax*8]
ficom dword [edi + 0x61]
nop
dec esi
popfd
push ebp
aas
or eax, 0x7443244d
popal
xchg ebp, eax
insb byte es:[edi], dx
xchg esp, eax
popal
push 0x26
invalid

Function at 0x1079bed4
Capabilities:
Encode data using base64

Disassembly:
inc ecx
xor edi, esp
push edx
inc cx
sal eax, 0x6a
jb 0x1085260b
ror edi, 1
neg edi
dec eax
shr edx, cl
xor edi, 0xdf9bb311
dec eax
lea edx, [edx*2 + 0x56ba0a8a]
ror edi, 3
movsx eax, dl
inc ecx
push ebp
dec esp
mov dword [esp + edx - 0x56ba0a7c], esp
shr word [esp + edx - 0x56ba0a91], 0x8e
dec ecx
not ebp
xor dword [esp + edx - 0x56ba0a7c], edi
dec esi
mov esp, dword [esp + ebp + 0x55]
call fcn.10a208c7

Function at 0x1079bf25
Capabilities:
Encode data using base64

Disassembly:
not dx
js 0x10a7c980
sub esi, 0xa51f1930
jmp 0x108644a1
not esi
inc esi
dec esp
lea eax, [edx*2 - 0x13759d6a]
movsx ecx, di
inc ecx
mov edx, 0x48ea297
dec esi
mov dword [esp + edi - 0x3c94affb], esp
inc edx
xor dword [esp + edi*2 - 0x79295ffe], esi
dec esp
lea ebx, [ecx*4 - 0x2a45f36b]
inc dx
mov dword [esp + edi - 0x3c94b001], 0x8b4ec93b
movsb byte es:[edi], byte [esi]
jl 0x108644e0
mov al, byte [0xc14986d6]
xchg byte [ecx - 0x3f], cl
in eax, 0x72
dec eax
arpl si, si
inc esp
adc ebx, edx
mov eax, 0x5e0a6e0a
dec eax
adc ebx, esi
dec edx
mov dword [esp + edi - 0x3c94b003], ebx
ret 8
mov dword [esp + eax*4 - 0x39ffc], eax
and cx, dx
or dword [esp + eax*2 - 0x1cffc], eax
call fcn.10c23aea
push ebp
pushfd
mov ebp, 0xac2073ac
mov dword [esp + 8], 0x635d5380
mov ebp, dword [esp + ebp + 0x53df8c58]
popfd
call fcn.10b7600a
Function at 0x1079ccd3
Capabilities:
Encode data using xor

Disassembly:
shr dx, cl
not eax
lea ecx, [eax + eax - 0x167368d4]
call fcn.10c4f1bf
bswap ecx
push eax
or edx, 0xdd98babc
js 0x10872b3d
and esi, dword [edi + 0xcb12997]
mov word [esi - 0x43ffcd08], gs
push edx
invalid
dec ecx
neg edx
inc eax
push edx
xor ecx, 0x4b2ea22e
and eax, 0x9a96c335
lea ecx, [ecx + edx*2 + 0x6ae77932]
ja 0x109a3221

Function at 0x107bede5
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], esi
mov esi, 0x521f6122
movzx esi, byte [eax + esi - 0x521f6122]
push 0xfd362aab
xor esi, ecx
and esi, 0xff
sal byte [esp], 0x63
mov esi, dword [esi*4 + 0x10c211c0]
shr ecx, 8
xor ecx, esi
inc eax
xor ecx, 0x4338b931
dec edx
lea esp, [esp + 4]
jne 0x107bede8
mov esi, 0x721d37ae
pop esi

Function at 0x107f6691
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
btr bp, 0x37
sar dh, 0xb5
adc dl, ah
mov ebp, esp
btc edx, 0x31
shr dh, cl
mov edx, dword [ebp + 8]
test edi, 0x9e1a1d3f
cmp ch, 0x37
sub esp, 0x114
push esi
test edx, edx
je 0x10857109
mov esi, dword [ebp + 0xc]
test esp, eax
test esi, esi
jmp 0x108ab4ac

Function at 0x10806c0f
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
dec byte [esp + 0x11]
test ebx, ebx
lea esp, [esp + 0x14]
je 0x10ae2145

Function at 0x10808af6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
add ebx, esi
dec esi
mov eax, dword [ebp + eax - 0x71]
inc cx
not ebx
dec edx
lea ebp, [ebp + ebp - 2]
inc ebp
movzx edi, byte [ecx + ecx - 0x71]
movzx edx, byte [esp + ecx - 0x5e]
dec ebp
lea ecx, [ecx + ecx*2 - 0xe1]
inc esp
movzx edx, dl
inc ecx
shl ebp, 0x81
inc ebp
xor bh, ah
inc ecx
movzx esi, bp
inc ecx
not bh
dec eax
add dword [esp + ecx - 0x68], ecx
inc ecx
xor bh, 0xa7
inc esp
sub bh, dl
dec eax
mov dword [esp + ecx - 0x71], 0x90aa72a9
inc ecx
rol bh, 1
dec edx
lea edi, [ecx + ebp*8 + 0x5f83deaa]
add byte [esp + ecx - 0x69], 0xf
inc ebp
xor ah, bh
dec ecx
sar ebp, 0xe8
dec esi
lea edi, [esp + edi + 0x28]
dec ebp
mov dword [edi + ecx*2 - 0xe2], eax
jae 0x10ccdb45
inc ebp
movsx edi, dh
dec eax
mov dword [esp + ecx*2 - 0xe2], ebx
ret 0x20

Function at 0x1080a9d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx - 0x79352f7a], edx
shr dl, 0x84
xor eax, ebx
xchg dword [esp + edx - 0x79352f07], edx
or dx, 0x57bb
not eax
jl 0x10be855d
dec word [esp + edx - 0x79357ff9]
dec eax