joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027a70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
lea edx, [eax + eax*2]
sub ecx, edx
push esi
xor esi, esi
mov edx, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edx
test eax, eax
jle 0x10027b64
mov edx, dword [ebp + 0x14]
add edx, 0xfffffffc
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
movzx edx, byte [ecx]
mov byte [ebp + 0xf], dl
movzx edx, byte [ecx + 1]
movzx esi, byte [ebp + 0xf]
mov byte [ebp + 0x13], dl
movzx edx, byte [ecx + 2]
movzx edi, byte [ebp + 0x13]
mov byte [ebp + 0xb], dl
mov edx, esi
shr edx, 2
movzx edx, word [edx*2 + 0x1007ccc0]
mov word [eax], dx
shl esi, 4
mov edx, edi
shr edx, 4
or edx, esi
add dword [ebp - 4], 4
and edx, 0x3f
movzx edx, word [edx*2 + 0x1007ccc0]
mov word [eax + 2], dx
movzx edx, byte [ebp + 0xb]
mov esi, edx
shr esi, 6
add edi, edi
add edi, edi
or esi, edi
and esi, 0x3f
mov si, word [esi*2 + 0x1007ccc0]
mov word [eax + 4], si
and edx, 0x3f
movzx edx, word [edx*2 + 0x1007ccc0]
mov word [eax + 6], dx
add ebx, 4
add ecx, 3
add eax, 8
cmp ebx, dword [ebp - 0xc]
jle 0x10027b53
mov edx, 0xd
mov word [eax], dx
mov edx, 0xa
mov word [eax + 2], dx
add eax, 4
xor ebx, ebx
add dword [ebp - 4], 2
dec dword [ebp - 8]
jne 0x10027ab5
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
jmp 0x10027b67
mov eax, dword [ebp + 0xc]
cmp edx, 1
jne 0x10027bab
movzx ecx, byte [ecx]
mov edx, ecx
shr edx, 2
mov dx, word [edx*2 + 0x1007ccc0]
mov word [eax], dx
and ecx, 3
shl ecx, 5
mov cx, word [ecx + 0x1007ccc0]
mov word [eax + 2], cx
mov dword [eax + 4], 0x3d003d
add eax, 8
add esi, 4
xor ecx, ecx
pop edi
mov word [eax], cx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 2
jne 0x10027c02
mov dl, byte [ecx]
mov cl, byte [ecx + 1]
movzx edx, dl
mov edi, edx
shr edi, 2
mov di, word [edi*2 + 0x1007ccc0]
mov word [eax], di
movzx ecx, cl
and edx, 3
mov edi, ecx
shl edx, 4
shr edi, 4
or edi, edx
mov dx, word [edi*2 + 0x1007ccc0]
mov word [eax + 2], dx
and ecx, 0xf
mov cx, word [ecx*8 + 0x1007ccc0]
mov word [eax + 4], cx
mov edx, 0x3d
mov word [eax + 6], dx
add eax, 8
add esi, 4
xor ecx, ecx
pop edi
mov word [eax], cx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100282f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10085fd0
push 0x10053eb0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, dword [0x1008dc90]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp dword [ecx + 0x1c], 0
je 0x10028430
mov edx, dword [ebp - 0x40]
cmp dword [edx + 0x20], 0
je 0x10028430
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
and eax, 0xffff0000
jne 0x100283be
movzx ecx, word [ebp + 0xc]
mov edx, dword [ebp - 0x3c]
movzx eax, word [edx + 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], 1
mov dword [ebp - 0x20], 0
jmp 0x100283d0
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
movzx edx, byte [ebp - 0x2d]
test edx, edx
jne 0x10028430
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0x18]
jae 0x10028430
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov cx, word [eax + edx*2]
mov word [ebp - 0x48], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0
je 0x1002842e
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10067e53
add esp, 8
test eax, eax
jne 0x1002842e
movzx ecx, word [ebp - 0x48]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], 1
jmp 0x100283c7
mov dword [ebp - 4], 0xfffffffe
jmp 0x10028449
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b0e7e
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x4c], esi
push esp
pop esi
pushfd
call fcn.101fbc79

Function at 0x100b0e8a
Capabilities:
Packed with generic packer

Disassembly:
push ebp
nop
mov word [esp], ax
pushal
pushfd
push edi
xchg dword [esp + 0x28], ebp
push 0x5d227209
bswap bp
pushfd
mov ebp, dword [esp + 0x34]
call fcn.1016d912
lea ecx, [ecx - 0x45d70da2]
call fcn.10028a23
sbb eax, 0x98238597
or al, 0xad
je 0x100b0f27
std
sub eax, 0x4a04903a
add byte [ecx - 0x3a], dh
push eax
sbb byte [ebx + edx], ah
adc esp, dword [eax]
cld
and ah, bh
in eax, 0x28
and eax, 0x5082ddb
jbe 0x100b0f1e
push edi
sub esp, dword [eax + 0x3942fed]
mov dword [0x83906633], eax
mov esp, 0xc4a561ac
push edi
jle 0x100b0ecb
popal
movsd dword es:[edi], dword [esi]
les edx, [edi + 0x7e]
loope 0x100b0f30
inc ebp
add dword [ebp + 0x4c], edi
sub eax, 0x2eeb028f
jb 0x100b0f45
and ecx, ebx
aad 0xb2
fimul dword [ecx + 0x10]
jl 0x100b0f36
popfd
sar dword [ebx + 0x1b0df2a3], cl
xchg esi, eax
cmp eax, 0xba688ba0
lcall 0xb77b, 0x6d820036
sbb al, 0xf6
rcl dword [eax], 0x3a
nop
jno 0x100b0f95
dec esi
shr byte [ebp + 0x4d], cl
insd dword es:[edi], dx
dec ebp
jg 0x100b0f9f
pop edi
loope 0x100b0ee4
out 0x94, eax
xchg esp, eax
or dword [ebx - 0x190956a1], esi
dec eax
imul eax, dword [ecx + ecx*8 - 0x2257cab6], 0x8f9e9274
xchg dword [ecx + 0x3805b866], ecx
out dx, al
test cl, cl
dec edx
xor eax, 0x9274dda8
je 0x100b0eca
sahf
pop dword [edi + 0x5b86689]
cmp dh, ch
mov bh, 0x16
cmp cl, byte [ebx - 0x58]
dec dword [ebx + edx*2 + 0x52]
test al, 0xff
dec esp
push ebx
push edx
dec esi
mov ecx, 0x44236e57
pop esp
pop edi
xor dword [edx - 0x6e], edi
subps xmm4, xmm1
out dx, eax
mov byte [0x9857e39f], al
sub ch, byte [ecx + 0x721b9167]
aaa
imul esp, dword [esi - 0x35], 0x34
into
popfd
push eax
les esi, [ebx]
fisttp dword [ecx]
leave
mov eax, 0xdc8f142b
sub al, 0x5b
mov eax, dword [0x94f5bb1]
mov dh, byte [ebp + 0x52]
invalid
mov cl, byte [ecx - 0x5e]
invalid
xor esp, ecx
mov eax, dword [0x5a123700]
stc
fld xword [esi + 0x761476d9]
mov edx, 0xf321002c
dec eax
invalid
Function at 0x100bbb60
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0xc], esi
jmp 0x101f8be4
inc esp
fdiv st(0)
mov dword [esp + 8], 0xee7efe6e
jmp 0x100fb56c
outsb dx, byte [esi]
invalid
lea esp, [esp + 0x14]
and al, 0x14
jbe 0x1017d919
pushfd
pushfd
mov esi, dword [esi + 0xa5730]
call fcn.10136536
leave
jne 0x100d5ed2
xchg byte [ebp - 0x22], dl
push edx
stc
mov ecx, 0x8430ab98
dec eax
push ecx
fimul word [eax + ebx*8 + 0x4f]
imul ebx, dword [ebx - 0x630bb907], 0xe968f35d
jg 0x100d5f95
stosb byte es:[edi], al
out dx, al
movnti dword [eax], esp
std
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
dec edi
fidiv word [ebx + 0x7a]
cmp dword [eax + edi*4 + 0x7454eaa2], esp
popfd
push ecx
rcr byte [edi + 0x4e562894], 1
xor ebp, dword [edi - 0x7eaef6d2]
or dword cs:[ecx - 0x7f], edx
ja 0x100d5ed9
jo 0x100d5ee3
shl eax, cl
mov esp, 0x4a37e1ad
adc al, 0x9f
push ebx
cmp al, 0xa0
fadd qword [ecx]
pop ebp
xchg ecx, eax
adc byte [edi + edx*2 + 0x6e724f34], dl
invalid
or esp, edi
out dx, al
xchg dword [eax - 0x43c10fa9], ebx
sbb ebx, esi
sbb dl, al
add ecx, dword [esi + esi*2 + 0x25fd43ec]
popal
mov esp, edi
xor dword [ebp + ecx*4 + 0x7a], esp
out 0x7b, al
cmp byte [edi + ebx*8], 0xbc
push cs
lahf
mov dl, 0xaf
jnp 0x100d5f37
cmp al, 0xdf
mov esp, 0xafb29f0e
inc ebx
scasb al, byte es:[edi]
pop edx
pop ebp
and al, 0x53
pop esp
sub dword [edi], esi
jg 0x100d5fb3
jb 0x100d6037
add byte [ecx], 0xc6
les eax, [edx + edx*2 + 0x689557db]
out 0x4e, eax
mov dl, byte [ecx - 0x73]
mov ah, byte [ebp + 0x79]
xor dh, 0x78
and edi, esi
lodsd eax, dword [esi]
push ds
out dx, eax
sbb dh, cl
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
pop ecx
pop ebx
invalid
ror dword [ebx + 0x23], 1
enter 0xffffffffffff9044, 0xffffffffffffff84
mov eax, 0x10031b51
clc
push esp
fcomp qword [edi + esi*4 - 0x3eb51a66]
retf 0x85aa
push 0x2bca3680
pushfd
mov dword [esp + 0xc], 0x81655b20
pushfd
mov byte [esp + 8], bl
pushal
lea esp, [esp + 0x30]
jmp fcn.1000ed42
call 0x101dbde8
call 0x100a7af7
pushfd
push esp
mov esi, 0x1004fdfd
jmp 0x100d5ee2

Function at 0x100f620f
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], dh
mov byte [esp], bl
mov dword [esp + 4], esi
lea esi, [edx*4 - 0x1af08617]
movsx si, cl
movsx si, al
mov esi, dword [esp + 8]
je 0x100bb051
add al, 0x8d
xor al, 0x95
jmp 0x76f0bfaf
pushal
pushfd
push dword [esp + 4]
push ecx
lea esi, [esi + 1]
call fcn.101ccb2e
adc dword [eax], eax
jle 0x100bb02b
and al, 0xe4
mov cl, 0x84
ja 0x100bb041
stosb byte es:[edi], al
lahf
inc ecx
xchg edi, eax
lds esi, [edx - 0x3e]
cdq
push esi
test byte [0xa5dc7b2f], ch
cdq
or dh, ch
xlatb
mov ah, 6
mov al, byte [ebp + 0x707fbc2d]
scasb al, byte es:[edi]
xor eax, 0x9ac3a738
sbb bl, ah
not dword [edi]
cmp byte [edi - 0x38caee36], ch
cmpsb byte [esi], byte es:[edi]
or bh, byte [eax + 0x15]
invalid
pushfd
mov byte [esp], dh
nop
jmp 0x100bb024
Function at 0x100fbf02
Capabilities:
Packed with generic packer

Disassembly:
inc esp
and al, 4
outsd dx, dword [esi]
push 0xfffffffffffffff7
xor eax, 0x9c686060
rcr dword [ecx + 0x24648d9c], 0x48
jmp fcn.1000f2d0
call fcn.101e5734
adc bl, dl
jo 0x100fbeec
ja 0x100fbee6
xchg esp, eax
jge 0x100fbf24
jecxz 0x100fbf68
sbb dword [eax - 0x5e], eax
pushfd
mov cl, 0x19
mov bh, 0x24
fld dword [ecx - 0x5d]
clc
xor dword [ebx + 0x114e3687], edi
out dx, eax
pushfd
cld
mov ebp, 0x21f84ca2
mov byte [0x85128fde], al
test al, 0xb4
scasd eax, dword es:[edi]
cdq
ret
push 0xffffffffffffffea
xor al, 0xee
jbe 0x100fbf81
mov dword [0x7906fb86], eax
mov bh, 0x7c
or byte [ebx - 0x39847036], dl
cmp dword [ebp + 0x7b], ebp
insb byte es:[edi], dx
jp 0x100fbfed
imul esp, dword [edi - 0x7f], 0xffffffbc
ret
cmp dword [si - 0x7a3d], 0xa013c8a7
mov bh, 0xb5
inc eax
jmp 0x100fbfcd
ror byte [edi], cl
push ss
xchg esp, eax
dec eax
xor dword [0x58cc67e5], eax
dec edx
mov eax, 0x1244be9e
and eax, 0xdcfe91ee
mov eax, dword [0x12e9b1dd]
mov word [0x2a460a57], gs
and eax, 0x7d2b4e83
sub ah, byte [0x7d2b4e83]
adc byte [ebp - 0x42], cl
fisttp dword [eax]
popal
inc ebp
push esp
mov ecx, 0xed2fd2cf
movsd dword es:[edi], dword [esi]
pop edx
dec ebx
cmpsd dword [esi], dword es:[edi]
inc eax
invalid
Function at 0x100fddf2
Capabilities:
Packed with generic packer

Disassembly:
mov bh, bh
xor al, 0x24
mov dword [esp + 4], 0xb970499f
mov byte [esp], bh
pushal
mov ecx, 0x60243c88
pushal
push 0x417b63fb
arpl word [ebx + 0x41], di
lea esp, [esp + 0x48]
jmp fcn.1000f310
call fcn.100ddb6c
popal
lea edi, [edx - 0x44d21b9c]
aad 0xe2
push 0xffffffffffffffc1
inc esi
adc ah, byte [eax - 0x63b98fc9]
pushfd
push ecx
xlatb
dec eax
fsub dword [ebx - 0x48]
jecxz 0x100f3ca1
ror byte [edi + 0x5429a14f], 0x31
jo 0x100f3cf7
not byte [ecx]
test al, 0x77
dec ebx
imul eax, esi, 0xffffffc3
mov byte [0xa049073a], al
mov dword [0x1e4a3417], eax
push ds
int1
dec edi
dec ebp
mov eax, dword [0xbf413415]
adc eax, dword [edi - 0x6c402906]
dec edi
loop 0x100f3cd8
das
jge 0x100f3ca9
dec ebp
jb 0x100f3c96
cmpsd dword [esi], dword es:[edi]
jne 0x100f3d87
jno 0x100f3cfb
push eax
rcr dword [ebp + 0x35752f86], 0x87
xchg dword [ebx], ebx
mov esp, gs
jg 0x100f3d4b
in al, dx
pop ecx
setge byte [ecx + 0x2c]
pop edx
pop ds
push ecx
jmp 0x100f3cc7
adc byte [esi + 0x4d], 0x81
pushfd
test dword [esi + ecx*8], eax
test edi, esp
push esp
or dl, dl
sbb al, byte ss:[esi]
dec edi
jne 0x100f3cec
leave
cmp al, 0x71
movsb byte es:[edi], byte [esi]
jno 0x100f3cee
in al, dx
sar byte [ebp + 0x63486bc1], 0x7a
movsd dword es:[edi], dword [esi]
and dh, 0x66
cmpsd dword [esi], dword es:[edi]
out 0x57, eax
loope 0x100f3da9
push eax
movsd dword es:[edi], dword [esi]
mov dword [0xa0cc43e9], eax
shr dword [edi], 0x20
inc esp
out 0x94, eax
aaa
xchg ecx, eax
test dword [edx + 0x6d], 0x3e33e55e
pushal
jbe 0x100f3d48
pop ecx
mov ah, 0x8f
imul eax, dword [esi - 0x76], 0x76
push ebx
or dh, dh
out 0x5c, eax
fdivr st(0), st(0)
fstp dword [esi + 0x61]
or dh, byte [ecx]
ror dword [esi - 0x60fe5db2], 0x87
loope 0x100f3d4b
xor ecx, eax
mov cs, word [esi - 0x5e]
add dword [edi - 0x76451e79], ebx
pop ebp
and dword [0x1f425f77], edi
mov dword [ebp + 0x21], ebx
cmp al, 0x25
ja 0x100f3df7
inc edx
pop ds
sti
mov bh, 0xea
jae 0x100f3da2
xor byte [esi + 0x1e3c38b6], al
cmp byte [esi + ebx], bh
push edx
int 0x60
stc
mov dl, 0x2f
jmp 0x100f3d33
clc
or byte [eax], ch
scasb al, byte es:[edi]
mov dh, 0x34
adc ebp, dword [ecx + 0x371aa9c9]
invalid
lea esi, [esi - 0x486117fe]
pushfd
mov word [esp], 0x8fba
jmp 0x100f3cc2
Function at 0x10101086
Capabilities:
Encode data using xor

Disassembly:
push ecx
pushal
call fcn.10101ddd
pop ebx
sbb al, 0xfd
jmp 0x100cc5ae
sbb dword [edx - 0x2a571904], esi
std
clc
cmp ebx, dword [eax + 0x4ce46673]
push esp
stosb byte es:[edi], al
call 0x4307f6d4
pushfd
xchg edi, eax
inc esi
pop esi
bound esi, qword [esi + 0x78ae159e]
or byte [ebx + 0x714cd08c], ah
adc al, 0x18
movsd dword es:[edi], dword [esi]
jecxz 0x100cc5f7
or byte [ebx], ah
pop edi
push edx
cmp eax, dword [ebx]
lodsd eax, dword [esi]
dec eax
sbb bl, dh
nop
push 0xffffffffffffffe1
cld
and al, 0x17
mov dl, 0xec
pop es
push cs
cmp eax, 0xddffded4
mov al, 0x10
sbb al, 0x8f
invalid
neg dword [ebx + 0x63]
cmp al, 0x63
pop ebx
arpl word [ebx], di
mov dh, 0xbe
adc al, 0x71
inc esi
out dx, eax
xor ah, byte [ebp + 0x60b80b9d]
xchg edx, eax
pop esp
or byte [ebx - 0x5d], ah
push dword [eax + 0x3e]
jns 0x100cc5f6
aad 0xb0
out dx, al
insb byte es:[edi], dx
invalid
pushfd
mov dword [esp + 0x14], esi
lea esp, [esp + 0x14]
jno 0x10261f80
not si
mov esi, 0x10027b81
jmp 0x100cc578
pushal
push esp
jmp 0x10251edb
xchg dword [esp + 0x44], esi
mov byte [esp], 0x6e
push dword [esp + 0x44]
ret 0x48
push eax
mov esi, 0x10027b81
push dword [esp]
push ebx
lea esp, [esp + 0xc]
jb 0x101926be
mov esi, dword [esi + 0xb51f0]
pushfd
pushal
mov byte [esp], bl
lea esi, [esi + 0x1bab098e]
pushal
jmp 0x101e5b66

Function at 0x1013c2bc
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 0x1005e902
movsx si, dl
mov ecx, dword [ecx + 0xdb8a9]
movzx si, cl
lea ecx, [ecx + 0x6c316c02]
not si
lea esi, [edi*4 + 0x59dbd872]
mov esi, ecx
not ch
call fcn.101a17d6

Function at 0x1015392f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x34], eax
jmp 0x101f9f4d
call fcn.1010113e
and al, 0x24
cmp bh, bh
pop esi
mov ecx, 0x2444c760
inc eax
pushal
invalid
call fcn.1014cb58
outsd dx, dword [esi]
adc dword [esi], eax
fcom qword [ecx]
inc edx
sbb byte [ecx - 0x2de1e235], al
mov dword [edi - 0x1b76c52], ecx
insb byte es:[edi], dx
popal
leave
jns 0x10126280
push esp
fdiv dword [ebx + 0x3b]
lds ebp, [edx]
jbe 0x1012629f
invalid
pushfd
jmp 0x100e0073
pushfd
movzx ax, bl
push dword [esp + 4]
mov eax, 0x1005a7f6
push ecx
mov eax, dword [eax + 0xb5321]
jmp 0x101262b8

Function at 0x10159e16
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 4], bx
lea edx, [edx + 0x59ac9e06]
call fcn.100210e0

Function at 0x1015a709
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 0xc], 0x13
mov esi, dword [esi + 0x926f4]
lea esp, [esp + 0x3c]
jg 0x101ef3d2
lea esi, [esi - 0x5884dd99]
pushfd
pushal
xchg dword [esp + 0x24], esi
pushfd
pushfd
push dword [esp]
push dword [esp + 0x30]
ret 0x34
movzx esi, al
movsx si, bl
mov esi, 0x100266b2
push dword [esp + 4]
jmp 0x1011f41d
mov dword [esp + 0x30], eax
setb al
mov ah, byte [esp]
cwde
push dword [esp]
mov eax, 0x10048eb3
mov byte [esp + 8], 0x9d
mov eax, dword [eax + 0x1609ed]
call fcn.1014ce04
pushfd
pushal
mov byte [esp], bh
call fcn.101fcf50
mov byte [esp], 0xe5
mov dword [esp + 8], edx
movzx edx, dl
mov dh, 0xda
mov edx, 0x1000f485
call fcn.102621a6
push dword [esp + 0xc]
jmp 0x101a0c2f
Function at 0x10174ab9
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea edi, [edi + 0x761d1289]
call fcn.1024760f
jmp 0x100d3353

Function at 0x101b5ffd
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x4154e7a7
push 0x9337d01f
mov ecx, dword [ecx + 0x7e2d8]
jmp 0x100b0ea9

Function at 0x101b7fc3
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp + 0x50], ecx
movsx cx, dl
mov ecx, 0x1004fdb0
pushfd
lea esp, [esp + 0x50]
jg 0x101ae77a
mov ecx, dword [ecx + 0x6f801]
call fcn.1016a2e8
jmp 0x10191e51

Function at 0x10238b62
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov eax, dword [eax + 0x1312ae]
mov byte [esp + 4], 0x86
lea esp, [esp + 0x48]
jl 0x10191b0a
lea eax, [eax - 0x855e035]
pushal
call fcn.10129550
pushfd
push esp
mov dword [esp + 4], 0x40aefe6f
pushfd
pushfd
jmp 0x102389ee
pushfd
mov byte [esp], 0x81
push 0xb5b4fea2
pushal
xchg dword [esp + 0x24], eax
movzx eax, al
bswap ax
mov eax, 0x10033cf5
pushal
jmp 0x1009b8f0
call fcn.101d53d9
add eax, 0xf2aaa912
loop 0x10191b83
out 0x2f, al
mov ebp, 0xbb01ccbe
mov ecx, 0x735672e
xchg byte [ecx + ebp*2 - 0x216c69a5], dh
xor dword [edx + 0x69], 0xdf7504c9
xor ebx, edx
nop
invalid
ret
sub bl, cl
push esp
cld
lahf
push ebp
push ds
sbb al, byte [ebp + 0x6a]
out 0x56, al
fst qword [eax]
sbb byte [0x3b752ef], dh
mov esi, dword [esi + 0x51734a93]
cmp dh, dh
mov al, 0xa9
imul edi, dword [edx + 0x79a5912a], 0xffffff9a
imul esi, dword [ebp + 0x4e], 0xffffffdc
imul eax, ebp, 0xbff09712
jg 0x10191b67
sbb byte [ebp + ebx*4 - 0x6a], dh
sub dword [ebx], 0x1a
in eax, 0x31
insd dword es:[edi], dx
pop ss
retf 0x5eb3
mov dword [esp + 8], 0x493a55e5
pushal
lea esp, [esp + 0x28]
jmp fcn.1000c8fa
lahf
nop
bswap ax
movzx ax, al
cwde
pushal
mov eax, dword [esp + 0x20]
pushfd
mov byte [esp + 4], dl
push dword [esp]
xchg dword [esp + 0x2c], eax
push dword [esp]
lea esp, [esp + 0x30]
jne 0x1017fece
pushfd
push 0xa90f75d7
xchg dword [esp + 4], eax
push dword [esp]
push edx
mov eax, 0x10033cf5
mov word [esp + 4], cx
pushal
push esi
mov eax, dword [eax + 0x1312ae]
call fcn.100b7489
pushfd
mov dword [esp + 0x38], ebp
call fcn.101561a3

Function at 0x10245e18
Capabilities:
Packed with generic packer

Disassembly:
pushfd
xchg dword [esp + 0x2c], eax
push dword [esp]
jmp 0x101ef3f4
Function at 0x102872c9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1028bbfb
mov eax, 0x2724a98f
insd dword es:[edi], dx
in al, dx
and byte [edi], bh
xchg edx, eax
ror edi, cl
pop eax
and ebp, ecx
and al, 0x46
pop ebp
push cs
xchg ecx, eax
retf
lea esp, [esp + 0x18]
je 0x1027b3b1
shl ecx, 0xa
add edx, eax
bsf cx, bx
ror cl, 4
rcl cl, cl
mov ecx, dword [esi + 0x7c]
push 0x38189568
pushal
clc
test sp, cx
add ecx, edx
pushfd
mov word [esp + 4], 0x5b52
rcr dword [esi + 0x42444c7], 1
push edx
pop ebx
stc
call fcn.1026f685
outsb dx, byte [esi]
mov byte [ebx], dh
leave
sbb byte [edi + 0x72189cb3], 0x4b
xor dword [edi - 0x7d], edi
push ebp
mov ah, 0x47
pushfd
call 0x488c061a
pop ebp
dec ebx
cmp byte [ebp + 0x4b], bl
cmc
je 0x1028bc21
xchg ebp, eax
jle 0x1028bbdb
inc ecx
test eax, 0xb7e1a8d3
std
fisttp word [ecx + 0x2915ebe4]
xor byte [ebp + 0x2c], al
xchg edi, eax
loop 0x1028bcb8
sbb al, 0xfd
xor edi, dword [0xcf7c38b0]
mov eax, dword [0xf1e27eab]
cdq
jecxz 0x1028bc46
pop edx
int1
les ebp, [ecx + 5]
and byte [eax], cl
lahf
out 0x93, eax
sub al, 0x93
popfd
add eax, 0x32735f92
add dword ds:[ecx - 0x1b], esp
and byte [esi], ch
shl dword [ecx - 0x7b], cl
push eax
mov eax, 0xe50dd86d
dec edx
clc
adc esp, edx
in eax, dx
xlatb
xchg ecx, eax
and edx, edi
xchg edx, eax
in eax, dx
clc
push ss
dec ebp
mov ebp, 0x52805f0
invalid
test eax, 0xfeff169b
in eax, dx
fldcw word [ecx + 0x28]
xchg esi, eax
cmp bh, 0xf1
sub al, 0x81
pop ebp
sbb ch, byte [si - 0x76b1]
in eax, 0x99
dec edx
invalid

Function at 0x1028e7f1
Capabilities:
Encode data using xor

Disassembly:
xor esp, dword [ebp + 0x71348a39]
inc esp
inc esp
iretd
leave
add byte [0x87719205], 0xb
movsb byte es:[edi], byte [esi]
out dx, al
movsd dword es:[edi], dword [esi]
pop esp
into
lodsd eax, dword [esi]
xchg edx, eax
jno 0x1028e720
or esp, dword [esi + ebp*8 - 0x5231a35b]
jae 0x1028e796
xor dword [ebp + 0x33], eax
dec ebp
mov word [eax], cs
popfd
and al, 0xa6
jnp 0x1028e792
lodsd eax, dword [esi]
pushal
popfd
jge 0x1028e7d9
sbb ch, dl
daa
push ecx
mov word [esp + ecx*8 + 0x6d1768aa], fs
push ebp
ret
push es
pop ecx
into
xchg esi, eax
iretd
lodsb al, byte [esi]
jns 0x1028e796
ret
push 0xe14fd2d7
mov dword [esp + 0x30], 0x1026f294
call fcn.1027aabe
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add dl, dh
or dword [ecx + 0x37], edx
test dword fs:[eax + 0x39], ecx
pop eax
loop 0x1028e7e4
mov edi, 0x4d8733c8
sbb bl, byte [esi]
rcr ebx, 0xa2
dec edx
mov eax, dword [0x8f3890bb]
xor al, 0xa2
out dx, eax
popfd
or eax, dword [eax - 0x75a88433]
mov esi, 0xd0943ef7
int3
Function at 0x4010a8
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 8]
call fcn.00401414
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4010fa
push 0x10
push 0x46dd82
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4012a8
mov eax, dword [0x490df4]
test eax, eax
jne 0x40110f
or dword [0x480394], 0xffffffff
jmp 0x40129b
mov ebx, 0x490e0c
cmp eax, 1
jne 0x401138
push 0xffffffffffffffff
push dword [0x490dfc]
mov esi, 0x491f78
push eax
call fcn.004084bb
mov al, byte [0x480388]
mov byte [0x491f7b], al
jmp 0x401186
lea eax, [ebp - 6]
push eax
push 0x490df4
mov esi, ebx
mov eax, 0x491f78
call fcn.0040894d
test al, al
jne 0x401160
mov dword [0x480394], 1
jmp 0x40129b
mov al, byte [0x491f78]
mov byte [0x490df8], al
mov al, byte [0x491f79]
push 0x490df0
mov byte [ebp - 5], al
lea eax, [ebp - 0x43c]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [0x490df4]
push ebx
call fcn.0041703e
test eax, eax
je 0x4011bc
mov edi, 0x491f78
call fcn.004085fa
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x480394], 1
jmp 0x4012a8
cmp byte [ebp - 5], 1
jne 0x401258
call fcn.0040fba5
test al, al
jne 0x401258
push edi
lea eax, [ebp - 0x43c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 6], 0
je 0x401231
mov edi, 0x46ddf0
push edi
lea esi, [ebp - 0x18]
call fcn.00401983
push ebx
call fcn.00401a27
push edi
call fcn.00401a27
push 1
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x43c]
push eax
push 0x46ddf4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00401a04
jmp 0x401291
push 1
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x43c]
push eax
push 0x46ddf4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401291
call fcn.004012af
call fcn.004013a3
cmp byte [0x490df8], 0
mov ebx, 0x4915b0
jne 0x401275
call fcn.0040be39
push 1
mov ecx, 0x491018
call fcn.0041731e
cmp byte [0x490df8], 0
jne 0x401291
mov ecx, ebx
call fcn.0040c1dc
mov edi, 0x491f78
call fcn.004085fa
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret 4