joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1628b66
Capabilities:
Get number of processors
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
lea esi, [esi - 0x6562884e]
lea ebp, [ebp*2 - 0x33c56cec]
not dword [esp + ebp - 0x26513e86]
je 0x15610b8
add ebp, ebp
xor dword [esp + ebp - 0x4ca27d18], 0xe636709c
or ebp, dword [esp + ebp - 0x4ca27d18]
xchg dword [esp + 0x18], esi
mov ebp, dword [esp + 0x14]
ja 0x16e0591
mov ecx, 0xd1226e15
mov ecx, dword [esi]
add esi, 4
mov eax, 0xd02b771c
sub edi, 1
dec eax
jg 0x16c9a01
movzx eax, byte [edi]
jle 0x1745850

Function at 0x1628f9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0xfa81d114
test ecx, 0xba9baeab
mov esi, dword [esp + ecx + 0x4c58e4d1]
mov esi, dword [esi + ecx + 0x4c58e4c9]
not cl
jl 0x175f2f7
mov ecx, 0x99302bc
mov dword [esp + 8], ecx
je 0x17846a8
lea esi, [esi - 0x455583f9]
neg byte [esp + 8]
mov edx, dword [esp + 0x34]
cmp word [esp + 0x30], cx
setne byte [esp + ecx + 0x7dead2e5]
call fcn.0178f5aa
mov ecx, 0xf42b20aa
movzx edx, cl
bts cx, dx
mov ecx, dword [edi + edx - 0xaa]
sub edx, edx
inc edx
mov dl, byte [edi + edx*4]
jne 0x16ca698

Function at 0x162917e
Capabilities:
Encode data using base64

Disassembly:
bswap edx
or edx, edx
shr edx, 0xa6
push edx
xor byte [esp + edx - 0x76cec1], dl
xchg dword [esp + edx*4 - 0x1db3af4], edi
shl byte [esp + edx*8 - 0x3b67608], 0xc1
jbe 0x164bca3
push ecx
mov ecx, dword [esp + edx*4 - 0x1db3b00]
shl edx, 0x57
ja 0x17706fa
mov edx, dword [esp + ecx - 0x76cdf0]
mov dword [esp + 0x10], edi
lea ecx, [ecx*8 + 0x23982830]
and dword [esp + ecx*2 - 0x4e9d305c], ecx
movzx ecx, cl
and byte [esp + ecx*2 - 0x5c], 0x3f
add dword [esp + 8], 0xfff97d85
shl cl, cl
js 0x172d2de
push ebx
mov ebx, dword [esp + ecx + 8]
push edx
mov edx, dword [esp + ecx + 0xc]
test cl, 0xbb
setne cl
mov edi, dword [esp + edx - 0x4687f0]
mov edi, dword [edi + ecx]
mov edx, 0x3c0471a2
jg 0x173a4b2
shl dword [esp + ecx + 0xc], 0x24
shl word [esp + ecx + 0xc], 0xdb
movsx edx, byte [esp + edx*2 - 0x7808e338]
lea edi, [edi + ebx*2 + 0x3fa55b81]
mov dword [esp + ebx - 0x4687f0], ecx
neg ebx
shr bl, 0x9b
cmp word [esp + 0xc], bx
call fcn.016ab793
popfd
jmp fcn.016c45a3
or dh, al
sub al, 0xd5
jbe 0x16febd9
jbe 0x1562c92
mov esi, 0x6c8ce800
add si, si
je 0x16817ae
xor si, 0x2cae
call fcn.0173f9a7
neg bp
dec eax
mov dword [esp], 0x62462be
sar dword [esp + 0x20], 0xce
setp byte [esp + 0x1a]
ror bp, 1
push 0xac067124
dec eax
shr dword [esp + 8], 0x95
xor bp, 0xe21c
inc sp
xor esi, ebp
dec eax
lea ebp, [esp + ebp + 0x30]
dec eax
mov dword [esp + 0x18], 0x8b105522
push 0x84aeea14
push 0x6e81b69b
inc esp
mov byte [ebp], ch
dec eax
lea esp, [esp + 0x40]
jmp fcn.016b95a5
cmp edx, 0x713e5a8b
not dx
lea edx, [edx + edx*4 + 0x4f887911]
push esi
mov edx, dword [esp + 8]
mov dword [esp + 8], ebp
jl 0x170dc7f
push edi
mov edi, 0x32ac7e37
call fcn.0171e47c
add ax, dx
push 0x27904e00
push 0xf908c90d
mov word [esi], ax
not word [esp + 6]
lea esp, [esp + 0x10]
jmp fcn.016bd1c1

Function at 0x162efec
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov ebp, dword [esp + edi + 0x53444171]
mov edi, dword [esp + edi + 0x53444161]
shr ebp, 0x36
call fcn.01665f37
Function at 0x16328b8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov al, byte [eax + edi - 0x59a2c518]
mov dword [esp], 0x8284ac9d
add edi, 2
call fcn.0170a1ac

Function at 0x16357e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + ebp + 0xa]
mov ebx, dword [ebx + ebp*4 - 8]

Function at 0x1637487
Capabilities:
Authenticate hmac

Disassembly:
add dword [esp + 0x1c], 0x794c3
mov edx, ecx
shl ebx, 0x9d
test dx, 0x387
lea ebp, [ebp*2 + 0x40aa089b]
call fcn.01721461
mov dword [esp + 0x14], eax
push ebx
je 0x178af9a
mov ebx, 0x328681a2
shr cl, cl
test edx, ebx
push edi
add dword [esp + 8], 0xffffea3c
call fcn.016734af

Function at 0x16374a5
Capabilities:
Authenticate hmac

Disassembly:
add dword [esp + 0x1c], 0x794c3
mov edx, ecx
shl ebx, 0x9d
test dx, 0x387
lea ebp, [ebp*2 + 0x40aa089b]
call fcn.01721461
mov dword [esp + 0x14], eax
push ebx
je 0x178af9a
mov ebx, 0x328681a2
shr cl, cl
test edx, ebx
push edi
add dword [esp + 8], 0xffffea3c
call fcn.016734af

Function at 0x1648ec0
Capabilities:
Packed with generic packer

Disassembly:
call fcn.01763636
jne 0x16edc87
mov ebx, dword [esp + 8]
mov dword [esp + 8], ebx
add dword [esp], 0x4cf3b
mov ebx, 0x3a82a020
test ebx, ebx
sets bl
shr bx, 0x99
mov ebx, dword [esp + ebx - 0x3a820000]
mov ebx, dword [ebx]
mov dword [esp], 0xc6b71692
and dword [esp], 0x8b83212e
or word [esp], 0x8faa
and byte [esp], 0x1d
add dword [esp], 0xd3b456a8
shl word [esp], 0x32
cmp byte [esp], 0xb1
jle 0x16d279d
lea ebx, [ebx + 0x99d79b9]
cmp byte [esp], 0x3a
mov word [esp], 0x2c18
jl 0x167814b
mov ax, word [ebp]
mov cl, byte [ebp + 2]
call fcn.0169a9f4
jmp 0x1643b31
xchg dword [esp + 8], ebx
push dword [esp + 4]
popfd
lea esp, [esp + 8]
ret
mov eax, dword [ebp + ebx*4]
push 0xa23bd22b
call fcn.01663d54
jmp 0x173a5ed
mov dword [esp + 0xc], eax
and cx, 0xaf80
sub ecx, 0xf483febd
xor ecx, 0x952efab7
push ebx
mov ebx, ecx
xor ecx, 0x84244ea5
shl cx, 0xff
call fcn.016a199e
mov dword [esp + edi*2 - 0x31045804], edi
jns 0x156ebbb
add esi, dword [esp + esi - 0x76108421]
and byte [esp], 0x31
mov dword [esp + 0xc], eax
add si, word [esp + 1]
mov dword [esp], 0x12b5aa87
ja 0x16f017d
xor byte [esp], 5
or esi, dword [esp]
call fcn.01767b52
lea esp, [esp + 8]
jne 0x168a6e5
mov eax, 0x383e8ba9
push eax
mov eax, dword [ebp + eax*2 - 0x707d1752]
push 0xef058886
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov esi, 0x1012f311
lea esi, [esi*4 - 0x68cd9174]
push esi
mov dword [ebp], eax
mov esi, ebp
mov ebx, dword [esp + 4]
mov ebp, 0x9e90f333
mov ebp, dword [esp + 8]
lea esp, [esp + 0xc]
jmp fcn.0176d941
jmp 0x1782dc6
mov si, word [esi]
jmp fcn.017427ff

Function at 0x164abce
Capabilities:
Authenticate hmac

Disassembly:
add esi, 2
sal bp, cl
call fcn.0169ad8a
Function at 0x164abdc
Capabilities:
Authenticate hmac

Disassembly:
push 0x1b3aa207
push 0x27aa138a
mov cl, byte [ebp + 2]
jle 0x169baca
rol word [esp + 8], 0x41
adc ebp, 1
dec word [esp + 1]
shr byte [esp + 0xc], 0xa7
call fcn.0168aaa3
sysenter
push ecx
push edi
pushfd
mov edi, 0x79337591
mov dword [esp + 8], 0xf8c1785d
pop ebp
js 0x164ab79
clc
mov edi, dword [esp + edi - 0x7933758d]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.0178811e
push esi
call fcn.01631bec
nop
mov bh, 0xc5
jno 0x164ac08
std
mov cl, 0x7b
pop ebp
pop ss
pop edi
lds eax, [ebp - 0x215d8dca]
dec esi
push ss
adc dh, 0x3d
cwde
mov ah, 0x3a
outsb dx, byte [esi]
sbb al, 0x23
inc edx
mov eax, dword [0x6a5f64f3]
push edi
xchg dword [ecx], esi
fld qword [eax + 0x78]
insb byte es:[edi], dx
out dx, eax
inc esp
mov cl, 0x2c
js 0x164ac21
and dword [0x33a21854], edi
add byte [edi - 0x1ae8214f], al
test eax, 0x56651984
sbb dword [ebp + 0x56], esp
leave
js 0x164abb5
and eax, eax
stosd dword es:[edi], eax
pop eax
imul eax, dword [edi + 0x2c7ede31], 0xe7822bb
and byte [0xaab4410d], dh
mov byte [0xb187a097], al
fbstp tbyte [ecx + 0x78c05bae]
mov fs, word [eax]
xlatb
and eax, 0x81b42569
xchg dword [ecx], esi
fisttp word [eax + 0x4369d995]
imul edi, dword [ecx], 0x43
or eax, 0x8dc1bbbd
dec edx
mov byte [ebp + 0x6b4369d9], dl
cmp dword [ebx + 0xd], eax
mov ebp, 0x4a8dc1bb
pop esp
push 0xffffffffffffffc7
in al, dx
fstp qword [ebx + 0x228e783b]
sub al, 4
dec eax
mov byte [0xa78e35c0], al
sbb bh, bl
push esp
shl byte gs:[edi - 0x2e], cl
scasd eax, dword es:[edi]
sub al, 0xed
jge 0x164ac51
xor dword [esi - 0x76cc3d0a], esi
pop esp
and al, 0x18
lea esp, [esp + 0xc]
jmp fcn.0157e977

Function at 0x165a9fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ecx
jae 0x16f5bae
syscall
call fcn.01716614

Function at 0x165c319
Capabilities:
Execute syscall

Disassembly:
movzx edx, dx
mov edx, dword [esp + 8]
jo 0x17461df
jbe 0x16d47cf
syscall
inc ecx
push edi
push edi
dec eax
mov dword [esp + 8], 0x63db6700
dec eax
lea esp, [esp + 8]
call fcn.01649b8c
or dh, bh
jbe 0x16d4815
and esi, esi
test byte [esp + 0x18], 0x9b
call fcn.016b68e6
scasb al, byte es:[edi]
xchg ebp, eax
loope 0x16d47ab
lahf
push edx
lds ebx, [ecx + 0x7d9ec251]
loop 0x16d4852
and esi, dword [eax + 0xb]
pop edi
and byte [ecx + 0x66], bh
mov al, byte [esi + 0x7bc4b548]
add ebx, ebp
lds ebp, [esi - 0x700936bb]
mov bh, 3
pop edi
push 0x6acf3e
or dword [0x67769142], ebp
mov eax, 0xcf643bac
push 0
mov dword [eax + 0x76], edx
loopne 0x16d47da
invalid
fcomp qword [ecx - 0x22]
ljmp 0xf2f5
cmp eax, 0xba76d18e
cmp ecx, dword [ebp - 0x1e]
xor byte [ebp + 0x422d09ff], dl
nop
inc ebp
add cl, byte [ecx + 0x2a02931c]
imul esp, dword [ebp + 0x59f0cd99], 0x31654d5c
in eax, dx
sub dword [edx + 0x69209d81], ebp
xchg edx, eax
mov dl, 0x11
cli
cmpsb byte [esi], byte es:[edi]
ret 0xd8b3
Function at 0x1667986
Capabilities:
Encode data using base64

Disassembly:
call fcn.0171d388
lea ebx, [eax + 3]
lea ecx, [ebx + ebx]
push ecx
call fcn.0151319c
mov edi, eax
add esp, 4
test edi, edi
je 0x14b7717
push 0
push edi
push ebx
push esi
call fcn.01731040
fcom dword [esi - 0x18]
push esp
mov bl, 5
add byte [ebx - 0x3074fb3c], al
call fcn.014b67b0
push edi
jmp 0x14b7748
push esi
call fcn.01512a46
add esp, 4
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, eax
call fcn.01512a46
add esp, 4
test esi, esi
je 0x14b7720
mov eax, dword [ebp + 8]
push esi
push 0xe827f0
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.014b4940
push esi
call fcn.01512a46
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jge 0x14b76c7
lea edx, [edx + 1]
shl dword [esp + 4], 0xa8
cmp dword [esp + 4], 0x4ca29c24
jl 0x1794189
cmp ecx, 0x88ab1493
call fcn.016424ee
jg 0x16820ed
mov dword [esp + 0x18], edx
cmp word [esp + 4], 0x2f16

Function at 0x1668df9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 4], 0xa59224bf
lea esp, [esp + 4]
call fcn.0176e569

Function at 0x1674381
Capabilities:
Authenticate hmac

Disassembly:
push ebx
mov ecx, dword [esp + 0xc]
neg word [esp + 0x14]
jae 0x1721574
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]

Function at 0x16781f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
jmp 0x16a1e27
push ebp
mov ebp, esp
and esp, 0xfffffff8
xadd ah, al
sbb cx, 0x5836
shr eax, 0xa9
sub esp, 0x114
not al
cwde
push ebx
mov ecx, edx
cbw
movsx cx, bh
push esi
xchg esi, eax
mov esi, dword [ebp + 0xc]
movzx cx, al
cbw
push edi
lahf
mov edi, dword [ebp + 8]
bswap eax
lea eax, [esp + 0x28]
push eax
lahf
mov eax, esi
sets ch
cmovs ecx, edi
mov ecx, edi
jmp 0x1690a99
call fcn.017005b9
test eax, eax
jmp 0x1748ccf
push eax
jmp 0x1716c0e
jne 0x168acb6
mov ebx, dword [ebp + 0x10]
movsx edx, di
mov edx, dword [esp + 0x7c]
jmp 0x1659b47
Function at 0x1685521
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
push esi
adc dword [eax], eax
or dword [0xb8739142], ebp
inc ecx
shl byte [ebp - 0x2a21e522], cl
invalid
pushfd
add dword [esp + 4], 0x7880b
nop
mov esi, 0x1d28e685
mov si, 0xa800
sub esi, esi
mov esi, dword [esp + esi*8 + 4]
mov esi, dword [esi]
jbe 0x16b1866
aad 0x1d
mov ch, 0xb9
xor eax, 0x84a080e8
push esp
call 0xdf09ba50
jne 0x16854f3
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
jne 0x16855c9
or eax, 0xa19401f3
inc edi
sub eax, 0x4ac51464
lea ecx, [eax - 5]
push edi
xchg ecx, eax
push edi
dec edi
sub edx, dword [edx + 0x50]
test byte [ebp - 0x2b], ch
sub byte [eax], bh
sbb byte [esi + ecx*2], dl
mov dh, 0x63
mov ch, 0xd6
stosb byte es:[edi], al
inc edx
adc bl, dh
outsb dx, byte [esi]
fst qword [edi + esi*4]
fisttp qword [eax]
mov edx, 0x9a6c1456
les ebp, [ecx]
jnp 0x16855b2
pop esp
mov dword [ecx - 0x18647917], eax
cdq
fnstsw word [edx]
cmove eax, dword [ebx + 0x14c2e314]
mov byte [0x5bbb617f], al
fild word [edi - 0x69]
push ebx
push edi
stc
call 0xe621cd9
add dword [ecx], esp
aaa
mov dh, 0xe
sub eax, 0xd5def2c2
retf 0xc949
aad 0xca
dec ecx
leave
add byte [edi + 0x5d], 0xbe
and cl, byte [edx]
sbb bh, byte [edx]
outsd dx, dword ss:[esi]
xor al, 0x4c
dec esp
xor al, 0x50
push edx
push ecx
loop 0x16855c2
sal byte [esi - 0x2d53dbb4], cl
or al, byte [eax + 0x76]
and byte [edx + 6], dh
inc esp
push 0x34
and ecx, ebp
pop edx
adc byte [esi], ah
js 0x16855ba
mov esp, 0xf6102668
fld xword [ecx - 0xe]
inc ebx
and dh, bh
mov ch, 0xe4
push edx
dec ebx
jmp [ebp - 0x2e]
call fcn.01733535

Function at 0x1686a1d
Capabilities:
Encode data using xor

Disassembly:
push edx
shl bp, 0x45
push esi
mov dword [esp + ebp + 0x116189c0], edi
call fcn.0174658d
inc edi
rcl edx, 0x6a
sub dword [edi - 0x8f48744], edx
and al, 0xaa
sbb ecx, dword [eax + 0x2b]
in eax, 0xde
jb 0x1686a6b
invalid
pop esi
push ebp
dec ebp
xchg esi, eax
salc
in eax, dx
loop 0x1686ac1
invalid
sub byte [ecx], bl
add eax, edx
mov edx, 0x7900a609
mov edi, 0xb21c2938
adc dword [ecx + eax*8], ebp
inc esp
arpl word [edi], dx
shr cl, cl
push esi
invalid
Function at 0x1692c09
Capabilities:
Packed with generic packer

Disassembly:
jae 0x16d2a19
xchg dword [esp + ecx + 0x79344014], ebp
mov esi, dword [esp + esi + 0x784df347]
jl 0x1644423
push dword [esp + 0x5c]
popfd
lea esp, [esp + 0x68]
ret
shl cx, 1
neg ecx
jne 0x177dbac
xchg byte [ecx + 0x74818e15], dh
and al, 0x28
sbb edx, ebp
cmpsb byte [esi], byte es:[edi]
add dword [ecx - 0x5cd7dbbc], 0xffffffe3
mov byte [edx], bl
sub dword [esp + 0x3c], 0xdf94d0ab
jb 0x16e63f3
call fcn.0163cc80
mov dword [esp + 8], ebp
push esi
mov esi, 0xd31b96b4
push ecx
push ebx
add dword [esp + 0xc], 0x27b1
mov ecx, esi
xor si, 0x6726
jno 0x16d5126
cmp dword [esp + ebx*8 + 0xe5ac0c], ebx
call fcn.016fc813
loop 0x1692bbd
xchg esi, eax
sub cl, byte [ecx]
loope 0x1692c67
in al, dx
insd dword es:[edi], dx
sbb dword [edi - 0x24], eax
pushfd
bswap ecx
mov dl, 0x21
int 0x76
iretd
mov byte [0x32e1cb69], al
inc edi
loopne 0x1692c15
das
invalid
call 0x1755fa1
adc esi, 4
or word [esp + 4], 0x523
jae 0x16d8525
call fcn.016c7bf9
dec eax
lea esp, [esp + 0x20]
jmp fcn.0177ca2c
mov ebp, ecx
mov ebp, dword [esp + ecx*2 + 0x59c8d2a4]
mov ebp, dword [ebp + esi*2 + 0x59c81cdc]
bswap ecx
mov cl, 0x2f
mov dword [esp + ecx + 0x4b69e4dd], ecx
lea ebp, [ebp + ecx + 0x6f83736a]
add esi, dword [esp + esi + 0x2ce40e7a]
setle byte [esp + ecx + 0x4b69e4dd]
shl ecx, 0xe
cmp esi, dword [esp + esi + 0x784df34b]
jl 0x162236d
shrd bp, ax, cl
call fcn.01701fb5
cmovo ebp, dword [esp + edi*8 + 0xc]
mov ebx, ecx
movzx di, byte [esp + edi + 0x12]
call fcn.016c2e6c
call fcn.016499ae
and dword [esp + 0x3c], 0xe01a9600
jns 0x1637462
jmp 0x16d2cb6
mov ebx, ecx
or byte [esp + 0xc], 0x92
cmp cl, byte [esp + 0xf]
mov ebx, dword [esp]
setge byte [esp + 0xc]
sets cl
bswap ecx
cmp cl, 0xd
jg 0x16dd00d

Function at 0x16a260a
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + 0x4d18672b]
ja 0x172d310
mov byte [edx], cl
call fcn.017744f8

Function at 0x16a35ec
Capabilities:
Encode data using base64

Disassembly:
jo 0x170251f
and ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x28]
shr word [esp + 0x28], 1
cmp di, bx
js 0x1729b1d
xchg dword [esp + 0x30], edx
mov edi, dword [esp + 4]
add dword [esp + 0x2c], 0xff894bae
add bl, byte [esp + 0x2a]
shl bx, 0x1e
js fcn.01783a67
mov byte [esp + 0x28], 2
shl dword [esp + 0x28], 0xc8
call fcn.016f1bff
call fcn.01752a48
sub esi, dword [esp + ecx*2 - 0x7a55ffce]
or esi, 0x6726bbbf
ja 0x162f268
repne cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
push edi
shl dword [esi], cl
cli
add eax, dword [ebx + 0x3cee8e0c]
shr cl, cl
test ecx, edi
push edx
mov edx, 0xff1eb7c0
lodsd eax, dword [esi]
mov edx, 0xac118161
mov dh, 0xfe
or al, 0x7d
out dx, eax
enter 0x5cc0, 0xffffffffffffffff
salc
add eax, 0xd0cacb03
sal dword [edx], 1
add al, 0xf1
retf

Function at 0x16a86f3
Capabilities:
Encode data using base64

Disassembly:
call 0x17954ae
pushfd
add dword [esp + 4], 0x1ac969
mov edi, 0x93165a03
movsx edi, di
push edi
shl edi, 0xf6
lea edi, [edi + edi - 0x18c840c2]
mov edi, dword [esp + edi + 0x174840ca]
mov edi, dword [edi]
add byte [esp], 0x8b
jl 0x16dc5cb
jmp 0x16bd596
mov word [esi], dx
call fcn.0165f2c3
call fcn.01741cbc
Function at 0x16b6e8f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ebx
mov ebp, 0xd884e025
call fcn.0162089a

Function at 0x16bd5a3
Capabilities:
Encode data using base64

Disassembly:
jae 0x1729afe
not word [esp + 7]
lea esp, [esp + 0xc]
jne fcn.0176d941
mov ecx, dword [esp]
mov ecx, dword [ecx + ebx*2 - 0x7b484634]
add esi, esi
shl ebx, 0x32
mov esi, 0x3b169b01
call fcn.01740447
neg dword [esp + 0x18]
mov ebx, ecx
setg byte [esp + 0x18]
test esi, 0xe73ec0ba
call fcn.0173a0ec

Function at 0x16c3edb
Capabilities:
Authenticate hmac

Disassembly:
xor word [esp + esi + 0x25710bcf], 0xfc16
jae 0x16c3ea0
mov esi, 0xda8ef431
lea edi, [edi + 1]
add dword [esp + esi*2 + 0x4ae2179e], 0xffeee46e
push ebp
test dword [esp + esi*2 + 0x4ae2179e], ebp
movsx ebp, word [esp]
mov bp, 0xc108
mov dword [esp + 0x1c], edi
jae 0x16636cc
lahf
dec ebx
call 0x2cf1a37d
xor al, 0xa9
pop es
push 0xbc7d927d
cli
inc ecx
mov dword [0xe4178617], eax
inc edx
mov dl, 0x97
sbb eax, 0xc2c6adc8
mov edi, edi
and ah, byte [ebx - 0x48]
mov esp, 0x4fdb48a9
in al, 0x2a
daa
test word [esp + 1], bp
push ebp
push esi
push edx
nop
mov edx, esi
not ebp
mov edi, 0x2a1ea819
jbe fcn.01643ade
push ecx
mov edi, dword [esp + edx + 0x25710be3]
mov edi, dword [edi + esi*2 + 0x4ae2179e]
movzx bp, dl
add dword [esp + esi*2 + 0x4ae217ba], 0xff945f6d
call fcn.01680a9c
xchg dword [esp + 0x18], ecx
not edi
mov edi, dword [esp + edi*2 + 0xfd0c6ea]
mov dword [esp + 0x14], ecx
call fcn.016201c0

Function at 0x16d6628
Capabilities:
Encode data using xor

Disassembly:
retf
add dword [esp + edi - 0x5ab3fe13], 0xff94cdb3
add di, 0xbb2
xchg dword [esp + edi - 0x5ab309b9], ebp
mov edi, dword [esp + edi - 0x5ab309bd]
mov esp, 0x4cf6433c
movsd dword es:[edi], dword [esi]
jbe 0x173aaa1
push cs
insd dword es:[edi], dx
push ss
inc edx
lcall 0xc8e0, 0x9cd78cb4
push ecx
lodsd eax, dword [esi]
xchg esi, eax
div dword [edx]
in al, 0xcc
adc edi, dword [edx - 0x21952e6e]
inc ecx
clc
xor eax, 0x9086fee5
inc ebp
in al, 0xc3
cmp byte [esp + esi*8 + 0x1dc2aa87], ch
add byte [ecx], cl
sub eax, 0xfd4e9142
push ecx
mov ch, 0x89
je 0x16d6640
inc esi
jp 0x16d6684
jge 0x16d66de
xor cl, bh
push esi
sub eax, 0xd26ed29
jno 0x16d661e
or eax, 0x661d8c71
or cl, byte [ecx]
rcl ebp, 0x45
sbb eax, 0xc1090a66
aad 0x45
into
in eax, 0xa1
lcall 0x8895, 0x6acbd468
inc edi
push ebx
cwde
and al, 0x2b
jp 0x16d668f
leave
dec esi
inc esi
nop
cwde
jmp 0x16d6729
cmp eax, 0x2cefbe58
int 0xd
xchg ebp, eax
adc ecx, 0x7a3b60a7
shr ebx, 1
xor ebx, esi
cdq
push ebx
dec edi
cdq
retf 0x663c
push edi
int3
push dword [esp + 4]
popfd

Function at 0x16d793b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xc], eax
pushfd
mov ecx, 0xa7ae4719
push edi
mov edi, 0x42a74989
or cx, 0x7b3b
push ebx
mov ebx, 0xd0b52910
and bx, 0x219a
mov dword [esp + 0x14], eax
or ebx, 0x1720bb04
add dword [esp + edi - 0x42a7497d], 0x1391c5
and edi, edi
je 0x163449b
nop

Function at 0x16db897
Capabilities:
Encode data using xor

Disassembly:
jae fcn.0164e60d
add dword [esp + esi + 0x94500af], 0xff908467
Function at 0x16dd8ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
cmovp ecx, esi
mov ecx, dword [ebp + 0xc]
jmp fcn.01726ac4
xor dword [esp + edi - 0x5d94fff0], 0x758f4e28
mov dword [esp + edx - 0x5d950093], edi
lea esi, [esi + edx*2 - 0x539d97a4]
mov edi, dword [esp + edx - 0x5d950083]
js 0x172c9e3
test word [esp + edx - 0x5d95008b], 0xa200
jge 0x170ca41
jb 0x16dd981
mov edi, 0xc717ae42
stosd dword es:[edi], eax
sub eax, 0x8880e761
outsb dx, byte [esi]
in al, dx
popfd
clc
ljmp 0xb16a
add dword [esp + edx - 0x5d950097], 0xff99311e
add byte [esp + edx - 0x5d95008b], 0xaa
xor edx, edx
jle 0x1744ec4
mov ebx, dword [eax + 0x34]
movzx eax, sp
mov eax, dword [ebp + 0x10]
jmp 0x16b9ae1
call fcn.01696cd9
push ebp
cwd
rdtsc
bswap cx
mov ebp, esp
cdq
rdtsc
mov eax, dword [0xec2e40]
xchg ecx, edx
movsx ecx, cx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push ebx
jmp 0x17251f1
mov edx, dword [esp + edx*2 + 0xc]
mov dword [esp + 0x1c], 0x660ff397
call fcn.01790d7a
lea esp, [esp + 4]
jmp 0x172db7a

Function at 0x16e3455
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
pushfd
mov ebp, 0x182393a7
add ebp, ebp
ja 0x1753f77
sub dh, dl
invalid

Function at 0x16ee5ec
Capabilities:
Parse pe header

Disassembly:
mov ebp, dword [ebp - 4]
mov esi, 0xfa325fad
mov dword [ebp], eax
call fcn.0170fa2a
mov eax, ebp
mov dword [esp], 0x272e4e3e
add eax, edx
inc byte [esp + 3]
inc word [esp]
push 0x5e3d7c82
mov dword [ebp - 4], eax
jp 0x1768275
test ebx, ebx
lea esp, [esp + 8]
je 0x1768299
mov eax, dword [ebp + ebx*4]
push 0xd016bc2c
dec dword [esp]
mov dword [esp], eax
dec ebx
jne 0x1768281
mov eax, 0xa7a60685
not al
mov eax, dword [ebp]
call eax
jmp 0x16bca35

Function at 0x16ee69b
Capabilities:
Encode data using base64

Disassembly:
push edx
pushfd
mov edx, 0x5da396a6
neg dl
not edx
neg edx
mov esi, dword [esp + edx - 0x5da3964b]
shr edx, 0x3f
jae fcn.0164c9ef
sets dl
call fcn.01785a5e

Function at 0x16fedb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [esi + esi + 0xa3b2803]
js 0x16a0570

Function at 0x1700575
Capabilities:
Parse pe header

Disassembly:
jne 0x16a2241
sub dword [esp + 0xc], edi
xchg dword [esp + edi + 0x5e000028], eax
mov esi, dword [esp + ebx + 0x630c65ec]
jo fcn.0167253c
test word [esp + ebx + 0x630c65d4], 0xc10b
mov edi, dword [esp + 0x10]
jbe fcn.0176a3d7
shr bl, 0xcb
js 0x1760cd0
mov ebp, dword [esp + 0x18]
call fcn.01679987

Function at 0x17005b9
Capabilities:
Parse pe header

Disassembly:
push ebp
movsx edx, dx
mov ebp, esp
xadd dx, dx
rcl dx, 0x82
sub esp, 0x13c
push esi
seta dh
jmp 0x1567c9d
Function at 0x1703a5f
Capabilities:
Encode data using base64

Disassembly:
jmp 0x171d313
js 0x1752ce2
or word [esp + esi - 0x7ebe773b], 0x888c
xchg dword [esp + esi - 0x7ebe7737], ecx
xor esi, 0x9b67398
je 0x16a25dd
shl si, 0x69
not dword [esp + esi - 0x7708b5f8]
bswap esi
mov esi, 0x2d89753f
push ebx
mov ebx, esi
mov dword [esp + 0xc], ecx
cmp si, 0x5fa7
jl 0x1744587
cmp esi, 0xf9b679b9
call fcn.01719dd2
call fcn.0179747e
add esi, 0xd5bbc797
jne 0x17832be
or ebp, 0x671bfb80
add dword [esp + ebp - 0x6f9bfb8e], 0xffec4312
lea edi, [edi + ebp - 0x6f9bfb9d]
xor ebp, 0x18938e3c
mov dword [esp + ebp - 0x770875a2], ebp
xor bp, bp
call fcn.016fb2f7
pushfd
or dword [esp + 8], 0x7aa8359c
neg byte [esp + 8]
mov esi, dword [esp + 8]
jge 0x1568fb5
mov esi, dword [edi]
mov edx, 0xbc86032e
not edx
or edx, edx
mov dl, byte [edx + edi - 0x4379fccd]
push 0xa0871daf
adc edi, 6
jmp 0x15620ad
mov byte ss:[esi], dl
call fcn.01799b5b
add dword [esp + ebx - 0x245f83ac], 0xff9cdcf7
lea edx, [edx + ecx - 0x7089028]
or ecx, edi
jo 0x16cc395
add dword [esp + edi - 0x705bd623], 0xff9f035b
not ebx
neg ebp
xchg dword [esp + 0x3c], edx
mov ebp, dword [esp + ecx*2 + 0x80803ae]
jg fcn.01566b07
neg word [esp + ecx + 0x40401d1]
call fcn.01628b27
push eax
mov al, 0xd
mov eax, dword [ebp + 8]
jmp 0x17907bb
jmp 0x16f7a03
push edx
push eax
jmp 0x16d0e4c
not edx
jge 0x1664119
js 0x1633d3c
mov ebp, 0xabae0285
mov edx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, 0xe231ae0f
mov cl, byte [esi + 8]
call fcn.017102cb
push ecx
jmp 0x1731c6c