joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10dcc465
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x151aa2b4
pushfd
add word [esp + 4], 0x310
mov dword [esp + 8], 0x6a900fac
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10da9477
rdtsc
dec di
dec edi
lea esi, [esi + ebp*2 - 0x142]
inc ecx
not bl
dec edi
inc ebx
mov dword [esi + ebp - 0x99], eax
add esi, ecx
inc ebx
mov dword [ebp + esi - 0x9d], edx
jg fcn.10b9172b
sar cl, 6
sub ecx, 0x3417de95
mov word [edi + edx - 0x49bf], ax
shr dl, 0xa1
bswap ecx
btr edx, edx
jae fcn.10c088fe
not edx
adc ecx, edx
or dl, ah
shr eax, 0x7a
push eax
rol ecx, 3
imul eax, eax
xadd byte [esp + eax*2 + 2], ah
not dword [esp + eax + 0xb]
sbb ecx, edx
xor ebx, ecx
sal dx, 0xa8
add edi, ecx
pop eax
pop edx
pop ecx
pop edx
pop edx
jmp fcn.10c1ca3f

Function at 0x10de1a15
Capabilities:
Encode data using base64

Disassembly:
dec edx
lea esp, [esp + 0x10]
jne 0x10be1a83
mov edx, 0x1b394437
pop ebx

Function at 0x10de9e56
Capabilities:
Authenticate hmac

Disassembly:
push 0x9a09930e
xor edi, edx
push 0x8018b62a
and edi, 0xff
inc dword [esp + 4]
sal byte [esp], 0x41
sar dword [esp + 4], 0xc4
mov edi, dword [edi*4 + 0x10c51c0c]
jns 0x10d0ea77
push 0x42a32198
push 0xabbb27a0
shr edx, 8
xor edx, edi
inc eax
or dword [esp + 1], 0x69a8a101
xor edx, 0xa922393e
dec ecx
lea esp, [esp + 0x10]
jne 0x10de9ed6
mov edi, 0x66a59a28
pop edi
lea edx, [eax + edx - 0x60ea8476]
xor ebx, edx
mov dword [esp], eax
xadd cl, ch
adc ebp, edx
sub eax, 0x788933a0
lea edi, [edi + eax*2 - 0x560338b9]
movzx eax, byte [edi + eax*2 - 0x560338b8]
xor al, bl
lea ecx, [ecx*8 + 0x38afa931]
inc al
or cl, byte [esp + ecx - 0x5500100e]
neg dword [esp + ecx - 0x550010b3]
rol al, 1
lea edx, [ecx + ecx*4 + 0x6d2d7980]
add al, 0xa9
and edx, 0xedacdc08
xor al, 0x21
xor bl, al
dec ecx
lea eax, [esp + eax + 4]
mov cx, word [ecx + eax - 0x550010b2]
jnp 0x10e23ec7
lea esi, [edx + esi - 0x42ccc0a]
pop edx
movsx eax, dx
jns 0x10ad164a
mov dword [esp + 4], edi
lea esp, [esp + 4]
mov edi, 0xeb3c24a1
movzx edi, byte [eax]
jmp 0x10ba6a80

Function at 0x10e03b77
Capabilities:
Encode data using base64

Disassembly:
push ecx
add ebp, 4
or dl, 0x25
or ecx, ecx
inc dword [esp]
xor eax, ebx
lea edx, [edx + 0x7081579b]
xor dx, word [esp + edx*2 - 0x4c4d219c]
inc eax
sar dl, 0xe1
bswap eax
btr dx, 0x89
call fcn.10bd0706
movsx edx, ax
mov eax, dword [esi]
push edx
mov dword [esp + 4], edx
or edx, 0xb3006d91
xor eax, ebx
lea ecx, [edx + edx*2 + 0x79a74081]
shl dx, cl
bswap eax
not eax
push edx
sbb eax, 0xa63a1021
sar edx, 0x8f
sbb dx, 0xd72a
jns 0x10e1a369
mov edx, 0x78b8b182
mov ecx, dword [edi + edx - 0x78b8b182]
lea eax, [edx + edx*8 + 0x6a0c4f81]
lea edi, [edx + edi - 0x78b8b17e]
xor ecx, ebx
dec edx
sar al, 0xe2
setp al
ror ecx, 1
mul edx
mul ax
imul ax, dx
sbb ecx, 0xb62323a0
xor ecx, 0xe427d910
inc ecx
not eax
xor ebx, ecx
and dl, al
adc edx, 0xce119ea5
add esi, ecx
movzx edx, byte [edx + edi - 0x1d8b9f4e]
xor eax, 0x4d091607
adc edi, 1
or eax, 0xcc8be80a
jo 0x10d786b5
rol al, 0x23
xor dl, bl
neg dl
dec dl
jmp 0x10df129a
Function at 0x10e11972
Capabilities:
Manually build aes constants

Disassembly:
sub cl, al
btr edx, 0x3b
btr edx, 0x14
xor cl, 0x95
ror eax, 0xeb
btc eax, eax
sub cl, al
inc edx
xor cl, al
btr edx, 0x99
xor bl, cl
neg dl
cbw
push esi
bt edx, 0xa5
sub edx, eax
push ebp
push ebx
movzx ebx, dl
jnp 0x10d208f4
push 0x2924af0d
mov ecx, dword [esp]
mov eax, dword [ecx + esi - 0x2924af0d]
jmp 0x1177d9e2
and dx, 0x41b5
mov ebp, edi
mov ebx, ecx
and edx, eax
push eax
ror byte [esp + edx - 0xeffff], 0xe3
mov edx, ebx
inc word [esp + eax - 0x7ffffffe]
js 0x10cf6865
shl edx, 2
not eax
add byte [esp + eax - 0x7ffffffd], ah
or al, ah
mov eax, ebp
call fcn.11794a29
sub ebp, 4
mov edx, 0xe80cd783
movsx eax, dx
lea ecx, [eax + edx*2 + 0x620f4500]
mov eax, dword [ebp + ecx - 0x3228cb89]
btr edx, ecx
xor cl, 0
btc edx, ecx
xor eax, ebx
sub edx, edx
push ecx
lea eax, [eax + edx*4 - 0x578ab310]
sar byte [esp + edx + 2], 0x42
xor eax, 0x620a4e39
sal cl, 0x81
rol eax, 1
shl word [esp + edx + 1], 9
sbb eax, edx
xor ebx, eax
btc ecx, edx
sal word [esp + edx], 0xc3
sbb dl, ch
add esi, eax
mov ax, word [edi + edx*2 - 0x6a]
lea edi, [edx + edi - 0x33]
not dword [esp + edx*8 - 0x1a8]
sub edx, dword [esp + edx*8 - 0x1a8]
shl byte [esp + edx - 0x3296047c], 0x85
lea ebp, [edx + ebp - 0x3296047f]
movzx ecx, byte [ebp + edx*2 - 0x652c08fc]
bt edx, 0x1b
setb dl
xor cl, bl
and dx, dx
or dl, dh
not dx
inc cl
shl edx, 0x63
rol cl, 1
sal byte [esp + 1], 0x42
xor cl, 0x91
shl edx, 0x34
and edx, 0x34367a19
and dx, word [esp + edx - 0x33fffffe]
not cl
neg cl
xor bl, cl
shr dword [esp + edx*2 - 0x68000000], 0x62
push edx
xadd dword [esp + edx*2 - 0x67fffffc], edx
lea ecx, [esp + ecx + 8]
mov byte [esp + edx - 0x33483b27], dl
sbb dx, word [esp + edx - 0x33483b27]
sbb dword [esp + edx - 0x3348d3fe], 0xe91ce917
mov byte [ecx + edx*2 - 0x6691a800], al
mov eax, edx
movsx ecx, ax
mov dword [esp + eax - 0x3348d400], esi
ret 4
pop ecx
pop eax
pop eax
pop edx
pop ecx
jns fcn.10c6c737
sub edx, edx
rol ecx, 3
mul eax
xchg dx, ax
bt edx, eax
not ecx
bts eax, edx
lea ecx, [ecx + edx*4 - 0x3e907e38]
ror ecx, 1
bt eax, 0xb9
xor ebx, ecx
add ebp, ecx
lea esi, [eax + esi - 0x240009f0]
lea ecx, [edx + 0xc10b085]
not dx
xor al, 0x99
movzx ecx, byte [esi + eax*2 - 0x480012ec]
sar edx, 3
sub eax, eax
dec eax
xor cl, bl
jmp 0x10adee1f
mov edx, dword [esp + ecx*2 - 0x52495e1a]
mov ecx, dword ss:[ecx + eax - 0x2924af0d]
mov eax, dword [esp + edx - 0x2924af0d]
add eax, edx
mov dword [esi + edx - 0x2924af0d], ecx
mov ecx, edx
ror dx, cl
mov edx, dword [edi + edx*2 - 0x5248f0da]
shl al, 1
lea edi, [eax + edi - 0x52495e30]
adc ecx, eax
pop eax
xor edx, ebx
sar ecx, cl
sar al, 0x62
xor edx, 0xe434f70a
call fcn.10c1324a
Function at 0x10e2224f
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, byte [ebp]
xor cl, bl
movsx edx, ax
xor cl, 0x2f
shl dl, 0x26
not edx
xor al, ah
adc cl, 0xbc
sal eax, 0x49
setp dl
ror cl, 1
ror eax, 0xf4
bswap edx
cbw
not cl
adc edx, edx
cbw
sbb al, ah
sbb cl, 0x85
mul edx
call fcn.10d9ed25
movzx ecx, dl
mov ecx, dword [edi + edx*8 - 0x2e420]
lea eax, [edx + edx*8 + 0x6e1b9d37]
lea edi, [edi + edx*4 - 0x1720c]
xor ecx, ebx
imul eax
dec ax
ror dl, 0xc2
xor ecx, 0x49321682
ror ecx, 1
and byte [esp + edx*2 - 0x5ebd1430], 0x92
lea ecx, [edx + ecx + 0x1255ed09]
ror ax, 0x24
call fcn.10c520da
mov edx, 0x99bb7e0a
movsx eax, dx
movzx ecx, al
mov cx, word [esi + eax*4 - 0x1f828]
mov dx, word [esi + eax*4 - 0x1f826]
lea esi, [esi + eax - 0x7e08]
jmp 0x10c2b84d
call fcn.10e17fdc
pushfd
lea esi, [edx + edx + 0x2a29de9b]
pushfd
mov ecx, 0
dec edx
push ebp
mov dword [esp + esi - 0x7b3037fd], ecx
movsx edi, si
mov ebp, dword [esp + esi - 0x7b3037e5]
or edi, edi
rol ebp, 1
bt di, di
inc edx
xchg si, dx
inc ebp
sub edi, 0x2b053689
ror ebp, 1
inc edi
imul edx, edi
btr si, 0x9b
lea ebp, [ebp + edx - 0x7fdb8a1a]
sal dx, 0x8a
add ebp, ecx
jmp 0x10d2185a
lea ecx, [ecx*2 - 0x2cfdcac5]
mov ecx, dword [esp + ecx - 0x35177565]
call fcn.1177b73f
mov ecx, 0x1b32b108
lea esi, [esi + ecx - 0x1b32b10c]
movsx eax, cl
div al
sub eax, eax
mov edx, dword [esi + eax*4]
ror eax, 0x46
xor ecx, eax
xor edx, ebx
btc eax, 0x84
jae 0x10ca988f
xor edx, 0x852ee40d
sub edx, 0x86a5bc07
and eax, eax
sal ecx, 0x4f
xor ebx, edx
add esi, edx
or byte [esp + eax - 0x4004af03], ah
add word [esp + eax - 0x4004af05], 0x8ca7
mov eax, dword [ebp + eax - 0x4004af06]
movsx edx, cx
add word [esp + 2], dx
mov edx, dword [ebp + 4]
dec dword [esp]
xor cl, byte [ebp + 8]
push 0x32804c1c
call fcn.10a6aeee
mov ecx, 0xd436259c
not cx
sub ebp, 1
mov eax, ecx
ror cx, cl
jae 0x10a64ae7
mov ecx, dword [ebp]
add ebp, 4
jmp 0x10b574ba
Function at 0x10e33fb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror cl, 0x22
not al
rol al, 1
sal cl, 0xc2
imul ecx, ecx
bts cx, 0x2c
neg al
inc cx
xchg ch, cl
bts ecx, ecx
adc al, 0x2b
add cx, cx
ror cx, 0x2d
xor bl, al
inc cx
js 0x10d7378c
add eax, esp
shl ecx, cl
mov dword [eax + ecx*2 - 0x44404], edx
mov edx, ecx
lea esi, [esi + ecx - 0x22206]
mov eax, ecx
not eax
mov eax, dword [esi + ecx*2 - 0x44404]
xor eax, ebx
lea eax, [eax + ecx*2 - 0xb3d8435]
not eax
not ecx
rol edx, cl
jb 0x10bce7db
xor eax, 0x80862d1f
sal ecx, 0x18
not eax
lea eax, [eax + edx*2 - 0x1dfb985c]
push ecx
ror eax, 1
or ecx, edx
shl dx, 0xc
not eax
pop edx
ror eax, 2
bt cx, 0x1d
inc ecx
and edx, ecx
xor ebx, eax
jmp 0x10af0725
rol ecx, 0x46
add ebp, eax
jmp ebp
sbb edi, 7
jmp 0x10d1121b
mov dword [edi + 0xc], eax
mov eax, 0x74963d09
mov dword [edi + eax - 0x74963d01], ebx
or ax, 0x6faf
jge 0x10d622df
inc eax
inc dh
inc eax
xor dh, 0x9c
inc esp
mov ebx, ecx
inc eax
rol bh, 0x21
dec edx
lea ebx, [ebx*4 + 0x261d1431]
inc ecx
adc dh, ch
inc ebp
xchg ebx, edi
dec ecx
sal ebp, 0x28
inc cx
sbb edi, 0xd0408a10
invalid
jmp 0x10d0c48e
mov dword [eax + edi - 0x74967fab], ecx
lea ebx, [eax + 0x10b2a9f]
mov dword [edi + eax - 0x74967faf], edx
mov edx, eax
pop ebx
lea ecx, [edx + eax*2 - 0x7dc823f4]
xchg edx, ecx
imul ax, cx
jb fcn.10a522e2
mov edx, 0x7628111e
sar edx, 0x22
lea ecx, [edx*4 - 0x61f08d6d]
mov ecx, edi
lea edi, [edx + edi - 0x1d8a044b]
mov dword [edi + edx - 0x1d8a0447], ecx
mov ecx, edx
mov eax, ecx
neg cx
lea esi, [edx + esi - 0x1d8a044b]
jp 0x10bca7c5
mov ecx, dword [esi + edx*2 - 0x3b14088e]
cdq
xor ecx, ebx
shr edx, 0x12
ror ecx, 1
not edx
imul eax, edx
xor eax, 0x5137108c
xor ecx, 0xe2986e0d
mul ax
rol ecx, 1
add ax, 0xaa93
sbb ecx, 0xcd0847ba
neg eax
not eax
cwd
xor ebx, ecx
rol ax, 0x41
setae dl
inc eax
adc ebp, ecx
btc edx, edx
lea ecx, [eax*2 - 0x25425867]
jae fcn.10cf0654
mov dword [esp + edx - 0x1b0080ea], edx
xor bl, cl
lea ecx, [esp + ecx + 0xc]
xor dx, dx
mov eax, edx
mov edx, dword [ecx + edx - 0x1b000000]
pop ecx
sbb ecx, dword [esp + eax*4 - 0x6bffffff]
lea ebp, [ebp + eax*2 - 0x36000004]
setb cl
sar al, 0x85
push ecx
mov dword [ebp + eax - 0x1b000000], edx
pop eax
pop eax
pop eax
jns fcn.10d4ada1
ret
loop 0x10d949c3
xlatb
xor eax, ebx
xor eax, 0x89a776b9
and cx, 0x6137
btc ecx, edx
bswap eax
btc edx, edx
or dx, dx
rol eax, 3
xor dx, cx
jne 0x11772d8f
call fcn.10c9742c
jp 0x10d94985
sbb bh, byte [edi]
push edi
bound ecx, qword [edi - 0x364e4f3c]
scasb al, byte es:[edi]
fmul st(7), st(0)
and dl, bh
mov edx, 0x384bbf3c
sbb al, 0xb7
dec ebx
cmp byte [edi + esi*4], bl
int3
push 0xdb1c172b
sal dword [esp + 9], 0xb0
test edx, edx
push 0xb219f0a4
jmp 0x10d949ab
lea eax, [edx + eax + 0x316f8974]
setbe cl
ror edx, 0x13
dec edx
xor ebx, eax
btr edx, 0x32
lea edx, [edx - 0x74bf4d4]
setb dl
add ebp, eax
neg cl
mov eax, 0xd92e1be
movzx dx, byte [edx + esi - 0x2fc5b801]
dec eax
call fcn.10abb2e6
jae 0x10a64634
lea ecx, [edx*8 - 0x17f626ff]
mov ecx, dword [edi + edx*2 + 4]
lea edx, [edx*8 - 0x7b5205d2]
inc edx
bswap edx
push ebx
lea edx, [edx + edx*4 + 0xb08c28c]
cpuid
jne 0x10cc490a
Function at 0x11776e7f
Capabilities:
Authenticate hmac

Disassembly:
push esi
pushfd
mov esi, 0x9e0422ab
mov esi, dword [esp + esi + 0x61fbdd59]
mov dword [esp + 4], 0x915b5131
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1178bfea
mov ecx, 0x1232c7a6
movsx eax, cl
sal al, cl
lea ebp, [ebp + ecx*4 - 0x48cb1e9c]
and ecx, ecx
ror ecx, cl
rol eax, cl
mov eax, dword [ebp + eax*2 - 0x7fffffc0]
adc cx, 0xec36
mov edx, ecx
xor eax, ebx
dec edx
bt dx, 0x35
jae 0x10b9e0c8
syscall
push ecx
dec eax
mov dword [esp], 0xff6e7118
call fcn.10c6db11
not eax
xor ebx, eax
shl cx, 0x26
dec edx
sar ecx, 0xbc
add ebp, eax
mov dx, word [edi + edx*4 - 0x1ffc]
xor edx, 0x3fa1fe19
ror edx, 1
shl word [esp + 8], 0xc3
sub dword [esp + 0xf], 0x912b1a09
sar dword [esp + 0xc], 0x6b
not edx
dec edx
shr word [esp + 0x10], 7
xor ebx, edx
dec word [esp + 9]
add esi, edx
push 0x9cb6cd0e
not dword [esp + 0x15]
lea esp, [esp + 0x20]
jmp 0x10b24d21
dec eax
btr ecx, ecx
ror eax, 2
neg dx
bts ecx, ecx
call fcn.10cece82
mov dword [esp + 0x10], 0x39370c94
dec edx
sar dword [esp + 6], 0x10
jb 0x10b7f52f

Function at 0x1177c5ee
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
neg edx
ror edx, 1
neg eax
xor ebx, edx
add edi, edx
movsx edx, cl
movzx ax, byte [esi + ecx*2 - 0x7166af60]
not edx
mov dl, byte [esi + edx - 0x4d]
not ecx
sub ecx, 0x41902798
adc esi, 2
add al, dl
movzx edx, cx
bts ecx, edx
and edx, edx
mov word [esi + edx*2 - 0x1016e], ax
js 0x10cf34e9
ja 0x10b347db
xor edx, ebx
jmp 0x10b37cb9
push edx
mov dword [esp + edx*4 - 0x202dc], edi
ret
neg edx
push 0xe6b0c62f
mov dword [esp + 8], 0x2f24cca6
add edx, 0x3c0f7688
neg edx
shl dword [esp], 0xb7
adc dword [esp + 0xc], 0xe6186f94
inc edx
not byte [esp + 2]
neg word [esp + 0xd]
jp 0x10ac222a
neg edx
call fcn.10c0934c
mov edx, 0xfa8edb82
bts edx, edx
rol edx, 0x4b
mov eax, dword [edx + ebp - 0x76dc37d4]
lea ebp, [ebp + edx - 0x76dc37d0]
mov ecx, edx
ror cx, 0xa1
and cx, cx
xor eax, ebx
bt cx, dx
cmovae ecx, edx
bt dx, cx
inc eax
dec cx
sal cl, 0xc7
xor eax, 0xcd08820f
add cl, cl
neg eax
call fcn.10e23d7b
mov edx, dword [esp + eax*8 - 0x6c725a14]
xor ecx, ebx
not ecx
shr word [esp + eax*2 - 0x1b1c9686], 0xcf
sbb ecx, 0xcdb9edbc
and dword [esp + edx - 0x1f], eax
mul dl
cwde
not ecx
xor ecx, 0xdf8d3f23
ror edx, 0xde
pop eax
cdq
ror ecx, 1
add ecx, edx
xor ecx, edx
sar dl, 0x42
jbe 0x10a6909a
inc bp
mov esp, dword [esi]
mov edi, 0x3b07930c
inc dx
mov esi, dword [edi + esi - 0x3b07930a]
mov ebp, 0x182555ad
movzx edx, bp
inc edx
mov cl, byte [edi + esi - 0x3b079308]
jmp 0x10e33b0c
jmp 0x10b1d60a
Function at 0x1178ded7
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
pop ecx
jae fcn.10c6c737
lea eax, [ecx + ecx + 0x561fed3a]
mov ecx, dword [esi + eax - 0x78691694]
mul ax
sal byte [esp + edx*2 - 0x6e4803f3], 0xe1
mov dx, word [edx + esi - 0x372401f9]
ror word [esp + eax - 0x7869c589], 0x8f
call fcn.10cf1765
mov dword [esp], 0x91243e94
mov ecx, dword [esp]
sub eax, 0x1c90de29
mov dword [esp + 4], ecx
ror eax, 2
lea eax, [eax + ecx + 0x5661903]
btc cx, 0xb7
lea edx, [ecx + ecx*8 + 0x1c3b0dbb]
not eax
xadd word [esp + edx - 0x36813c6c], cx
add byte [esp + edx - 0x36813c6d], dl
or word [esp + edx - 0x36813c67], 0x5299
xor ebx, eax
xor cl, dh
not edx
imul edx, edx
add ebp, eax
neg dl
jae 0x10d6517f
mov ecx, 0xa695e021
movsx edx, cx
sub edi, 4
xor cl, cl
mov eax, dword [edi]
xor eax, ebx
bt ecx, edx
bt ecx, 0xaf
xor eax, 0x7b350717
lea eax, [eax + edx - 0x4a4ed893]
sal edx, 6
not eax
sub ecx, ecx
sar ecx, 0x3c
inc eax
bts dx, 0x3e
sar cx, 7
push edx
xor ebx, eax
shr dx, 0xe8
xor dl, ch
lea esi, [esi + ecx - 4]
bswap ecx
shl byte [esp + ecx*2], 6
shl ecx, 0xaa
mov dword [ecx + esi], eax
and word [esp + ecx], cx
adc edx, edx
jo 0x117739a0
lea edi, [edi + ecx - 4]
mov eax, dword [ecx + edi]
xor eax, ebx
sub edx, dword [esp + ecx]
dec edx
lea eax, [eax + ecx*2 - 0x17bd73ac]
sal dword [esp + ecx*2], 0x12
bt edx, 0x2d
not eax
sar dword [esp + ecx], 0xc4
inc cl
imul cx, cx
neg eax
sar ecx, cl
setb dl
sar dword [esp + ecx*4], 0x64
ror eax, 2
xor ebx, eax
rol byte [esp + ecx + 3], 0x46
and edx, 0x6639a78f
bts dx, 0xa4
adc ebp, eax
movzx eax, word [esp + ecx]
and edx, ecx
jbe 0x10c8d083

Function at 0x1179c221
Capabilities:
Encode data using xor

Disassembly:
rol ax, 0x4f
neg cl
and dx, word [esp + edx - 0x1e64487c]
xadd dl, al
xor bl, cl
neg edx
add edx, eax
sub eax, 0x88292599
mov dword [esp + edx - 0x4a91be45], edi
mov dword [esp + edx - 0x4a91be49], esi
imul dx, dx
push ebx
mov ebx, ecx
lea edx, [eax*4 - 0x276b67e4]
jo 0x10b64ee8

Function at 0x117a0788
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec dword [esp + 4]
xor ecx, ecx
rol dword [esp + 4], 0xd7
setae byte [esp + 4]
test edx, edx
lea esp, [esp + 8]
je 0x10cb1057
push edi
Function at 0x117a194d
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
shl dl, 0x21
inc al
sar edx, 0x5e
xor bl, al
sal edx, 0xde
add eax, esp
jmp 0x10c9ea48
mov edi, esi
xchg dx, di
pushfd
pop eax
mov dword [esp + edx - 0x738f02af], eax
dec di
mov eax, 0x21b7f494
cwd
mov eax, 0
movzx ebx, dx
mov dword [esp + ebx*2 - 0x1fff2], eax
push ebx
inc dx
mov esi, dword [esp + edx - 0x738effdc]
add edx, edi
bswap edx
and dword [esp + ebx - 0xffff], edi
neg esi
or dword [esp + edx - 0x377ec1f3], 0x43283b9b
lea edx, [edi + ebx*4 + 0x36a5db13]
ror word [esp + ebx - 0xfffe], 0xf
not esi
imul edi, ebx
ror esi, 1
shr word [esp + ebx*4 - 0x3fffc], 5
js 0x10c7c8e5
shl bx, 0xee
lea esi, [esi + ebx*4 - 0x2339872a]
add esi, eax
rol word [esp + ebx*8 - 0x5ffff], 8
bts bx, 0x87
bswap edx
mov dword [esp + edx - 0x4659dc96], ebp
pop eax
mov dword [esp + ebx*2 - 0x180e0], ecx
not ax
sbb dx, 0xf0b7
and edi, 0x74ae9390
mov edi, esp
imul eax, edx
lea ebx, [edi + ebx - 0xc140]
movzx ecx, ax
inc ecx
mov esp, ebx
Function at 0x10017150
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1001716e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10017163
pop esi
ret
Function at 0x1009f080
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1009f0be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1009f0b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1009f0c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1009f0a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1009f190
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1009f1c1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1009f1c1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x1009f1c1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100b743a
Capabilities:
Encode data using xor

Disassembly:
call 0x100b73b3
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100b73e3
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x100b73ff
xor edx, 0
jmp 0x100b740a
xor edx, edx
jmp 0x100b7421
jmp 0x100b742d
xor eax, eax
push 0x8427d7c0
call 0x100b743a
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x100b7476
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x100b744f
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x100b748d
add eax, 0
jno 0x100b7492
add esi, 0
ret 0x10
Function at 0x100b81fb
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x100b821d
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x100b83bf
cmp edi, dword [ebp + 0x10]
jb 0x100b83bf
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.100b7ce7
inc edi
jmp 0x100b82a6
jmp 0x100b82b3
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.100b7ce7
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.100b7ce7
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x100b8307
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x100b82eb
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.100b8335
add dword [eax], 0x39
jle 0x100b8311
sub al, 0xf5
mov ch, al
call fcn.100b834a
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x100ba022
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x100ba038
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x100ba049
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.100ba08a
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx
Function at 0x100bc3f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x100bc33f
add ebx, 0
push ecx
call 0x100bc354
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x6dce71ec
sub ebx, dword [0x6dd06a2b]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x6dd06a1b
call fcn.100b7e1e
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.100b732c
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x100bc4b2
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x100bc4b2
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x100bc469
mov eax, 1
lock xchg dword [0x6dd06a27], eax
push 0x3dd1fc71
call 0x100bc3f6
push esi
add esp, 8
cmp eax, 0
jne 0x100bc3df
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x100bc405
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x100bc41a
cmp ecx, edx
cmp eax, 0
je 0x100bc43f
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x100bc429
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.100bc458
dec eax
loope 0x100bc45b
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x6dd06a27], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x100bc48f
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x100bc4a4
jmp 0x100bc4af
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x100bc39d