joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009646a
Capabilities:
Encode data using xor

Disassembly:
call fcn.101e03d9
int3
je 0x104ae839
xor bp, 0xfb97
mov edx, 0xd02ec6af
neg ebp
add dword [esp + 0x18], 0xffdb5585
add ebp, 0xea8f720
sub ebp, dword [esp + 4]
push edx
jge 0x1040c430
inc edi
mov ah, ch
cmp al, byte [esi]
mov ebx, dword [0x1314fa67]
jecxz 0x1009651b
and ecx, dword [esi]
mov ch, 0x59
inc eax
mov bh, 0xe5
std
iretd
push cs
jl 0x10096534
lcall 0xdef0, 0x79d3406d
xchg edi, eax
jg 0x1009655e
sar dword [ecx - 0x10], cl
ficom word [edi + 0x581e357f]
push ds
pop eax
xor eax, 0xb5a6e395
jp 0x10096522
dec edx
mov byte [0xc8e943a7], al
lodsb al, byte [esi]
pushaw
retf 0x3504
xor dword [ebx - 0x5a], ebx
pop edi
invalid
sub dword [esp + edx + 0x60ec], 0xe32f792e
mov edx, dword [esp + edx*2 + 0xc1d4]
not dword [esp + 0x1c]
js 0x1001c3d1
ror edx, 3
movzx ecx, ax
or cl, ah
xor edx, 0xeb28a32e
push ecx
bswap edx
call fcn.1012cb1e
mov edi, 0xbeb5e723
mov edi, dword [esp + ebp*2 - 0x1d508152]
mov edi, dword [edi + ebp*2 - 0x1d50816e]
and word [esp + ebp - 0xea840b7], dx
movsx dx, byte [esp + edx + 0x2fd13953]
sub dword [esp + ebp*2 - 0x1d508166], edx
test byte [esp + edx*2 + 0x5fa3ffac], 0xe
setb byte [esp + edx*2 + 0x5fa3ffa4]
movzx edx, word [esp + edx*2 + 0x5fa3ffac]
not edx
lea edi, [edi + edx - 0x74d83395]
test edx, 0x7b02dbb2
mov byte [esp + edx*2 + 0x1b1b0], 0xae
not bp
setno byte [esp + edx + 0xd8dc]
mov dword [esp + ebp*2 - 0x1d517e74], edx
xchg dword [esp + edx + 0xd8f4], edi
mov ebp, dword [esp + edx + 0xd8ec]
or dl, byte [esp + edx*2 + 0x1b1c6]
and dword [esp + edx + 0xd809], 0xafa23f04
add dx, 0x771d
jne 0x1015320f
lea ecx, [eax + ecx + 0x6c27babe]
xor edx, 0x5635c80d
sar ecx, 0x7b
xor ebx, edx
lea ecx, [eax + ecx*2 + 0x3eb2a199]
xchg ecx, eax
add edi, edx
mov edx, dword [esi + eax - 0x1d7237da]
and ecx, ecx
mov ecx, dword [esi + eax*4 - 0x75c8df64]
call fcn.1058f9b7
mov eax, dword [ebp + eax - 0x42390881]
imul ecx
mov ecx, 0x963c0731
lea ecx, [ecx + ecx*4 + 0x4a230b7]
inc cx
mov dword [ebp], edx
mov dword [ebp + 4], eax
sub esi, 4
call fcn.10583198
or dx, dx
mov edx, dword [esp + edx - 0x2e00df9e]
mov dword [esp + 4], esi
call fcn.10529da4
call fcn.10303904

Function at 0x100a3dfe
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lea edx, [edx + ecx - 0x27769f4]
mov dword [esp + eax - 0x518d], ecx
dec cl
jne 0x102401f8
invalid
xor ebx, edx
or dword [esp + eax - 0x518d], eax
adc esi, edx
shl ecx, 0xac
adc dword [esp + eax*2 - 0xa31a], 0x4b08b196
mov edi, dword [edi + eax*4 - 0x14634]
pop eax
jb fcn.1031df4e
Function at 0x100b9b4b
Capabilities:
Encode data using xor

Disassembly:
add ebp, 2
shr dx, cl
mov dword [esp + 4], 0x6b8bfe34
mov word [ebp], dx
sub edi, 4
mov ecx, dword [edi]
mov eax, 0x498b2d3d
xor ecx, ebx
lea edx, [eax*2 + 0x6e08869b]
mov dword [esp + eax - 0x498b2d3d], eax
call fcn.1063fe64
pop ecx
nop
mov al, 0x4b
sub byte [edx], al
push cs
sub dh, dl
cmpsb byte [esi], byte es:[edi]
push ds
add ch, byte [eax - 0x13]
xlatb
shl byte [ecx + 0x3743291b], 1
mov ah, 0xbe
test al, 0xd7
sub byte [edx], cl
xchg ebp, eax
popfd
xlatb
push ds
xor byte [edi + 0x76bbd761], al
pop ds
stc
sub byte [edx + 0x5e], dh
mov eax, 0xe9ac2912
push 0x2b
jg 0x100b9b37
fcmovnbe st(0), st(2)
xlatb
inc esi
and edi, dword es:[edx + 0x512bd6c6]
and edi, dword [edx + 0x512bd6c6]
popfd
jns 0x100b9bf6
pop ss
and al, 0xd5
cmpsb byte [esi], byte es:[edi]
push cs
xlatb
and al, 0xde
lodsd eax, dword [esi]
aam 0xab
jnp 0x100b9c0c
mov byte [0x2a52f70d], al
insb byte es:[edi], dx
clc
and eax, 0xfaf52886
push 0x663a9350
xchg byte [ebx + 0x6c605504], bl
fisttp word [eax + 0x4b]
mov bh, 0xcc
sub dword [edx + 0x4c1ebe59], esi
int1
stosd dword es:[edi], eax
in al, 0x59
jae 0x100b9bba
push cs
sub dl, byte [ebp + edx - 0x31f37197]
in eax, 0xa2
mov eax, dword [0x74b54b6f]
test byte [ebx], dh
xchg esi, eax
insd dword es:[edi], dx
ficom dword [ebx]
xchg byte [edx + 0x74987a9], dh
rcl dword [edx + 0x4b]
js 0x100b9c4b
xchg byte [ebx + 0x3be539ee], ah
push ds
jb 0x100b9c92
ret 0x567d
invalid
ror byte [ebx + 0x5c], 0xc7
sub al, 0x18
inc ecx
sub cl, byte [eax - 0x3a]
int3
imul esi, dword [esi + 0x6bef5dbf], 0xd9f7f033
neg ecx
aad 0x6e
aas
add edx, dword [esi + 0x59]
xchg edx, eax
inc eax
mov esp, 0x881552d2
jno 0x100b9c2f
je 0x100b9c8a
inc ebx
or al, 0x51
or ebp, dword [edi - 0x56]
dec edx
fiadd word [edx + edx*8 + 0x1378cb69]
dec ebp
dec ecx
popal
mov edi, 0x4bad3007
sub byte [esi], 0x67
xor byte [ebp + 0x672e824b], ch
pop esp
bound ebx, qword [edi + 0x45e1dae5]
aam 0x3b
xchg edi, esp
xchg esp, eax
xchg esi, eax
inc ecx
cmp ah, ah
rcr dword [edx], cl
fild word [edx + 0x18]
inc ecx
lodsd eax, dword [esi]
leave
mov esi, 0x220a5d2d
mov edi, 0xbd5a5baf
test ch, bl
imul esp, edx, 0x34fd1141
or dh, dh
inc eax
mov ecx, 0xf54040ea
int1
int 0x8c
test dword [ecx + 0x1f], eax
inc ebp
jae 0x100b9cb9
or al, 0xa0
jnp 0x100b9d58
rol byte [ecx + 0x6e], 0x16
push esp
and dword [ecx - 0x22], edi
jnp 0x100b9d59
mov esp, 0x82bb2db6
xlatb
loope 0x100b9d4e
sub al, 0x37
test al, 0xce
sbb byte [eax + 0x503b4290], bl
lahf
les eax, [eax - 4]
invalid
dec ebx
clc
lcall 0xf4b7, 0x4f85adc1
stosd dword es:[edi], eax
cmc
mov ah, 0xa7
pop ebp
mov edi, 0xf7d4170e
mov edx, 0x2d0dd588
push esi
loop 0x100b9db6
inc ebp
js 0x100b9dc1
jbe 0x100b9ddc
push ds
sub al, 0xbc
invalid
ficomp word [0xcdf2e392]
insd dword es:[edi], dx
add dword [edx], ecx
xor byte [ebx - 0xe], bh
pushal
pushal
push esp
xchg dword [edi], ecx
mov ebx, 0x344b74db
int1
invalid
daa
loope 0x100b9de3
adc dh, byte [ebx]
mov al, 0x6f
fisubr dword [ecx - 0x6a13a2c2]
in al, dx
xchg ebp, eax
daa
ja 0x100b9dd1
pop edi
xchg edx, eax
mov byte [0xed2bacb8], al
invalid
Function at 0x100c7848
Capabilities:
Packed with generic packer

Disassembly:
mov byte [edx + eax - 0x75979d0f], cl
lea edi, [eax + edi - 0x75979d13]
jne 0x102392c9
lea edx, [eax*4 + 0x790b052d]
mov dword [esp + edx - 0x4f697969], eax
mov ecx, dword [edi + edx - 0x4f697969]
neg dword [esp + eax - 0x75979d0f]
xchg esi, eax
mov al, 0x8b
mov word [edi], ss
xchg edi, eax
xchg byte [esi + 0x49cf7b0], dl
int1
bound ebp, qword [eax - 0x76]
shl edx, 0x85
js 0x106b8c2f
or edi, dword [ecx]
lahf
cld
sub al, 0xdc
pop eax
and eax, 0x42ccad7a
jae 0x102392d5
invalid

Function at 0x100cd9eb
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, 0x2d206b28
pushfd
test esi, esi
not si
jg 0x1026e796
mov ecx, 0x4906573e
bswap eax
call fcn.105fedd4
leave
mov bh, 0x48
sub byte [ebx], ah
pushfd
dec edx
xchg ecx, eax
lahf
lodsb al, byte [esi]
inc ebx
lea ebp, [esi + 0x61]
dec ebp
insb byte es:[edi], dx
daa
nop
dec ebp
invalid
add dword [esp + esi*2 - 0x5a4129a6], 0xeffed4d6
mov dword [esp + 0xc], 0x3b4ec51
mov esi, dword [esp + esi*2 - 0x5a4129aa]
popfd
lea esp, [esp + 8]
call fcn.10674e81

Function at 0x100ddfa3
Capabilities:
Packed with generic packer

Disassembly:
mov si, 0x172d
mov ebx, dword [esp + esi - 0x632b1715]
mov ebx, dword [ebx + esi - 0x632b172d]
lea edi, [edx*8 + 0x24bed2a5]
add dword [esp + ebp + 0x57f4963a], 0xeff97075
call fcn.102f0200
Function at 0x100e2b61
Capabilities:
Execute anti-debugging instructions

Disassembly:
or byte [edx], 0xa6
iretd
in eax, 0xe8
cmp byte [eax - 0x7372ffe0], bl
inc ecx
clc
pop ss
out dx, eax
dec ebp
call fcn.101f42ec
mov eax, 0x69817006
rdtsc
jmp 0x103f80da
sub edx, dword [edi - 0x73]
mov word [eax + 0x27], es
test al, 0xa9
jb 0x100e2b16
test byte [eax], bh
arpl ax, bx
aam 0xa8
ror cx, 0x8e
jae 0x102c8b5e
mov edx, dword [ebp]
call fcn.103853ba
push esp
and eax, 0x27f4e800
sub al, byte [eax]
pop esp
stc
sub dh, byte [si + 0x4f4f]
push ebx
fisttp qword [ecx + 0x2c]
xor ch, ch
aam 0x1d
aaa
jno 0x100e2b60
pushal
movsb byte es:[edi], byte [esi]
bound esi, qword [ebp + ecx*2 + 0x15e666aa]
xor eax, 0x1e82cdec
pop eax
cmpsb byte [esi], byte es:[edi]
mov edx, 0x5b411afb
out 0xe8, al
loope 0x100e2b81
pop esi
xor edx, dword [0xe089c9e6]
fimul dword [eax + ecx*4 - 0x56c59815]
mov ah, byte [ebx + ecx*4 + 0x71d9ace4]
call 0x160a3ea5
fidiv dword [edi + 0x60]
mov word [esi - 0x4d254de1], fs
out 0xd1, al
sahf
adc ecx, ebp
inc esi
mov ch, 0xa7
ficom dword [esi]
stosd dword es:[edi], eax
fsubp st(2)
movsb byte es:[edi], byte [esi]
jbe 0x100e2bbe
clc
cdq
inc esp
shr byte [ecx], 1
cmp dh, ch
das
adc dword [edx - 0x285863e1], 0xffffffe5
stc
add edi, dword [0x2ed34b08]
or byte [edx + 0x1d2c2621], al
pushfd
cmp byte [edi - 0x2f], ah
add al, bh
invalid
jle 0x100e2bbd
inc ebp
mov edx, dword [ecx + edx - 0x660e9686]
inc ecx
movzx ecx, ch
inc ecx
not ch
dec ebp
lea ebp, [eax + ecx*2 - 0x3ce36c4c]
dec esi
lea ecx, [edx + ecx - 0x660e9682]
call fcn.10099f2c
lea edi, [edi + ecx - 0x782b7bf4]
rol ecx, cl
movzx edx, cl
shr cx, 0xa4
xor eax, ebx
shl dx, 0xe1
xor eax, 0x373dea83
lea eax, [eax + edx*2 + 0x768d2ac3]
call fcn.101e600e
mov eax, 0xe804d109
push eax
mov word [esp + 1], ax
mov edx, dword [esi]
mov ecx, 0x8b0f710f
neg word [esp + 1]
xor ax, cx
adc esi, 4
xor edx, ebx
bswap edx
jmp fcn.1029a60e

Function at 0x100ef236
Capabilities:
Packed with generic packer

Disassembly:
rol eax, 3
dec eax
rol ecx, 0x26
mov dword [esp + ecx - 0x4fec5fd9], edx
call fcn.1061902c

Function at 0x100f08d7
Capabilities:
Packed with generic packer

Disassembly:
lea ebx, [ebx + ecx - 0x690589f1]
cmove esi, ecx
jb 0x10249109
xor cx, word [esp + 0x14]
add dword [esp], 0xffe2715a
add ecx, dword [esp + 8]
lea ecx, [edx + 0x2b888406]
bswap esi
je 0x104877df
xchg dword [esp + ecx - 0x1b307a99], ebx
mov esi, dword [esp + ecx*4 - 0x6cc1eae8]
shl cl, 0xd1
sub cl, 0x9d
xor edx, dword [esp + ecx*4 - 0x6cc1e984]
cmp dl, 0x38
lea edx, [ecx + ecx*2 + 0x2834f122]
mov ecx, dword [esp + edx - 0x79c6602b]
mov dl, dh
push esi
call fcn.101994e8

Function at 0x100fd942
Capabilities:
Encode data using base64

Disassembly:
bswap edx
bswap edx
add dword [esp], 0xfff133d9
mov eax, dword [esp + 0xc]
and esi, 0xf50dffba
sub al, 0x39
sub ax, word [esp + 0xd]
mov eax, dword [esp]
mov eax, dword [eax]
cmp byte [esp + 0xc], 0xac
mov dword [esp], edx
call fcn.103600f7
inc eax
call fcn.102ce0a9
Function at 0x1010e60c
Capabilities:
Encode data using xor

Disassembly:
cmp ecx, 0xf5174f1a
bswap ecx
mov ecx, dword [esp + 8]
call int.106ad748
mov ecx, 0xc9351339
test cx, 0x6187
jno 0x10078ae2
Function at 0x1012d1c6
Capabilities:
Packed with generic packer

Disassembly:
xor edx, ebx
lea eax, [eax + ecx*4 + 0x38cf99]
and ax, 0x9292
ror edx, 2
dec edx
shl ecx, cl
jo 0x105dee25
bswap edx
jo 0x1015d9de
sbb eax, 0x5924f82e
ror edx, cl
sar ecx, cl
call fcn.102b6257
xlatb
inc edx
in eax, 0x8d
pop edi
aam 0x4d
adc dword [ecx - 0x108ec30b], esp
pop ds
sub eax, 0xee9215c6
inc edx
test byte [edx + edi*4 + 0x10], ah
jb 0x1008bff2
mov esi, 0xf7b5110
adc dword [ebp - 0x10f1fc96], ebp
repne cmpsb byte [esi], byte es:[edi]
invalid
or bl, byte [eax + esi + 0x7261aea]
inc ebx
or dword [eax + 0x6601595], esp
std
cmpsb byte [esi], byte es:[edi]
inc ebx
sub edi, dword [0x8cfd1cb6]
mov ch, 0xe1
or al, 0x2d
cwde
neg dword [ecx + 0x42]
dec edi
sti
movsb byte es:[edi], byte [esi]
invalid
mov dword [esp + ecx*2 - 0x10004000], eax
xor edx, 0x2ab8530e
rol cl, 0x46
shr ax, 0xa2
jbe 0x1061edbf
inc ecx
mov ebx, 0x60abcb8f
inc ebx
mov esi, dword [ebx + ecx - 0x60abcb8f]
dec edi
lea ecx, [ecx + ebx - 0x60abcb8b]
dec edi
lea esi, [ebx + ebx*4 - 0x17510dc1]
dec ecx
neg ebx
inc ebp
movzx eax, bl
inc ecx
xor esi, esp
add esi, 0xd83d2f26
dec ebp
add ebx, ebx
not esi
inc ecx
movsx ecx, ax
inc ebp
movzx ebp, dh
jp 0x10215e0d
mov ecx, 0x440cd1a7
mov edx, dword [esi + ecx - 0x440cd1a7]
mov eax, ecx
lea esi, [esi + ecx - 0x440cd1a3]
xor cl, cl
and eax, eax
sar cl, 0x47
xor edx, ebx
add eax, ecx
inc cx
lea edx, [edx + ecx*2 + 0x3804bc93]
jno 0x1043636d
dec esp
mov edx, ebp
inc ecx
pop ebp
dec eax
lea ebp, [ebp + eax - 0x17909d0b]
inc cx
sal ebp, 0xc4
inc esp
mov dword [eax + ebp - 0x17909d07], edx
dec esp
mov dword [esp + eax*2 - 0x2f213a0e], ebp
pop esi
js fcn.102e94b3
mov dword cs:[ebp - 0x6b], eax
xchg dword [edi], esi
into
xor esi, dword [ebp + 0x22]
iretd
rol eax, 2
shr cl, 0x22
inc dl
xor ebx, eax
bswap ecx
xchg cl, dl
inc dx
add edi, eax
not dl
xor edx, 0x6101a6a5
xor cl, cl
jmp edi
dec esi
bswap esi
inc ecx
push esi
inc si
xor dword [esp + eax - 0x6b], eax
dec esi
mov dword [esp + eax - 0x71], esp
inc ecx
push ebx
call fcn.100f354b
dec cx
xadd cl, ch
mov eax, dword [ebp]
add ecx, ecx
ror cx, 0x23
add ebp, 4
ror ecx, 0xb5
mov edx, ecx
sub ecx, 0x3d2cf48e
xor eax, ebx
push edx
neg edx
not eax
shl cx, 0x28
sub ecx, dword [esp]
ror eax, 1
pop edx
or edx, edx
neg eax
neg ecx
xadd edx, ecx
jp 0x101f4335
pop eax
jmp fcn.103dc9c5
shr ecx, cl
lea ebp, [ebp + ecx - 0xe8bef]
setns cl
jp 0x1008bf73
ror edx, cl
shr al, cl
call fcn.1067b8ff
adc cx, cx
add esi, 6
mov byte es:[eax], dl
jmp 0x1038185f
lea ecx, [ecx + eax + 0x6e94e821]
rol ecx, 3
push edx
xor ecx, 0x8a9ef08e
rol edx, 0x26
neg ecx
xor ebx, ecx
or dx, word [esp + edx - 0x203df08e]
and dl, 0xaf
call fcn.10633841
mov edx, 0xe8bf3a8c
mov ecx, edx
mov edx, dword [ebp]
movzx eax, cx
jmp 0x103deeb0
xor ebx, ecx
neg eax
xor al, 0x8a
xadd dl, ah
adc edi, ecx
ror edx, 0xc8
not eax
jmp edi
xor ebx, edx
lea esi, [esi + ecx*2 - 0x10004004]
pop ecx
mov dword [esi], edx
mov ecx, dword [ebp]
lea edx, [eax + 0x77b32d0a]
lea edx, [edx + eax + 0x33b29914]
add ebp, 4
xor ecx, ebx
add edx, eax
jb 0x104d7289
Function at 0x101419a0
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [esp + 8]
mov ebp, dword [ebp]
js fcn.105ec776
jne 0x10447db2
push edx
pushfd
mov edx, 0x9d00680a
not edx
shr dx, 0xd8
add dword [esp + 8], 0x351dc
or dl, dl
jo 0x10305beb
ja 0x104ae856
mov ebp, edx
and ebp, 0xd94258c
jns 0x1007c7b6
lea edx, [edx + edx*4 + 0x7aac9e24]
or edx, 0xf3314a2d
seto dl
cmp dl, dh
lea ebp, [ebp + edx + 0x7d56cd2c]

Function at 0x10179513
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0x102a0a00
call fcn.103d89dc

Function at 0x1017f4a1
Capabilities:
Encode data using base64

Disassembly:
cmova ecx, dword [esp + ecx + 0x412400a4]
jae 0x103555e7
call fcn.104b70cf
Function at 0x1019674c
Capabilities:
Packed with generic packer

Disassembly:
dec eax
mov dword [esp + esi - 0x98], ecx
inc ecx
mov edx, dword [ecx + esi*2 - 0x130]
call fcn.10275a0d

Function at 0x101b3fe0
Capabilities:
Encode data using base64

Disassembly:
neg ecx
bswap ecx
ror al, 0x81
sbb edx, edx
ror ecx, 2
sal ax, 0xcf
lea eax, [edx + edx*4 - 0x57ded0f2]
sar al, 0xc2
xor ebx, ecx
mov dword [esp + edx*4], 0xce8f5516
dec edx
call fcn.1020597c

Function at 0x101b4009
Capabilities:
Encode data using base64

Disassembly:
mov ax, word [esi]
mov cl, byte [esi + 2]
mov edx, 0xd2336a16
add esi, 2
sal ax, cl
push edx
mov word [esi], ax
sal dword [esp], 0xd6
neg edx
lea ecx, [edx + edx*8 + 0x55b85b1c]
lea edi, [edi + edx*2 - 0x5b992bd8]
pop eax
mov ecx, dword [edx + edi - 0x2dcc95ea]
xchg dx, ax
call fcn.100d63ac
rol eax, 1
sar cl, 0x47
neg eax
dec edx
ror cl, 0x62
rol eax, 2
shr edx, 0xb1
ja 0x102b7a22

Function at 0x101bd771
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc cl
sal dl, 0xa2
or dword [esp + eax - 0x75fa3e8e], 0x9a985c1d
xor al, byte [esp + edx - 0x296ac3eb]
not cl
mov dword [esp + edx*2 - 0x52d587e0], edx
xchg dword [esp + eax - 0x75fa3e75], edx
sal edx, 0x38
xor bl, cl
neg eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
sub dword [esp + 3], edx
shl dword [esp], 0xb8
mov dword [esp + 4], ebx
mov ebx, ecx
shr word [esp + 2], 0xc9
neg dx
mov edx, ebx
sal edx, 2
or eax, eax
and dword [esp], 0xc0a893bb
mov eax, ebp
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
call fcn.10380e39
mov eax, dword [edi]
add edi, 4
xor eax, ebx
mov ecx, 0x40b00097
neg eax
ror ecx, cl
mov edx, ecx
inc eax
bswap eax
sub ecx, 0x5916e783
lea eax, [eax + ecx + 0x18b4489f]
shr ecx, cl
xor ebx, eax
xchg cl, dl
add esi, eax
xchg edx, ecx
call fcn.105e4038
mov ecx, 0x9a056e10
xor cx, 0xe288
mov eax, dword [ebp]
neg cl
mov edx, ecx
shr cx, cl
push ebx
sub edx, 0xdbabea2d
jno 0x102734bd
cpuid
push 0x1203cf2a
sub ebp, 0xc
neg byte [esp + 3]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
push 0x43384537
mov dword [ebp], edx
mov ebx, dword [esp + 8]
dec word [esp + 4]
mov ecx, 0xc922a3b8
movsx eax, word [esp + 4]
sub edi, 4
mov ecx, dword [edi]
xor ecx, ebx
rol word [esp + 5], 0x2f
push eax
setae al
not ecx
sal al, 0x66
bswap ecx
movsx edx, ax
pop edx
inc ecx
add al, ah
not ecx
mov dword [esp + 8], edx
or word [esp + 0xa], ax
neg al
ror ecx, 2
sar eax, 0xd1
adc dl, byte [esp]
jg 0x1060d9d1

Function at 0x101c041d
Capabilities:
Encode data using base64

Disassembly:
push edi
push edi
pushfd
mov edi, 0xbc28c7af
mov edi, 0xe1977b02
and di, di
shl edi, 0xd7
shr edi, 0x2f
shl edi, 0x4a
mov edi, dword [esp + 0xc]
jb 0x10224900
mov dword [esp + 4], 0x41942781
sub word [esp + 4], 0x1c80
lea edi, [edi + 1]
shr dword [esp + 4], 0xc
mov word [esp + 4], 0xccab
add word [esp + 4], 0x7400
mov dword [esp + 0xc], edi
Function at 0x101c1759
Capabilities:
Encode data using base64

Disassembly:
sub cx, cx
lea eax, [eax + 0x43b25a86]
jae 0x103555d4
mov dword [esp + ebp + 0x50ec8685], ecx
add ecx, dword [esp + ebp + 0x50ec8685]
call fcn.1062cf98
mov edi, dword [esp + 0x38]
test byte [esp + 0x24], 0x2c
call fcn.1064c010
rol al, 1
sub al, 0xa4
call fcn.10413cca

Function at 0x101cf6e4
Capabilities:
Execute syscall

Disassembly:
mov word [esp + edx + 0x44c40004], 0x383c
call fcn.100a4383
syscall
inc ecx
push ebx
pushfd
dec ecx
mov ebx, 0xf0a10898
mov ebx, 0xe8329e51
xchg byte [eax + 0x32], dh
add cl, dl
ret 0xe6c1

Function at 0x101d2bac
Capabilities:
Encode data using xor

Disassembly:
not bp
jg 0x103acdee
shl bx, 0xa2
mov ebp, dword [esp + 0x20]
add bl, 0xb5

Function at 0x101d3de7
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
je 0x101d3e38
push ebx
mov ebx, 0x461a0a0d
xor ebx, ebx
sbb ebx, ebx
or bl, byte [ecx + ebx*2]
push 0xe7b43c2a
push 0x540ae
xor ebx, edx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x105c77e4]
shr edx, 8
neg dword [esp + 4]
xor edx, ebx
inc ecx
xor edx, 0x29344287
dec eax
lea esp, [esp + 8]
jne 0x101d3df2
mov ebx, 0xb688332f
pop ebx
mov ecx, 0x901ea915
not edx
mov dword [ebp], edx
call fcn.1047f2dc

Function at 0x101e600e
Capabilities:
Execute syscall

Disassembly:
shl cl, 0xa5
xor eax, 0x75b06405
lea eax, [eax + edx*2 + 0x533ff6c4]
inc cx
mov dword [esp + edx*2 - 0x1ec], edx
xor ebx, eax
sar ecx, 0xc
add ecx, dword [esp + edx - 0xf6]
call fcn.104141b6

Function at 0x10202346
Capabilities:
Encode data using base64

Disassembly:
ror ecx, 0x74
inc eax
rol eax, 3
xor ebx, eax
push ecx
mov dword [esp + ecx - 0x5ceab164], ecx
add edi, eax
add dword [esp + ecx - 0x5ceab167], 0x8626e28f
sbb cx, word [esp + ecx - 0x5ceab161]
sub cl, 0x85
mov esi, dword [esi + ecx - 0x5cea1987]
inc cx
ror cx, cl
pop ecx
pop edx
pop ecx
jns fcn.1043cc5d
mov edx, 0xf59be8aa
sub esi, 4
movsx eax, dl
mov edx, dword [esi]
movzx ecx, ax
neg eax
xor edx, ebx
xor edx, 0xb620f019
rol edx, 1
jmp 0x102b0b3a
dec edx
sar eax, cl
neg ax
jge 0x1052c846
setle cl
jle 0x103555b2
mov eax, 0xf41dfe30
movsx ecx, al
mov eax, dword [esi + ecx - 0x30]
call fcn.100aa618
ror eax, cl
xor ebx, eax
ror edx, cl
add edi, eax
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
sub dword [esp + 3], ecx
shr ecx, cl
mov cl, byte [ecx + ebp - 0x408b6b78]
jo 0x1034076a
ror edx, 1
bswap eax
add ax, cx
call fcn.1056e416

Function at 0x10203f9e
Capabilities:
Execute syscall

Disassembly:
jb 0x1008e5b0
mov ebp, dword [esp + 0x10]
add dword [esp + 4], 0xfff6e8de
call fcn.10226267
jno 0x1010acbc

Function at 0x10206434
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp + esi - 0xaa], 0xfc0ab82d
ror esi, 2
dec eax
mov dword [esp + edx - 0x7108d49a], 0xfe2d5b26
inc ecx
movzx ecx, dh
dec esp
lea ebp, [edx*4 + 0x659cafba]
inc esi
shl cx, 0xe8
push edx
call fcn.100f09ca

Function at 0x102064be
Capabilities:
Packed with generic packer

Disassembly:
bswap eax
xor ebx, eax
shl byte [esp + 4], 0xe3
not edx
add edi, eax
dec dx
call fcn.104aa726
Function at 0x102064d3
Capabilities:
Packed with generic packer

Disassembly:
sar dword [esp + ecx - 0x2d34581e], 0xf1
sbb eax, 0xb2aa4aa8
add ecx, dword [esp + ecx - 0x2d34581e]
mov dword [esp + ecx - 0x2d345822], ecx
and ecx, 0xbeadc29e
ror eax, cl
sub edx, ecx
or ecx, 0xb29c1d14
inc eax
sal cl, 5
xor eax, 0x1e08593f
sar ecx, 0x41
xadd word [esp + edx*2 - 0x239e7392], cx
jnp 0x106eb552
test dword [edi - 0x798bd5a8], esp
mov al, byte [0xd3056d77]
mov dl, 0xb
xchg edi, eax
out 0xa4, eax
in al, 0x13
int3
xor ebx, eax
call fcn.1006db50

Function at 0x10213edb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not eax
ror ax, 0x41
bswap ecx
call fcn.10234940

Function at 0x1021d265
Capabilities:
Encode data using base64

Disassembly:
call fcn.10645cd6
and dword [esp + ebx + 0x2754561f], ebx
test dword [esp + ebx + 0x2754561f], 0xeb9c4e39
jne 0x106876de
mov ebx, dword [esp + ebx + 0x27545607]
jne 0x10122a88
Function at 0x1023652c
Capabilities:
Execute syscall

Disassembly:
jae 0x103a3e61
sysenter
call fcn.10627231
shr cx, 1
push 0xc521eaae
rcr eax, cl
mov dword [ebp], eax
ror dword [esp + 0xc], 0x88
mov eax, dword [esp + 3]
mov dword [esp + eax - 0x2b8000c5], esi
ret 0xc
mov ebp, 0xac2a5130
push esi
mov ebp, dword [esp + ebp + 0x53d5aee8]
mov ebp, dword [ebp + esi*8 - 0x55524138]
and dword [esp + esi - 0xaaa4827], 0x78a1ff8b
jo fcn.102114fc
mov word [esp + esi - 0xaaa4827], 0xb636
neg byte [esp + esi*2 - 0x1554904e]
lea ebp, [ebp + esi - 0x761c5620]
add dword [esp + esi*2 - 0x1554904e], 0x3d2eee31
mov dword [esp + esi*8 - 0x55524120], esi
setno byte [esp + esi - 0xaaa480f]
push 0x5038e08b
xchg dword [esp + esi*2 - 0x1554902a], ebp
mov esi, dword [esp + esi - 0xaaa481b]
neg dword [esp]
and dword [esp + 0x1c], 0x9ca806a2
mov byte [esp + 4], 0
and dword [esp + 4], 0xd7a2e020
xor byte [esp], 0x83
mov word [esp + 0x1c], 0xa824
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x24]
ret

Function at 0x1024fd72
Capabilities:
Encode data using xor

Disassembly:
cli
ret 0x6c8d
xor ecx, ebx
xadd al, dl
js 0x101f5a77
repne scasb al, byte es:[edi]
push ebp
xlatb
lodsd eax, dword [esi]
loop 0x1024fd91
repne outsb dx, byte [esi]
jp 0x1024fd5d
scasb al, byte es:[edi]
outsb dx, byte [esi]
pop eax
lock sbb dword [0xa6d99157], ecx
cmpsb byte [esi], byte es:[edi]
enter 0x6ead, 0xffffffffffffffd1
push eax
pop eax
xchg ecx, eax
cld
cmp cl, byte [edi + 0x3a166e9f]
invalid

Function at 0x1025202d
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + ecx*8 - 0x24]
mov dword [esp + ecx*8 - 0x28], ecx
movsx eax, cx
or cl, 0x2e
xor edx, ebx
sub byte [esp + ecx - 0x2f], ah
bswap edx
sbb ecx, ecx
sar eax, 0x7f
lea edx, [ecx + edx - 0x9b0db1a]
ror dword [esp + ecx], 0xf0
sal ecx, 0x21
add al, 0xbb
bswap edx
xor cl, 0x9a
adc al, al
ror eax, 0x5d
not edx
pop eax
adc edx, 0xfc9b3cbd
xchg ecx, eax
shl cx, 0x4b
xchg ch, cl
xor ebx, edx
ror cx, 0xb
adc esi, edx
not al
lea ecx, [eax*2 + 0x7580d29d]
movsx edx, ax
mov ecx, dword [edi + ecx - 0x7580d367]
mov eax, dword [edi + edx - 0x61]
call fcn.10555a60

Function at 0x10275a0d
Capabilities:
Encode data using base64

Disassembly:
shl dword [esp + esi - 0x8c], 0x5c
dec esp
mov dword [esp + esi - 0x98], eax
dec ebp
lea ecx, [ecx + esi*8 - 0x4bc]
neg byte [esp + esi - 0x96]
jb 0x102dc206
mov edx, 0xb6170f2d
movsx ecx, dx
xor eax, ebx
dec eax
ror ecx, 0x83
rol cl, 0xc4
xor eax, 0xd5333680
xadd edx, ecx
inc eax
not eax
and edx, ecx
rol dl, 0x43
xor ebx, eax
add edi, eax
inc dx
movzx ecx, byte [ebp + edx*2 - 0x2c2e0092]
lea ebp, [ebp + edx*2 - 0x2c2e0091]
xor cl, bl
lea edx, [edx + edx - 0x66c57d48]
add cl, 0xa7
lea eax, [edx + edx*2 + 0x35b179ac]
ror al, 0xa1
cmovae edx, eax
rol cl, 1
xor ax, dx
sub edx, eax
adc cl, 0x29
push eax
not cl
lea edx, [eax + 0x2fb08717]
call fcn.100d6291
dec eax
mov dword [esp + esi*4 - 0x25f], esi
inc ecx
xor edx, esp
rol edx, 1
neg dword [esp + esi - 0x8e]
sub edx, 0xe4063821
sal byte [esp + esi - 0x8f], 4
dec eax
ror dword [esp + esi*2 - 0x128], cl
neg edx
dec eax
sar dword [esp + esi*4 - 0x258], 0x5f
inc edx
dec esp
lea edx, [esi*2 - 0x6e5efe4c]
Function at 0x102827cf
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov dword [esp + 0x18], edi
add dword [esp + 0xc], 0x596f26
neg ebp
test bp, 0x5b26
mov ebx, ebp
not bx
push edi
add dword [esp + 8], 0x3e712e
mov dword [esp + ebx*4 - 0x56180db8], ebp
shr bx, 2
lea edi, [edi + 1]
shr bp, 0x26
jne 0x10143811