joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1048ffd4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
lea edx, [edx + ecx*2 + 0x5d7fe084]
sal word [esp + ecx - 0x4f016781], 0xcc
xor edx, 0xe868719
sar ax, 0x85
mov dword [esp + ecx - 0x4f016788], 0x178311a1
neg edx
xor edx, 0xe4096982
sub byte [ecx + 9], 0xe4
neg dword [esp + eax - 0x4f010334]
adc dword [esp + ecx - 0x4f016786], ecx
dec edx
call fcn.100ee1ef
or eax, 0xe22a201a
mov edx, 0x797545d2
arpl word [eax], cx
push ebx
and al, 0xec
add byte [ebp - 0x13], dh
imul ecx, dword [eax - 0x7277c9e5], 0x4df34ec1
mov ebx, 0x723903df
in al, dx
sub byte [esi + 0x7f7f5859], ch
salc
push es
pop ebx
or ecx, edx
scasd eax, dword es:[edi]
loope 0x10490002
pop ebx
pop ds
push edx
out 0xd4, al
mov eax, 0x88cbf6dd
xchg dl, bh
push ss
out dx, al
mov bh, byte [ecx]
cmpsd dword [esi], dword es:[edi]
mov dword [0xc44410ac], eax
ficom word [edx]
in eax, dx
js 0x10490046
popfd
ja 0x104900e3
cmp dword [edx - 0x10d44da8], ecx
sbb edi, ebp
fst dword [ebx]
xor byte [edx - 0xe], ch
cmpsd dword [esi], dword es:[edi]
jae 0x104900d1
salc
invalid
lds edx, [edi - 0x3225a6fb]
ja 0x104900c9
add bh, bh
in al, dx
push edi
inc ebp
leave
hlt
mov dh, 0xf
lcall 0x22d, 0xd0c98876
in al, dx
mov ecx, dword [edi - 0x24ee54d6]
popal
mov dh, 0x30
pop edi
mov bl, 0x49
xor byte [edi - 0x4d], bl
dec ecx
xchg edx, eax
stc
test dword [ecx - 0x7b], ecx
dec ecx
jb 0xb77db741
cmpsd dword [esi], dword es:[edi]
rcl ebx, 1
outsb dx, byte [esi]
mov dh, 0xf4
cmp byte [edi - 0x4a], 0xdd
and eax, 0xb67d3610
scasb al, byte es:[edi]
cld
pushfd
dec ecx
sar edx, 0x3a
xchg ecx, eax
jno 0x104900c1
mov dl, 0x89
dec esp
inc ebp
mov dh, 0x13
jae 0x10490175
mov ecx, 0x9b892b49
dec edi
mov dh, 0xa8
pop ds
popfd
dec ecx
push 0x32
std
or dword [ebx + 0x60c27749], ebp
mov dh, 0x7c
inc edi
stc
xchg ebx, eax
inc eax
mov dh, 0xdc
rcl byte [ecx - 0x4a], 0xc6
cmc
push edi
cmp eax, 0x8a964984
inc esi
sub bl, ah
aam 0x9b
sbb dword [ebx + 0x2b], ebp
loop 0x10490181
add dh, byte [edi - 0x17]
frstor dword gs:[edi]
jne 0x104900f2
insb byte es:[edi], dx
push 0x53
shl dword [ebx + 0xf], cl
pop ss
in eax, dx
mov ss, edi
adc al, 0x54
mov byte [esi + 0x4d914116], dl
or al, 0xdc
cmp al, 0x36
adc ah, ch
pop ss
mov eax, dword [0x5c5c583b]
cdq
cmp dword [ebx + ebx*2 + 0x44], esp
vpsraw ymm0, ymm6, xmm1
adc byte fs:[eax], dh
out 0xf3, al
cmpsd dword [esi], dword es:[edi]
xor dh, ah
repe cmpsd dword [esi], dword es:[edi]
stc
test eax, 0x1915c988
mov word [edx - 0x533e572a], cs
mov dl, dh
test al, 0xc1
lodsb al, byte [esi]
stosd dword es:[edi], eax
add ecx, ebx
mov esp, 0xd0479612
push dword [edi + 0x42]
push cs
test dword [edx], edi
mov dl, 0x68
inc esp
sub eax, 0x1c330bd9
inc edx
arpl word [esi], sp
test al, 0xa0
inc esi
sal byte [edx - 0x33], 1
out 0x28, eax
pop ss
xor ecx, edx
or edx, dword [ecx - 0x76]
cmc
cmp bl, dl
add bh, byte [ebx + 0x6d]
stosd dword es:[edi], eax
mov bl, 0xff
mov cs, ebx
insd dword es:[edi], dx
dec ebp
lea esp, [edx + 0x5a26a328]
xchg dword [ebx + 0x20], ebp
jecxz 0x10490191
or ebp, dword [eax + 0x27428c93]
dec esp
pop eax
out 0x58, al
out 0x46, eax
ficom word gs:[ebx + edi*4]
push esp
ret
Function at 0x1049283b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd9e2c1c4
mov dword [esp], 0x9697e4a2
neg dword [esp]
movzx edi, byte [eax]
xor edi, ecx
not dword [esp]
and edi, 0xff
call fcn.1029ae03
dec esi
xor ah, byte [eax]
sub ah, ch
jno 0x10492859
inc ebp
jne 0x10492814
mov dl, 0x4b
dec ebx
or byte [ebx - 0x19], dl
aaa
sub byte [ebp - 0x13], dh
fiadd dword [ebx - 0x7177c9cd]
fisub dword [esi - 0xd]
dec ebp
movsb byte es:[edi], byte [esi]
in al, 0x40
adc dword [edx - 0x14], esi
imul eax, dword [esi + 0x305859], 0xffffffc5
push ds
push es
pop ebx
sbb dl, ah
scasd eax, dword es:[edi]
loope 0x1049281a
and byte [edi], dh
push edx
out 0x9b, al
jecxz 0x104928ee
fmulp st(3)
mov byte [ecx], dl
push ecx
out dx, al
mov dl, byte [edx - 0x24535c71]
das
in al, dx
ficom word [edx]
xchg edx, eax
cmp esi, edi
popfd
ja 0x10492921
cli
mov byte [0xb490b258], al
clc
aad 0xd9
adc edx, ebx
inc edx
repne cmpsd dword [esi], dword es:[edi]
fdiv dword [eax + 0xc]
std
in al, dx
mov eax, dword [0x25bfc674]
sub byte [eax + 0x16], dh
pop edx
fbld tbyte [eax]
ror byte [ecx - 0x7096e491], 1
mov byte [edi - 0x64], cl
in eax, dx
jae 0x104928d5
invalid
mov dword [0x85f3a55b], eax
lodsb al, byte [esi]
lds edx, [ebp - 0x3f]
jno 0x10492861
dec esi
pop ebx
dec esp
sub cl, byte [ecx - 0x13]
int1
mov ecx, 0xa7a3df35
leave
dec edi
or bl, byte [esi + 0x17]
aad 0x11
sub al, 0x3e
nop
push ds
cmp eax, 0x6af23a8e
rcl byte [ecx + ecx*8]
cmpsd dword [esi], dword es:[edi]
sbb bh, byte [eax - 0x3c]
pop ebp
wait
salc
pop esp
insd dword es:[edi], dx
invalid
pop esp
sub al, 0x2f
inc esi
sti
add eax, 0xd038b042
out 0x9b, eax
out 0x46, al
xchg ecx, eax
invalid

Function at 0x10496f99
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov dword [esp], ebx
mov ebx, 0x591d578c
movzx ebx, byte [ecx + ebx - 0x591d578c]
xor ebx, edx
push 0x10aa025
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x104d8970]
shr edx, 8
inc word [esp + 1]
xor edx, ebx
inc ecx
xor edx, 0x8f9b5f05
dec eax
lea esp, [esp + 4]
jne 0x10496f9c
mov eax, 0x6f266330
push eax
mov ebx, dword [esp + eax - 0x6f26632c]
lea esp, [esp + 8]

Function at 0x104b018b
Capabilities:
Execute syscall

Disassembly:
call fcn.103d8bb5
dec eax
movzx ax, byte [edx + ecx*8 - 0x1ff8]
movsx edx, cl
lea ebp, [ebp + ecx*2 - 0x800]
inc edx
mov word [ebp + ecx*4 - 0xffc], ax
movsx eax, dx
lea edi, [ecx + edi - 0x403]
add ax, 0x4313
and ecx, 0xf4994e29
inc dx
mov edx, dword [edi + ecx*4 - 0x8a4]
xor edx, ebx
shr cl, 0xc7
inc edx
xor eax, ecx
shr eax, 0xb0
dec eax
neg edx
xchg ecx, eax
xor edx, 0xd78f1421
sal al, 0x84
inc eax
rol eax, 0xfd
inc edx
add cl, ah
xor ebx, edx
add eax, eax
adc esi, edx
call fcn.1040deea
sysenter
push ecx
mov dword [esp], 0xf4f5d5ce
call fcn.102bed54
Function at 0x104c0111
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp esi
sub eax, 0xcd0189bd
neg edx
sets cl
xor eax, 0xafb92228
not eax
sar dx, cl
lea eax, [eax + ecx*2 + 0x77a81bbb]
shr cx, 0x2b
sar cl, 0x64
xor ebx, eax
add esi, eax
pop ecx
dec cl
jne 0x100177a5
xor ebx, ecx
add esi, ecx
jmp 0x101e43d5
lea esp, [esp + 8]
jmp 0x101ff3e4
call fcn.102f7597
ror eax, 2
rol ecx, 0xae
xor cl, 0x98
inc eax
rol eax, 1
neg eax
not eax
lea ecx, [edx + edx*8 - 0x5872cfeb]
sal dl, 0xc1
dec eax
shr ecx, cl
xor ebx, eax
add ecx, 0x239fc887
adc esi, eax
or dx, cx
lea eax, [ecx + edx + 0x2798701c]
mov ecx, dword [ebp + ecx - 0x239fc9c2]
movzx dx, byte ss:[ecx + eax*2 - 0x79fc7340]
lea ebp, [ebp + eax*2 - 0x79fc733e]
mov word [ebp + eax - 0x3cfe39a0], dx
lea ecx, [eax*4 + 0x3438b63a]
movsx edx, cx
jmp esi
call fcn.102467ee
mov dx, word [edi + edx*2 - 0x204d9d02]
mov ax, word [edi + ecx*2 - 0x204d9d00]
sal cl, cl
dec cx
lea edi, [ecx + edi - 0x1026cdff]
inc ecx
not dx
jl 0x10021519
sbb cl, 0x2a
not ax
and dx, ax
shr cx, 0xab
mov word [edi + ecx*2 - 0x204c0032], dx
push ecx
xor ecx, 0x2f2f272f
mov eax, dword [ebp + ecx - 0x3f092736]
add byte [esp + ecx*2 - 0x7e124e6b], ch
lea ebp, [ebp + ecx*2 - 0x7e124e68]
movzx edx, word [esp + ecx - 0x3f092736]
sub ecx, edx
xor eax, ebx
inc eax
bswap edx
or edx, edx
dec dword [esp + ecx*2 - 0x7e12003a]
bswap eax
neg word [esp + ecx - 0x3f09001b]
sal dword [esp + ecx - 0x3f09001d], cl
jbe 0x1016859c
movsx ecx, dx
neg eax
lea edx, [edx*2 - 0x6040c0c8]
jmp 0x1034384a
Function at 0x104c30ed
Capabilities:
Encode data using base64

Disassembly:
bswap edx
call fcn.1049a5c4
shl edx, 0x4c
shr eax, cl
mov ecx, edx
mov dword [ebp + edx - 0x4c4db000], eax
mov dword [esp + ecx - 0x4c4db000], esi
ret
rol ax, 0x62
dec al
shr cx, 1
call fcn.1001fd0c
mov edx, 0x489caba8
movzx ax, byte [esi + edx - 0x489caba8]
movzx ecx, dx
sar cx, cl
mov cl, byte [esi + edx - 0x489caba6]
push edx
sar dx, 0x6c
neg word [esp + edx - 0x489cfff8]
lea esi, [esi + edx - 0x489cfff8]
adc byte [esp + edx - 0x489cfffa], dh
call fcn.104ca445
call fcn.1009fd6f
mov ebx, 0xb0b99fb2
call fcn.10172da0
mov edx, 0x6d0b6db7
lea ecx, [edx*4 + 0x391fae11]
rol ecx, 0xc1
mov edx, dword [esi + edx - 0x6d0b6db7]
or cx, 0x2199
adc esi, 4
xor edx, ebx
movzx eax, cx
or eax, 0x5f055c25
jne 0x1006dbf2
bswap eax
lea esi, [esi + eax + 2]
jmp 0x102c9201
add edi, eax
rol edx, 0x48
mov eax, dword [edx + ebp]
xchg byte [esp + edx + 0xa], dl
shl word [esp + edx + 9], 0x42
pop ecx
mov dword [esp + edx + 8], ebx
cpuid
sub byte [esp + 5], 0xb9
sub ebp, 0xc
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 4]
sar dword [esp + eax - 0x46fd], 0x3d
mov dword [ebp + eax - 0x46f8], ebx
mov dword [eax + ebp - 0x46fc], ecx
mov dword [ebp + eax - 0x4700], edx
or dword [esp + eax*2 - 0x8dff], eax
dec dword [esp + eax - 0x46fd]
mov ebx, dword [esp + eax*2 - 0x8df8]
pop eax
pop edx
pop edx
jle fcn.101ad508
mov eax, dword [ebp]
mov edx, 0xa723be95
lea ecx, [edx + edx*4 + 0x528334bc]
add ebp, 4
shl dl, cl
setns dl
xor eax, ebx
neg eax
jmp 0x10627198
setbe dl
dec eax
bswap eax
sal ecx, 0xf8
xor ebx, eax
add edi, eax
shl cx, 0xd
mov edx, dword [esi + ecx*2]
movzx eax, cx
add cx, word [ecx + esi + 4]
jmp 0x10422724
sal ecx, 0x3f
xor edx, 0x51fc53b
lea eax, [edx + eax + 0x33cc1b71]
not eax
shr ecx, 0xa8
jae 0x10580262

Function at 0x104f97d0
Capabilities:
Packed with generic packer

Disassembly:
jp 0x104f9819
dec dword [ebp - 0x290d2a54]
sti
sti
bswap edi
mov dword [esp + 8], edi
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
shl word [esp + 8], 0xe8
xor di, di
jbe 0x106207d6
pop es
ja 0x104f9825
xor byte [edx + 0x30], bl
dec edx
sub ecx, dword [ebp - 0x7b25d9cd]
jge 0x104f9798
ret
stosd dword es:[edi], eax
push edi
imul byte [ecx]
mov esp, 0x9634bfc5
adc al, 0xcb
add eax, 0xdf8ceac8
enter 0xffffffffffff8cea, 0xffffffffffffffdf
mov eax, dword [0x8deb637b]
in eax, dx
cmp dword [ebx - 0x23], ebx
cmp esi, ebp
insd dword es:[edi], dx
push 0xa1c96917
lcall 0xa601, 0x77f364a1
mov ch, 0xa4
dec ecx
rcl dword [ecx + 0x4a48c026], 0xba
cmp ecx, ebx
cmp al, 0xa3
invalid
mov dword [esp + 0x10], edi
lea ecx, [ecx - 0x2656c56b]
jae 0x1023301b
Function at 0x10509fe3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x1065f899
jp 0x103fa2cb
adc ebp, 2
call fcn.1002cb42
mov ecx, dword [ebp]
mov eax, 0xf80a4636
inc ax
lea edx, [eax + eax*2 + 0x5826b189]
lea ebp, [ebp + edx - 0x4045842a]
jge 0x106522c0
inc al
mov dword [esp + ecx*4 - 0x22c], ecx
shl ecx, 0xc4
xor bl, al
call fcn.1067488f
xor ebx, eax
pop ecx
jmp 0x106a1263
lea edx, [edx - 0x4d5136c]
xor byte [esp + edi*4 - 0x76f6e0c0], 0x89
shl byte [esp + 0x14], cl
add ebp, 0xa832862a
mov esi, dword [esp + 0x38]
xchg dword [esp + ebp + 0x57cd79ea], edx
mov esi, dword [esp + edi - 0x1dbdb81d]
jne 0x1032de34
rol edx, 0xee
xor ecx, ebx
lea ecx, [ecx + edx - 0x2ad5d374]
rol ax, 0xa9
cmovb edx, eax
dec al
bswap ecx
sbb ecx, 0x938ba20f
shl dl, 0x43
xor ecx, 0xc22d0fa2
push eax
xor ebx, ecx
add edi, ecx
movzx eax, byte [ebp + edx - 0x610b9088]
lea ebp, [ebp + edx - 0x610b9087]
xor al, bl
xor al, 0x8c
or edx, edx
and dl, 0x86
movzx ecx, byte [esp + edx - 0x610b9080]
inc al
ror dl, 0xe1
not al
jo 0x103bba49
sub ebp, dword [esp + 0x38]
and cl, 0x39
shr dword [esp + 0x38], 0x38
setne byte [esp + ebp + 0x573760e5]
mov ebp, dword [esp + ebp + 0x573760bd]
call fcn.102f02de
add edi, eax
rdtsc
not cx
lea ebp, [ebp + ecx*8 - 0x78000]
shl cl, 0xa1
setge cl
mov dword [ebp + ecx*2 - 0x1ddfc], eax
mov eax, ecx
mov dword [ebp + ecx - 0xef00], edx
js fcn.101ad508
mov eax, 0x34bbe915
movzx ecx, al
mov ecx, dword [esi + ecx*2 - 0x2a]
rol ax, 0xc8
mov eax, dword [esi + eax*2 - 0x69762bce]
imul ecx
mov dword [esi], edx
mov ecx, 0x2c915806
mov dword [esi + ecx*2 - 0x5922b008], eax
sal ecx, cl
push ecx
call fcn.106873d0

Function at 0x105200fa
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
call fcn.10142aa2
Function at 0x10529c48
Capabilities:
Encode data using base64

Disassembly:
inc word [esp + 9]
dec edx
add dword [esp + 7], eax
rol edx, 1
lea ecx, [eax*4 - 0x4d5ac5e3]
call fcn.1030cfe2
mov ecx, dword [esi]
push 0x62b6c283
shl word [esp + 2], 0xed
mov eax, dword [esi + 4]
mov edx, dword [esp]
pop edx
seta dl
adc esi, 4
call fcn.1038edc6
mov edx, 0xf61b162a
sub edi, 4
xadd dl, dh
lea ecx, [edx + edx*8 - 0x19e618e8]
setle cl
mov eax, dword [edi]
dec cl
xor eax, ebx
call fcn.1053d9a5
dec ecx
sbb eax, 0x863f3188
inc esp
movzx edi, di
inc ecx
push esp
dec ebp
xor ebx, eax
shr edi, cl
inc ecx
neg edx
inc esp
xor dword [esp + ecx - 0x5d01], ebp
inc ecx
pop esp
inc ecx
sal edi, cl
inc cx
sar eax, cl
dec ebp
arpl bp, bp
dec esp
xchg edi, eax
dec esi
lea edx, [edi + edx*2 + 0x2f3afb9a]
dec ecx
add ebx, ebp
dec ecx
add edx, 0xcb266b3d
inc ecx
sar bh, cl
sar ax, cl
mov bp, word [ebp + ecx - 0x5d01]
jbe fcn.102e94b3
not al
push edx
setl byte [esp + 2]
mov word [ebp], ax
movsx eax, dl
mov ecx, eax
not byte [esp]
mov eax, dword [edi]
sub cl, ch
rol edx, 0x2e
xor dword [esp + edx*2 - 0x56ed728e], ecx
lea edi, [edi + edx*2 - 0x56ed728a]
shr dl, 0x24
call fcn.102fbc64
add ax, ax
bswap edx
jne 0x1011b4d0
lea edx, [edx*4 - 0x3bcc2950]
lea ebp, [ebp + edx*2 - 0x39aedf16]
sub edx, 0x46299da5
lea edx, [edx + edx*8 + 0x59004cbc]
and al, cl
jmp 0x1031206f
dec edx
jl 0x1014c56d
mov ecx, dword [esi]
mov edx, 0xa53b3599
lea ebp, [edx*2 - 0x2e798ec7]
lea esi, [esi + ebp*2 - 0x37f9b8d2]
not ebp
lea eax, [ebp*8 + 0x4a90e82]
mov edi, ecx
neg dx
mov ebp, esi
jb 0x1058b0f2
mov dword [esp + edx*2 - 0x5a7b5a10], edx
lea ebp, [ebp + edx*2 - 0x5a7b5a0e]
shr cx, 1
rcr eax, cl
sal word [esp + edx*2 - 0x5a7b5a0d], 0x65
call fcn.106ca2fa
movzx ax, byte [ebp]
mov edx, 0x9628e637
mov ecx, edx
mov cl, byte [ebp + 2]
jmp 0x101fafea

Function at 0x1057b063
Capabilities:
Execute syscall

Disassembly:
pop eax
push ebx
pushfd
mov ebx, 0x3517fa06
neg bl
neg ebx
jge 0x104fded7
lea ebx, [ebx*4 - 0x6b505f63]
bswap ebx
xchg dword [esp + 8], eax
cmp bl, 0x1a
push edi
push ebx
jno 0x10698d2b

Function at 0x10583198
Capabilities:
Authenticate hmac

Disassembly:
not edx
rol cl, 1
jo 0x1052ec9b
mov ecx, 0x4b366421
movzx ax, byte [ebp + ecx - 0x4b366421]
lea edx, [ecx + ecx - 0xaea1bed]
rol cx, 0x41
mov dl, byte [ebp + ecx - 0x4b36c840]
jae 0x10196bac
sub esi, 1
movzx eax, byte [esi]
mov edx, 0x24bc0e96
jmp 0x1026fda6
ror cx, cl
lea ebp, [ebp + ecx - 0x4b36b20e]
shl ecx, cl
push ecx
jbe 0x100db08d
adc al, dl
dec dword [esp]
js 0x1021fb4d
movsx ecx, dl
xor al, bl
xadd edx, ecx
rol al, 1
call fcn.10640e5c
pop ecx
xor ebx, edx
and cx, cx
adc edi, edx
movsx edx, cx
shl ax, 2
jmp edi
mov edx, dword [esi]
xor edx, ebx
lea eax, [ecx + ecx*2 + 0xd171cb8]
mov dword [esp], eax
sub cl, 8
ror edx, 2
and dword [esp], eax
sbb ax, word [esp]
neg edx
sub edx, 0xb32ced94
jmp 0x1010f299
Function at 0x1059b9a2
Capabilities:
Encode data using base64

Disassembly:
or esi, esi
lea edi, [edi + 0x721f0434]
mov dword [esp + ecx*2 + 0x5a3a0000], esi
and word [esp + ecx*2 + 0x5a3a0000], 0x63d
neg dword [esp + esi - 0x65e08fff]
xor ecx, dword [esp + esi - 0x65e08fff]
push 0xf71c2f15
xchg dword [esp + 0x18], edi
mov esi, dword [esp + esi - 0x65e08ff7]
xor dword [esp], ecx
call fcn.102ed51e
mov dword [esp + 4], ebx
call fcn.106a5923
shr ebp, 0x3f
jne 0x101bad6f
mov ecx, 0x1f985207
add cl, 0x3f
mov edx, esi
movsx eax, cl
lea esi, [esi + eax*2 - 0x8e]
sub ecx, ecx
rol ecx, 0x1f
ror eax, 0x8b
mov word [esi + ecx], dx
adc ecx, dword [ebp + ecx*2]
push eax
lea ebp, [eax + ebp - 0x8bffffc]
call fcn.105c5928
push ecx
mov dword [esp + ecx + 0x41d5d207], eax
test cx, 0x1112
mov word [esp + ecx + 0x41d5d1e7], 0xb19a
not word [esp + ecx + 0x41d5d1e7]
push esi
add dword [esp + 0xc], 0xfffd7f6e
shl cx, cl
or dl, ch
shr dword [esp + edx*2 - 0x3ed87b2c], 0x24
mov eax, 0x9a327c2f
js 0x102f2307
jbe 0x102fc821
mov esi, 0x69892f0f
mov eax, dword [esp + eax + 0x65cd83dd]
mov eax, dword [eax + edx - 0x1f6c3d98]
shl esi, 0xa5
cmp dword [esp + ecx + 0x41d60004], ecx
jo 0x10087bae
mov esi, 0xa1b8ce14
call fcn.1006168e
mov eax, dword [ecx + esi - 0x80acc1e]
mov cl, byte [ecx + esi - 0x80acc1a]
mov dword [esp], 0x794d71f
call fcn.10360150
pop edi
cmpsd dword [esi], dword es:[edi]
fisubr word [ecx]
push esp
loop 0x1059ba5e
xchg ecx, eax
xchg byte [edx + 0x6ed13a1b], ah
ljmp 0x679f
outsb dx, byte [esi]
lodsb al, byte [esi]
arpl word [eax + esi*2], cx
xchg ecx, eax
dec edi
retf

Function at 0x105b9c02
Capabilities:
Encode data using base64

Disassembly:
pop edx
add ebp, 4
xor dword [esp], 0xa3b5613d
push 0x40194686
or eax, ecx
jmp 0x1058f918
not eax
mov dword [ebp], eax
pop ecx
pop edx
jmp esi
or ecx, 0x93ad3108
rol edx, 1
mov dword [esp + 4], eax
xor ebx, edx
sal cl, 0xe4
adc esi, edx
sal ecx, 0x5c
shr eax, 0x2c
dec ecx
mov eax, dword [ebp + eax*2 - 0x16065e]
mov ecx, dword [ebp + 4]
jl 0x1018600a

Function at 0x105c26c1
Capabilities:
Encode data using base64

Disassembly:
mov ebx, 0x1bb0c783
add dword [esp + ebx*2 - 0x37618efa], 0xefc8d7f4
xchg dword [esp + ebx*2 - 0x37618ef6], ecx
movzx bx, bl
xor bx, 0xb323
push ebp
Function at 0x105cbfe2
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
mov dword [esp + edx*2 - 0x292e5384], ecx
lea edx, [ecx + edx*4 + 0x663f202b]
dec eax
xchg dword [esp], ecx
inc cx
sal word [esp + 2], 1
xor eax, 0xe10bf320
lea eax, [edx + eax - 0x3a8e2e56]
rol eax, 1
inc cx
not word [esp]
rol word [esp + 1], cl
xor ebx, eax
rol ecx, cl
not dword [esp]
cmovae ecx, dword [esp]
add edi, eax
neg cl
movzx eax, dx
call fcn.10297ef2
outsb dx, byte [esi]
xor byte [ecx - 0x4a440ad1], ch
pushal
pop edx
test al, 0xa4
mov byte [0xa56aa8e], al
pop ebp
lcall 0x5789, 0xb666fea7
mov byte [esi], ah
push ebp
push cs
pop ecx
add byte [eax + 0x57aa4373], bl
xlatb
adc edi, edi
test al, 0x91
mov ebx, esp
add ebp, dword [eax + 0x44484b0d]
dec eax
inc esp
cmpsd dword [esi], dword es:[edi]
adc ebx, 0x30545636
jae 0x105cc07d
pop esi
retf
adc al, 0x52
mov bh, 0x26
xchg edi, eax
inc eax
mov dword [0x7a6a1d5a], eax
jp 0x105cc060
sub eax, 0xef6cd3b5
mov edx, 0x1bfdd473
or dword [ecx + 0x55], esp
push ds
in al, dx
push eax
rcr dword [ebx], 0xe
jge 0x105cc0d6
loopne 0x105cc088
add eax, 0x9a8dfc2c
in al, 0xc1
sbb eax, 0x267fe7ab
nop
xchg dword [edx + 4], eax
mov ds, word [ecx + 0xcb8f11c]
in eax, dx
dec ebx
adc dword [0xd251001e], esi
add al, 0x8e
cdq
sbb al, 0xf1
mov eax, 0x114bed0c
xor eax, 0xd251001e
push cs
and dword [ebp + 0x66b1aff1], edi
movsb byte es:[edi], byte [esi]
jb 0x105cc0b0
or byte [edx + esi*8 + 0x6a], al
fsub qword [0x951be54f]
sub byte [ebx + 0x4c3f67c1], dh
aas
dec esp
insd dword es:[edi], dx
jmp 0x105cc05d

Function at 0x105d44ad
Capabilities:
Encode data using xor

Disassembly:
rol eax, 3
sal edx, 0x56
xor ebx, eax
call fcn.102e564a
call fcn.10388865
push edx
mov edx, 0xb401100b
pushfd
sub edx, 0xf50ecf3e
or dl, dh
mov edx, dword [esp + edx + 0x410dbf37]
mov dword [esp + 4], 0x83b2e9a5
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10674e81

Function at 0x105f7bd2
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
je 0x105eff1f
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x1001e105

Function at 0x105fce20
Capabilities:
Encode data using xor

Disassembly:
call fcn.1030b1ba
mov ecx, 0x2d21758a
push esi
neg ecx
mov esi, 0x8080919a
call fcn.10616fa0
mov edx, 0x56889921
movsx ecx, dl
mov ecx, dword [edx + esi - 0x56889921]
jmp 0x106c6b5a
movzx eax, dx
mov dx, word ss:[edx + ecx - 0x56889921]
lea ecx, [eax*4 - 0x1457ff63]
lea esi, [eax + esi - 0x991f]
jmp 0x105c338c
Function at 0x1060a9c1
Capabilities:
Encode data using base64

Disassembly:
not eax
push ecx
shr dword [esp + edx], 0xdd
not dx
bswap eax
rol dx, 0x85
not eax
bswap ecx
shr dx, 6
add eax, 0xaab0b439
xor dx, word [esp + edx*2 - 0x7fd]
shr dword [esp + edx*2 - 0x7fe], 0x70
ror dword [esp + edx*8 - 0x1ff8], 0xdf
ror eax, 2
xor ebx, eax
not cl
add esi, eax
ror dword [esp + edx*2 - 0x7fe], 0x18
mov edx, dword [edi + edx*2 - 0x7fe]
mov ecx, dword [edi + ecx*8 - 0x7f4]
inc dword [esp]
adc edi, 4
rol byte [esp + 1], 3
mov eax, 0xde0bc6a0
not edx
jae 0x102c12cb
not ecx
and edx, ecx
mov dword [edi], edx
call 0x105b4091
call 0x105f952a
mov eax, 0x3c9dcd34
movsx edx, al
mov eax, dword [ebp + eax - 0x3c9dcd34]
lea ebp, [edx + ebp - 0x30]
movzx ecx, dx
and dl, ch
xor eax, ebx
bswap edx
sal cl, 0x27
jbe 0x102150ee
movzx edx, ax
not cl
inc edx
inc eax
mov word [esi + eax*2 - 0x122], cx
xchg dx, ax
mov edx, dword [ebp + eax - 0x91]
lea ecx, [eax + eax - 0x47e4275]
lea ebp, [eax + ebp - 0x8d]
xor edx, ebx
or ecx, ecx
shl al, 0x41
dec edx
rol edx, 2
shr cl, 0x81
neg cl
sub edx, 0xc6098a33
neg edx
bswap ecx
bswap eax
and eax, eax
xor ebx, edx
add edi, edx
call fcn.10323670
Function at 0x10628686
Capabilities:
Parse pe header

Disassembly:
neg dl
jae 0x102389c0
movsx edi, word [esp + edi - 0x6a2569ae]
not edx
xchg dword [esp + edx + 0x3085e180], ebp
mov edx, dword [esp + edx*2 + 0x610bc2d8]
add dword [esp + edi - 0x6daf], edi
shl edi, 0xc5
neg byte [esp + edi*2 - 0x1b6fb0]
call fcn.1050c8cb
not dl
lea eax, [ecx + ecx*2 - 0x5b625a7d]
sar ecx, cl
sub ax, 0x3188
xor dl, 0x10
jmp 0x103cf844
not eax
bswap ecx
shl ecx, 0x4f
call fcn.106613f6
lea edi, [edi + edi*8 + 0x6a8faebe]
not esi
not esi
call fcn.103a9db0
shl al, 0xc3
sbb dl, 0xc
dec ecx
not dl
push ecx
xor byte [esp], ch
shl eax, cl
xor bl, dl
call fcn.104fa336
mov eax, edx
mov word [ebp], cx
call fcn.10552537
setnp cl
movzx dx, byte [esi + ecx*4 - 0x800]
sub word [esp + ecx*2 - 0x400], cx
jbe 0x105b9c3f
rol dx, 1
add byte [esp + ecx*2 - 0x74891eeb], al
xor word [esp + ecx*2 - 0x74891eec], 0x4eae
xor bx, dx
pop ecx
sub esi, 2
mov word [esi], dx
movsx edx, ax
inc eax
pop edx
jl fcn.10616578
rcr eax, cl
mov ecx, edx
rol ecx, cl
mov dword [esi + edx - 0x587c4854], eax
shr cx, cl
or ecx, edx
lea edi, [edi + edx - 0x587c4858]
neg ecx
shl edx, 0xb7
mov eax, dword [edi + edx*2 - 0x54000000]
not ecx
xor eax, ebx
sal dx, 0x65
lea edx, [edx*4 + 0x53a19231]
je 0x10131bf2
or byte [esp + ecx*4 - 0x7fe], ch
adc cl, byte [esi + ecx - 0x1fe]
add esi, 2
mov eax, dword [esp]
and dword [esp + eax - 0x4802fe00], eax
sal dl, cl
movzx ecx, ax
neg cl
mov word [esi + ecx - 0xfe00], dx
mov dword [esp + eax - 0x4802fe00], edi
ret
jge 0x100139fe
movzx eax, dl
mov al, byte [ebp + edx*2 - 0x6b579966]
add dl, dh
lea ebp, [ebp + edx*2 - 0x6b5798fe]
sbb dx, dx
ror edx, 0xe5
and cl, al
sub edx, 0x5b9454b2
not cl
jne 0x1052868e

Function at 0x10640e5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal edx, cl
dec al
ror al, 1
shl dl, 0xa1
dec al
mov dword [esp + ecx - 0x24bc0e96], edx
inc word [esp + ecx*2 - 0x49781d2c]
push ecx
not al
xor bl, al
rol edx, cl
rol cx, 0xa1
lea eax, [esp + eax + 8]
push ecx
shl byte [esp + edx - 0x22bff6], 0xc4
movzx cx, byte [eax + edx*2 - 0x458000]
ror edx, 0x6a
jns 0x105d51d3

Function at 0x10640ea0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 0xd
inc ecx
not ecx
or dword [esp + eax*2 - 0x70f48000], edx
xor ebx, ecx
dec al
push ecx
shl dword [esp + ecx*2 - 0x4c26414a], cl
jp 0x100efa87
mov bh, 0xe7
sbb al, 0xc0
dec edx
dec ecx
xchg dword [esp + edx*4 - 0x2e8efffc], edx
shl eax, 0x8e
not ecx
dec ecx
not ecx
jmp 0x103f3506

Function at 0x106461ce
Capabilities:
Encode data using xor

Disassembly:
push edx
xor ecx, ebx
ror ecx, 1
push edx
not ecx
movsx eax, dx
push edx
ror word [esp + edx - 0x14515dfa], 0xa6
xor ecx, 0x9e8bd90f
xchg edx, eax
bswap edx
shl edx, 0xef
not ecx
xor ecx, 0x3f8102a0
xor dx, dx
neg ecx
ror edx, 0x67
call fcn.1008f0e1
test dword [edx + ecx*8], esp
jb 0x106461d0
retf
invalid