joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e8a51
Capabilities:
Packed with generic packer

Disassembly:
jl 0x1011ecf2
lea esi, [esi + 0x663f513f]
jo fcn.10114f08
xchg dword [esp + 0xc], esi
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
ret
mov esi, 0x14bc2166
adc eax, 0x8ddf29ff
mov ah, 0x3e
mov esi, 0xfbe976b
invalid
jno 0x1022ab71
jns 0x1011ecb4
adc byte [eax], al
pushal
mov dword [0x4589149f], eax
pop es
shr dh, cl
lodsd eax, dword [esi]
jnp 0x1011ecf4
in al, 0x11
pop ebp
jbe fcn.1011ed69
ret 0x5d7e
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
ret

Function at 0x100e8e27
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101b782a
shr word [esp + 2], 0x82
shr cx, 1
call fcn.10248b80
bswap ecx
not edi
jns 0x101ce79d
sub edi, dword [esp + edi*8 + 0x3b0]
mov dword [esp + ecx + 0x73a4ecaf], edi
mov dword [esp + 0x14], ecx
xchg dword [esp + ecx + 0x73a4ecbf], ebp
mov edi, dword [esp + ecx + 0x73a4ecab]
shr byte [esp + ecx + 0x73a4ecb3], 0x58
or word [esp + ecx + 0x73a4ecb3], 0x4107
and dword [esp + ecx + 0x73a4ecb3], 0x19b492bf
jb fcn.1023bfa0
and dword [esp + ecx + 0x73a4eca7], 0xac893929
mov ecx, dword [esp + ecx + 0x73a4ecb7]
not dword [esp + 0x10]
jbe 0x100ddbcc
cmp word [esp + 8], 0xbe17
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x20]
ret
lea ebp, [ebp + 0x6a39e309]
jg 0x100f711b
mov dword [0xc1929760], eax
in eax, 0x81
lodsb al, byte [esi]
add dword [edi + 0x6a8941d3], 0xffffffad
mov al, 0xb7
jl 0x10159302
inc dword [ebp + 0x76]
adc dl, cl
cdq
or dh, byte [ebp + 0x28]
mov byte [ecx + 0x4c9bfff6], 0x51
test bh, bh
neg byte [esi - 0x5532e7b7]
inc ebp
jbe 0x10159316
retf 0xa99
dec ecx
sbb ch, cl
stosb byte es:[edi], al
mov dword [0x2e6854d7], eax
and ah, byte [ecx - 0x76a563e3]
push esp
and al, 8
mov edx, dword [esp + 8]
push 0x272f6605
mov word [ebp + 4], ax
call fcn.10217aec
push 0x58105a3e
dec eax
lea esp, [esp + 0x30]
jmp fcn.10144331
add al, cl
pop es
rol byte [eax - 9], cl
push esp
and al, 8
push 0xb385ef16
bswap eax
xor ebx, eax
shl byte [esp + 5], 0x42
sbb esi, 3
push 0xcc1ae728
mov dword [esi], eax
push 0x2ebbc43b
lea esp, [esp + 0x18]
jmp fcn.101eb1b9
jg 0x101592e4
lodsd eax, dword [esi]
mov ch, 0x78
xor al, 0x1f
salc
wait
cmpsd dword [esi], dword es:[edi]
inc esp
xor dh, byte [esi - 0x63]
sar byte [edi + 0x247f63ee], 1
jb 0x101ce75e
sub eax, 0x96dfd498
adc ecx, dword [edi + 0x3c]
stosb byte es:[edi], al
push ss
popfd
mov al, byte [0xa6119166]
out dx, al
xor ah, byte [0x72c2a477]
and eax, 0x44f6110d
cdq
clc
mov fs, word [edi]
cmp ah, byte [0x32fa8c47]
xor eax, 0x9447916d
outsd dx, dword [esi]
stc
mov edi, 0x2bdf49ea
add byte [ebp - 0x37], ah
mov dl, 0x5b
lcall 0x9935, 0x6863e711
stosb byte es:[edi], al
arpl word [esi], sp
sbb dl, cl
daa
add ebp, eax
sub eax, 0xbe337a81
or cl, 0xf0
dec edx
push esi
push 0x17
jecxz 0x101ce7fd
retf
Function at 0x100ea20e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x10148a77
lea eax, [eax + edi + 0x6941fa79]
and di, 0x1505
add dword [esp + ebp*2 + 0x4081fb80], 0x1e79
add dword [esp + ebp*2 + 0x4081fb88], edi
or edi, dword [esp + 8]
js 0x10151fe0
mov cl, byte [ecx + ebp - 0x11a8de36]
jb 0x101e7d3b
mov ecx, 0x6aa7c69f
mov dx, word [ebp + ecx - 0x6aa7c69f]
ror ecx, 0xc8
sbb cx, 0x8339
mov ax, word [ebp + 2]
jo 0x100feef8
mov cl, byte [ebp + 4]
call fcn.100eb4b0
mul dword [edx]
shr dword [ebp + 0x19719249], cl
invalid
mov edx, 0xaa11671e
mov ecx, 0xc99b88d
mov eax, dword [ebp + ecx*2 - 0x1933711a]
sar ecx, cl
mov ecx, dword [ebp + ecx*2 - 0xc996]
sbb dx, 0x8533
push ebx
shr edx, 0xb8
cpuid
call fcn.10150022
mov eax, 0x15994723
mov edi, dword [ebp + eax*4 - 0x56651c8c]
bt eax, 0x1c
dec eax
jg 0x101959b9
mov eax, 0x2eb64888
add al, al
mov eax, dword [eax + esi - 0x2eb64810]
mov edi, 0x1492c7b4
jne 0x10238cc0
call fcn.101997a9
adc esp, dword [edi]
sub al, 0xc5
mov al, 0x8c
int1
inc ebp
dec esi
mov bl, 0x7f
cmp al, 0x55
call 0x85a52428
fidivr word [ebx + 0x17]
mov word [ebp - 0x80], es
mov esp, 0x5eb541d7
sbb esi, edi
movsb byte es:[edi], byte [esi]
lea ebx, [eax - 0x19b5905c]
mov esi, 0xc3c98195
in al, dx
out dx, eax
mov ebx, 0x4262317c
fxch st(2)
call 0xb14414ca
in al, dx
xchg ecx, eax
jecxz 0x10133d24
push ebp
ret
mov ebx, 0x8862317c
jmp 0x10133d97
invalid
test ebx, 0xd6a287af
setb bl
lea eax, [eax + 1]
shr ebx, 0xe5
call fcn.101d1241
push esi
call fcn.101990f6
mov edx, 0x33bb68b4
mov dx, word [ebp + edx*2 - 0x6776d168]
push 0x6c18928c
push 0x11a8de3a
ror dword [esp + 4], 0xfb
mov ax, word [ebp + 2]
pop ecx
jb 0x100fbd26
mov al, byte [ebp + eax*4 - 0x56651c84]
call fcn.101f2fc3
rol word [esp], 0xc5
adc ebp, 4
shld dx, ax, cl
jmp 0x10133c9c

Function at 0x100eeb5a
Capabilities:
Packed with generic packer

Disassembly:
push 0x24b9c805
adc esi, 3
or eax, ecx
jmp 0x10210ba7
jo 0x101499ac
call fcn.1011ce04
mov eax, 0xdc335501
mov eax, dword [esp + edx - 0x569dffe4]
mov eax, dword [eax + edx - 0x569e0000]
jo 0x101ca7ea
xor edx, 0x589584b5
js fcn.101c14aa
mov ecx, 0xf323143c
add dword [esp + ecx + 0xcdcebd8], 0xefefc9e1
lea eax, [eax + edx + 0x5aaa7304]
mov dword [esp + edx*2 - 0x1c17094e], ecx
or dl, 0x24
jbe 0x10159c4d
push ebp
mov dword [esp + edx*2 - 0x1c17094a], 0x610aa7af
push edx
or cl, 0x36
xchg dword [esp + edx*2 - 0x1c170942], eax
mov ecx, dword [esp + ecx*4 + 0x3373af10]
je 0x1012cfa3
sub edx, 0x4d1376b5
jl 0x101079d7
jae 0x101d843b
mov ecx, 0xa13a4707
movsx eax, cl
mov eax, dword [eax + esi - 7]
not ecx
add ecx, ecx
bts ecx, ecx
mov ecx, dword [esi + 4]
jb 0x100d3347
mov ecx, 0xf703be07
lea ecx, [edi + ecx*8 + 0x67a37fa1]
lea eax, [eax - 0x2e71aa65]
and ecx, 0x8404cb33
jl 0x101fb1ad
movsx ecx, cx
and di, cx
call fcn.101049a0
add dword [esp], 0xefe47ef4
call fcn.101d0760

Function at 0x100ef30c
Capabilities:
Packed with generic packer

Disassembly:
mov esi, dword [esp + 8]
pushfd
add dword [esp + 4], 0x58319
lea esi, [esi + 1]
push edx
mov edx, 0x1c354706
test edx, edx
push edx
call fcn.100f592d
Function at 0x100f6056
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + eax - 0x55b275b1]
call fcn.101393a4

Function at 0x100f71af
Capabilities:
Packed with generic packer

Disassembly:
lea ebx, [edx + edx - 0x7a54d9cd]
cpuid
sbb esi, 8
call fcn.101ad8a1
mov eax, 0x803aff8d
lea edx, [eax*2 - 0x15c7cd79]
mov ebp, dword [esi]
movsx ecx, al
shr ax, 0xc2
adc esi, 4
movsx edi, ax
xchg ebp, esi
bts eax, 0xa2
or eax, 0x6528fd22
jp fcn.1011b6dd
call fcn.101a61ef
mov eax, dword [esi]
mov ecx, 0xc3923ba5
movsx edx, cx
sal cl, cl
mov ecx, dword [esi + edx - 0x3ba1]
je 0x101bb3c1
js 0x1020ceeb
shr byte [esp + ecx*2 - 0x3c22d4f6], 0x9b
mov dword [esp + ecx*4 - 0x7845aa38], ecx
sub ecx, dword [esp + ebx + 0x63e2fd65]
xor ebx, ecx
mov ecx, dword [esp + ecx - 0x6e8fa154]
test dword [esp + ebx*2 + 0x1adab87e], 0xca8408a0
jbe 0x100ef3eb
invalid
pop edx
bswap ebx
not bl
not bl
pop ecx
call fcn.101c77da
cmp dword [0xd041df8f], esp
shl dword [0x1040e237], cl
scasb al, byte es:[edi]
aas
adc al, 0xe2
mov word [ecx - 0x1d], ds
mov bl, 0x31
jb 0x101bb372
out 0x14, al
pop es
ljmp 0x32e8
push ebx
lea edx, [edx - 0x13ca60f0]
js 0x100d3b40
Function at 0x100f85a3
Capabilities:
Packed with generic packer

Disassembly:
jle 0x1015d726
xor byte [esp + edi - 0x76af7d06], dh
shl edx, cl
mov edi, dword [esp + edi - 0x76af7cde]
je 0x101b921c
and dword [esp + edx*4 - 0x7ffffff8], 0x27a89c3e
jge 0x101f5ada
call fcn.102544e1
mov dword [esp], 0xafa1ce87
sub al, cl
mov ecx, 0x3cbe1b39
pushfd
pop ecx
mov dword [esp], ecx
pop ecx
push 0x69309b07
call fcn.101fe996
jns fcn.1011d1db
mov ebx, dword [esp + ebx + 0x6bfb0e4a]
mov ebx, dword [ebx]
mov dword [esp + 8], 0x5908c529
xor byte [esp + 8], 0x9a
add dword [esp], 0xefe78c80
sub dword [esp + 8], 0xc30ef72a
mov dword [esp + 8], 0xb3698b7
and dword [esp + 8], 0xba2d4d3d
mov dword [esp + 8], 0xd6365598
jne 0x10158891
push 0x9182a7a5
jmp 0x101e4035
ret
shl ebp, 0x32
neg ebp
push ebx
shr bl, 0x9b
mov dword [esp + ebp - 0x9b7ffdc], eax
add dword [esp + ebp*2 - 0x136fffec], 0x1c4114
call fcn.101c4169
stosb byte es:[edi], al
dec ebx
inc esp
div dword [ecx]
int1
salc
jge 0x1015d6fa
jecxz 0x1015d785
sbb esi, dword [0xebcdeeb1]
or byte [edi + 0x65], bl
mov esi, 0x66a3c392
adc al, 0x67
push ecx
invalid
cmp al, 0x9f
mov ebx, 0xedcce975
add al, 0
mov byte ss:[edx], al
lea esp, [esp + 4]
jmp fcn.10154f3a
mov ecx, 0x4e36922f
push ebx
mov ebx, 0xb51b4ebe
push ebp
adc byte [ebx], 0xcd
add byte [eax], al
lea eax, [eax + edx*2 - 0x3e2dfb23]
ja 0x100d18f9
mov edx, 0x3ba7e808
mov edi, 0xde25e21c
shr dl, 0x66
mov edx, dword [esp + edi*2 + 0x43b43bdc]
neg edi
mov dword [esp + 8], edi
jo 0x101a5ab7
call fcn.100e6923
jmp 0x101b9209
sub ecx, eax
pushfd
mov eax, 0x9c06f7a4
lea eax, [eax + eax + 0x42bf5f25]
lea eax, [eax*2 - 0x20420844]
pop eax
call fcn.10160479
les edx, [eax - 0x34]
daa
sub al, dh
xchg ebp, eax
fdivr st(1), st(0)
int 0xa6
push eax
fdiv qword [edi]
cli
push esi
in eax, dx
and al, 0xe9
mov ch, 0xce
cmp byte [edi + edx + 0x2cc5563a], bh
push ecx
int 0x56
and byte [edi + ebp*8 + 0x7a], ah
mov dh, 0xfd
mov ebx, 0x59a68b11
mov edx, esp
out dx, eax
mov ebx, 0x9362317c
enter 0x28db, 0xffffffffffffff8e
mov ax, word [0x221d10]
fisttp dword [0x96ab52b4]
push eax
mov dword [0xc9ffbe89], eax
rcr dword [ebp + 0x2d8af8ea], 0x85
ret 0xb62a
lea esp, [esp + 0x28]
jmp fcn.10201bf4
mov ebx, dword [esp + ebx - 0x400d64ea]
xor dword [esp + 0x28], 0x98b0172e
mov cl, byte [esp + 0xb]
jae 0x10136b08
jmp 0x101d7646

Function at 0x100f974b
Capabilities:
Packed with generic packer

Disassembly:
inc cx
neg edx
jmp 0x1016fbe9
xchg dword [esp + ebp + 0x34], edi
mov ebp, dword [esp + ebx - 0x2010b8ed]
jne 0x101b452e
movzx ecx, byte [edi]
mov edx, 0xbc20f49d
mov ebp, edx
add edi, 1
lea ebp, [edx*8 - 0x79ca8de3]
call fcn.1011f700
dec eax
inc dword [esp]
inc cx
dec edx
dec eax
not dword [esp]
inc cx
ror edx, 1
inc cx
inc edx
dec eax
and dword [esp], 0x7b18f009
inc cx
rol edx, 1
inc cx
inc edx
call fcn.100f3101
jbe 0x100fb669
dec ecx
sub ebx, 2
inc ecx
mov edx, 0x1908a924
dec ecx
and edx, 0xaf1c6a80
inc ebp
adc edx, edx
inc edi
movzx edx, word [ebx + edx - 0x12105000]
push 0x923c7caa
inc byte [esp + 2]
inc sp
xor edx, esi
ror byte [esp + 3], 0xc3
jae 0x100dc907
Function at 0x100fe182
Capabilities:
Check for vm using instruction vpcext
Packed with generic packer

Disassembly:
push ebp
push edx
mov edx, ebp
test dword [esp + 4], ebp
jns 0x100f82d4
push edi
movzx ebp, word [esp + 8]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
call fcn.10129240
mov edx, 0x8e3e5fb6
lea eax, [edx + edx*4 - 0x6df29441]
mov eax, dword [esi + eax - 0x59454a4d]
lea ecx, [edx*4 - 0x64ee8600]
add esi, 4
rol cl, 0xe6
mov edi, ecx
jae 0x10198ea5
add dword [esp + 0x10], 0xefdc663b
not ebp
add ebp, 0x808fa3ba
sub ebp, 0x339cc027
add dword [esp + 4], 0x155efb
or ebp, 0xb721a59f
neg ebp
nop
jns 0x100eab16
sbb ebp, 2
call fcn.100eeb7b
add byte [eax], al
mov ecx, dword [esi + 4]
push ebx
cpuid
push 0xba9d2785
sal dword [esp], 0xc4
sbb esi, 7
mov dword [esi + 0xc], eax
call fcn.1011b238
cmc
dec esp
add al, byte [eax]
jnp 0x1017710a
inc esi
or al, 0xe8
int3
or al, byte [eax]
xchg ebp, eax
pushal
pop es
add byte [ebx + 0x65fffa86], cl
add ax, word [eax]
aam 0x26
add dword [eax], eax
jle 0x10177165
or eax, dword [eax]
mov edx, 0xccfff72c
push ss
sti
call eax
jmp 0x10177197
add byte [edx + 0x380000e0], bh
or dh, bh
call [eax - 0x5afffd79]
rol dword [0x2e8d600], 1
add ch, bl
or esp, edi
push dword [edx + 0x1100055a]
mov esi, 0x6791fffc
idiv edi
ret
mov ebp, eax
adc edx, ecx
push ecx
jge 0x1017714d
pop edi
jo 0x1013ba9a
daa
in eax, 0x39
test eax, 0x68f5d349
cmovp esi, dword [edi + 0x6e894dc5]
add cl, ch
mov edi, 0xe8ffff25
pop ds
inc esi
invalid
Function at 0x100fe1ce
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add dword [esp + 0x10], 0xffe75b85
neg dword [esp]
mov edi, dword [esp + 8]
not byte [esp + edi*4 + 0x4780cf10]
mov edi, dword [esp + edi + 0x11e033d2]
mov edi, dword [edi]
mov dword [esp + 0x10], 0xb33c7e04
jo 0x10111d9f
mov byte [esp + 8], 0x9f
push 0x6403f801
call fcn.102508de
lea edi, [edi + 1]
push edi
mov edi, 0x871875b4
pushfd
test edi, 0x4d965c34
jne 0x1024b33f
mov word [esi], ax
lea esp, [esp + 4]
jmp fcn.100019eb
call fcn.102009e2
call fcn.100034d4
call fcn.10219920
add dword [esp], 0xfffe4670
mov edi, 0x5fa9851f
call fcn.100eb4d1
jns 0x10144805
out dx, al
pop edx
stosd dword es:[di], eax
ror byte [ecx + 0x5dab30ac], 0xf1
sbb bl, byte [edi]
jae 0x10161977
or dword [eax + eax + 0x1af155a3], edi
push edi
sti
shr byte [ecx + 0x3deb2814], 0x21
retf 0x34f
loopne 0x101619be
pop edi
sub byte [esi], 0x9d
push esp
adc dword [ebp - 0x709b9f6a], ecx
dec edx
cmpsb byte [esi], byte es:[edi]
pushal
invalid
jne 0x101619d5
dec ecx
jne 0x101619b2
loopne 0x10161972
inc dword [edx]
outsb dx, byte [esi]
std
salc
loopne 0x101619b3
test dword [eax - 0x71], esi
out 0xe9, al
out dx, eax
mov ebx, 0x462317c
xlatb
retf
sbb ebp, dword [edi - 0x72992dbc]
scasd eax, dword es:[edi]
inc esp
shl byte [esi - 0x73], cl
mov byte [edi + ebx*2], ah
jbe 0x10161968
test dword [edx + ebx - 0x3a], 0x2627bd8e
sub bh, dh
mov esp, edi
adc eax, 0xa9a78cc0
wait
mov bh, 0x3c
invalid
dec esp
sbb al, dh
invalid
out 0x78, eax
dec ebp
invalid
test byte [esp + eax], ch
add al, dh
fbstp tbyte [edi + 0xf]
stc
jmp dword [esi - 9]
cmp dword [esp], 0xe9bd4126
mov dword [esp + 8], 0xfb297734
mov dword [esp + 8], 0xee1fcc3e
jns 0x100ebf97
mov byte [0x771b6d36], al
jl 0x102363ca
inc ebp
xchg byte [edi - 0x6e], ch
into
jge 0x102363d3
pop es
mov word [ecx - 0x35f831c3], ss
xchg esi, eax
insd dword es:[edi], dx
wait
aaa
fcom qword [ecx - 0x65682123]
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
cmp esp, edi
or al, 0x49
pop es
inc eax
lodsb al, byte [esi]
mov dh, 0xb5
aas
wait
fsub st(7), st(0)
mov ebx, 0xb462317c
fsubp st(0)
fcom st(4)
and dh, byte [ecx]
fisubr dword [esp + eax*4 + 0x43]
retf 0x8097
test di, 0x54b1
push 0x2089f8e
lea edi, [edi + edi - 0x207e0063]
mov edi, dword [esp + edi + 0x124d1503]
mov dword [esp + 0x20], edi
jge 0x1023641c
sal word [esp + 1], 0x2f
neg dl
ror dword [esp + 4], 0xb3
xor bl, dl
sub esi, 4
call fcn.1017cb6d
mov eax, 0x53036c2a
sar eax, 0x7a
and eax, 0xaf9e328b
lea esi, [esi + eax*2 - 1]
sbb ax, 0xd41f
movzx eax, byte [esi + eax*4 - 0xaf84]
jbe 0x10161902
call fcn.101652e7

Function at 0x101009ee
Capabilities:
Packed with generic packer

Disassembly:
jns 0x10252e0e
or word [esp + 0x20], cx
mov ecx, dword [esp + 0x18]
or word [esp + 0x20], 0xeb85
setbe byte [esp + 0x20]
jge fcn.1016aace
neg dword [esp + 0x20]
push dword [esp + 0x24]
popfd
lea esp, [esp + 0x2c]
ret
shl dword [esp + 0x10], 0x27
add dword [esp + 0x24], 0xefeea61a
shr dword [esp + 0x20], 0xe1
shr dword [esp + 0x10], 0xa4
mov byte [esp], 0x14
sub byte [esp], 0x2c
lea edx, [edx + 0x2b0def3e]
cmp dword [esp + 0x18], 0x72092817
sets byte [esp + 0x18]
call fcn.101beea8
Function at 0x10101b60
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, 0xae3506b5
movzx esi, si
xchg dword [esp + 0x38], ecx
mov ebx, dword [esp + 8]
jb 0x10201b5f
or edx, esi
add word [esp + 0x20], si
call fcn.1016ecd5

Function at 0x10101bba
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
jmp 0x1021378b
call fcn.101e6f02
mov dword [esi], ecx
jmp 0x101a118e
mov ecx, dword ss:[eax]
jmp 0x101fbdcf

Function at 0x10104241
Capabilities:
Packed with generic packer

Disassembly:
cmp edx, esi
jno 0x101c94a2
mov ecx, dword [esp + ecx*8 - 0xc780]
mov eax, dword [esp + esi + 0x28]
mov eax, dword [eax]
not dword [esp + 4]
xor word [esp + 8], 0x6300
cmp byte [esp + 4], 0x12
mov dword [esp + 0x28], edx
not dword [esp + esi*2 + 0x28]
mov ecx, dword [esp + 0xc]
lea esp, [esp + esi + 0x10]
ret

Function at 0x101042c3
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x63735bf
shl dl, cl
jmp 0x1014b2e4
push 0xca0403af
jmp 0x100f856b

Function at 0x10107fae
Capabilities:
Encode data using xor

Disassembly:
jle 0x101e3d37
pushfd
pop edx
mov dword [esp + 8], edx
call fcn.102560ea
adc eax, 0x2dc30ef8
push ds
and esi, dword [ecx]
pop edx
or dl, byte [edi - 0x2fa5b9e3]
or dword [ebx + 0x49ea493a], edx
xor dword [edx + 0xa], ebx
xchg edi, eax
sbb eax, 0x9d05a46
xchg ebx, eax
cmp cl, byte [ecx - 0x16]
dec ecx
adc eax, 0x340d23b3
dec edi
mov ch, 0xae
outsd dx, dword [esi]
sbb byte [esi], ch
pop es
jb 0x10107fc7
xchg dword [edx + 0x5b], ebx
pop eax
punpckldq mm3, dword [eax + 0x33]
mov edx, 0x28571e6f
sbb al, 9
xchg edi, eax
xchg byte [edi], dl
pushal
cmp edx, dword [eax + 0x35]
jb 0x102565f3
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x2c]
ret

Function at 0x10111761
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
sub di, 0x4b93
call fcn.1018927a
mov ecx, 0xd391a933
shl ecx, cl
lea edx, [ecx + ecx*4 - 0x50606dfa]
mov dx, word [ecx + esi - 0x49980000]
dec ecx
sal cl, 2
mov cx, word [esi + ecx - 0x4997fffa]
push 0x9e298b2f
sbb esi, 1
rol byte [esp + 3], 0xc5
sub dx, cx
call fcn.10224dc8
jmp 0x10239f0a
mov edi, 0x7db0c602
not di
push esi
mov esi, 0x76858e93
pushfd
bt esi, 0xbf
shr esi, 0x7e
mov esi, eax
and edi, 0xb506353b
inc edi
ja 0x101e610e
neg byte [esp + 0x2c]
shl word [esp + 0x2c], 0xef
push dword [esp + 0x28]
popfd
lea esp, [esp + 0x34]
ret
sub ebp, ecx
mov esp, ebp
push edi
jmp 0x101e8110

Function at 0x10119396
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1020049a
dec ebp
mov dword [edx], esp
push 0xe9a5722b
push 0x9726902e
call fcn.1025362b
Function at 0x1011c68d
Capabilities:
Encode data using base64

Disassembly:
setne byte [esp + edx*2 + 0x77d5fe1a]
call fcn.101d8c86
movsd dword es:[edi], dword [esi]
sar byte [esi + 0x2444c7ce], cl
add byte [esi + 0x32b097be], bh
shr eax, cl
mov ebp, 0x680007b9
mov edi, ecx
mov dh, byte [ebp - 0x7f]
fiadd word [edx]
add byte [eax], al
add al, ch
fidiv dword [ebp + edi*8 + 0x4848bff]
mov eax, dword [esp + eax - 0x5085be43]
mov eax, dword [eax]
mov edx, 0x2dbc6f2c

Function at 0x1011c6f3
Capabilities:
Packed with generic packer

Disassembly:
not word [esp]
mov dword [esp], eax
jae 0x1021da1b
jmp 0x101a3c5b
lea esp, [esp + 0x14]
je 0x1021da31
mov eax, 0xf39f236
or eax, eax
not al
mov eax, dword [ebp + ebx*4]
push 0x14beae0c
ja 0x1010b833
call eax
mov ebp, dword [ebp - 4]
mov ebx, 0xcb15e0a5
push ebx
lea ebx, [ebx + ebx + 0x1f9c1e8f]
mov dword [ebp], eax
push ebx
call fcn.101fe179
push 0xd6b3f986
ror word [esp], 0x4a
dec ebx
lea esp, [esp + 4]
jne 0x1011c6fd
mov eax, dword [ebp]
jmp 0x1018f341

Function at 0x1011c7de
Capabilities:
Packed with generic packer

Disassembly:
setns bl
ja 0x10171b51
call fcn.101129b7
call fcn.1018f76f

Function at 0x1011cf26
Capabilities:
Authenticate hmac

Disassembly:
lea esi, [esi + esi + 0x4a83cda5]
and esi, 0x19285c0b
push dword [esp + esi - 0x9000c0b]
popfd
lea esp, [esp + esi - 0x9000c07]
ret
jne 0x100fb083
sub bl, byte [esp + ebx + 0x72b10189]
push esi
cmp esi, dword [esp + esi - 0x4ab48160]
movsx dx, bl
xchg dword [esp + ebx + 0x72b101ad], edi
mov ebx, dword [esp + esi - 0x4ab48138]
jl fcn.101fa0ea
call fcn.101d42c9
call fcn.1023f567
mov ecx, 0x98bff3ae
inc bp
mov ecx, dword [esi]
mov ebp, ecx
inc cx
mov ebp, dword [esi + 2]
dec eax
inc ecx
sal cx, 0x41
btc ecx, ecx
inc ecx
mov cl, byte [esi + 4]
dec ecx
adc esi, 4
inc cx
shrd ecx, ebp, cl
call fcn.1024dfe6

Function at 0x1011e735
Capabilities:
Packed with generic packer

Disassembly:
shr ecx, 0xb7
mov ecx, dword [esp + ecx*2 - 0x300]
shr word [esp + 0x24], 0xe1
ja fcn.10193d8e
jg fcn.100d4095
call fcn.10248253

Function at 0x1011e859
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov eax, edx
mov eax, dword [esp + eax + 0xe700012]
mov eax, dword [eax + edx + 0xe6ffffe]
movzx edx, dx
or edx, edx
mov ecx, 0x85a1a724
jne 0x100d54ab
insd dword es:[edi], dx
aaa
jae 0x1011e8f5
invalid
xor al, 0xe9
ret 0x49e9
Function at 0x10125427
Capabilities:
Encode data using xor

Disassembly:
push 0xb818a895
mul edi
jmp 0x101cdedb

Function at 0x10125497
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
mov edx, dword [esp + 8]
add dword [esp + 4], 0xfff7d122
sub byte [esp + edx*8 + 0x2beba2f0], 0x25
shl edx, 0x43
jb 0x101ffce6
neg byte [esp + edx + 0x2beba2f0]
call fcn.1021e736
jb 0x10138c7b
Function at 0x101296e3
Capabilities:
Packed with generic packer

Disassembly:
push ebp
sar ax, 0x66
movsx ebp, ax
push ebx
neg al
or ebp, esi
movzx ebx, al
rol ebx, 0x73
shl bx, 0xae
adc ebx, edx
mov edx, ebx
btr eax, eax
call fcn.100aef43
dec edx
jmp fcn.101ee1a0
mov edi, 0x17142bbb
shl edi, 0x16
mov edi, dword [esi + 4]
ja 0x1016d88e
not dword [esp + 0xc]
call fcn.1020a8c6
syscall
call fcn.101ce1a1
push 0x612f14a5
mov eax, dword [esp + 0x24]
jmp 0x10226524
test dword [esp + edi*2 + 0x7bf00aa8], edx
jae 0x10206fee
push 0xffffffffffffffde
retf
inc edx
outsd dx, dword [esi]
xchg edx, eax
call fcn.1013af25
jne 0x1012b4a8
add byte [eax], al
mov edx, dword [esi]
jmp 0x100e8940
mov ebx, 0x7c351b12
xor bx, 0x98b2
mov esi, 0x6c26fe90
add dword [esp + 0xc], 0xc3b5b
or bl, 0x3e
call fcn.100cf769
cmc
mov eax, 0x59037058
mov eax, dword [0x18f4b611]
mov al, 3
mov eax, dword [0xa62445dd]
sbb dword [esi], edx
aam 0x6f
fld xword [esp + eax + 0x59128e84]
mov edx, 0x7f24f579
fiadd dword [ebx]
xor eax, 0x9e2fed4b
adc dword [ebp + 0x28], esi
jp 0x1012b4ac
pop esi
test eax, 0x9dacebb
jecxz 0x1012b502
and dword [ecx - 0x3380990d], 0x48ce1d05
rcr byte [edi + 0x26], cl
cdq
push eax
and bl, dh
sbb dword [ebx - 0x2923a8d2], eax
fnstcw word [ebx + 0x67ccf67]
into
push ds
jmp 0x303e08cd
call fcn.10001313
mov dword [0x10098384], 1
bts si, sp
sub eax, eax
pop esi
mov esp, ebp
movzx ebp, sp
bswap ebp
pop ebp
jmp 0x100012f3
jmp fcn.1024b59c
ja 0x101a12c9
push edx
je 0x1010f0aa
lea eax, [eax + edi*2 + 0x4a2fe8ab]
not edx
shl dword [esp + edx*2 - 0x6f75ffda], 0x61
xor dx, di
cmp byte [esp + edx*2 - 0x6f740a6a], 0x8d
push edx
jae 0x1012b4cf
xchg dword [esp + edi + 0x3df80574], eax
mov edi, dword [esp + edx*2 - 0x6f740a72]
seta byte [esp + edx*2 - 0x6f740a66]
not dword [esp + edx*2 - 0x6f740a5e]
shr byte [esp + edx*2 - 0x6f740a82], 0xba
call fcn.10219276
mov edi, edx
call fcn.101cfdc6
lea esp, [esp + 8]
jmp fcn.10154f3a
jae 0x102202fc
push eax
jmp 0x10142803
lea esp, [esp + 0x28]
ret
mov eax, dword [esp + edi*2 + 0x7bf00aa4]
mov eax, dword [eax + edi + 0x3df80544]
xor dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x101727d5
mov edx, 0x429c4884
jmp 0x1020aea0
rol edx, 0xcd
movzx edx, word [esi]
call fcn.101dd60d
nop
sub si, 0x3810
add si, 0x7618
mov ecx, 0xc7365a0e
call fcn.101a1e38
invalid
movzx eax, byte [edi + eax*2 - 0x2d49041e]
xadd dl, dh
push edx
lea edi, [edi + edx*4 - 0x4488be5b]
shl edx, 0x9a
xor al, bl
sub edx, edx
inc dword [esp + edx]
call fcn.101b7362
mov eax, 0x83925d3d
cbw
movzx edx, byte [ebp]
add ebp, 1
sar ax, 0xa9
xor dl, bl
dec dl
xor dl, 0x14
neg eax
ja 0x10148a6f
xor eax, eax
inc dl
ror dl, 1
bswap eax
shl eax, 0xf9
adc eax, eax
xor bl, dl
jmp 0x100d09f4
adc esi, 4
call fcn.1022a754
mov eax, 0x16a4820f
mov edx, 0x1122682f
jmp 0x1021e694
mov dword [esp + 0x1c], 0x5f30fe2e
jmp 0x101fad3e