joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10113dfe
Capabilities:
Authenticate hmac

Disassembly:
sub byte [esp + ecx - 0x6d02937b], 0xb2
mov ecx, dword [esp + ecx - 0x6d02939f]
jbe 0x102360e3
test edx, edx
call fcn.1017c9ac
rol dword [esp], 6
jae 0x1017eb34
shr dword [esp + 4], 0xc9
mov byte [esp + esi - 0x293a64f0], 0xc
je 0x1011d453
mov edx, dword [esp + esi*2 - 0x5274ca00]
mov edx, dword [edx + esi - 0x293a6500]
sub dword [esp + esi - 0x293a64fc], esi
jne 0x101aa1d0
aaa
int3
adc ebp, 8
call fcn.101e2a0f
mov edx, 0x598f1b1a
movzx eax, dx
mov dx, word [esi + eax*2 - 0x3634]
xor ax, 0x4613
neg eax
mov ax, word [esi + 2]
jno 0x10255c52
mov dword [esp + esi - 0x293a64f4], esi
call fcn.100dbebb
shr dl, cl
mov word [ebp], dx
push 0x963d3cb6
jmp 0x1024f7b7
sbb esi, 1
not dx
push 0x6e8437a7
call fcn.1013ebe8
mov edx, 0x8294781d
movzx dx, byte [ebp]
mov ecx, 0xadacd5b2
bts ecx, 0x2f
shl ecx, 0x6b
add cl, byte [ebp + ecx - 0x66ad8ffe]
add ebp, 2
jmp 0x101adadc
not byte [esp + 0x2c]
jo 0x10132db3
sub byte [esp + 0x2c], 0x86
or dword [esp + 0x2c], 0x370f6d09
push dword [esp + 0x28]
popfd
lea esp, [esp + 0x30]
ret
not dword [esp]
lea esp, [esp + 4]
jmp fcn.10162df0
js 0x10209073
test byte [esi + 0x41], al
cdq
outsb dx, byte [esi]
sub ebp, esp
sbb dword [edx - 0x7e], ebx
jns 0x10255ca0
mov bl, 0x46
sub dword [ecx + 0x71846722], esi
pop esi
cmp al, 0xe5
popal
mov bl, 0x70
sub dword [edi + 0x3770c634], esi
pushal
add esp, ebx
xchg byte [edx - 0x3b], dl
mov byte [0xd40a4d96], al
or byte fs:[esi - 0x51], al
out 0x3a, eax
push edx
insd dword es:[edi], dx
clc
xchg dword [edi], edi
mov eax, 0x848b7efd
sbb al, 0xc3
cmpsb byte [esi], byte es:[edi]
jne 0x10255c79
xlatb
outsd dx, dword [esi]
int3
jmp 0x10255d03
test al, 0xc0
mov dword [esi + ebp*4], edi
cwde
push esp
outsb dx, byte [esi]
xchg ebx, eax
and ah, byte [eax + 0x536629d6]
and dword [edx], esi
pop edi
imul edx, dword [ebx - 0x6c396f46], 0xbafe2022
clc
aaa
xchg ecx, eax
out dx, al
and dword [eax + 0x6c], esi
fstp qword [esi - 0x38]
mov eax, 0x3c22b155
fcom dword [ebx + ecx*8 - 0xc202294]
scasd eax, dword es:[edi]
pushfd
mov eax, 0xcd753a78
sub cl, byte [eax + 0x32c70896]
jge 0x10255d6c
dec eax
scasd eax, dword es:[edi]
ljmp 0x823a
mov ch, 0xca
xlatb
mov ecx, 0xf7286abe
or ebx, dword [esi + 0x6f]
and dword [eax + 0x1193d22], edx
pop ss
mov bl, 8
jecxz 0x10255dae
fbstp tbyte [eax + 0x16]
xchg ebp, eax
jae 0x10255d7e
dec edi
daa
xchg ebx, eax
and ah, byte [eax - 0x73d638e1]
int3
loop 0x10255e2c
push edi
mov byte [ebx + edx*8], dh
xchg esi, eax
jno 0x10255e2e
inc eax
push esp
xor eax, 0xbab53fd2
inc eax
call 0x24571c86
out 0xb2, eax
pop ecx
invalid
add al, 0xd8
sbb edx, dword [edi]
Function at 0x10118296
Capabilities:
Encode data using xor

Disassembly:
or al, ch
mov edx, 0x848d0008
invalid
invalid
inc eax
pushfd
retf
add dword [esp], 0xefe004a4
mov esi, dword [esp + 0xc]
mov esi, dword [esp + 4]
call fcn.1016711c
nop
push edx
aas
jecxz 0x1011827f
adc bl, ah
sbb ch, byte [edi - 0x21]
mov ecx, 0x77629402
fidivr dword [esi + 0x14]
push 0xffffffffffffffbd
inc ebx
fdivr st(2)
adc cl, al
mov ebx, 0x90d98121
and dl, byte [ecx]
xor edi, dword [esi + 0x26]
outsd dx, dword [esi]
mov cl, 0x15
inc ax
push ds
xor al, 0x80
ja 0x101182bf
pop ebx
jbe 0x10118354
test al, 0xe0
mov ebp, 0x3f7886a1
xchg edx, eax
cmp ah, byte [eax + ecx*2]
xchg ebx, eax
aas
pushfd
mov edi, 0xec144485
pop esp
pop esp
sub eax, 0x1176b71a
je 0x1011833f
sal dword [esp + eax*4], cl
jne 0x101182e0
push esp
xchg byte [ebx], dh
das
invalid
or eax, 0x28d28000
and al, 0
cwde
invalid

Function at 0x10119c17
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0x4f0d330a
call fcn.1013e251
jg 0x101a7fba
neg esi
or dword [esp + 0x2c], 0x5bb27911
mov esi, dword [esp + 0x1c]
test dword [esp + 0x2c], 0xe439d00a
je 0x1025142e
test word [esp + 0x2c], 0x4db0
setge byte [esp + 0x2c]
push dword [esp + 0x40]
popfd
lea esp, [esp + 0x48]
ret
mov dword [esp + 0x10], 0xda0cad97
sets byte [esp + 0x10]
cmp dword [esp + 0x10], 0xa2273f8e
not dword [esp + 0x24]
jl fcn.101dddee
push dword [esp + 0x2c]
popfd
lea esp, [esp + 0x38]
ret
movsx ebx, bl
lea esi, [esi + ebx*2 + 0x71e1611]
bswap ebx
cmp byte [esp + 0x10], 4
xchg dword [esp + esi*2 - 0x3c3eddd6], edi
mov ebx, dword [esp + 0x18]
jb 0x1019260f
cmp dword [esp + esi - 0x1e1f6ee9], esi
jns 0x1010bb0e
and byte [esp + esi*4 - 0x787dbbd4], 0x13
mov esi, dword [esp + esi - 0x1e1f6ef5]
cmp dword [esp + 0x10], 0x3b3248bd
jbe 0x10254ad6
test byte [esp + 0x10], 0xa7
seto byte [esp + 0x10]
shl byte [esp + 0x10], 0x63
shl word [esp + 0x10], 0x3b
xor byte [esp + 0x10], 0x36
add dword [esp + 8], 0xefdfda35
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x1c]
ret

Function at 0x1011d422
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, edx
jo 0x100b1852
and byte [esp + edx*2 + 0x1ff5b774], 0xb6
setne byte [esp + edx*4 + 0x3feb6ed0]
add word [esp + ebx*4 + 0x3feb6ed4], 0x2f8c
mov byte [esp + ebx*4 + 0x3feb6ed4], 0xa4
mov ebx, dword [esp + edx*8 + 0x7fd6dd68]

Function at 0x101246b0
Capabilities:
Authenticate hmac

Disassembly:
add dword [esp + ecx*2 + 0x24], ecx
mov dword [esp + ecx + 0x2c], edx
mov ebx, ecx
add dword [esp + ebx*8 + 8], 0xeff0a3ec
mov word [esp + ebx + 0xc], cx
sub ebx, dword [esp + ecx + 0x24]
je 0x10133d3c
mov edi, dword [esp + 0x24]
add byte [esp + edi - 0x2a00db], 0x1d
add dword [esp + 4], 0x433b1
push dword [esp + edi - 0x2a00eb]
popfd
mov ebx, dword [esp + edi - 0x2a00ef]
mov edx, dword [esp + ecx*2 + 4]
lea esp, [esp + ecx + 0x18]
ret

Function at 0x10124f6b
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
shl edi, 0xb6
mov esi, 0x3c18b00e
jne 0x10102128
Function at 0x1012994c
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xffeda20f
push edx
and bx, bx
cpuid
in eax, dx
call dword [edx + 0x66]
and ebx, ebx
mov edi, 0x49b28c0c
mov edx, 0x2e1ca423
mov edi, dword [esp + edx - 0x2e1ca41f]
mov edi, dword [edi + edx*2 - 0x5c394846]
jge 0x101684e9
or dl, 0x1e
cmp dl, 0x35
setb bl
call fcn.1020f3ed
push edx
mov bl, 0xa5
jns 0x10129991
mov dl, 3
mov es, word [esi + eax*2 + 0x71822d91]
mov ebp, 0xdb3a9001
xor byte [ecx - 0x43], 1
nop
cmp bl, bl
jno 0x10129950
add dword [eax + 0x6c4adb3a], edx
dec edx
insb byte es:[edi], dx
fsub dword [ecx]
cmpsd dword [esi], dword es:[edi]
sbb dl, byte [ecx + 0x1eb83d85]
add ecx, dword [edx + 0x4035e94]
push ebx
std
outsb dx, byte [esi]
lodsd eax, dword [esi]
outsb dx, byte [esi]
leave
clc
xor dh, byte [ecx]
dec ebx
in eax, 0x7e
lodsd eax, dword [esi]
outsb dx, byte [esi]
leave
clc
push esi
dec edx
xor byte [0x82812f94], ah
inc ebp
jg 0x10129990
inc esi
xor cl, byte [ebx + 0x72]
push ds
fld qword [edi]
jle 0x10129a14
sub edx, dword [ebp + 0x2fd9a307]
xor byte [ebx + 0x46270e27], 0x53
cmp ecx, edx
lahf
dec ecx
mov dl, 0x15
out 0x8c, al
inc esi
push ebx
mov ebx, 0x4278ff1f
xchg dword [edx + 0x7a2fab02], eax
cmp byte [edi + 0x24c85dbd], 0x71
xlatb
cmp al, byte [ecx - 0x7369153]
jmp 0x44d62d15
fnstenv [edx - 0x7d775550]
xor al, 0x9d
mov ebp, 0xf19de564
mov edx, 0xb038a288
dec ecx
nop
in al, 0xe1
mov ah, 0x64
hlt
and ebp, 0x9d08e135
xchg dword [esp + edx + 0x28550762], ecx
call fcn.1012110f
sub eax, 0x726eab0
iretd

Function at 0x10133d2e
Capabilities:
Authenticate hmac

Disassembly:
adc eax, dword [eax]
mov dx, cx
test dl, 0xa2
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], edi
call fcn.10266025
inc ebx
and dl, byte [ebx]
add byte [ebx - 0x1f], al
call 0x42f864bf
loope 0x10133d2c
ja 0x10133d6d
in eax, 0x32
mov al, 0x19
invalid
scasb al, byte es:[edi]
sbb al, 0xb2
enter 0x79ca, 0x5c
inc edi
sti
outsd dx, dword [esi]
dec ebp
sahf
test al, 0xee
inc ebx
jbe 0x10133dd8
mov word [edi + 0x50], es
push eax
sbb byte [0x9560939d], al
pushal
xchg ebp, eax
outsd dx, dword [esi]
xchg esi, eax
lds ebx, [esi + 0x5a]
push cs
inc esi
das
cmc
outsb dx, byte [esi]
lodsd eax, dword [esi]
outsb dx, byte [esi]
leave
clc
and byte [eax + 0x68], bl
jle 0x10133d3e
mov dword [0x6ead7ef6], eax
leave
clc
adc eax, 0xb60e6eee
add eax, 0x712c352c
cmp cl, byte [eax]
xor ah, byte [eax + 0x58cf458]
jno 0x10133de6
or byte [edx], dh
mov al, byte [0x58cf458]
jg 0x10133d42
push ss
or dword [edx + 0x60], esp
test eax, 0x1c147800
dec ebp
xchg dword [ebp + 0x879b1e5], ebp
adc dword [ebp + 0x68], edx
call 0x37f092af
jbe 0x10133d85
loopne 0x10133daa
jle 0x10133d80
outsb dx, byte [esi]
retf 0xc878
imul ebx, edx, 0x7ab17329
cmp eax, ecx
ljmp 0xcd06
int 0xda
int1
push ds
mov dword [0xe922e0ba], eax
hlt

Function at 0x10135545
Capabilities:
Packed with generic packer

Disassembly:
not dword [esp + edx - 0x301bf864]
jns 0x1009d187
xor byte [eax], 0xd7
add esp, dword [edi + edx*8]
sbb esi, dword [ecx + 0x36ddca6e]
ret 0xcf06
Function at 0x10137bc8
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov eax, edi
mov eax, dword [esp + eax + 0x438c240e]
mov eax, dword [eax + edi + 0x438c240a]
or edi, 0x7211a50a
mov dword [esp + edi*2 + 0x3180008], edi
xor dword [esp + edi*2 + 0x3180008], 0xda918fa9
not dword [esp + edi + 0x18c0006]
lea edi, [edi + edi*4 - 0x2fdc766d]
setb byte [esp + edi + 0x3798767b]
shl edi, 0x63
lea eax, [eax + edi + 0x45e45f70]
mov byte [esp + 4], 0x18
js 0x1020870b
push ecx
sub byte [esp + 8], 0x15
add di, word [esp + 9]
jg 0x1019c5af

Function at 0x10138955
Capabilities:
Packed with generic packer

Disassembly:
push 0x75b878a3
add esi, 2
mov ecx, 0xd501f38f
add cl, cl
lea ecx, [ecx - 0x2255957d]
movzx ecx, byte [ebp]
ror byte [esp + 3], 0x23
mov dword [esp + 4], 0xc27d91c
je fcn.1024ff83
adc ebp, 0
and word [esp + 5], 0xe208
mov word [esp + 6], 0xff8c
jle 0x101c9658
xor cl, bl
ror byte [esp + 5], 4
dec cl
and dword [esp], 0x921f312a
push 0x9f8c2418
not cl
xor dword [esp + 8], 0x153b1dad
jl 0x1026062d
adc ebp, 4
jmp fcn.1010c729
call fcn.1018d0d4
ror word [esp + 4], 0xa7
adc cl, 0x98
neg word [esp + 0xa]
rol cl, 1
add cl, 0xb3
inc byte [esp + 2]
xor cl, 0x1e
xor bl, cl
shr byte [esp + 2], 0xc3
inc byte [esp + 0xa]
lea ecx, [esp + ecx + 0xc]
jbe 0x10214263
call fcn.102393f2
Function at 0x101398fb
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0x1434f5a6
mov edi, dword [esp + edi - 0x1434f576]
jb 0x100ac014
jl 0x101e953f
jle 0x1021708c
call fcn.10193db5
jne 0x101414e2
mov edx, 0x8b023196
add dx, dx
sal edx, 0x2a
mov edx, ebp
push 0x1126d833
call fcn.1020fa9c
push dword [esp + 0x44]
popfd
lea esp, [esp + 0x4c]
ret

Function at 0x1013c55e
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
not ecx
mov dword [esp], 0x3ac0d8b
dec byte [esp]
not edx
jno 0x101dc64f
push 0x4a93fa2a
js 0x1023447a
mov edi, 0x1a8aef1d
mov di, word [ebp + edi*2 - 0x3515de3a]
mov eax, 0x49b2012f
not eax
push eax
mov ax, word [ebp + 2]
rol dword [esp], 0xfc
adc ebp, 1
not di
call fcn.10194823

Function at 0x1013c574
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
shr dword [esp + 0xd], 0x4e
neg ax
rol word [esp + 0x10], 0x27
sbb dword [esp + 0x13], 0xb28a2106
js 0x101e3802
syscall
call fcn.10187bd5
xor bx, ax
sub edi, 2
call fcn.102423d0
syscall
inc ecx
push edx
pushfd
dec ecx
mov edx, 0x94a0f638
sahf
in eax, dx
and al, 0x1b
dec esp
mov edx, dword [esp + 8]
dec eax
mov dword [esp + 8], 0x6df6502a
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.10243ebd
mov eax, dword [ebp + ecx*2 - 0x6e06960e]
mov cl, byte [ebp + ecx*2 - 0x6e06960a]
add ebp, 6
mov byte [eax], cl
jmp fcn.100d1962

Function at 0x1013c5a8
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
jns 0x101eebeb
sysenter
call fcn.10263524
mov ecx, 0xb0b029b6
xor cl, cl
call fcn.10182c52
lea esi, [esi + 1]
call fcn.101408d9
xchg dword [esp + 0xc], eax
sub si, 0x1f15
not si
bswap esi
xor esi, 0x333cbc3d
and si, si
mov esi, dword [esp + esi - 0x51bbda99]
mov dword [esp + 8], eax
jb 0x10114f4c
js 0x10180af4
jge 0x10185656
call fcn.10106049
sub dword [esp + 4], 0x403ceda1
call fcn.1011399e
mov eax, 0xcfa70b9d
mov edx, dword [esi]
movzx ebp, ax
lea esi, [ebp + esi - 0xb99]
xadd bp, ax
lea ecx, [ebp + ebp*8 - 0x7af2a26a]
rol bp, 0xa2
mov edi, edx
adc ecx, ecx
movsx edx, bp
rol dl, 0x41
jns fcn.100dbd99
shr ecx, 0xcb
call fcn.101e3d51

Function at 0x1013da58
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + 0x18], 0xbaaaf
mov ebx, 0x9059fa7
lea ebx, [ebx*8 - 0x4a7f0f7f]
and ebx, 0xb934a26
not ebx
add dword [esp], 0xffec779e
cmp ebx, 0xcb2a826
jae 0x1019eb9f

Function at 0x10140652
Capabilities:
Packed with generic packer

Disassembly:
push esi
or dword [esp + edi + 0x63e38314], esi
push 0x1109e19a
push ebx
not dword [esp + esi + 0x63e3831c]
mov esi, dword [esp + edi + 0x63e38320]
mov esi, dword [esi + edi + 0x63e38300]
mov ebx, 0xb04bb10
sub di, 0xbe07
shl ebx, 0xed
call fcn.1017e71b
Function at 0x1014c1e2
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [ecx + edi*8 - 0x615dece6]
mov dword [esp + 0x10], edx
setle byte [esp + edx - 0x4a94cbe2]
push 0x4e87183c
xchg dword [esp + edi*2 - 0x5f197e46], ebx
mov edi, dword [esp + 0x18]
and ecx, 0xf8a6098e
xor edx, 0xac2ed284
mov edx, dword [esp + 0x28]
not byte [esp]
jb 0x1020ae2b
sub dword [esp + 0x2c], ebp
add dword [esp + 0x10], 0xeff4e78b
call fcn.10173833
inc ecx
cmp dword [ecx], ebx
retf 0xa165

Function at 0x10155000
Capabilities:
Packed with generic packer

Disassembly:
jg 0x1026c3c4
push dword [esp + 0x40]
popfd
lea esp, [esp + 0x44]
ret
jl 0x10126a3e
bswap ebx
lea ebp, [ebp + ebx - 0x5c92b5b]
call fcn.100e0fe9
jmp 0x102603d3
push 0xa9850b94
shl dword [esp], 0xf
not dl
and al, dl
push 0x76a28585
jmp 0x1024d4cc
pushfd
pop edx
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
mov word [edi + 4], ax
push 0xcc05caad
mov dword [edi], edx
push 0xb8b2e00e
mov dword [esp + 0xc], 0xa42e8891
push 0xfe04ec0d
lea esp, [esp + 0x14]
jmp fcn.102609f2
not al
jmp 0x101b05a2

Function at 0x10157c2c
Capabilities:
Packed with generic packer

Disassembly:
push 0xb81de320
xchg dword [esp + 0x2c], ecx
mov edi, dword [esp + ebp - 0x164f0fa]
je 0x1010b16d
not dword [esp + ebp*8 - 0xb2788e4]
neg byte [esp + ebp - 0x164f0f6]
not byte [esp + ebp - 0x164f112]
mov dword [esp + ebp - 0x164f11e], 0x660291a8
neg dword [esp + ebp - 0x164f11e]
and dword [esp + ebp - 0x164f11e], 0xb019db0b
cmp ebp, 0xaeaa9206
mov ebp, dword [esp + ebp - 0x164f10e]
je 0x101f9e00
not dword [esp]

Function at 0x10160ffa
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp + 0x18], edx
push 0x2a1a382f
xor dword [esp + 0x14], 0x291544b9
neg byte [esp + 0xc]
or word [esp + 0x14], 0xce8c

Function at 0x10161022
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + ecx*2 - 0x6c538e56]
mov dword [esp + 0x18], esi
mov edi, 0x2a28e4a9
not edi
movzx edi, bl
add dword [esp + ebx - 0x573a29b2], 0x253ce
nop
mov ebx, 0x7f25580e
call fcn.10242cfe

Function at 0x1016b49f
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0xa2300f1a
setae byte [esp + edx + 0x5dcff0f2]
push 0x9081752c
add dword [esp + 4], 0xfffb344f
mov esi, edx
mov eax, 0x6b063a02
add dword [esp + edx + 0x5dcff0fa], 0xefda7ba1
bswap esi

Function at 0x101729a2
Capabilities:
Execute syscall

Disassembly:
test dword [esp + esi*4 - 0x402f306c], 0x90b96711
mov esi, dword [esp + esi*4 - 0x402f3074]
mov esi, dword [esi]
mov dword [esp + 0x10], 0xdbab1214
not dword [esp + 0x10]
mov edi, 0xf00593a8
push ebx
push edx
lea esi, [esi + edi*2 + 0xf26713d]
jne 0x1023343d
mov edx, edi
test dword [esp + edi*2 + 0x1ff4d8cc], edx
jns 0x1012c3ae

Function at 0x10176feb
Capabilities:
Authenticate hmac

Disassembly:
push edi
push ecx
mov ecx, dword [esp + esi - 0x44a3b88b]
call fcn.1026331c

Function at 0x1017f5dc
Capabilities:
Encode data using xor

Disassembly:
cmp word [esp + edi + 0x24], 0x93a5
Function at 0x10180191
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ecx + ecx*4 + 0x4cacefb4]
push 0xd37a3a1
mov dword [esp + ecx - 0x56fcef94], edx
mov word [esp + ecx - 0x56fcefb4], cx
jg 0x1024d2d8
neg word [esp + ecx - 0x56fcefac]
push ecx
jle 0x100e9046

Function at 0x101801b7
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, 0x4231b11b
pushfd
add ebp, ebp
call fcn.101d57d9

Function at 0x10180204
Capabilities:
Packed with generic packer

Disassembly:
push 0xcc051e22
call fcn.1015d896
add dword [esp + esi - 0x6dbcafab], 0x2c8df
mov ebx, 0x639eeb30
lea edi, [edi + ebx - 0x639eeb2f]
mov ebx, esi
add ebx, 0xf89bf6b8
shr bl, 0xdb
mov dword [esp + esi - 0x6dbcaf8f], edi
shr ebx, 0xfa
add dword [esp + ebx - 0x15], 0xefe9bdf0
call fcn.10165fa2

Function at 0x10180aff
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
sub al, 4
in eax, 0xec
movsd dword es:[edi], dword [esi]
invalid
pushfd
add dword [esp + 4], 0xffeaaa85
call fcn.1021e640
and ebp, ebx
imul esi, ecx, 0x27
mov byte [esi + eax*8], bl
jo 0x10180ad9
insb byte es:[edi], dx
leave
inc ebx
xchg dword [ebx], edx
lea edx, [edi - 0x2a]
sub byte [0xf6b60426], ah
pop esp
pop ebp
lahf
ret 0x368a

Function at 0x1018306a
Capabilities:
Encode data using xor

Disassembly:
call fcn.1022ee02
insd dword es:[edi], dx
mov bh, 0xe6
jae 0x101830b5
invalid
leave
clc
xor edi, edi
push esp
out dx, eax
pop ecx
mov ebx, 0x83b321c8
mov esp, 0x3e1c7c1
add ebp, dword [ecx + edi*2 - 0x27]
xor al, 0x6f
fnstenv [edi + ebp*2]
sti
xchg ecx, eax
jnp 0x101830a1
cmp byte [edx + edx*8], ah
push eax
sub bh, byte [ebx + 0x10]
cmpsb byte [esi], byte es:[edi]
les esp, [eax + eax + 0x63]
push ecx
and byte [esi + 0x70], ah
mov esp, 0x2f44a610
iretd

Function at 0x1018855a
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [edx + ecx - 0x429ea811]
or cl, 0x2a
shl si, 0x5a
sub ecx, 0x809760ab
ja fcn.10142f5e
movsx ecx, cl
ja 0x10265327
mov dword [esp + esi - 0x5b79ffec], edx
push edi
xor cx, 0x373c
mov edi, 0x4b5f1b4
call fcn.101bce28
lea esp, [esp + 8]
jmp fcn.1014eb23
je 0x1025520b
mov esi, dword [esp + ebp + 0x2c590a14]
call fcn.1013eba0
xor al, bl
not dword [esp]
sub dword [esp], 0x41a3c338
push 0x4b9b2f30
not al
push 0x95bdf289
rol al, 1
jmp 0x1022acfe
dec dword [esp + 1]
xor al, 0xbb
shl dword [esp + 3], 0x10
adc al, 0x9e
xor bl, al
push 0xeb98d29e
sar word [esp + 0xe], 0x6c
ror byte [esp], 0x85
sbb ebp, 1
call fcn.101f31fa
lea edx, [edx + 0x5f08218e]
not bp
test dword [esp + 0x14], edi
movsx edi, di
xchg dword [esp + 0x20], edx
mov edi, dword [esp + 8]
ja 0x1011748d
add word [esp + 0x14], bp
je 0x1020aee1
setb byte [esp + 0x10]
mov ebp, dword [esp + 0xc]
shl dword [esp + 0x14], 0x6f
add dword [esp + 0x18], 0xefe99e56
call fcn.101b816d
call fcn.1022c514
mov edx, 0xbd81272b
call fcn.100e3544
mov eax, 0x75ad3f94
lea esi, [eax + esi - 0x75ad3f95]
movzx eax, byte [esi + eax - 0x75ad3f94]
push 0x51848f3a
jmp 0x101d9880
Function at 0x10188bb3
Capabilities:
Encode data using xor

Disassembly:
shl esi, 0x7e
test word [esp + esi + 0x20], 0x4715
mov esi, dword [esp + esi + 0x10]
jge 0x10261417
mov byte [0x35ee2300], cl
jo 0x10188b71
and ebp, esi
xor eax, 0x2d6a9f70
push 0x2d
xchg ebp, eax
push esi
xor esp, dword [ecx + edx*2 + 0x441a61e]
out dx, eax
xchg edi, eax
jne 0x10188bd2
shl byte [esi], 0xdb
pushfd
add ebp, dword [esi]
jns 0x10188bca
loope 0x10188c20
sbb byte ss:[ecx - 4], dh
sbb byte [ecx - 4], dh
and byte [edx + 0x31e1efb0], bl
mov al, byte [0x57f25357]
wait
add dword [edi - 0xba03e11], eax
loop 0x10188be8
mov esp, 0x45c684c7
add byte [ebx + 0x7a010f91], al
mov byte [0xd9f1c59], al
push esi
pushal
shl bl, 1
cwde
dec ebx
jo 0x10188c0c
mov dh, 0x35
xor edi, dword [eax]
mov dword [0x664fee47], eax
int3
dec edi
int3
setg byte [esp + 8]
shr byte [esp + 0x20], 0x7a
not dword [esp + 8]
jne fcn.100cfc52
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x24]
ret

Function at 0x101916c1
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
jbe 0x10240df4
add dword [esp + esi + 0x357dbb45], 0x8d4a5
call fcn.10207120
push 0xb78b58aa
lea esp, [esp + 0x24]
jmp fcn.101711b2
jae 0x101ff15a

Function at 0x10198506
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ecx
mov dword [esp + 8], 0xfd5714cf
lea esp, [esp + 8]
call fcn.100a3b1c

Function at 0x101988f1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe71e5319
lea ecx, [eax - 0x3d6d0e65]
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
call fcn.1022c019
call fcn.101e3ca0
jmp 0x1013de94
jg 0x10274695
mov ebp, dword [esp + 0xc]
shr word [esp + 0x14], 0xb1
and byte [esp + 0x14], 0x87
not dword [esp + 0x14]
call fcn.100de3f7
mov eax, 0xb3059eab
movsx edx, al
or eax, eax
mov eax, dword [ebp]
mov ecx, 0x2112c625
sar cl, cl
mov ecx, dword [ecx + ebp - 0x2112c5fd]
adc dl, dh
push ebx
movzx ebx, dx
seta dl
cpuid
sbb ebp, 7
jmp 0x1019cf67
call fcn.101a89f5
mov edx, dword [edi]
jmp 0x1016d6cb

Function at 0x1019c5c8
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
xchg dword [esp + ebp - 0x695d4d61], eax
mov ebp, dword [esp + ebp - 0x695d4d81]
jle 0x102380ef
test byte [esp + 0x3c], 7
not byte [esp + 0x28]
call fcn.1019456e
Function at 0x101a6b1a
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp + edx - 0x7ddff415], 0xae
or dl, dl
mov dword [esp + edx - 0x7ddff415], 0x26b0c3a2
add dword [esp + edx - 0x7ddff429], 0xefeee5c0
cmp dword [esp + edx - 0x7ddff415], 0x520e8c95
mov esi, 0xf1bc1481
mov edx, dword [esp + edx - 0x7ddff409]
call fcn.101c92b0
neg byte [esp + 0x38]
js 0x1017e2d3
shr byte [esp + 0x38], 0x9a
call fcn.10135f41
mov ecx, dword [ebp]
mov edx, 0x532d7aab
call fcn.10202b96
push ecx
mov dword [ebx + 0x5a], esp
and dword [ebx - 7], ebp
jnp 0x101a6b6e
sub dword [eax], ecx
arpl bp, si
or byte [ebx - 0xb], ah
iretd
aaa
mov esp, 0x9c36a62c
mov esp, 0x9c36a62c
in al, dx
salc
push esi
hlt
je 0x101a6bd6
and al, 0xf6
jecxz 0x101a6b44
inc edx
call 0x42fb366d
mov ah, 0xde
pause
jp 0x101a6baa
or eax, 0x91a31c83
sar byte [ebx - 0xa0bdc83], 1
pop ebx
imul esi, dword [ecx], 0xffffffa1
sub esi, dword [ebx]
pop ebp
and eax, 0xb1214b5b
sbb ebx, dword [ebx - 0x3b80dee7]
mov dword [edx], ebx
dec eax
retf 0x1a48
pop esp
sub byte [edx + 0x1953b4f1], bh
call ebp
sub cl, ah
and byte [eax - 0x11b75641], bl
fcomp qword [ebx - 0x60b69998]
int 0x8f
je 0x101a6b5c
xor ebx, dword [edi + edx]
mov esp, 0xf8796b5
cli
sbb byte [ecx], 0x9d
je 0x101a6b5a
fcom qword [edx - 0x5e81399e]
invalid
invalid

Function at 0x101a843c
Capabilities:
Packed with generic packer

Disassembly:
call fcn.100f6740
mov byte ss:[edi], dl
call fcn.10272b1f
shl dword [esp + ebx*2 - 0x17e66], 0x4a
ja 0x10187931
lea edx, [edx + ebx*2 - 0x747322d4]
js 0x1016c794
mov ebx, 0xe7a28582
sub byte [esp + 0x10], 0xa7
je 0x100f122a
test word [esp + 0x10], 0xdc9a
call fcn.10171c57
not si
call fcn.101cfaae
jmp 0x101164cd

Function at 0x101a93c2
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp], 0xfff87849
add si, 0x6527
jne 0x1024a4fb
shl dword [eax - 2], cl
push ebx
sbb eax, dword [edi + 0x2d508a66]
out 0x6c, eax
leave
adc al, 0xdb
mov esp, 0x3263a0e8
mov word [ebp + 0x75], ss
leave
sti
mov ecx, 0x3a45f8ec
invalid
mov dl, 0x26
mov eax, esi
mov eax, dword [esp]
mov eax, dword [eax]
jo 0x1022f934

Function at 0x101af20e
Capabilities:
Authenticate hmac

Disassembly:
and al, 0xc
bswap edx
sub edx, 0x1336ee19
cmp dl, 0xa9
ja 0x10229e0b
mov dword [esp], 0xfbb4c18a
and byte [esp + 1], 0x9a
adc esi, 2
mov eax, 0x7397592b
neg dword [esp + eax - 0x7397592b]
js 0x10198dfc
lea edi, [eax + edi - 0x7397592c]
bt eax, 0xb5
lea eax, [eax*8 + 0x12d54b0]
movzx eax, byte [edi]
jae 0x1010215c
xchg esp, eax
out 0x2d, al
mov ch, 0x6e
or ebx, dword [eax + 0x45ca720d]
add byte [ebx + 0x4ea1197e], cl
imul edx, dword [eax - 0x12f8e5bb], 0xffffff99
jae 0x101af1f5
enter 0xffffffffffff9de4, 0xfffffffffffffffd
adc dword [edx + 0x11], esi
push ss
ret 0x27c6

Function at 0x101b00b9
Capabilities:
Authenticate hmac

Disassembly:
not dword [esp + 0x1c]
jle 0x10119c33
push dword [esp + 0x28]
popfd
lea esp, [esp + 0x3c]
ret

Function at 0x101b023f
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 8], 0x7cbaf
shl byte [esp], 0x23
test byte [esp], 0x97
mov ecx, dword [esp]
not ecx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx]
push 0xc53111a8
jne 0x100e39a7