joyce8/EMBER2024-capa huggingface dataset:
Function at 0xab40b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xab4200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xab40d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab40c2
add dl, dl
jne 0xab40e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab4134
xor eax, eax
add dl, dl
jne 0xab40ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xab41d5
add dl, dl
jne 0xab40fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab4108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab4113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab411e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xab412a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xab40cd
mov eax, 1
add dl, dl
jne 0xab4142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xab414d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab4139
sub eax, ebx
mov ebx, 1
jne 0xab4180
mov ecx, 1
add dl, dl
jne 0xab4166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xab4171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab415d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab40cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xab4197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xab41a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xab418e
cmp eax, 0x7d00
jae 0xab41c5
cmp eax, 0x500
jb 0xab41c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab40cd
cmp eax, 0x7f
ja 0xab41c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xab40cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xab41f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xab40cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, reloc.untfs.dll_Recover
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10acff2b
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [eax + ebp - 0x3b19e508]
mov edx, dword [ebp + eax - 0x3b19e504]
movzx ecx, ax
dec al
rol ecx, 0xd8
xor edx, ebx
sal ecx, cl
bswap edx
mov dword [esp + eax - 0x3b19e503], 0x6a957a30
ror al, 0x21
lea eax, [eax + ecx*8 + 0x5420c682]
sbb edx, 0x73a46d80
neg edx
shr byte [esp + 3], 0x42
pop ecx
lea edx, [edx + ecx*8 - 0x516416b]
sar ecx, cl
shl ecx, cl
adc eax, ecx
xor ebx, edx
sar ecx, 0xa6
ror eax, 0xbb
cbw
adc esi, edx
shl cl, 0xa3
adc al, ch
movzx edx, cx
mov ecx, dword [eax + edi - 0x3b72ff1c]
imul eax
sal al, 0x41
push edx
lea edi, [edi + eax - 0x1b28cb1c]
lea ebp, [edx + ebp - 0xdce3540]
push edx
movzx eax, byte [ebp + eax*2 - 0x36519640]
xor al, bl
not al
xchg dword [esp + edx - 0xdce353b], edx
call fcn.10e27724
lds edi, [0x31fb5543]
sub dword [edi], 0x337c61c0
lcall 0xff09, 0xebcd861c
in al, 0x8d
lodsb al, byte [esi]
sub al, al
retf 0xf231
int 0xeb
or edi, edi
insb byte es:[edi], dx
xor eax, 0x83e182cc
fmul dword [ebx]
mov ah, 0x77
outsd dx, dword [esi]
jl 0x10acff9e
pop eax
sbb eax, 0x1e6cda12
mov edi, 0x42486539
adc byte [esi], 0x80
xchg ebp, eax
fdiv dword [ecx + edi*2 - 0x2a7d2e91]
adc eax, 0xad874224
or byte [edx], bh
inc eax
movsd dword es:[edi], dword [esi]
mov dh, 0xbd
inc ebx
ja 0x10acffce
test byte [ebx - 0x320c9f8f], ah
ret 0x39bc

Function at 0x10afd543
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + ecx*8 + 0x4994785]
mov word [edi + ecx - 0x205a0ff], ax
mov dword [esp + ecx - 0x205a0ff], 0x42987732
sub dword [esp + ecx*2 - 0x40b41fe], 0x91a5dead
lea esi, [esi + ecx - 0x205a103]
adc edx, ecx
movsx eax, cl
and edx, edx
mov ecx, dword [ecx + esi - 0x205a0ff]
dec dl
shr al, 0x47
xor ecx, ebx
idiv byte [esp + edx*4 - 0x634645ec]
neg dword [esp + edx*2 - 0x31a322f6]
dec ecx
sub al, byte [esp + edx*2 - 0x31a322f3]
sal edx, 0xee
not ecx
ror byte [esp + edx - 0x645ec000], 0xe2
jb 0x10cdbd82

Function at 0x10b01b81
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x74134ca4
mov dword [esp + 4], 0x38254799
inc ecx
xor edx, 0x4f8dac93
shr dword [esp + 0xc], 0x7b
push 0x3858d23
sar byte [esp + 7], 0x21
dec eax
lea esp, [esp + 0x14]
jne 0x10ac71e7
mov ecx, 0xa13b54ab
rol cl, 0xe2
mov eax, ecx
pop edi

Function at 0x10b35179
Capabilities:
Authenticate hmac

Disassembly:
ror eax, 3
xchg dword [esp + ecx - 0x800aff8], ecx
btr ecx, 0x8f
lea eax, [eax + edx*2 - 0x663f14b7]
jae 0x10b82367
pop ecx
add ecx, 0x94cbd
jmp ecx
Function at 0x10b4ccb1
Capabilities:
Authenticate hmac

Disassembly:
mul ecx
not word [esp + 9]
mov dword [ebp], edx
call fcn.11771ceb
mov eax, 0x343abf14
mov ecx, 0x23b2999e
mov eax, dword [ebp + eax - 0x343abf14]
lea ebp, [ebp + ecx*2 - 0x47653338]
neg ecx
xor eax, ebx
not ecx
inc eax
bswap eax
mov edx, 0x691d2e84
sub eax, 0x85a88585
sal dl, 0xe2
sal cl, 0xc1
neg eax
btc ecx, 0x1b
xor ebx, eax
push edx
ror byte [esp + ecx - 0x2bb29939], 0xa1
jae 0x10becb21
adc edi, eax
not ecx
movzx eax, byte [esp + edx - 0x691d2e10]
xadd eax, ecx
mov dx, word [esi + ecx - 0x10]
mov cl, byte [esi + ecx*4 - 0x3e]
push eax
lea eax, [eax + 0x11a8c712]
not dword [esp + 3]
adc esi, 2
dec al
shl dx, cl
add byte [esp + 3], ah
xor byte [esp + 1], 0x8f
mov word [esi], dx
movzx edx, ax
jl 0x10c3fcb0
or byte [ebp - 0x50246926], bh
dec edx
or byte [ecx - 0x12], dl
mov dh, 0x3d
mov ah, 0x25
xchg edx, eax
push ds
movsb byte es:[edi], byte [esi]
out 0x9b, eax
das
test al, 0xfa
rcl byte [esi - 0x5a], 0x28
test bh, dh
nop
cld
push ebx
mov esp, 0x9151f6ca
lcall 0x59f1, 0xa044bb5c
shr ah, 0x44
or edi, esi
dec ebp
in eax, 0x54
or eax, 0xc68dda43
arpl word [edx + 0x74], cx
cmp eax, 0xa801622d
jmp 0x10becb86
retf 0x51f6
Function at 0x10b5ec7b
Capabilities:
Encode data using xor

Disassembly:
xor dl, bl
inc ecx
btc cx, cx
neg cl
neg dl
mov dword [esp + ecx - 0x6ea5bc73], ecx
rol dl, 1
neg dl
shr ecx, cl
sbb ecx, ecx
lea ecx, [ecx + ecx*4 - 0x3e550478]
ror dl, 1
xor bl, dl
call fcn.10c187f5
jmp 0x10e28208
mov ecx, 0xa49ba414
movsb byte es:[edi], byte [esi]
mov edx, esi
sub esi, 4
movsx eax, cx
mov dword [esi], edx
movsx edx, ax
xchg ecx, eax
sub ebp, 4
xchg dl, cl
mov edx, dword [ebp]
xor edx, ebx
dec cl
je 0x10e0b1e4
sub edx, 0x3f82e809
or eax, eax
lea ecx, [eax*4 + 0x75399d0b]
call fcn.10a5398e
inc ebp
or dl, 0xe8
mov al, 0xc5
dec ecx
fimul word [eax]
push edx
jecxz 0x10e2820f
das
neg dword [0xcc24bfd1]
enter 0xffffffffffff8b2d, 0xffffffffffffffdb
shr byte [eax - 0x40], 1
adc al, 0x35
pop ss
inc ecx
test bh, 0x35
mov bh, 0x90
fidiv word [esi]
rcl byte [esi - 0x99abee9], 0xcf
xor eax, 0x36de90b7
pop ss
cmp ch, byte [ebx]
or dword [ebp - 0x25], 0xf897197e
and cl, byte [esp + ecx - 0x3f]
lahf
jns 0x10e28262
and eax, 0x55ca8188
pushal
dec edx
jae 0x10e282f4
je 0x10e2820c
xor dword [ebp + 0x37], 0xf87f0687
jne 0x10e282c4
xchg dword [esi], eax
jg 0x10e28289
dec eax
adc al, 0x99
push edi
jmp 0x10e282f5
out 0xb0, eax
cmpsd dword [esi], dword es:[edi]
ljmp 0x9eb4
ja 0x10e2828a
xchg esp, eax
jle 0x10e28356
nop dword [ecx - 0x20]
or al, 0xb8
sub eax, 0xfe565559
mov dh, 0x57
outsb dx, byte [esi]
jp 0x10e28370
hlt
imul ebx, dword [ecx], 0x17
lea ebx, [eax - 0x4a]
xchg ecx, eax
and bh, byte [edx + 0x14]
add al, 0xbe
cmpsd dword [esi], dword es:[edi]
jbe 0x10e28361
dec eax
loop 0x10e28318
xlatb
fbstp tbyte [ebp + 0x591d1888]
xacquire xchg dword [edx], eax
int3
int3
mov ecx, 0xa90ac020
fst qword [esi + edx - 0x6d60eec5]
xchg edx, eax
adc dh, byte [ebp + 0x13a8cfd0]
jg 0x10e2830a
mov dl, dh
add byte [edx + edi*8 - 0x36], bh
jo 0x10e28384
pop es
push edx
pop esi
dec esp
jae 0x10e28327
leave
jnp 0x10e283d4
ror byte [edx], 1
xchg ebp, eax
jge 0x10e283d2
xor al, byte [edx - 0x5d38e71d]
ror ebp, cl
not dword [si - 0x72c7]
mov byte [edi + 0x1c], dl
and ch, byte [ecx - 0x1c]
rcr byte [eax + eax*4], 0xe0
mov ch, 0x4e
sti
xchg edi, eax
mov edi, 0xc7df5b7b
mov ecx, 0x85aaa408
sbb byte [eax + 0x12af36c3], dl
test ebp, 0x7a0b0c81
jns 0x10e2836c
invalid
xor bl, byte [ebp + ebx*8 + 0x7fba2e7b]
and ah, byte [edi + edi]
push 0xf3769a70
xchg esi, eax
adc dword [edx - 0x6d54e812], edx
rcl ch, cl
test al, 0xea
lodsd eax, dword [esi]
pop edx
rcl byte [esi - 0x50], 0x69
mov al, 0x69
xchg ebx, eax
xchg edi, eax
adc dword [ebp + 0x68ebf7bc], ecx
adc al, 0x65
invalid
Function at 0x10b60d71
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
je 0x10c29f77
mov eax, 0xeb3abb26
bt eax, eax
setb al
mov eax, dword [ebp + ebx*4]
push 0xea01b626
shl dword [esp], 0x27
sar dword [esp], 0x3e
mov dword [esp], eax
jae 0x10df1295
mov eax, 0x60098e81
not eax
mov eax, dword [ebp]
call eax
mov ecx, 0xdebe6e2c
jmp 0x10d65f42
lea ecx, [ecx + edx - 0x6ff611e5]
bswap ecx
and edx, 0x53113020
xor ecx, 0x852ee40d
sub ecx, 0x86a5bc07
sar edx, 0x46
movzx eax, dl
xor ebx, ecx
add esi, ecx
call fcn.10b74dec
mov edx, dword [edi]
mov eax, 0xc1d1c2a
mov cl, byte [eax + edi - 0xc1d1c26]
sal al, 0x86
bswap eax
xor ax, ax
adc edi, 2
or al, al
push eax
shl edx, cl
xadd byte [esp + 2], al
mov dword [edi], edx
sbb esi, 4
lea ecx, [eax*4 - 0x50f93a74]
rol al, 0x41
mov ecx, dword [esi]
xor al, 6
xor ecx, ebx
movzx edx, al
dec ecx
dec eax
cwde
bswap ecx
cwde
pop edx
sar dl, 0x62
lea ecx, [ecx + edx*2 - 0x3926b6c5]
bswap ecx
sbb eax, 0xe8abd1b5
div al
not dx
xor ebx, ecx
ror edx, 0x5e
not edx
adc ebp, ecx
jmp ebp
lea edi, [ecx + ecx + 0x211b83f]
mov ebp, dword [ebp - 4]
imul cx, cx
bt ecx, edi
imul di, cx
mov dword [ebp], eax
mov esi, ebp
rol ecx, 0xa1
mov edx, ecx
pop ebx
seto cl
movsx eax, cl
dec eax
pop edi
pop ebp
call fcn.10deab16
mov ecx, 0x7126b486
lea edi, [edi + ecx - 0x7126b48a]
movzx edx, cx
mov ecx, dword [edi + edx - 0xb486]
xor ecx, ebx
lea edx, [edx*4 - 0x65e2f3f4]
jmp 0x10d0273b
call fcn.10c29f64
sar eax, 0x70
sub eax, 0x8ab3c21e
xor dl, 0xb8
and al, al
rol dl, 1
sar eax, 0xb
adc eax, 0xccb9fd04
ja 0x10b3b118
Function at 0x10b68a68
Capabilities:
Encode data using base64

Disassembly:
and dx, ax
neg ecx
div eax
xor ebx, ecx
call fcn.10d4e230
jmp 0x10e0e036
lea esi, [esi + edx*4 - 0x7618fffe]
mov word [esi + edx - 0x1d864000], ax
movzx eax, dl
bts edx, edx
mov ecx, dword [ebp + edx - 0x1d864001]
add eax, 0xa91f45b4
lea ebp, [ebp + edx - 0x1d863ffd]
sal dx, 0x43
shl edx, 0x47
xor ecx, ebx
bts eax, eax
setae dl
sbb ecx, 0x25a1689d
ror ecx, 3
neg al
jnp 0x11766dca
xor ebx, ecx
add esi, ecx
mov ecx, 0x26266525
sal dl, 0xa2
pop eax
pop ecx
pop eax
jae fcn.10b4c515
mov dword [eax + esi - 0x7d59d9b6], edx
call fcn.11784b64
ror byte [edx + 0x47bf7993], cl
push ecx
pop dword [eax + 0x751e3f8e]
mov edi, 0x202f3bf8
xchg ebx, eax
jo 0x10b68a20
add edx, dword [esi - 0x6bcf4200]
adc byte [edi], al
jmp 0x10b68b1c
scasb al, byte es:[edi]
xor eax, dword [ebp - 0x11]
adc al, 0x8c
call 0x1ae48b87
out dx, eax
dec ebx
push eax
xchg edx, eax
invalid
jno 0x10b68b23
xchg edx, eax
pop edx
call 0xce230947
add dh, al
jge 0x10b68b97
jle 0x10b68b91
mov ebp, 0x6d7df002
pushfd
cmp al, 0xba
dec edi
xchg edx, eax
push ebp
mov byte [0x85576db1], al
jmp 0x10b68ad9
adc byte [eax - 0x20cc38c4], ch
push 0xd940c0a1
leave
pop esi
lodsb al, byte [esi]
xor byte [edi], ch
scasb al, byte es:[edi]
inc esi
cmp byte [edi + 0x67], bh
fimul word [ecx]
ret 0x1940
mov ecx, 0x22855f12
lea edi, [ecx + edi - 0x22855f16]
movsx eax, cx
mov ecx, dword [edi + eax*4 - 0x17c48]
lea edx, [eax*2 - 0x485060f4]
sar dx, 0x41
ror ax, 0x49
xor ecx, ebx
dec ecx
neg dx
mul edx
and edx, edx
bswap ecx
btr eax, 0x24
call fcn.10d2682a
sub edi, 4
mov ecx, 0xdd0c9a83
movsx edx, cx
mov eax, dword [edi]
xor eax, ebx
not eax
or cx, dx
shl ecx, 0xfb
and cl, 0x91
bswap eax
sal dx, 0x21
sbb edx, 0x321b6499
ror eax, 3
shl ecx, 0x9b
ja 0x10d5c101
bswap eax
shl dx, 0xad
add cl, dh
lea edx, [edx*4 + 0x5dbfb29c]
neg eax
bt edx, ecx
xor ebx, eax
imul cx, dx
lea ecx, [edx + edx*2 - 0x7a7aa27a]
add esi, eax
ror cx, 0x82
movsx eax, cl
mov ax, word [ebp + eax*4 - 0x158]
inc cx
ror cx, 0x2a
shr ecx, 1
mov cx, word [ebp + ecx*2 - 0x456e55e4]
adc ebp, 1
btr edx, edx
add ax, cx
lea ecx, [edx + edx - 0xe65055a]
sar edx, 0x57
mov word [ebp], ax
jmp esi
ror edx, 0xf9
neg ecx
shr dx, 0x28
shr eax, 0x41
xor ecx, 0xe98c929
bswap edx
inc ecx
jmp 0x10ad4eb9
Function at 0x10b70c88
Capabilities:
Authenticate hmac

Disassembly:
imul eax, eax
call fcn.10c9eccb
leave
push edi
sub dword [esi], 0xffffffb7
adc byte [esi], cl
scasd eax, dword es:[edi]
shr al, 0xba
pop ds
adc eax, 0x8357c900
mov bh, 0x10
push cs
sub al, 0x36
std
loope 0x10b4cd32
ja 0x10b4cd0a
xchg ebx, eax
and byte [edx - 0x45], dh
pop edx
rcr dword [edx + 0x29], 0x5c
or eax, 0xb9993270
mov byte [esi + 0x6e], bh
lcall 0x34d0, 0xa17f87d6
lodsb al, byte [esi]
xchg dword [edi - 0x5f], edi
sal byte [esp + ebp*4], 1
mov ch, 0xbc
out 0x83, al
je 0x10b4cdaf
invalid
rep movsb byte es:[edi], byte [esi]
stc
loope 0x10b4ce01
pop ebx
out dx, eax
ror dword [edx + 0x21], 1
jp 0x10b4ce0c
je 0x10b4cdd1
jae 0x10b4ce00
mov dword fs:[esi + 0x5dcb5ae], edx
test al, 0x3a
cdq
dec esp
fadd qword [0x2e993aa8]
dec esp
xchg byte [eax], dl
sbb eax, 0xa861350f
out dx, eax
test al, 0xef
jl 0x10b4cdc4
rol dword [esi - 0x5611c8df], cl
or dword [ebp + 0x11], 0x7c727caa
push ss
mov cl, 0x98
xor al, 0x2b
inc ebx
out 0xda, al
add al, 0xd0
add byte [edi], 0x5a
or dword [esi], edx
push ebx
and al, 0x87
mov ss, word [ebx]
fild dword [ebp + 0x431f1983]
pop ebp
xchg esi, eax
xor dword [ecx - 0x11], edi
out dx, eax
or edi, dword [edx + ecx*2]
pop eax
inc ebx
or eax, 0xa4f38f0c
salc
into
leave
dec ecx
cmp edi, esi
mov byte [edi], ch
or eax, dword [esi + ebp*4 - 0x75c65883]
jg 0x10b4ce4e
pop eax
enter 0x6f74, 7
rcr byte [0x1b571aeb], cl
retf 0x4633
xchg ecx, eax
mov dword [0x6eea886b], eax
xchg byte [eax + 0x58c7cb13], ah
invalid
fldenv [esi + 0x2f94f989]
mov ebp, dword [ebp + 0x7f]
dec edx
push ecx
inc ebp
mov edx, ecx
dec edi
mov edx, 0x81b43267
fst st(2)
lea ebp, [edi]
loopne 0x10b4ce97
inc edi
jge 0x10b4cebb
sar byte [esi - 0x1c], 1
inc ebx
sub edi, dword [ebx + 0x28]
rol dword [ecx + 0x55], 1
aas
fisubr word [esi - 0x717d8584]
test ebp, ecx
cmc
sub eax, 0xcf46963c
jecxz 0x10b4ce37
jmp 0xe51ba647
ret
adc al, bh
shr dword [ebx + 0xb], 1
sub eax, 0x102e404a
mov ch, 0
jl 0x10b4ce75
in al, 0xdc
jmp 0xf995dfcf
lea eax, [ecx + ecx - 0x2efc0ada]
movzx edx, cx
mov eax, dword [edx + ebp - 0x1491]
shl dl, 0x66
je 0x10c958f1
dec edx
lea ebp, [ebp + edx*2 - 0x287a]
sub ecx, 0x8d282794
mov dword [esp + edx*4 - 0x50fc], ecx
adc cx, dx
xor eax, ebx
shl dword [esp + edx - 0x1437], 0xdf
shr cx, 0x85
not dx
dec eax
btc cx, 0x2d
ror eax, 2
lea eax, [eax + edx*2 + 0x79037d28]
btc dx, dx
not edx
neg eax
xor ebx, eax
shr cx, cl
xor edx, dword [esp + 8]
adc edi, eax
mov dword [esp + edx - 0x7fff143e], edi
ret 8
not al
xor ebx, ecx
jmp 0x10b4cd09
Function at 0x10b9fbe0
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx esi, bl
bswap ebp
dec eax
mov dword [esp + ebx - 0x20205792], ecx
and cx, si
dec eax
sub dword [esp + ebx - 0x20205792], ebx
ror ebp, 1
bswap ebp
dec ecx
dec ebp
sub byte [esp + ebx*2 - 0x4040af1e], 0xb7
dec esp
mov dword [esp + ebx - 0x20205792], edx
movzx edx, cx
ja 0x10b53c2e
mov edx, edi
sub edi, 2
mov word [edi], dx
sub ebp, 4
mov edx, 0x402b3e26
mov ecx, dword [edx + ebp - 0x402b3e26]
xor dl, dl
and edx, edx
ror dx, 0x43
xor ecx, ebx
dec ecx
lea eax, [edx + edx*8 + 0x128bf3b7]
dec dl
neg ecx
and edx, eax
dec ecx
neg ecx
dec ax
not ax
xor ebx, ecx
and al, 0x95
sbb ax, dx
adc esi, ecx
mov ecx, eax
jmp fcn.10c088fe

Function at 0x10ba6b22
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], 0x82838989
call fcn.11768d5c
sub ebp, 1
push 0x59a9c284
pop ecx
movzx edx, byte [ecx + ebp - 0x59a9c284]
mov eax, 0x2d3de924
or al, ah
xor dl, bl
imul ecx, eax
btc ecx, ecx
xor dl, 0x2f
add dl, 0xbc
and cl, 0xab
ror dl, 1
not dl
sub dl, 0x86
push eax
shr cx, 0xe9
xor bl, dl
bts ecx, ecx
pop eax
add edx, esp
and ecx, eax
shl eax, 0xc1
sub ecx, eax
mov cx, word [eax + edx - 0x5a7bd3da]
sar eax, 0x27
bt eax, eax
mov edx, 0x1c8ea1a4
lea edi, [edi + eax - 0xb4f7a9]
or eax, 0x3931b2a
ror edx, 0xee
xadd dx, ax
mov word [edi + eax*2 - 0x76ee474], cx
mul edx
and eax, 0x16b0720e
bt dx, 2
lea ebp, [ebp + eax*2 - 0x20002018]
lea eax, [eax + edx*8 + 0x3d9209b1]
movsx ecx, dx
btr cx, ax
mov edx, dword [edx + ebp - 0x1f41ea1]
shl al, 0x44
sub ax, ax
xor edx, ebx
bswap edx
sar eax, 0x98
shr al, 0xe1
dec ecx
dec edx
neg cx
not edx
or cl, 0xb8
sbb edx, 0x93b5943d
ror ax, 0xe1
not ecx
rol edx, 2
xor ebx, edx
sar cx, 2
add esi, edx
mov edx, ecx
cwd
neg ecx
jg fcn.10c088fe

Function at 0x10bae4a3
Capabilities:
Execute syscall

Disassembly:
adc edi, ecx
inc eax
movsx ecx, al
pop edx
pop eax
jg fcn.10b2e837
mov eax, 0x779d3c3c
lea edi, [edi + eax - 0x779d3c38]
xor edx, ebx
cbw
lea eax, [eax*4 + 0x2bbe88ae]
mov dword [esp + eax - 0xa32899e], eax
ror edx, 3
lea edx, [eax + edx + 0x6bf19a04]
or al, al
xor edx, 0x1927f1be
shr al, 0xe1
xor eax, eax
dec ax
not edx
dec edx
bt ax, ax
ror edx, 3
call fcn.10ad9d4b
syscall
inc ecx
push ebp
pushfd
dec ecx
mov ebp, 0xda0dff1a
or ebp, dword [ebx + 0x2f]
mov byte [0x4ced854d], al
mov ebp, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xff941384
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.10c6db11

Function at 0x10bae8ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
ja 0x10b25a23
mov dword [esp], 0xe530af96
mov dword [esp], eax
dec ebx
jmp 0x10cf2f7e
push 0x52303233
push 0x1b377abf
lea esp, [esp + 8]
jne 0x10d91320

Function at 0x10bcb54e
Capabilities:
Authenticate hmac

Disassembly:
and al, 0x29
mov edx, dword [edi]
mov ecx, eax
xor ecx, ecx
lea edi, [edi + ecx*2 + 4]
ja 0x10c26360
xor edx, ebx
bswap ecx
push eax
mov dword [esp + ecx + 4], eax
ror edx, 3
push eax
bswap eax
lea edx, [ecx + edx + 0x762423a2]
Function at 0x10bffaad
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7431fb0b
sar di, 0xe1
movzx edi, byte [edi + eax - 0x7431fd85]
xor edi, ecx
jmp 0x10c847af
mov edx, dword [eax + ebp - 0x7292c000]
btr eax, eax
not eax
sar eax, 0x6d
mov ax, word ss:[edx]
mov edx, 0x1baebe82
lea ebp, [ebp + edx*4 - 0x6ebafa06]
mov word [ebp + edx*4 - 0x6ebafa08], ax
jne 0x10c17b36
dec edx
push 0x8c93bbb2
lea esp, [esp + 0x20]
jne 0x10a5e451
pop edi
mov edx, 0xcf1a92b0
shr dl, 0x81
xor edx, edx
not ecx
movzx eax, dl
imul eax, edx
sub dx, dx
mov dword [esi + edx*2], ecx
movsx ecx, dx
adc eax, dword [edi + eax*4]
xadd edx, ecx
dec cx
sal edx, cl
lea edi, [edx + edi + 4]
xadd cl, dh
xor eax, ebx
and cl, dh
adc ecx, 0x988f34aa
ror eax, 3
sar ecx, cl
sar edx, 0x76
push ecx
lea eax, [edx + eax + 0x762423a2]
jns 0x10cfbbeb
mov eax, 0x72923b1f
sal ax, 0xe
jp 0x10bede6e
rol dword [ebx + 0x4ebf6160], cl
mov byte [0x36878097], al
in eax, dx
insd dword es:[edi], dx
mov edi, 0xd3fe51f1
mov esi, dword [eax + 0x53]
xor dh, al
mov es, word [eax]
jg 0x10bffaf8
mov word [eax], ss
invalid
neg edx
mov ecx, dword [edi]
shr dx, 0x4c
movzx eax, dx
adc edi, eax
cdq
xor ecx, ebx
and ax, dx
ror ecx, 3
inc ecx
xchg edx, eax
neg ax
not ecx
cwd
imul al
shr edx, 0xdf
neg ecx
inc ecx
call fcn.10e0e801
mov ecx, 0x8011c796
mov eax, dword [ebp]
movzx edx, cl
shl edx, 0x45
btr edx, edx
mov cl, byte [ebp + edx - 0x12bc]
jb 0x10bd9440
neg edx
xor dl, dh
adc ebp, 6
neg dl
lea edx, [edx + edx*8 - 0x10e8d7df]
neg dl
mov byte es:[eax], cl
mov ecx, edx
sbb edi, 3
movsx eax, dl
mov eax, dword [edi]
push edx
shr edx, 0x6d
xor eax, ebx
lea eax, [eax + edx*4 + 0x33f0a36e]
not eax
rol dx, 0xf
or byte [esp + edx - 0x73c57], dl
ror eax, 2
pop ecx
shl cl, 0x84
neg edx
not eax
xor ecx, edx
xor ebx, eax
ror ecx, 0x71
adc esi, eax
movzx eax, cl
imul eax, ecx
jmp esi
and edi, 0xff
call fcn.10a49f57
xor eax, 0x1927f1be
xadd dword [esp + edx], edx
jne 0x10c77b49
mov ecx, 0x120519a1
mov ecx, dword [ecx + ebp - 0x120519a1]
mov eax, 0x7fb06f2a
mov eax, dword [eax + ebp - 0x7fb06f26]
mov edx, 0xb0a3bd83
dec dx
and edx, edx
adc ebp, 4
not ecx
add edx, 0x8910496
shl dx, 0x2a
not eax
add edx, edx
neg dx
imul edx, edx
and ecx, eax
btr edx, edx
mov dword [ebp + edx*2 - 0x20000000], ecx
rol edx, 0x33
shr dl, 0x43
lea eax, [edx + edx*2 + 0x73326587]
lea edi, [edi + edx*2 - 0x10004]
shr eax, 0xf6
mov eax, dword [edx + edi - 0x8000]
setnp dl
xor eax, ebx
dec edx
movzx ecx, dl
inc cx
rol eax, 1
bswap eax
imul dx, cx
sal cl, 0x25
add ecx, 0x601ca2ac
inc eax
rol cx, cl
call fcn.10b6ce5f
call fcn.117916be