joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret

Function at 0x477160
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x61000]
push edi
jmp 0x47717a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x477181
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477170
mov eax, 1
add ebx, ebx
jne 0x477193
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4771a4
jne 0x4771c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4771c3
dec eax
add ebx, ebx
jne 0x4771b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x477188
add ebx, ebx
jne 0x4771bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x477215
xor ecx, ecx
sub eax, 3
jb 0x4771db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47724a
sar eax, 1
mov ebp, eax
jmp 0x4771e6
add ebx, ebx
jne 0x4771e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4771b4
inc ecx
add ebx, ebx
jne 0x4771f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4771b4
add ebx, ebx
jne 0x477201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4771f6
jne 0x477212
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4771f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x477234
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x477226
jmp 0x477176
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x477234
add edi, ecx
jmp 0x477176
pop esi
mov edi, esi
mov ecx, 0x25ac
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x477252
cmp byte [edi], 5
jne 0x477252
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x477257
lea edi, [esi + 0x74000]
mov eax, dword [edi]
or eax, eax
je 0x4772cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x77000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x77118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x477284
mov ecx, edi
jns 0x4772b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7711c]
or eax, eax
je 0x4772c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4772a1
call dword [esi + 0x7712c]
mov ebp, dword [esi + 0x77120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x477303
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40a7d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40a800
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040abd0
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret

Function at 0x426d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
or ebp, 0xffffffff
jmp 0x426d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x426d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x426d48
mov eax, 1
add ebx, ebx
jne 0x426d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x426d60
jne 0x426d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426d60
xor ecx, ecx
sub eax, 3
jb 0x426d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x426e02
mov ebp, eax
add ebx, ebx
jne 0x426d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x426da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x426dcc
inc ecx
add ebx, ebx
jne 0x426db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x426dad
jne 0x426dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x426dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x426ddd
jmp 0x426d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x426dec
add edi, ecx
jmp 0x426d4e
pop esi
mov edi, esi
mov ecx, 0xc3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x426e0a
cmp byte [edi], 1
jne 0x426e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x426e0f
lea edi, [esi + 0x24000]
mov eax, dword [edi]
or eax, eax
je 0x426e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2bc28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2bc64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x426e3c
mov ecx, edi
jns 0x426e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2bc6c]
or eax, eax
je 0x426e81
mov dword [ebx], eax
add ebx, 4
jmp 0x426e59
call dword [esi + 0x2bc68]
mov ebp, dword [esi + 0x2bc70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x426ebb
sub esp, 0xffffff80
jmp 0x401e60
Function at 0x100d1f30
Capabilities:
Encode data using base64

Disassembly:
or dl, ah
neg edx
neg ecx
mov dword [esp], 0xb937adbc
shl dword [esp], 0xf7
sbb ecx, 0x6127db95
call fcn.1015dd1e

Function at 0x100d2073
Capabilities:
Encode data using base64

Disassembly:
inc sp
add edx, ecx
call fcn.100c6b94
inc cx
movzx ecx, byte [esi + edx - 0xfd]
inc ecx
sar al, 0x41
dec edx
lea edi, [edi + ebp*2 - 0x1fffc]
dec esp
sbb esp, esi
inc dx
mov dword [edi + esi*4 - 0x3f4], ecx
inc ecx
bt esi, esi
dec eax
dec edi
lea ecx, [ecx + ebp*2 - 0x1fffe]
inc ebx
mov eax, dword [ecx + esi - 0xfd]
dec ebp
lea esp, [ebx + ebp*8 - 0x6fd4e9d0]
dec ecx
shl eax, 0x79
inc ecx
xor eax, edi
ror eax, 1
dec ecx
shl esp, 0xa
not eax
inc ecx
lea eax, [esi + eax - 0x40945a23]
inc ecx
setb al
dec edx
lea ecx, [eax*8 + 0x4f28e83d]
inc ebp
xadd ch, ah
bswap eax
inc ecx
push edi
ja 0x1022a6c6
ror ecx, 1
add dl, dl
jle 0x10123acf
jmp 0x100e56bd
jge 0x100dd2b0
add byte [eax], al
out dx, eax
push 0x72
lahf
cmp al, 0x7a
fcmovnb st(0), st(7)
inc ecx
lahf
dec eax
push 0xffffffffffffffc7
mov dword [ecx - 0x61], 0xc79b6e24
inc ecx
lahf
js 0x100d450a
mov bl, 0xc7
inc ecx
lahf
sar byte [esi + 0x5d], 1
jge 0x100d457d
xor dl, byte ds:[ebp - 0x7c9f4c39]
cmp byte [ebp + 0x21990bc], ch
sbb dword [edx], eax
add ah, byte [ecx + 0x645fa7dc]
movsb byte es:[edi], byte [esi]
popal
fsub qword [edi + 0x6402645f]
xchg al, dl
add ah, byte [esi + eax*4 - 0x30]
invalid
dec edi
sbb dword [edx], eax
movsb byte es:[edi], byte [esi]
and eax, 0x648c1c57
add ah, byte [edx + esi*8 - 0x16]
and byte [eax - 0x359bfd9c], ch
inc edx
and byte [esi], ch
push cs
leave
dec edi
sbb esi, esp
dec ecx
jle 0x100d453a
popal
aas
jbe 0x100d4539
pop edx
jl 0x100d4541
inc ebp
cmp edx, edx
int3
xor eax, eax
test edx, edx
push 0xfe34dd1b
call fcn.100e7e59
mov edx, 0xb0a3d780
inc esp
movsx ebp, dx
dec ecx
sub ecx, 4
dec eax
lea esi, [edx + edx - 0xffe44c7]
jmp 0x100e934b
inc esp
movsx edx, si
inc edi
mov esp, dword [ecx + edx - 0x6a39]
inc esp
movzx esi, dh
dec ebx
lea ebp, [ebp + esi*4 - 0x3cdcaccc]
inc ebp
xor esp, edi
and bp, 0x3000
inc ecx
inc esp
dec ebp
lea ebx, [edx + 0x7b84b295]
dec ecx
and ebp, 0x8a2bc99b
bts dx, bp
inc ecx
bswap esp
inc ecx
inc esp
inc ecx
neg esp
call fcn.1017a92c
xor ecx, 0x2a0f82af
bts edx, 0xe
lea ecx, [edx + ecx + 0x18c1cbdc]
neg ecx
ror dx, 0x6d
setb dl
jae 0x10203c7f
xor ebx, ecx
add ebp, ecx
btr edx, edx
mov ecx, dword [edi]
or al, 0x27
ror dx, 0x65
xor edx, dword [edi + 4]
push 0x7d08811b
add edi, 4
inc dword [esp]
jne 0x100d4506
pop eax
pop edx
pop edx
jno fcn.102260e1
push es
adc ebx, dword [edi - 0x61]
cmc
add dword [edx], 0xffffffbe
insb byte es:[edi], dx
lahf
int1
xchg ebx, eax
and bh, byte [esi - 0x10be6094]
push edx
mov esi, 0xcfb19f6c
jbe 0x10203c87
insb byte es:[edi], dx
lahf
xchg ebp, eax
retf
Function at 0x100e9d56
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
inc edx
sbb dword [esp + ebx*2 - 0x9895], 0x7fa52710
dec ecx
xadd ebx, edx
inc ecx
pop esp
pop eax
inc ecx
pop esi
ja fcn.10115f46
inc ecx
xadd bl, dh
inc sp
movzx ebp, byte [eax + edi - 0xc1cfffa]
dec esp
or ebx, ecx
inc esp
mov dh, byte [eax + edi - 0xc1cfff8]
movzx ebp, byte [esp + eax - 0xc1cfff4]
jp 0x101fbd24
inc cx
not eax
dec esi
lea edx, [edx + ebx*2 - 0x2b4aacc1]
inc edx
sub ecx, dword [esp + ebx - 0x4c42]
movzx esi, cl
inc bp
xor edi, eax
dec esi
lea eax, [esp + eax + 0x18]
inc edi
mov esi, dword [eax + ebx*2 - 0x989e]
inc ecx
mul edx
inc ebp
mov ah, 0x58
bound esp, qword [edi - 1]
inc dword [ecx - 9]
loop 0x100e9dee
mov eax, ebx
dec ecx
lea edi, [ebx + edi - 0x4c53]
dec eax
cwde
dec eax
or edx, ecx
inc ebp
mov dword [ebx + edi - 0x4c4f], esi
jnp 0x100c8473
movsd dword es:[edi], dword [esi]
mov cl, 0x71
lahf
out 0x5c, al
in eax, 0x1c
inc edx
lahf
inc eax
sbb dword [edx + eax*2], 0xf554f29f
sbb al, 0x42
lahf
xchg esi, eax
cmp byte [ecx - 0x2560bde4], ch
js 0x100e9e34
dec edi
push ebx
mov edi, dword [0xb01cbb32]
pushal
mov ch, 0x58
pop eax
jecxz 0x100e9d9f
mov esp, 0xa401c2ae
invalid
jecxz 0x100e9de4
mov esp, 0xa401c2e5
mov bh, 0xa0
cli
cmp bh, byte [edi + 0x41206401]
retf 0xbf42
Function at 0x100f03c7
Capabilities:
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
dec esp
mov esp, dword [esp + 8]
dec eax
mov ebx, dword [esp + 0x10]
dec eax
lea edx, [edx + edx*2 - 0x294be653]
dec eax
mov edx, dword [esp + 0x18]
bswap esi
dec eax
mov dword [esp + esi*2 - 0x66c72116], esi
dec esp
mov ecx, dword [esp + esi*2 - 0x66c7210e]
inc esp
movsx eax, word [esp + esi - 0x33639096]
movsx edi, si
dec eax
mov ecx, dword [esp + esi*2 - 0x66c72106]
inc esp
movsx edx, dh
dec esp
mov ebp, dword [esp + esi - 0x33639067]
call fcn.10228ff9
mov edx, 0x3396ff34
dec eax
lea esi, [edx + edx*2 + 0x5f080096]
dec esi
lea ecx, [edx + ecx - 0x3396ff38]
inc ebp
mov ebp, dword [ecx + edx*2 - 0x672dfe68]
mov ebp, esi
xor bp, si
inc ebp
xor ebp, edi
inc ecx
xor ebp, 0x20a73e33
mov eax, esi
inc ecx
bswap ebp
inc eax
dec ch
dec eax
and ebp, edx
inc ecx
not ebp
dec esp
lea edx, [esi + eax*8 - 0x20658cc5]
inc ebp
lea ebp, [ebp + eax - 0x10c6de7d]
inc ecx
push edi
mul dl
jae 0x100c8485
jo 0x1012043d
int3
call fcn.1016aa35
inc ecx
pop esi
dec eax
lea esi, [esi + esi*4 - 0x12e8fafd]
pop eax
dec eax
xchg esi, ebx
dec eax
lea ebx, [ebx*8 + 0x503b2834]
movsx edx, bx
inc ecx
pop ebx
push esi
xchg edx, ebx
jmp 0x100ce119

Function at 0x100f32fa
Capabilities:
Encrypt data using aes mixcolumns step
Encrypt data using chaskey

Disassembly:
lea esp, [esp + 0xc]
jne 0x1010db35

Function at 0x100fea14
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call fcn.10101f0d
add ebp, ecx
push 0x39110037
lea esp, [esp + 0x18]
jmp 0x100f5620
Function at 0x100ffd6c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push eax
xadd al, ah
adc edi, 4
add ecx, edx
call fcn.1017a97d
mov ecx, 0x2cb5ec22
movsx eax, cx
inc esp
movsx esi, cx
dec esp
lea esp, [esp + ecx*2 - 0x596bd7cc]
movzx esi, ax
inc esp
movzx ebp, cl
dec ecx
bts ebp, esi
inc dx
movzx ecx, byte [esi - 0xec22]
mov word [edi + esi*2 - 0x1d846], cx
inc ebp
mov esi, dword [ecx + esi*2 - 0x1d848]
dec esp
or ebp, esi
inc esp
movsx eax, dh
dec ebp
lea ecx, [ecx + esi*2 - 0x1d848]
inc ebp
xor esi, edi
inc ecx
not esi
inc ebp
movsx ebx, bp
cdq
dec ecx
inc ebp
inc ecx
rol esi, 3
inc ebp
lea esi, [esi + esi*4 - 0x7f25be2d]
inc esp
movzx edx, al
inc ebp
movzx esp, dx
inc ecx
xor esi, 0x98b75205
inc ecx
push edi
inc esp
xor dword [esp + esi*2 - 0x1d844], esi
inc ecx
push eax
inc ecx
neg dl
inc eax
setl dh
dec esp
mov edi, dword [esp + esi - 0xebf9]
inc ecx
push ebx
pop ebp
dec ebp
arpl si, si
dec esp
mov dword [esp + esi*4 - 0x3affc], ebp
dec eax
cwde
movsx ecx, ax
dec ecx
add ebx, esi
inc sp
movzx ebx, byte [edi + eax*2 + 0x27ba]
dec esi
lea esi, [ebp + ebp + 0x361c3521]
inc ecx
sal dh, cl
shr byte [esp + eax + 0x13ed], cl
mov dl, byte [edi + eax + 0x13de]
shl byte [esp + eax + 0x13e5], cl
cwde
inc ecx
not bl
dec esp
lea ebp, [esi - 0x774686ef]
btc si, 0xa5
not dl
inc esp
and bl, dl
inc sp
mov dword [edi + esi - 0xec21], ebx
inc cx
shl ebp, 0x62
inc byte [esp + esi*2 - 0x1d83e]
dec eax
mov dword [esp + esi - 0xec21], ebx
ret 8
mov dword [esp + ecx - 0xcf], 0x5c9fc092
setge cl
xor eax, ebx
jmp 0x10178ece
ror ecx, cl
rol eax, 1
and ecx, ecx
not eax
sbb edx, ecx
xchg word [esp + ecx - 0x80000000], cx
push ecx
sbb eax, 0x443a0714
neg eax
push edx
pop ecx
or edx, ecx
xor ebx, eax
add ebp, eax
add word [esp + edx - 0x634df7cd], 0x226
mov ecx, dword [edi + ecx - 0x634df7cf]
lea eax, [edx*2 - 0x21fac4e7]
dec eax
sar edx, 0x1c
mov edx, dword [edi + edx*2 - 8]
jp 0x100ebc33
mov eax, 0xac9e3331
mov ebp, dword [edi]
movsx esi, ax
inc esp
mov ebp, esi
dec ebp
lea eax, [ebp + esi*4 + 0x229a74ae]
dec eax
lea edi, [edi + esi*2 - 0x665e]
dec esi
lea esp, [esi + eax - 0x52dd12e7]
dec esi
lea ecx, [esi + ecx - 0x3333]
inc ebp
movzx esp, word [ecx + esi*4 - 0xccc4]
mov edx, eax
dec esi
lea esi, [ebp*8 + 0x2bb42419]
cdq
inc bp
xor esp, edi
xor al, 0xed
sbb dword [esp + esi*4], esp
sub ebx, dword [ecx - 0x18ccba9a]
inc sp
add esp, edx
inc cx
xor esp, 0x994827a9
inc cx
inc esp
call fcn.100eee9c
push esi
and ah, al
pop ebx
xor edx, ecx
jbe 0x10178f51
sub al, ch
shld eax, edx, cl

Function at 0x10105634
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
call eax
mov ecx, 0x2004c69a
movzx ebx, cl
mov edx, ebx
Function at 0x1010b1de
Capabilities:
Encode data using xor

Disassembly:
loope 0x1010b1e3
add byte [esi - 0x77], cl
jl 0x1010b1fe
dec esi
mov dword [esp + ebx - 0x23], edi
frstor dword [esi - 9]
fisttp qword [eax - 9]
salc
neg bp
dec eax
not esi
dec esp
lea edi, [ecx*8 + 0x5984dc9c]
inc edx
xor dword [esp + ebx*4 - 0x8c], edx
inc ecx
pop edi
inc cx
inc esi
push eax
pop esi
dec ecx
lea edi, [ebx + edi - 0x27]
inc edx
mov dword [edi + ebx*2 - 0x46], edx
jl fcn.10115f46
invalid
xchg ebx, eax
cmp eax, 0xbae8eea2
adc byte [esi + 9], ah
or dword [ebx + esi*4 - 0x5ece9970], esp
movsb byte es:[edi], byte [esi]
mov bl, 0x90
out 0x49, al
inc ecx
movsb byte es:[edi], byte [esi]
mov bl, 0x90
inc edx
xor ecx, ebp
movsb byte es:[edi], byte [esi]
mov bl, 0x90
stosb byte es:[edi], al
sbb dword [ecx], esi
movsb byte es:[edi], byte [esi]
mov bl, 0x90
push es
jns 0x1010b21a
movsb byte es:[edi], byte [esi]
mov bl, 0x90
mov ecx, 0x90b3a4e9
push ebp
jge 0x1010b1db
pop ss
adc al, bh
adc eax, dword [ebp - 0x43]
out dx, al
out dx, eax
Function at 0x1010f268
Capabilities:
Encode data using xor

Disassembly:
bts edx, 0x93
dec edx
lea edi, [edx + edi - 0x5d3d56aa]
dec dx
not al
btc edx, 0x80
lea edx, [edx*4 + 0x521ded1f]
or edx, 0x1f2fa825
not cl
sal edx, 0x19
and dl, dh
sub dx, dx
or al, cl
mov word [edi], ax
lea eax, [edx + edx*8 + 0x2882f103]
cwde
sub esi, 4
sal dl, 2
mov edx, dword [esi]
xor edx, ebx
pop ecx
dec edx
lea ecx, [eax + eax*8 + 0x253c3591]
call fcn.10106615
push 0xfffffffffffffff4
inc edi
sbb ebp, dword [ecx - 0x5304ef46]
adc al, 0xe5
mov bl, 0x90
add al, 0x8c
in eax, 0xb3
nop
mov bh, 0xcc
and al, 0xe5
mov bl, 0x90
jae 0x1010f305
hlt
cld
out dx, al
out dx, eax
pop ecx
in eax, 0xee
jbe 0x1010f2f7
xchg edx, eax
lcall 0x9ada, 0x1a261010
adc byte [eax], dl
jle 0x1010f378
mov dl, 0x9a
adc byte [eax], dl
push es
loop 0x1010f36f
lcall 0x9a9a, 0xf5561010
adc byte [eax], dl
cmp eax, 0x10109a32
xchg byte [0x10109aca], dh
out dx, al
nop
out dx, eax
out dx, eax
sub eax, 0xa9f480cb
mov edx, 0xd36b0810
in eax, 0xb3
nop
test bl, bl
invalid
xlatb
pop ss
adc byte [esi - 0x11034875], ch
mov bh, 0xfc
out dx, al
out dx, eax
cmc
loop 0x1010f36a
sub dword [ecx], esi
jmp 0x1010f3d8
or eax, 0x3910109a
push ebp
aad 0x9a
adc byte [eax], dl
popal
push 0x65
lcall 0x9a9d, 0x2dc11010
adc byte [eax], dl
pop ecx
pop ss
out dx, eax
out dx, eax
pop edx
and al, 0x63
lahf
fadd dword [ebp - 0x11]
inc edi
sbb byte [eax - 0x3190b36c], cl
fucomp st(7)
mov al, byte [0x7d3f49b5]
xor eax, 0x80efedbb
sub dword [edx + 0x3c9393bf], 0xc5254c2e
shr dword [edi - 0x69ad5f6d], 0x45
stc
mov al, byte [0xf9459652]
ror dword [edi + edx*2], 1
jge 0x1010f3fa
mov esi, 0x50e3ba69
xchg esi, eax
shl al, 1
push cs
jge 0x1010f3ad
mov dword [0xf4f321c0], eax
push 0x4f78d903
or eax, 0x544930f2
dec ecx
push esp
add ch, cl
jl 0x1010f395
or byte [esp + eax*2], cl
stc
nop
popal
dec esp
ja 0x1010f469
add bh, byte [ebp + 0x4b]
xchg edi, eax
pop ecx
or al, byte [edi - 0x4d]
adc dl, byte [ebx]
int 0xec
pop ss
push ebp
ret 0xefe9
push ss
adc byte [esi + 0x1cefe915], bl
sbb eax, 0x7c7e062a
fnstcw word [edi + 0x24]
cmp edx, dword [edi]
adc byte [ebp - 0x6a], bh
pushfd
in eax, 0x96
lahf
jbe 0x1010f4e9
dec ebp
sub byte [edi], 0xdf
xor dword [ebp + 0x391cefeb], ebp
xor bh, al
invalid
mov eax, dword [0xcad05422]
or al, 0xe9
pop ecx
add dl, byte [eax]
push edx
sbb dh, dh
out dx, eax
rol byte [edi - 0x53], cl
in eax, 0xfa
aad 0x4f
dec esi
sub dword [ebx + 0x1fa97329], ebx
wait
sub dword [ebx - 0x57], esi
pop ds
outsb dx, byte [esi]
clc
rcl dword [eax + 0x199486ca]
adc byte [edi], al
push ds
dec eax
or eax, 0x5f881170
mov cl, 0x69
into
jl 0x1010f4d2
adc byte [ecx], 0x5d
sub eax, 0x285e3ef3
fidiv word [ebp + 0x2563904e]
fisubr word [esp + ecx*4 + 0x539322f7]
call 0xa7e1b11e
mov eax, 0xdd9cacb7
shr esp, cl
adc al, 0x5d
push eax
mov ah, 0x2d
dec eax
outsd dx, dword [esi]
invalid
Function at 0x1010f7e9
Capabilities:
Encode data using xor

Disassembly:
dec eax
arpl bp, bp
inc cx
btc ebx, eax
inc cx
sal eax, 0xcf
dec eax
adc ebx, ebp
inc ecx
sub al, al
dec edx
mov dword [esp + ebx - 0x4c3f], eax
adc al, 0x11
dec edi
lea ecx, [ebx + ecx - 0x4c51]
inc edx
not dword [esp + ebx*8 - 0x26277]
dec edx
rol dword [esp + ebx - 0x4c44], 7
inc ecx
movsx ecx, ah
inc edi
movzx eax, word [ebx + ecx - 0x4c4f]
js 0x10156b84
inc edx
xor dword [esp + ebx*8 - 0x36268], ebp
dec esi
mov dword [esp + ebx*2 - 0xd89e], esp
dec eax
cwde
inc esp
mov ebp, edx
dec esi
mov edi, dword [esp + ebx - 0x6c3f]
jmp 0x10108c12
dec ecx
xchg ebp, ecx
inc bp
xor eax, edi
inc cx
sub ebp, 0x4666073c
add dword [esp + ebx - 0x4c3e], ebp
call fcn.1012e393

Function at 0x1011e7b0
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
dec esi
lea edx, [edx + ebp - 0x3de07acf]
bswap esi
dec esp
mov dword [esp + edx - 0x99], edi
inc esp
mov edi, eax
dec eax
not edx
xor dword [esp + edx + 0x9a], esi
inc ecx
div eax
call fcn.100d5d37

Function at 0x1012550c
Capabilities:
Encode data using xor

Disassembly:
not ecx
bswap eax
call fcn.1010bcae
cld
jp 0x10125585
lahf
invalid
clc
and byte [ebp + ebx + 0x64], dh
inc esi
shr byte [eax + 0x4fd61ee2], cl
push ds
salc
dec edi
insd dword es:[edi], dx
jp 0x101255ca
lahf
scasb al, byte es:[edi]
invalid
mov esp, 0xa41d095a
js 0x101255a7
push ecx
sal dword [ebp + ebx + 0x64], 1
invalid
adc esi, ecx
add bh, byte [ebp + 0x4e]
pop ds
mov eax, dword [0xa4e3a62f]
cmpsb byte [esi], byte es:[edi]
jecxz 0x1012554e
insb byte es:[edi], dx
xor edi, dword [ebp + 0x6f]
call 0x8626344c
inc dword [esi]
inc eax
pop ds
mov eax, dword [0x30205e0d]
test ebp, edx
jb 0x1012559f
jne 0x10125557
arpl word [ecx + 0x79ee7a31], si
sub byte [edi], bl
pop ds
or al, 0x15
into
mov edx, 0xa3fe8748
dec ecx
fdiv dword [eax]
pop ebx
aaa
push es
dec edx
invalid

Function at 0x10148c9c
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov edx, ebp
inc ecx
movsx esi, bp
dec edx
lea edi, [edi + ebp - 0xaa]
dec esi
mov dword [esp + ebp - 0xba], edx
dec eax
lea ebp, [esi + edx*8 - 0x64709e55]
dec esi
mov dword [eax + ebp - 0xba], esp
push ebp
dec edi
lea ecx, [ecx + ebp*2 - 0x178]
inc edx
shl byte [esp + ebp*8 - 0x5c6], 0xc1
jbe 0x10163ec7
inc ecx
mov esp, 0x6412dd16
inc si
movzx ebx, byte [edi - 0x6412dd16]
inc ebp
movzx eax, ah
dec ecx
and esp, 0x15bebb24
inc ebp
mov al, byte [esp + edi - 0x4129902]
inc ecx
movzx ebp, ah
inc ecx
movsx edx, sp
inc ebp
or bl, al
shl dx, 1
inc bp
or esp, esp
inc ecx
mov esi, 0x40269f81
inc ecx
not bl
jnp 0x100fc9db
inc ecx
pop ebx
inc edi
mov esp, dword [ecx + ebp*2 - 0x174]
inc ebp
xor esp, edi
jmp 0x10237983
Function at 0x1015299a
Capabilities:
Check for software breakpoints

Disassembly:
xor dx, 0x439f
inc dx
xchg dword [esp + ebp*2 - 0x42], eax
dec eax
adc ebx, ecx
dec edx
lea esi, [esp + ebp + 0x52]
dec dl
sar ebp, 0x48
dec esi
mov ebx, dword [esi + ebp*2 - 0x4c]
dec esi
mov dword [esp + ebp*2 - 0x3c], esi
dec ebp
mov dword [ebp + edi - 0x30], ebx
dec esi
lea ebx, [eax*2 + 0xf3cb01f]
dec ecx
sal ebp, 0x3f
dec ecx
imul eax
dec edx
lea edi, [edi + ebp*8 - 0xa]
inc sp
bts ebp, esi
inc ecx
pop ebx
pop ecx
inc ecx
pop ebx
jae fcn.10115f46

Function at 0x1015c084
Capabilities:
Encode data using xor

Disassembly:
mov word [edi + ecx*4 - 0x571adb0c], dx
btr eax, 0x2d
pop ecx
pop ecx
pop edx
pop eax
jb fcn.102260e1
rol cl, 1
dec esi
lea esp, [esi*8 - 0x2a42c756]
sub cl, 0x39
rol cl, 1
inc sp
add edx, ebp
inc ebp
movsx ebx, ah
inc esp
xor bh, cl
dec ecx
ror edx, 0x7c
dec ecx
neg esi
dec eax
add ecx, esp
dec esi
mov esp, dword [ecx + ebp - 0x22c092d0]
cwde
inc ecx
neg bl
inc ecx
inc ch
dec edx
lea edi, [edi + ebp - 0x22c092d9]
inc cx
sal esi, 0xac
dec ebp
mov dword [ebp + edi - 0x22c092d1], esp
mov esi, edx
inc esp
movsx eax, ch
dec edi
lea ecx, [ecx + ebp - 0x22c092d5]
inc ebp
movzx esp, dl
inc edi
mov ebp, dword [ebp + ecx - 0x22c092d1]
inc ebp
xor ebp, edi
inc ecx
neg ebp
inc ecx
rol ebp, 2
inc eax
not dh
movsx ecx, dx
call fcn.101725bd
dec eax
mov ebp, dword [edi]
inc ecx
mov ebx, 0xf8a2a028
mov esi, dword [ebp]
dec eax
add edi, 4
mov dword [edi], esi
dec ecx
sub ecx, 4
inc ecx
mov eax, dword [ecx]
inc ecx
movsx ecx, bl
inc ebp
mov eax, ebx
inc ecx
xor eax, edi
dec esi
lea esi, [ebx*4 + 0x54bd8f0f]
inc ebp
movsx ebp, dh
inc bp
or esi, eax
neg eax
jmp 0x1012f36d