joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48102d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0xff
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
mov ebx, edx
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0xc], ebx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x48112c
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x481143
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.0048102d
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x481143
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.00480e72
test al, al
lea eax, [ebp - 0x228]
je 0x4810de
push ebx
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ebx
push eax
push esi
call fcn.0047fd84
call eax
jmp 0x4810e9
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0x481134
cmp dword [ebp - 0x18], eax
je 0x4810fb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor ecx, ecx
mov dword [ebp - 4], 0xff
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x1c]
jne 0x481077
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 0
je 0x481143
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x48112e
Function at 0x48b669
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4c6f20
push ebx
call fcn.00422f60
push 0x10
push 0
mov esi, 0x4c6f64
push esi
call fcn.00422f60
add esp, 0x18
mov dword [0x4c6f20], 0x44
xor eax, eax
inc eax
mov dword [0x4c6f4c], eax
push esi
push ebx
mov word [0x4c6f50], ax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
pop esi
pop ebx
test eax, eax
je 0x48b6ce
push dword [0x4c6f64]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
ret 4

Function at 0x48b6d2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
mov edi, ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 8], edx
pop esi
cmp dword [ebx + 0x190], eax
je 0x48b788
cmp dword [edi + 0x84], esi
jl 0x48b782
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x48b773
cmp dword [ecx + 4], edx
jne 0x48b773
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x48b770
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [ebx + 0x190]
je 0x48b742
cmp byte [ebx + 0x198], 0
je 0x48b770
cmp dh, 0xff
je 0x48b770
cmp dl, 0xa
je 0x48b770
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x48b770
cmp byte [eax + 0x90], 0x1a
jne 0x48b770
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x48b702
mov eax, dword [ebp + 0xc]
push 3
pop esi
mov dword [ebx + 0x190], eax
cmp dword [edi + 0x84], esi
jl 0x48b815
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x48b806
cmp dword [ecx + 4], edx
jne 0x48b806
cmp byte [ecx + 0x90], 0xb
je 0x48b806
movzx eax, byte [ecx + 0x93]
cmp eax, dword [ebx + 0x190]
jne 0x48b806
test byte [ecx + 0x92], 0x20
jne 0x48b806
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x48b806
cmp byte [eax + 0x90], 0x1a
jne 0x48b806
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x48b794
mov eax, dword [ebp + 0xc]
push 0
push eax
push 0x130c
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48ba67
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp word [eax], di
je 0x48bb81
push edi
push edi
push 3
push edi
push edi
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48ba9e
xor eax, eax
jmp 0x48bbb0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x48bac1
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x48ba97
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x48ba97
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x492cac
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x48ba97
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x48bb5d
cmp dword [ecx], edi
jne 0x48bb5d
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x48bb86
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x48bb9b
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x4ae826a5
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x28ab63f9
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100076a5
Capabilities:
Packed with generic packer

Disassembly:
jae 0x101b0f3f
not edx
push 0x88ae3916
mov dword [esp + 4], 0x14b4e52a
and eax, edx
push 0x578c2b81
pushfd
pop edx
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
jmp loc.1026fa28
push 0x52a353b5
mov word [edx], ax
lea esp, [esp + 0xc]
jp fcn.10118b16
inc dl
xor bl, dl
xor dword [esp], 0x58a7b48f
inc dword [esp]
push 0x440911ac
add byte [eax - 0x54], ch
adc dword [ecx], ecx
inc esp
lea edx, [esp + edx + 8]
jge 0x10210f65
jp 0x10151899
pushal
lodsb al, byte [esi]
sub al, 0x29
mov cl, 0xa8
sbb al, 0x94
push 0xffffffffffffffa0
pop esi
clc
sti
pop edi
or ah, byte [edx - 0x14848e37]
loop 0x101b0f4e
pop ds
retf
push 0x6db93806
lea esp, [esp + 0x10]
jmp fcn.10118b16
Function at 0x10010d10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x10096098]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x10010ddb
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.10029ad0
add esp, 0xc
test eax, eax
jne 0x10010ddb
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.10029ad0
add esp, 0xc
test eax, eax
jne 0x10010ddb
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10010d64
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.10029aa0
add esp, 0xc
test eax, eax
je 0x10010d98
sub eax, esi
push eax
push 0x2e
push esi
call fcn.10029aa0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10010d9a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10010dc6
mov al, byte [esi]
push eax
call fcn.1001e3b0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10010da8
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1005413c
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1005413c
add esp, 0x18
ret
Function at 0x1006c6fb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006c571

Function at 0x1009e10c
Capabilities:
Authenticate hmac

Disassembly:
push 0x8faf3123
mov dword [esp], ebp
mov ebp, 0xe928e88c
pushfd
btc ebp, ebp
xor bp, 0xf51d
push eax
push esi
jne 0x10114662
push ebx
lea esi, [ebp + ebp*2 - 0x3de9cdf]
lea ebp, [esp - 8]
and esi, 0x5e99fd8c
mov dword [esp + esi - 0x16998970], ecx
lea eax, [esi + ebp - 0x16998a74]
push esi
xor esi, 0x23b25607
mov dword [esp + esi - 0x352bdf83], edx
mov esi, dword [esp + esi - 0x352bdf67]
adc esi, 0x78011536
mov edx, 0x768bf7bb
push edx
xor esi, 0x3824fb06
mov ebx, 0xdfb2169c
xor dword [esp + edx - 0x768bf7bb], 0x729a7aa3
inc esi
inc ebx
xor esi, 0xab9ecaa9
mov dword [esp + edx - 0x768bf7bb], ebp
mov ebx, 0
jmp fcn.102513cc
Function at 0x100a3beb
Capabilities:
Execute syscall

Disassembly:
pushfd
add ebp, ebp
jne 0x10260f24
mov eax, dword [esp + 0x10]
bswap ebp
mov bp, 0x2f27
push edx
je 0x1025764b
lea eax, [eax + ebp*2 - 0x686c5e4d]
mov edx, ebp
setbe dl
add edx, ebp
setl dl
call fcn.1015aaa0
syscall
inc ecx
push ecx
pushfd
dec ecx
mov ecx, 0x1a1f1a9b
pop ss
ret

Function at 0x100d0b1e
Capabilities:
Authenticate hmac

Disassembly:
jge 0x100ddcfa
shr byte [esp + 0xc], 0x3c
xor byte [esp + 0xc], 0xbf
shl dword [esp + 0xc], 0x98
xor byte [esp + 0xc], 0xbd
push ecx
lea ebp, [ebp + 1]
jg 0x101d26be
mov ecx, dword [esp + 0x10]
shl ecx, cl
push 0x159272a5
mov dword [esp + 0x1c], ebp
cmp word [esp + 0x14], 0xc38d
js fcn.10105a59
add dword [esp + 8], 0xefeb5636
add dword [esp + 0xc], 0xfff062de
not word [esp]
or dword [esp + 0x14], ecx
mov dword [esp], 0xfb9ba53b
xor dword [esp], 0x14bfb72e
call fcn.10255420

Function at 0x100d5049
Capabilities:
Encode data using xor

Disassembly:
bswap edx
mov dword [esp + 0x1c], 0x60365689
call fcn.100a9d7c
Function at 0x100e3f8f
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + ecx*2 + 0x2ddc959]
setle byte [esp + ecx + 0x2c69c824]
shr dword [esp + ecx*2 + 0x58d39034], 0x39
add dword [esp + ecx + 0x2c69c81c], 0xefeaae5b
not word [esp + ecx + 0x2c69c824]
test cx, 0x67a3
xchg dword [esp + ecx + 0x2c69c82c], edi
mov ecx, dword [esp + ecx + 0x2c69c814]
not dword [esp + 0x14]
call fcn.10196c94
and edi, dword ss:[edx + 0x1485ffc7]
and ebp, dword [ecx]
inc ecx
ficom dword [0x7dec0d47]
pop ecx
xchg ecx, eax
sub ah, byte [edi]
das
dec ebx
lodsb al, byte [esi]
xor dword [ecx - 0x13], ebp
push 0xffffffffffffffd3
push dword [ecx + 0x19a18924]
xchg edx, eax
fdivr qword [esi]
jge 0x100e4072
retf 0x8546
or eax, 0x549e0a6
xor dword [esi - 0x4805f114], ebx
push ebx
cwde
push cs
cmp esi, dword [edi + 0x51]
clc
adc al, 0
mov bh, 0x85
dec edi
cmp bh, byte [esi]
invalid
invalid
cli
out dx, eax
adc esi, edi
adc al, 0x82
mov bh, 0x9b
inc ebp
in al, dx
rcl ah, 0x63
adc ebx, esi
out 0xb2, eax
jnp 0x100e400b
pop ss
and byte [edx], ch
jb 0x100e4023
lcall 0xfc27, 0x4917f094
pop ss
dec ecx
daa
cld
js 0x100e40c1
or byte [0x3bb00800], 0x22
lea esp, cs:[esi]
popfd
shr dword [eax + 0x17], cl
xor eax, 0xf3d356e9
mov edi, 0xb87aa150
sub eax, 0xf237fc70
jecxz 0x100e408d
dec ebx
enter 0x2313, 0xffffffffffffffc5
test byte [edi], bh
jle 0x100e40ea
retf 0xe6b8
or dword [edx], eax
out 0x87, eax
pop es
mov eax, 0xe748f5c0
call dword [edi]
invalid
xchg esp, eax
das
jge 0x100e4107
pop ss
test dl, dh
jb 0x100e415e
fistp qword [edi + 0x721a9ac7]
xlatb
stc
test eax, 0x47942139
dec esi
and al, 0xd5
xor eax, 0x25b07dad
mov al, 0x25
test byte [esi], dh
scasb al, byte es:[edi]
scasb al, byte es:[edi]
adc eax, dword [esi]
jecxz 0x100e411c
fist dword [esi]
sub al, 0x1b
sahf
jle 0x100e4115
inc edi
pop ecx
mov ebp, 0x375fdf4e
fistp word [edi + 0x37]
xchg edx, eax
test al, 0x74
pop edi
pop ebx
cmp al, 0xb9
fistp dword [edi]
mov edi, 0xf60e3bf1
mov dh, 0xfa
or byte [ebx], 0xe9
pop edi
sti
sbb byte [0x9505d165], 0x8d
cmp byte [edi + 0x3481600f], cl
add eax, 0x59fc9414
arpl word [edi + 0x37], bp
mov dword [0x167c8dee], eax
xorps xmm2, xmm7
fld xword [ebx]
fcomp qword [eax + 0x28]
out dx, eax
mov ecx, 0x5da63898
sub ecx, dword [esi + 0x355d51f]
out 0x9e, eax
mov ds, word [edi]
aad 0x55
add esp, edi
sahf
test eax, 0x6f5a282c
pop ebp
jmp 0xe7c62ac2
Function at 0x100ef5d8
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xfff6f1be
cmp byte [esp + ecx + 0x8dd000c], 0x1b
call fcn.1022232d
popfd
rcl al, 1
arpl word [ebx - 0x2a], bp
push edx
mov edi, 0x219c5a0a
mov esp, 0xdc4faee4
and dh, 1
jl 0x100ef647
rol byte [edi + 0x34], 0xa
dec edx
fnstcw word [edx + 0x54]
clc
ja 0x100ef5f4
ret 0x43e
pop esi
push edx
or cl, byte [edi + 0x30]
das
scasd eax, dword es:[edi]
xchg ecx, eax
jo 0x100ef661
or eax, 0xacc1ffbc
mov eax, 0x1d265a47
mov bh, 0xa5
imul edx, dword [ebx - 0x70f5c2a7], 0x9c5e541b
or cl, byte [edi - 0x63a1abe5]
push ebp
arpl word [ecx + 0x271a59ab], ax
loop 0x100ef6bb
jecxz 0x100ef6a4
or ah, dl
call dword [eax + ebx*8 + 0x7ca194fe]
pop ecx
jbe 0x100ef6d4
dec ebx
add al, 0x11
and byte [eax], bh
sbb al, 0xf8
mov byte [0x65ae4a7e], al
adc esi, dword [esi]
pop edx
sub al, 0x85
sal ebp, 0x9a
mov edx, 0x71f3782e
cmp byte gs:[edi + eax], bh
jno 0x100ef6fa
adc byte [esi - 0x21], dh
sti
out dx, eax
adc bl, ah
inc eax
jecxz 0x100ef6e6
push ebp
dec ecx
lodsd eax, dword [esi]
push eax
xor eax, 0xb1622802
mov dword [0xe0426377], eax
invalid
inc ecx
mov ch, 0x50
jp 0x100ef6a9
in eax, dx
xlatb
call dword [ebx]
push cs
hlt
dec esp
dec esi
inc esi
adc al, 0xd8
sub ecx, edi
retf 0x3577
in al, 0x40
and eax, 0x22c6ad67
ja 0x100ef6c2
mov bh, 0xec
or byte [ecx + 0x2662a0db], bl
xchg edx, eax
invalid
xchg ebx, eax
jno 0x100ef6b7
test byte [eax + 0x4c], cl
jns 0x100ef6e1
js 0x100ef74a
mov dh, 0xf2
rcr byte [ecx - 0x3592f01a], 0x17
pop edx
pop edx
or bh, byte [ecx]
int1
lock xor ch, byte [ecx]
cmp dword [ecx + 0x28], 0x5fbddc28
adc al, 0x8c
or dh, byte [ecx + 0x4b]
test eax, 0xd7fba1d6
adc esi, dword [esi]
pushfd
and ebp, dword [ecx + 0x41]
lodsd eax, dword [esi]
sbb byte [edx], 0xc9
fcmovnbe st(0), st(7)
push ebx
sbb ecx, ebx
mov edi, ebx
das
invalid
pop edi
mov al, 0x29
and esi, dword [edx - 0xc841ec]
div dword [esi + 0x3c]
cmp byte [ebx - 0x73], 0xbb
imul eax, dword [edi + 0x4f], 0xffffffec
inc edi
dec edi
in al, dx
and bl, bl
sub eax, 0xb9a1a8aa
sub ah, byte [edx]
mov dword [0x58ae57e9], eax
cmc
dec esp
xchg ebx, eax
das
cmp byte [ebx - 0x36], cl
in al, 0x70
pop ss
loopne 0x100ef739
add ch, byte [esi]
push es
movsd dword es:[edi], dword [esi]
or edx, dword [edi - 0x43]
not dword [ecx + 0x73]
pop ebx
mov esi, edx
pop esp
movsd dword es:[edi], dword [esi]
inc ebx
inc edi
xor ecx, esp
int 0xc5
fadd dword [ebp + ecx*2 + 0x1e1634b2]
sbb al, 3
mov ebp, 0xb31fb244
or eax, 0x9e4ad33d
add ebp, dword fs:[ebp + 0x53a94674]
out dx, eax
test al, 4
int3
Function at 0x100f04a9
Capabilities:
Packed with generic packer

Disassembly:
shl dword [esp + 4], 0xdc
add dword [esp + 8], 0xefdc70bf
xchg dword [esp + 0xc], eax
shl dword [esp + 4], 0xc4
and word [esp + 4], 0xeb23
sub dword [esp + 4], 0x4199478a
mov dword [esp + 8], eax
sub word [esp + 4], 0xdb5
push ebp
neg byte [esp + 8]
mov ebp, dword [esp + 8]
call fcn.101cc7ad
push 0xb50d9ab6
pushfd
sub dword [esp + 4], 0x12863927
jle 0x100ad9ab
jo fcn.101e8633
jle fcn.100b32da
mov word [esp + 0x18], 0xe43e
mov edi, 0x4c24cfa1
shr dword [esp + edi - 0x4c24cf85], 0x3b
mov ebp, dword [esp + 0x30]
shr dword [esp + 0x1c], 0xcf
cmp dword [esp + 0x1c], edx
jbe 0x102222cf
add dword [esp + 0x24], edi
mov edi, dword [esp + 0x14]
and dword [esp + 0x1c], 0xe90f0281
jg 0x1027fe00
jbe 0x100daad0
lea esp, [esp + 0x24]
ret
Function at 0x100f6cbc
Capabilities:
Encode data using xor

Disassembly:
adc byte [edx + 0xa0e1552], cl
retf 0x5a9c
pushfd
pop ecx
mov dword [esp + 4], ecx
call fcn.1022ae9e
insd dword es:[edi], dx
inc ebp
jbe 0x100f6d32
mov eax, 0x418ec7fc
push ecx
bound esp, qword [edi]
loopne 0x100f6ca1
out 0xe6, eax
sbb dword [ecx - 0x46], ecx
mov ebp, 0xf470da53
outsd dx, dword [esi]
cmp ebp, esp
jg 0x100f6cd6
out 0x19, al
dec ecx
mov edx, 0x70da53bd
hlt
outsd dx, dword [esi]
rcr dword [edx + ebp*4 - 0x3e], 0x4d
push ds
push 0x69e944b8
imul ecx, dword [ecx + 0x7ac0a28], 0x2c513886
shr byte [ecx - 0x67], 1
test eax, eax
invalid
loopne 0x100f6da3
scasd eax, dword es:[edi]
cwde
sub eax, 0x4e65e296
mov dh, 8
clc
sti
dec esi
int3
scasb al, byte es:[di]
xor al, byte [edx + esi - 0x20f11f56]
sbb eax, 0xaead5ddd
xor ebx, dword [ebp - 0xc882900]
push 0x5d4c76ec
shr byte [esi - 0x16], 0xa9
std
in al, dx
jno 0x100f6da3
inc edx
xor al, 0x72
mov dword [ebp - 0x10], 0x72efa960
fsubr qword [ecx - 7]
xor byte [esi], ch
mov dx, 0x5566
fist dword [edi]
xchg ebp, eax
xchg esi, eax
cmp ah, byte [esi + 0x619106d2]
invalid

Function at 0x100fb05a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ecx
mov ecx, 0xbfa2cdad
xchg dword [esp + ecx + 0x405d325f], eax
bswap ecx
lea ecx, [ecx + ecx - 0x13457014]
pushfd
shr cl, 0xfc
js 0x1023449f
push ecx
add dword [esp], ecx
mov dword [esp + 0x10], eax
not dword [esp]
lea ecx, [ecx*2 + 0x3a00c01c]
test dword [esp + ecx + 0x355395e4], 0x8d1f7429
add dword [esp + 0xc], 0xfff74b28
call fcn.101e8cde

Function at 0x100ff96f
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xa3a14c81
pushfd
add dword [esp + edx + 0x5c5eb39b], 0xfffe92b9
test edx, edx
mov ebp, 0xbd002a33
lea ecx, [ecx + edx + 0x5c5eb380]
je 0x1025f3eb
setno dl
call fcn.10191083

Function at 0x1011eb50
Capabilities:
Packed with generic packer

Disassembly:
xor dword [esp + 0x20], 0x86a68a22
push ebx
lea ebx, [ebx + 0x1fb9a99f]
jne 0x10230164
add word [esp + 1], 0x979d
or dword [esp], 0x698ca384
test ecx, ecx
call fcn.100a7362
jne 0x1028293e
cmp word [esp + 0x14], 0x3bb6
call 0x1025b192
not cl
jbe 0x1016e858
dec ebp
not word [esp]
call fcn.101fe043
mov esi, 0x30066928
movsx ecx, si
popfd
lea ebx, [ecx + 0x3c9303a1]
lea esi, [ecx*4 - 0x5b73b4e3]
pop ebx
pop ecx
call fcn.100f7e7b
jle 0x102301b5
add al, ch
rcr dh, 0xfc
invalid
xor eax, 0x45eb2f9e
aam 1
inc eax
jns 0x1023021b
jmp 0xa1428d3b
mov ecx, 0xaf1b95ee
sub eax, 0xb5465d97
insb byte es:[edi], dx
jl 0x102301e6
jbe 0x1023017d
dec edx
adc esi, dword [0xc3e1fcbb]
mov byte [0x99ddfc7], al
scasd eax, dword es:[edi]
xlatb
mov esi, 0xd9ae3a67
mov dword [edx - 0x2d], ecx
pop ebp
xchg dh, bh
pop ds
sbb al, 0xa2
enter 0x6fb0, 8
inc edi
dec esi
test dword [ecx], edi
bound eax, qword [ecx - 1]
dec edi
in al, dx
sbb al, 0xf2
invalid
xor bl, byte [ecx - 0x60371af1]
adc eax, 0xcba9eafb
std
retf 0x783
setb byte [esp + 0x12]
inc cl
not cl
sal dword [esp + 0xd], 0x29
neg dword [esp + 0x14]
Function at 0x1011edee
Capabilities:
Encode data using xor

Disassembly:
xor dword [esp + 0xc], 0xca16014
shl word [esp + 0xc], 0x6a
xchg dword [esp + 0x1c], eax
mov esi, dword [esp + 0x10]
add dword [esp + 0xc], 0x343cf81c
add word [esp + 0x18], 0x3b32
test dword [esp + 0xc], 0xc7b1af33
jg 0x1012fa50
sbb byte [edx], dh
cmp esi, edi
inc esp
and al, 0xc
xor ebp, dword [edi - 0x70f0384f]
das
or al, 1
add byte [edi], cl
mov byte [edx - 0x45ffec2a], ah
mov edx, 0xf3e1685
mov edx, 0xd20a3ff2
js 0x1025c4c9
mov edx, 0x3e1685ba
btr edx, 0x3f
or dl, dl
mov dx, word [edi + edx*2 - 0x7c2d0b74]
mov ax, word [edi + 2]
call fcn.1027c232
fidiv word [ebp - 0x4c080945]
les ecx, [edi - 0x4f]
in al, 0xf1
inc ebp
lcall 0x266b, 0xaf6a9fb1
aaa
pop eax
lodsb al, byte [esi]
jo 0x1011ee10
fdivr qword [edi - 0x57]
mov byte [0x88f487d9], al
rcr dword [ecx], 1
enter 0x6db1, 0x48
mov ebx, 0xde3687d6
sub dword [ebp - 0x7ca7e99e], edx
out 0x7a, eax
invalid

Function at 0x10123413
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov ebx, dword [esp + ebx*2 + 0x20]
seta byte [esp + 0x30]
jae 0x10127b3d
not byte [esp + 8]
shl byte [esp + 0x28], 0x8f
mov dword [esp + 0x18], 0xeaffa11
mov ecx, dword [esp + 0x30]
neg word [esp + 0x18]
shl cx, 0x61
mov byte [esp + 0x18], 0x39
mov ecx, dword [esp + 0xc]
or byte [esp + 0x2c], 0x2f
and word [esp + 0x2c], 0xa22d
test byte [esp + 4], 0x96
call fcn.1017f1bd

Function at 0x10123527
Capabilities:
Execute syscall

Disassembly:
setg byte [esp + 0x28]
shl cx, 0x3f
mov ecx, dword [esp + 0x20]
shr dword [esp + 0x28], 0x72
call fcn.10179c7a
syscall
push edx
pushfd
dec eax
mov edx, 0x59a42889
add al, 0x1a
nop
xor eax, 0x14e2c148
dec eax
mov edx, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xd49a8a0f
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.1017eab8
mov ebp, dword [esp]
mov ebp, dword [ebp]
shl esi, 0xa5
shl esi, 0x4e
shl si, 0x34
neg esi
lea esp, [esp + esi*8 - 0x283ffffc]
ret

Function at 0x10127baa
Capabilities:
Authenticate hmac

Disassembly:
push ecx
cld
not ebx
not ebx
call fcn.100de290
nop
jg 0x1021484f
lodsb al, byte [esi]
push ecx
rcr cl, 0xd5
lahf
jle 0x100f3514
cmp esp, dword [ebp - 0x6e3a6ae0]
push es
sub eax, 0xdb48f72b
test ecx, ecx
js 0x100f356d
xchg ebp, eax
lds edx, [ecx - 0x8d4d2fa]
dec eax
fild dword [ebp + 0x4b7826c9]
jo 0x100f34b4
mov dh, 0xca
push ebp
sbb ecx, dword [edx - 0x13]
add byte [edx + 0x64328910], 0x78
invalid
adc bh, byte [ebp + edx*8 + 0x59]
dec ebp
mov dl, 0xc0
mov byte [0xc4909ef7], al
push ebx
int3
nop
or ecx, dword [edx + 0x7e]
add ch, ah
lcall 0x621e, 0x48f37ab8
std
mov edx, 0x2e830480
push es
into
jne 0x100f355a
clc
inc eax
retf
mov edi, dword [esp + 0x1c]
push ebp
jge 0x100f3502
call fcn.1015483c
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], edx
jo 0x1011f2e9
mov edi, dword [esp + 0x24]
mov edi, dword [edi]
jg 0x1021dfb1
pushfd
call fcn.101ce424
mov ebp, 0x800f011
xor word [esp + ebp - 0x800eff1], 0x1404
jge 0x101ff199
lea edi, [edi - 0x2fdb87e5]
call fcn.1025c177