joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cbd7b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
cmp esi, 0xffff
ja 0x10126d67
mov eax, esi
cmc
sub eax, dword [ecx + edx + 0x10]
jmp 0x100c95ba
ret
je 0x100bbc8a
mov eax, 0x5a4d
cmp word [edx], ax
je 0x1010a324
sub eax, eax
movzx esi, bp
cmovae si, dx
jmp 0x100c1ec1
pop esi
jmp 0x100f3c69
je 0x100bbc8a
mov eax, dword [eax + 0x7c]
stc
test dh, 3
push ebx
test di, cx
push edi
mov dword [ebp - 0x10], eax
test ch, 0xad
mov dword [ebp - 8], 0xffffffff
jmp 0x100b6165
push ebp
cmp eax, edx
mov ebp, esp
shr dx, 1
ror dl, cl
neg edx
mov edx, dword [ebp + 8]
stc
lea esp, [esp - 0x114]
stc
cmp dh, ch
push esi
test cl, 0xa8
test edx, edx
jmp 0x101214ab
mov esp, ebp
pop ebp
jmp 0x100baa6b
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jmp 0x101158b4
jne 0x100bbc8a
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0x100c8e34
je 0x100bbc8a
mov esi, dword [ebp + 0xc]
test eax, 0x3a830199
jmp 0x10133833
test esi, esi
jmp 0x100bbc76

Function at 0x100cd0c0
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 2
add bx, bp
inc cx
mov dword [esi], ebx
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x100ce20d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
pushfd
shl word [esp + 8], 0x30
jns 0x100e7680
push 0xf69a0212
mov eax, dword [esp]
sub dword [esp], eax
mov edi, dword [ebp]
jge 0x1011fca2
jns 0x10126d4c
call fcn.1013154d
add byte [eax], al
add byte [esi + 0x69], al
outsb dx, byte [esi]
dec esi
js 0x10126dd0
inc esi
imul ebp, dword [ebp + 0x41], 0x998ee800
cld
dec dword [ebx - 0xae7ee84]
dec ebx
mov byte [edi], ch
push edx
adc ebp, esi
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
inc esi
push 0x8f2246b8
sub ch, 0x1d
pop ss
das
xchg edx, eax
scasd eax, dword es:[edi]
pop eax
ror byte [esi], 0x7a
das
push 0x31
fld qword [ebx + 7]
dec esi
js 0x7344b874
sub dh, byte [ecx - 0x63]
lodsb al, byte [esi]
adc ah, byte [edx + edx + 0x5e9287e2]
adc byte [eax], al
add byte [eax], al
add byte [0xac88b6b3], dh
jl 0x10126e7e
into
in al, 0xd2
or al, 0xb
int3
int3
cld
sal esp, 1
arpl word [esi], sp
jl 0x10126e3a
scasb al, byte es:[edi]
fist dword [eax + 0x3c06f699]
adc al, 0xfd
fcom qword [edi]
mov eax, dword [ebx]
sbb al, 0xd2
jae 0x10126e89
dec esi
sbb byte [edx + edi*4], bl
adc dword [esi - 0x70], ebx
add byte [eax], al
add al, al
and al, 0x6b
ja 0x10126e1c
jo 0x10126dcd
mov ecx, dword [ebp - 0x20]
enter 0x31aa, 0xffffffffffffffb3
ret 0xb0e8
stosb byte es:[edi], al
xor ebx, esi
mov esi, 0xb5179902
sar ebx, 1
add bl, byte [ecx - 0x42e4ae9]
mov ah, 0x72
lds ebp, [esi]
stosb byte es:[edi], al
xor dword [ebx], esi
and al, 0xa9
push cs
cmp edi, dword [esi]
inc esi
xchg ebp, eax
je 0x10126e22
int 0x4d
xor dword [eax - 0x11], eax
add eax, 0xde3f9275
sal bl, 0xd6
mov eax, dword [0x591a05fd]
pop ds
jns 0x10126e7a
adc ecx, ebx
inc eax
test ah, ah
xlatb
xchg esp, eax
adc al, 0x87
stosb byte es:[edi], al
xor dword [ebx - 0x29], esi
push edi
cdq
in al, 0x11
invalid
Function at 0x100ce526
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror ah, 1
inc ecx
not ah
inc ecx
ror ah, 1
inc ecx
add ah, 0x3a
inc ecx
neg ah
jmp 0x100f6bcd
inc ecx
inc ah
inc ebp
xor cl, ah
dec esi
lea esp, [esp + 8]
dec ecx
mov dword [esp], ebx
push 0xcc12e0bb
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100d323b
Capabilities:
Encode data using base64

Disassembly:
adc ebp, 2
not cx
call fcn.101214d4

Function at 0x100d3284
Capabilities:
Encode data using base64

Disassembly:
shl word [esp + 4], 0xe6
test edx, edx
push 0xf3927787
lea esp, [esp + 0xc]
je 0x100f6ca7
push esi

Function at 0x100d4455
Capabilities:
Encode data using base64

Disassembly:
inc esp
shrd edi, eax, cl
jmp 0x10129e67
inc ecx
mov dword [esi], edi
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100d4fb8
Capabilities:
Encode data using base64

Disassembly:
call 0x100eb62e
cmc
cmp bp, 0xa6ad

Function at 0x100d8eae
Capabilities:
Encode data using base64

Disassembly:
add ebp, 4
xor eax, eax
test edx, edx
jmp 0x100fbce6
lea esp, [esp + 8]
je 0x100c285e
push 0x941e783e
mov dword [esp], esi

Function at 0x100d9069
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x71862222
dec ebp
mov dword [edi], esp
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x100d9386
Capabilities:
Encode data using base64

Disassembly:
push 0x54b40836
dec ecx
mov dword [esi], ecx
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100da0a3
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp 0x100b2cd7

Function at 0x100df204
Capabilities:
Encode data using base64

Disassembly:
shld bx, dx, cl
jmp 0x10102569
inc cx
mov dword [esi], ebx
push 0xe2929a0c
push 0x479ea1a4
dec eax
lea esp, [esp + 0x20]
jmp fcn.100da766

Function at 0x100df98c
Capabilities:
Encode data using base64

Disassembly:
jae 0x100e20ad
xor al, bl
push 0xe22bc21b
dec al
xor al, 0xbc
sub al, 9
sub byte [esp + 2], 0x15
neg al
xor bl, al
lea eax, [esp + eax + 4]
mov dword [eax], edx
jmp fcn.101230ce
inc bp
mov esp, dword [esi + 2]
dec eax
mov dword [esp], 0xb00bdcb2
dec ecx
add esi, 2
inc cx
and esi, esp
not si
inc cx
mov dword [esi], esi
call fcn.1010d8a7
mov ebp, dword [esi]
push 0x52b769a9
call fcn.100f4752
dec ecx
sbb edx, 1
ror edi, 0xb1
inc eax
ror bh, 0xa6
inc ecx
movzx edi, byte [edx + edi - 0x6580705d]
jae 0x100d8527
xor dword [edx - 0x75], 0xffffffff
jmp dword [esi - 0x75]
mov di, word [ebp]
call fcn.10119e70
mov bl, 0x29
xchg ecx, eax
ficom dword [edi - 0x4d]
inc ecx
je 0x100df95b
mov bl, byte [edx]
jne 0x100df9b0
cmp bl, dh
cmc
sbb byte [ebp - 0x17], al
ret 0xc36f
call fcn.1012b9e7
inc ecx
xor bh, cl
call fcn.100d9d79
mov bp, word [esi]
mov ecx, 0x3086652d
push ecx
sar byte [esp + ecx - 0x3086652d], 0x25
mov cl, byte [esi + ecx - 0x3086652b]
adc esi, 2
shr bp, cl
jmp 0x100e1648
Function at 0x100e0eac
Capabilities:
Encode data using base64

Disassembly:
inc bp
movzx ebx, byte [ebx + eax - 0x171f7346]
dec ecx
sbb esi, 2
jmp 0x100d856e
dec edi
lea esi, [esi - 0x291fff8]
dec ecx
inc esp
dec edi
lea edx, [edx - 0x5240003]
inc cx
shl esp, 0xd
inc edi
movzx esp, byte [edx - 0x2922000]
inc ebp
xor ah, cl
call fcn.100ce526
call fcn.100fd636
cld
cmp cl, byte [edx + 0x568e14b5]
inc ecx
mov eax, 0xc35c21b9
daa
aad 0xdc
das
push es
xchg byte [edi + 0x7106f21c], bh
test al, 0x3b
cmpsd dword [esi], dword es:[edi]
mov ch, 0xb7
cmp esi, dword [ebx]
rcl byte [eax + 0x18fe6d31], cl
invalid
rol al, 1
inc ecx
dec ebx
inc ecx
shl ebx, 0xda
dec al
sal dword [esp + 2], 0x85
dec esp
xadd dword [esp], ebx
jno 0x10132f4d
call fcn.100d8eae
mov ebx, 0x27b32609
jmp 0x100e7cee
rol al, 1
dec ebp
and ebx, ebx
inc esp
xor cl, al
inc ebp
and ebx, ebx
dec eax
lea eax, [esp + eax + 8]
inc dx
rol dword [esp + ebx - 0x171f7343], 0x63
inc dx
sar dword [esp + ebx - 0x171f7341], 0x23
jne 0x100ce463
dec edx
mov ebx, dword [ebx + esi - 0x27b32609]
inc ecx
mov esp, 0xdf902920
inc ecx
shl esp, 0xcc
jns 0x100d62ba
inc ecx
mov ebx, 0x1e32e49e
dec ebx
lea eax, [ebx + ebx + 0x200dc1a0]
dec ecx
dec ebx
dec edi
lea edx, [edx + ebx*2 - 0x3c65c93b]
inc ecx
ror ebx, 0xca
inc ebx
movzx eax, byte [edx + ebx*2 - 0x4e8f1972]
inc ecx
xor al, cl
inc ecx
push ebx
dec ecx
ror ebx, 0x75
inc esp
add ebx, dword [esp]
adc al, 0x86
inc ecx
shl ebx, 0xe5
inc si
xadd dword [esp + ebx - 0x75aa971b], ebx
js 0x100d8ffa
xor al, 0xbd
inc ecx
not ebx
jmp 0x100e5043

Function at 0x100e1149
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 8
dec esp
or ebx, ebx
dec ecx
not ebx
push 0x50ba4419
dec ebp
mov dword [esi], ebx
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100e2c23
Capabilities:
Encode data using base64

Disassembly:
dec ecx
not ebx
push 0xe008a8ad
dec ebp
mov dword [esi], ebx
push 0xff937c94
jmp 0x100f8d07

Function at 0x100e3474
Capabilities:
Encode data using base64

Disassembly:
inc eax
not ch
not cl
inc eax
and ch, cl
inc cx
mov dword [esi], ebp
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100e4504
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xed29df91
inc ebp
mov ebx, dword [esi]
inc ecx
mov eax, dword [esi + 4]
push 0x2a1d8aa9
sub word [esp], 0xc03f
dec ecx
add esi, 4
inc esp
and ebx, eax
inc ecx
not ebx
inc ebp
mov dword [esi], ebx
dec eax
lea esp, [esp + 8]
jmp fcn.100da766
xor cx, cx
xor cx, word [ebp + ecx - 0x4d08fffc]
push 0x184422b
add ebp, 2
shr cx, 1
mov byte [esp + 1], 0x9f
call fcn.100f3360
jmp 0x100cf945

Function at 0x100e62cb
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov dword [esi], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100e62e5
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 2
dec eax
shl esi, cl
dec ecx
mov dword [esi], esi
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x100e7a78
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766
inc ecx
inc al
inc ebp
xor cl, al
dec esi
lea eax, [esp + eax + 0x10]
dec ecx
mov dword [eax], edx
jmp 0x100bb5bb
Function at 0x100e86e1
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 2
inc sp
and eax, ecx
inc cx
not eax
inc bp
mov dword [esi], eax
push 0x75185035
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100e9949
Capabilities:
Encode data using base64

Disassembly:
mov byte [ecx], al
je 0x1013c776
lea esp, [esp + 0xc]
jns fcn.1014053b
xor cl, 0x85
dec cl
xor bl, cl
call fcn.100fb640
mov edx, 0xde3a511d
dec ecx
mov ebx, dword [esi]
push edx
dec ecx
mov edx, dword [esi + 8]
dec ecx
add esi, 8
dec eax
not ebx
rol dword [esp], 0xad
shr word [esp + 6], 0x81
dec eax
not edx
dec eax
and ebx, edx
dec ecx
mov dword [esi], ebx
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x100ea0ba
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100eb337
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100ed38e
Capabilities:
Encode data using base64

Disassembly:
shr dl, 0xea
mov edx, dword [esp + 0xc]
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call fcn.100ce9d4

Function at 0x100ed3a3
Capabilities:
Encode data using base64

Disassembly:
shr ebx, cl
dec eax
mov dword [esp], 0x6b18960e
jmp 0x10110779
inc ecx
mov dword [esi], ebx
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100f0654
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror al, 1
inc ecx
add al, 0x3a
inc ecx
neg al
call fcn.100e7a78
dec esp
mov dword [esp], ecx
xor dword [esp], ecx
inc ecx
mov ecx, 0xfcaebc25
inc cx
ror ecx, 0x2c
inc ecx
pop ecx
call fcn.100f7402
push esi
jne 0x1010d53a
mov ecx, 0xbc085089
dec cl
and cx, cx
dec ecx
sbb edx, 4
inc ecx
mov ecx, dword [edx]
push 0x6d8241b3
inc ecx
xor ecx, ecx
xor ecx, 0x8f125fab
xor word [esp + 5], 0x15a0
rol ecx, 1
inc ecx
inc byte [esp + 3]
xor ecx, 0x279dd92a
not ecx
jmp 0x100ed15b
mov dword [esp + 0x14], 0xc6a6608e
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.10117392
jmp 0x100d7e17
Function at 0x100f2a3e
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push 0xe11cfae
call fcn.100e86e1
not edi
or esi, edi
add byte [eax], al
add ecx, ebp
sub dh, byte [ecx + 0x448bffff]
mov eax, dword [ebp]
pop ecx
invalid
pop es
invalid
mov eax, dword [ebp]
pop ecx
mov ecx, 0xea92f007
dec ecx
mov cl, byte [ebp + 4]
call fcn.100b35e4
inc ecx
mov eax, 0x4689559b
dec ecx
neg eax
inc di
mov eax, dword [esi + eax + 0x4689559b]
jae 0x100e4bdd
inc cx
mov ecx, dword [esi + 2]
jl 0x100b382b
cld
call dword [ecx]
int 0x25
jmp 0x81c45413
adc ebp, ecx
and eax, 0xb52997e9
jno 0x100f2a36
lea edx, [esi + 0x20569686]
fiadd word [edx - 0x6e]
xor bh, byte [edx + 0x49]
in eax, dx
test dword [eax + 0x115e971], 0x5841667e
mov esi, 0x792fcd96
mov byte [esi - 0xdd7f47c], bh
cmp byte [esi + 0x7d], bl
mov esi, 0x29ae278c
scasd eax, dword es:[edi]
pushfd
dec esp
fidiv dword [eax - 0x75ce27f6]
jo 0x100f2a83
sub edx, dword [ecx]
in eax, 0x83
jae 0x100f2a72
aad 0xaf
mov ebp, 0x95136d7b
aam 0xdc
or dword [esi + 0x24e18a8a], edx
mov esp, es
pop ecx
cli
lodsd eax, dword [esi]
test al, 0x14
inc ebp
lahf
sub ecx, dword [esi - 0x4b]
pushal
dec edx
cmp eax, 0x73b353d7
add ebp, edi
lcall 0x38cf, 0x4740df56
or esi, dword [edx + 0x636b964a]
lcall 0x149d, 0x4f775695
mov dl, byte [eax + 0x6a]
or byte [ebx - 0x26d5e396], ch
ret 0xaa8

Function at 0x100f37c3
Capabilities:
Encode data using base64

Disassembly:
movzx edx, dx
jl 0x100faa49
call fcn.100c5c6e

Function at 0x100f47a6
Capabilities:
Encode data using base64

Disassembly:
dec ecx
lea esp, [esp + 8]
jne 0x1011e69c
call fcn.1010ffbe
inc byte [esp + 6]
xor edi, 0xd6a527b7
jmp 0x100ce02b

Function at 0x100f4cb6
Capabilities:
Encode data using base64

Disassembly:
not dx
inc cx
not ebx
inc cx
and edx, ebx
inc cx
mov dword [esi], edx
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x100f5656
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp 0x100b81fe

Function at 0x100f6391
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x24817e81
dec ecx
add esi, 2
inc eax
not ch
dec byte [esp + 1]
inc eax
not bh
inc eax
and ch, bh
jmp 0x101191ed
inc cx
mov dword [esi], ebp
push 0x35befdb4
push 0x933a748c
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x100f6c71
Capabilities:
Encode data using base64

Disassembly:
mov bp, word [esi]
sal ecx, 0xd9
or cx, word [ecx + esi - 0x51fffffe]
push 0x7f1c5199
add esi, 2
add bp, cx
mov word [esi], bp
push 0x63a21d1b
lea esp, [esp + 8]
jmp fcn.100fc58f
movzx esi, byte [eax]
xor esi, edi
jmp 0x100cab84
and esi, 0xff
jmp 0x10121706
jmp 0x100bd88a
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
call fcn.100b309c
xor edi, 0xfdafbf9a
inc byte [esp + 1]
dec edx
lea esp, [esp + 4]
jne 0x100d329c
push 0x7937be32
push 0x1c9eb68a
mov esi, dword [esp + 8]
lea esp, [esp + 0xc]
jmp 0x1012ac44
call fcn.100bcab3
mov ecx, 0xba1e8ba9
jmp 0x100b7f95
call fcn.1013f322
Function at 0x100f8655
Capabilities:
Encode data using base64

Disassembly:
ror cl, 1
xor bl, cl
ror word [esp + 4], 0x4e
lea ecx, [esp + ecx + 0xc]
push 0x6d0d49b1
mov word [ecx], ax
jb 0x1013b389
inc eax
ror dh, 1
inc eax
not dh
rol word [esp + 8], 0x41
jno 0x100d8ebd
call fcn.100e44fc
jmp 0x100d8ef7
push edx
into
jmp 0xb0b1ee5f
adc edi, 1
xor cl, bl
sub cl, 0xb3
neg cl
dec cl
jmp 0x100cf976
lea esp, [esp + 0x10]
jb fcn.100fc58f
add byte [eax], al
add byte [esp + ebp*2 + 0x73], dl
inc edi
je 0x10100c2d
popal
insb byte es:[edi], dx
jne 0x10100c40
add byte [ecx + 0x27d1d101], bh
lodsd eax, dword [esi]
sub dword [ebp - 0x4df1c28b], ebx
pop edx
inc esi
fadd dword [edx - 0x3a]
invalid
std
popfd
sbb edx, esi
dec ecx
mov ah, 0xbc
call 0xe6db6c3e
outsd dx, dword [esi]
dec edi
jmp 0x10100c63
xor esp, dword [ebx]
xor edi, dword [ebx]
int 0x6b
ret
invalid
jb 0x10100bc3

Function at 0x100fbb37
Capabilities:
Encode data using base64

Disassembly:
rol byte [esp + 0xb], 0x61
inc esp
or bh, al
inc bp
mov dword [esi], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100fbd17
Capabilities:
Encode data using base64

Disassembly:
push eax
neg dl
push eax
call fcn.100d0b6d
push edi
insb byte es:[edi], dx
jns 0x100fbd3f
mov cl, 0xcb
add ebx, esp
bound esi, qword [eax + 0x22]
dec ecx
mov ebp, dword [esi]
inc ecx
mov ebx, 0x501f010
dec ebp
mov ebx, dword [ebx + ebp - 0x501f010]
push 0x65a0a226
dec ebp
mov dword [esi], ebx
mov al, byte [0x1e894d65]
push 0x1b19e337
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x100fc786
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x6220549a
rcr eax, cl
mov dword [ebp], eax
call fcn.1011b07f
inc ecx
mov edi, 0x2524ec13
dec ecx
inc edi
dec edi
lea esp, [edi + edi + 0x61183a4]
dec edi
mov edi, dword [edi + esi - 0x2524ec14]
inc ecx
xor ah, 0xc
inc ecx
sub esp, 0xab1c820
dec edi
mov esp, dword [esi - 0x45a99398]
dec ecx
adc esi, 0x10
call fcn.100d9069
add byte [eax], al
inc edi
je 0x100fc822
popal
jae 0x100fc84d
inc ebp
jb 0x100fc84e
outsd dx, dword [esi]
jb 0x100fc7df
clc
adc eax, 0xf701aa8b
or ebp, dword [edx]
sar dword [eax + 0x50de5b08], 0x84
mov cl, 0x56
and eax, 0xdb09aa93
cmp ecx, dword [ebp + ecx*4 - 0x2eba6167]
aad 0xa0
and dword [ecx], edi
out dx, al
push cs
dec esi
imul esi, dword [edx + 0x2d], 0xb37db80c
shr ah, 1
jl 0x100fc86d
stosb byte es:[edi], al
inc esp
inc esi
dec edi
inc edx
das
sbb al, 0xb6
test al, 0x54
mov ecx, 0x2f2adc34
fsub dword [ecx + 0x5dc74211]
test edx, eax
or edx, dword [esi - 6]
movsd dword es:[edi], dword [esi]
and al, 0xee
push es
adc eax, ebp
imul edi, dword [ecx - 0x66ce7c3d], 0x2831aff0
inc edx
mov fs, word [eax + 0x7b]
mov byte [0x7e656046], al
and dword [esp + edi*4], edx
pushal
jnp 0x100fc7f2
inc esi
pushal
jle 0x100fc876
adc al, 0xbc
mov bh, 0x83
dec esi
test al, 0x90
jns 0x100fc85a
cmp al, 0x90
inc ebx
pop esi
out 0x4f, al
div dword [ecx]
push ss
invalid
xchg edx, eax
int1
and al, 7
sub esi, 0xf245a17f
xchg ebx, eax
xchg ebx, eax
push eax
dec ebp
pavgb mm4, qword [edx + 0x246edaa1]
jmp 0xa653ed1c
Function at 0x100fd102
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov dword [esi], eax
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x101028b2
Capabilities:
Encode data using base64

Disassembly:
retf 0x203b
call fcn.100b76dd
sal byte [edx - 0x7e], cl
scasb al, byte es:[edi]
adc dl, bh
jle 0x1010288d
jb 0x1010291b
mov ebp, 0x5dd36545
mov eax, dword [0xd2019949]
mov byte [ebp - 0x735ca609], 0x56
or edi, dword [ebx]
inc esi
clc
add esi, dword [ebx - 0x623d34e4]
pop ecx
cmp esi, ebp
dec ebp
sbb dl, byte [esp + ebp*2 + 0x653c94ab]
dec dword [edx + 0x62]
push es
add esi, dword [edi - 0x1c55c642]
imul edi, edi, 0x7a
push cs
jmp esp

Function at 0x1010476e
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, 0xe18a3d99
pushfd
neg esi
mov dword [esp + 8], 0x5ef46e8e
mov esi, dword [esp + 4]
jge 0x1010e45b
jne 0x1011bf14
jae 0x1010476f
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10117392
inc ecx
mov edi, 0x1e9f49bc
dec esi
lea edi, [edi*2 - 0x5976ea6f]
call fcn.101322e3
dec ecx
adc esi, 0xa
mov word [eax], si
jmp fcn.100da766

Function at 0x10106227
Capabilities:
Encode data using base64

Disassembly:
add ebp, 2
not di
not dx
push 0x4389cc01
or di, dx
call fcn.100d3687
inc cx
mov dword [esi], eax
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x1010d1a8
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 0x10], 0xde36e522
dec ebp
mov dword [esi], edi
push 0x3a87ae02
dec eax
lea esp, [esp + 0x20]
jmp fcn.100da766

Function at 0x1010dd0c
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766
inc ecx
mov dword [esi], esi
jmp 0x100f9666

Function at 0x10113a4b
Capabilities:
Encode data using base64

Disassembly:
shr bl, cl
inc cx
mov dword [esi], ebx
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x10115588
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor cl, bl
dec eax
lea ebx, [esp + ebx + 0x20]
push 0x2c1e2085
inc esp
mov dword [ebx], esp
dec eax
lea esp, [esp + 0x28]
jmp fcn.100da766

Function at 0x10116ad6
Capabilities:
Encode data using base64

Disassembly:
add di, ax
inc cx
mov dword [esi], edi
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x1011bf0a
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x28]
jmp fcn.100da766

Function at 0x1011cb77
Capabilities:
Encode data using base64

Disassembly:
inc ecx
neg ah
push 0x1b22c5b8
inc ecx
inc ah
inc ebp
xor cl, ah
dec eax
rol dword [esp], 0xed
dec esi
lea esp, [esp + 0x18]
dec ecx
mov dword [esp], ebx
call fcn.10138543
inc ecx
ror ah, 1
inc ecx
add ah, 0x3a
jmp 0x100ce00a

Function at 0x1011de71
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x76392da7
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x101214be
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov dword [esi], eax
dec eax
mov dword [esp], 0xd701cea3
dec eax
lea esp, [esp + 8]
jmp fcn.100da766

Function at 0x1012955c
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 2
inc eax
shr ch, cl
inc cx
mov dword [esi], ebp
dec eax
lea esp, [esp + 8]
jmp fcn.100da766
Function at 0x1012a346
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + esi*4 - 0x6bcb3768]
mov dword [esp + 8], 0xa1272abf
call fcn.100e7404

Function at 0x1012bd71
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi], edi
push 0xea3b2181
dec eax
lea esp, [esp + 8]
jmp fcn.100da766
mov dword [ebp], edi
push 0x36b84085
call fcn.100ffcf3
call fcn.10113a4b
mov edx, 0x46d5bc34
mov ah, byte [eax + 0x4b]
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x7f912a3b]
mov edi, dword [esi - 0x7427b3a7]
push cs
loopne 0x1012bdae
imul esi, dword [esi + 0x4d1a978d], 0xb3a859d9
xor dword [edi - 0x3d505d55], esp
xor eax, 0xc570b273
or ebx, dword [ebx - 0x781cd256]
lodsb al, byte [esi]
shl dword [eax + 0x4a9059c3], cl
lds ecx, [ebx]
wait
stosb byte es:[edi], al
sub eax, 0xd3ac87e3
mov al, byte [0x4a9059c3]
shl dword [edi - 8], 0x4a
mov al, bh
or byte [ebx], ch
lodsd eax, dword [esi]
enter 0xffffffffffff8d5f, 0x6d
jbe 0x1012bd56
cwde
push cs
cmp eax, 0x9ba24698
js 0x1012be25
rol dword [esi - 0x80], 1
cmpsd dword [esi], dword es:[edi]
iretd
lodsd eax, dword [esi]
mov cl, 0x96
and dh, bh
jle 0x1012be81
push ebx
jns 0x1012be6a
push 0x3fc6eca1
int1
mov dword [0x2faeb2e0], eax
push ebx
and ebp, dword [edi]
popal
dec eax
out 0x9a, eax
out dx, eax
mov ebp, 0xac4b2fbd
frstor dword [eax]
adc cl, byte [edi - 0x69]
xchg edi, eax
mov dword ss:[0x5de21bd], eax
mov byte [0x1999545d], al
adc dword [edx + eax*2 + 0x5e], ebx
xor byte [ebx - 0x2f], dl
das
and byte [ecx + ebx], 0xef
xchg edi, eax
dec ecx
pop esp
inc edx
ficom word [ecx]
and byte [edi - 0x5e862e25], ch
insd dword es:[edi], dx
pop esi
mov ebx, 0xe85f5afe
hlt
int 0xfc
loopne 0x1012be4c
sbb dword [ebx + 0x63], 0xffffffa3
mov ebp, 0x19a70ea1
invalid

Function at 0x1012c2e8
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add esi, 8
dec eax
mov dword [esp], 0x2b50c2c
dec esp
add ebx, ecx
dec ebp
mov dword [esi], ebx
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766

Function at 0x1012d972
Capabilities:
Encode data using base64

Disassembly:
mov esp, esi
mov eax, 0xdf82e689
pop ebp
sar ax, 0x6e
lea edi, [eax*2 + 0x6b076b1c]
pop edx
call fcn.100bf421

Function at 0x101322e3
Capabilities:
Encode data using base64

Disassembly:
dec ebx
mov esi, dword [edi + esi + 0x1c3856f7]
inc di
mov edi, dword [edi + esi + 0x1c3856ff]
push 0xff25152b
dec eax
mov dword [esp + 8], 0xe0bd6607
dec ecx
add esi, 0xa
inc sp
mov dword [esi], edi
push 0x590dfa9a
mov byte [esp + 1], 0xb2
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x1013323b
Capabilities:
Encode data using base64

Disassembly:
push 0xed9d713d
dec eax
lea esp, [esp + 0x28]
jmp fcn.100da766

Function at 0x10135b9a
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x28]
jmp fcn.100da766

Function at 0x10139aff
Capabilities:
Encode data using base64

Disassembly:
inc cx
mov dword [esi], edx
dec eax
lea esp, [esp + 0x18]
jmp fcn.100da766

Function at 0x1013cbe8
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x28]
jmp fcn.100da766
jmp 0x100c8b93
Function at 0x1013fff8
Capabilities:
Encode data using base64

Disassembly:
inc bp
mov dword [esi], esp
dec eax
lea esp, [esp + 0x10]
jmp fcn.100da766
jmp 0x100cc442