joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e6b00
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + edi*8 - 0x20], 0x1ea2bf07
inc ebp
xor esi, edi
inc ecx
not esi
inc ecx
dec esi
not word [esp + edi*2 + 2]
not esi
rol byte [esp + edi + 6], 0xc4
inc ecx
neg esi
dec eax
and dword [esp + edi + 3], 0x338c7795
inc ebp
lea esi, [esi + esi + 0x6b38d1cf]
inc ecx
ror esi, 3
sar byte [esp + esi - 0x5377f268], 0x84
neg byte [esp + edi - 1]
dec esp
mov dword [esp + esi - 0x5377f260], edi
call fcn.101dc226
mov eax, 0xe93285a2
mov edx, eax
mov ecx, dword [ebp]
xor dx, ax
bts edx, edx
adc ebp, 4
xor ecx, ebx
neg edx
lea ecx, [ecx + edx*8 + 0x3c12d496]
setg al
push edx
mul ax
bswap ecx
cwde
cwde
ror word [esp + eax*4 - 0x2803], 0x24
not ecx
bswap ecx
xor ebx, ecx
mov dword [esp + eax*2 - 0x1402], edx
or ax, 0x8923
add edx, 0x9688bfac
adc esi, ecx
mul dword [esp + eax*4 - 0x22c8c]
mov dx, word [edi + edx*2 - 0x18c8]
mov ecx, eax
sal al, 0xa1
inc ax
adc edi, 1
not ecx
call fcn.100cc658
dec eax
mov dword [esp + edi - 5], esi
movsx edx, byte [esp + edi*8 - 0x26]
push dword [esp + 8]
popfd
neg dword [esp + edi - 3]
shl word [esp + edi - 4], 0xcc
inc ecx
mov esp, 0x36151511
inc ebp
mov esi, dword [eax + edi*4 - 0x14]
dec ebp
lea eax, [eax + edi*8 - 0x24]
ja 0x1009744e
inc esp
clc
fmul qword [edi]
xchg dword [edi], ebx
or ebx, edi
inc dword [ebp + 0x33]
iretd
inc ebp
xor ecx, edi
inc ecx
not ecx
inc ecx
mov ecx, esi
call fcn.101574c8
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
popfd
enter 0xffffffffffffd4f4, 0x52
and al, 0x63
call dword [eax + edi*8 - 0x6c9cdbae]
mov al, 0x98
push edx
and al, 0x63
wait
push esp
push 0x2a6310e8
mov al, 0xa6
xor eax, 0x27ff3227
jns 0x100e6b26
ror dh, 0x2b
enter 0xffffffffffff8db9, 0x4a
pop ecx
cmp ecx, dword [edi - 0x33]
adc ah, byte ds:[edx]
test al, 0x48
cmpsd dword [esi], dword es:[edi]
inc ebp
cmpsb byte [esi], byte es:[edi]
or dword [edi - 0xa498504], esi
enter 0xffffffffffffd20a, 2
mov dh, 0xf5
enter 0xffffffffffff9e3a, 0x3e
mov dh, 0xf5
enter 0xffffffffffffa8de, 0xe
pushal
or ecx, ecx
outsb dx, byte [esi]
frstor dword [esi + 0x22dec89d]
push edx
and al, 0x63
enter 0x5672, 0x52
and al, 0x63
sub eax, 0x24522696
arpl word [ebp - 6], sp
inc cx
inc edi
arpl word [0x4fade926], bx
or al, 0xb7
ret 0x1a4b
Function at 0x100e82e9
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + ebx*2 - 0x5f0cead2], ebp
dec eax
add ebp, ebp
dec ebp
lea ebp, [ebp + ebx*2 - 0x5f0ceac8]
jl 0x100e0b97
dec eax
sar dword [esp + ebx - 0x2f867569], 0x1d
inc esp
movsx ebx, word [esp + ebx - 0x2f867568]
dec esp
shrd edi, esi, cl
dec ecx
mov dword [ebp + ebx*2 - 0x5f0cead2], edi
call fcn.101138fd
shr edx, 0x26
movzx edi, bp
inc esi
mov ecx, dword [eax + eax]
inc eax
xor ch, ch
inc ebp
movsx esp, si
dec ecx
sal esi, cl
dec esi
lea eax, [eax + eax + 4]
dec ecx
add esi, 0x99263401
inc ecx
movsx esi, bx
neg bp
inc ebp
xor ecx, edi
not ax
xor ax, 0x473b
inc ecx
not ecx
inc ecx
idiv esi
inc esi
lea ecx, [eax + ecx - 0x1263d72f]
mul bx
inc ecx
not ecx
add dx, si
call fcn.100ad8ae
and byte [esi - 0x63], cl
enter 0xffffffffffffff63, 0xffffffffffffffba
and al, 0x63
and eax, 0x24ba8faf
arpl sp, di
jnp 0x100e8333
mov edx, 0xb30d6324
pop es
push eax
inc eax
arpl word [0x25eaa337], sp
arpl cx, si
adc byte [edi - 0xf], ah
mov ebx, 0xbc8774e2
dec eax
sub eax, dword ss:[esi]
lea esp, [eax + 0x5dedc6ad]
push edx
push ss
wait
salc
xchg ebp, eax
mov dl, 0x26
cmp byte [ebx + 0x7d], bl
cld
retf 0x202a

Function at 0x1010c42a
Capabilities:
Encode data using xor

Disassembly:
neg ax
mov dword [esp + edx - 0x52abfffc], 0x7722ad20
adc cl, 0x2c
xchg dx, ax
not eax
lea edx, [eax + edx - 0x49523543]
rol cl, 1
sar edx, 0xff
pop eax
dec cl
mov dword [esp + edx], 0x893f9201
neg cl
sal dx, 0xa3
neg edx
add edx, 0x791d69a8
xor bl, cl
movsx eax, dx
sar edx, 0x8f
or word [esp + edx - 0xf238], 0x4098
lea ecx, [esp + ecx + 4]
mov edx, dword [ecx + eax - 0x69a8]
mov ecx, 0x41189d2b
shr eax, cl
lea edi, [edi + eax*2 - 0x1e]
mov dword [eax + edi - 0xd], edx
movsx edx, cl
jnp 0x100ff308

Function at 0x1011a8bf
Capabilities:
Encode data using base64

Disassembly:
jne 0x101396e5
dec esp
mov ebp, dword [esp + ebx*4 + 0x38]
call fcn.10129b47
inc ecx
mov ebx, 0x2223adb3
inc ecx
movzx eax, bx
dec ecx
lea ecx, [ebx + eax + 0x3fab0497]
dec ebx
mov eax, dword [ebp + ebx - 0x2223adb3]
inc ecx
mov ebx, ebx
inc ebx
mov ecx, dword [ebx + ebp - 0x2223adab]
inc ebp
movzx esp, bx
inc ebp
sub esp, ebx
dec edi
lea ebp, [ebp + ebx - 0x2223ada7]
js 0x1015cb65
mov ax, word [edi]
mov edx, 0x26186c86
mov ecx, 0x68bf3034
btc ecx, 0x85
lea edi, [edi + edx*2 - 0x4c30d90a]
sal dx, 0x61
push ecx
lea ecx, [edx*8 - 0x54e455e1]
movzx edx, byte [edx + ebp - 0x2618d90c]
adc ebp, 1
mov dword [esp], ecx
xor dl, bl
imul ecx, ecx
not word [esp + 2]
and byte [esp + 2], cl
adc dl, cl
ror dl, cl
dec dword [esp]
xor dl, 0xbd
pop ecx
jmp 0x10144640
Function at 0x1011d8ed
Capabilities:
Encode data using xor

Disassembly:
push eax
rol ebp, 1
inc esp
movzx ecx, word [esp + edi - 0x4f]
dec ecx
lea ebx, [ecx + ebx*8 + 0x1c2027ae]
inc cx
neg ecx
dec esp
mov dword [esp + edx - 0x319f66e1], edi
inc ecx
shr cl, cl
call fcn.1014ddaa
add byte [eax], al
add byte [edi], bh
pop edi
push edi
pop edi
inc edi
je 0x1010fa29
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1010fa28
jae 0x1010fa02
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6e], bp
outsw dx, word [esi]
inc eax
jae 0x1010fa41
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc edx
inc edi
pop eax
pop edx
add cl, al
invalid
jl 0x1010fa00
or eax, dword [edi]
sub dword [esp + 2], 0xd8f7b5aa
and al, 2
stosb byte es:[edi], al
mov ch, 0xf7
fdiv dword [ebx]
fsub dword [esi - 1]
dec esp
and al, 7
cmp ah, byte [ebx + 0x1e]
arpl word [esi], bx
or byte [eax + 0x29], dh
pop esi
arpl word [ebx + 0x3e6680f8], dx
arpl word [eax - 0x1d], bx
jns 0x1010fa2b
or bl, cl
movsd dword es:[edi], dword [esi]
xor byte [edx], 0xce
xor cl, dh
jge 0x1010fa3e
cld
dec eax
mov dl, 0x5b
add bl, cl
pop ebx
invalid
jge 0x10155cab
mov eax, ebx
inc esp
movzx ebx, bh
inc dx
mov esi, dword [edi + ebp - 0xa412]
inc ecx
inc bl
inc ecx
movzx ebx, byte [eax + edi*4 - 0x2903f]
cmove cx, di
inc ecx
xor bl, bh
inc bl
dec eax
cdq
sal dl, 0x61
rol bl, 1
dec ecx
idiv ebx
inc ecx
inc bl
sub bl, 0x81
rol bl, 1
dec eax
cwde
ror eax, cl
inc esp
xor bh, bl
inc ebp
movsx esi, ah
xadd ax, dx
dec eax
adc ebx, esp
dec eax
sar edi, cl
bt di, 0x26
inc eax
mov byte [ebx + edi*2], dh
not bp
inc ecx
movzx ebx, dh
inc edx
mov ebp, dword [edi + eax + 2]
inc eax
xchg al, bh
inc ecx
push esi
dec eax
lea esi, [ebx + edi*8 + 0x30b0e71d]
dec ebp
lea eax, [eax + edi*4 - 0x156]
inc sp
or dword [esp + edi - 0x51], ebx
inc ecx
xor ebp, edi
dec ecx
lea edx, [esp + edi*8 + 0x1d96e431]
inc cx
neg esi
inc eax
sar dh, 0x21
lea ebp, [ebp + edi*2 - 0x4e22e1e2]
inc ecx
dec ah
neg ebp
dec ebp
jmp 0x1010f98c

Function at 0x1012952e
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], eax
dec ebx
call fcn.100a7942
dec eax
neg dword [esp + edx]
dec ebp
add edx, ecx
shr dword [esp + edx + 2], 0x5c
pop ecx
pop edi
jp fcn.100e032f
sysenter
push ebx
mov ebx, 0x651263a9
mov ebx, dword [esp + ebx - 0x651263a9]
mov dword [esp], 0x2d7973a
call fcn.100a96b2
Function at 0x1012e9d4
Capabilities:
Encode data using xor

Disassembly:
bt bp, 0xb9
pop edi
inc ecx
push edi
inc esp
xor dword [esp + ebx - 0x8c], ebx
dec eax
add ecx, 0xe22fc786
inc ecx
pop edi
adc al, 0x8f
dec ebp
arpl bx, bx
dec ebp
add edx, ebx
inc esp
movsx ecx, bp
push ebp
inc ebp
mov ebp, dword [ebp + ecx + 0x1dd037ee]
dec word [esp + ecx + 0x1dd037ef]
inc ecx
pop ebx
jns fcn.100e032f
inc edx
lea edx, [edx + ecx*4 + 0x6df2b74]
inc cx
mov ebp, edi
inc ecx
not ah
rol edx, 2
dec eax
rol eax, cl
neg edx
dec ecx
lea esi, [ecx + ecx*4 - 0x33d6bae8]
ror edx, 1
inc ecx
lea edx, [esp + edx - 0x7a190f5d]
sal al, 0x61
xor edx, 0x34265200
inc cx
xor ecx, 0xc166cb30
cmc
or dword [esi + 0xf], esp
mov edx, 0x574133ff
inc esp
movsx ebx, dh
inc edx
xor dword [esp + ecx - 0x34925718], edx
inc esp
add esp, esi
cbw
inc ecx
pop edi
inc ecx
shr cl, 0xa5
btc esi, 0x17
inc ecx
shr esp, cl
dec eax
arpl dx, dx
cwde
neg esi
je 0x100ab08e
dec esp
add edx, edx
inc cx
add eax, dword [ebp + eax]
inc cx
sar ebx, cl
inc sp
bts ebp, esp
inc di
mov ecx, dword [ebp + ecx - 0x349256fe]
call fcn.100c38e0
invalid
xor edi, ecx
mov dword [esp], 0x48822b30
not byte [esp + 1]
call fcn.101d6e15
sub ecx, ecx
sbb cl, ch
not eax
movsx edx, cl
shr cx, 0x2c
xor dl, dl
xor ebx, eax
ror dl, 0x62
call fcn.100a6007
inc ecx
mov edx, dword [eax]
inc ecx
mov ecx, 0x34929c28
inc ecx
movsx edi, cx
dec edi
lea eax, [eax + ecx*2 - 0x6925384c]
inc ecx
movzx eax, cl
inc ecx
xor edx, edi
inc ecx
mov ecx, ecx
inc esp
movsx esp, ax
jmp 0x100eda06
Function at 0x1015d323
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey

Disassembly:
jae 0x10130991
inc ecx
xor ecx, edi
lea ecx, [ecx + ebx + 0x573b07a3]
jmp fcn.101296a2
dec eax
mov dword [esp + eax + 0x677646d5], 0xd72b74b3
inc ebp
mov ebx, dword [eax + eax + 0x677646d5]
dec ebp
lea eax, [eax + eax + 0x677646d9]
mov esi, 0xc4974c8a
inc ecx
shr ah, 0xe1
mov edi, dword [esp + eax + 0x677646d9]
inc ebp
xor ebx, edi
dec esp
lea ecx, [edi*4 + 0x17ad369b]
or dword [esp + eax + 0x677646d7], 0x85a455a6
inc ecx
movsx ebp, cl
inc ecx
rol ebx, 3
movsx ecx, byte [esp + eax + 0x677646d6]
inc esp
add ebx, edi
inc ecx
xor ebx, 0xc5207892
inc ecx
rol ebx, 3
dec eax
sal dword [esp + eax + 0x677646d5], cl
inc ebp
add ecx, esp
dec eax
xchg dword [esp + ecx*4 - 0x1d0], ecx
inc esp
xor ebx, edi
movsx edx, al
inc ecx
pop esi
inc esi
lea ebx, [esi + ebx - 0x4d8080e6]
dec ecx
lea ebp, [ecx + eax - 0x3ad022d5]
inc di
mov ebx, 0x549e2a83
inc ecx
rol ebx, 3
bt di, 0x81
inc ecx
push edi
jae 0x1010e995
inc sp
shrd edi, esi, cl
dec esp
lea esp, [ebx + ebx*8 + 0x188fad91]
inc ecx
sar ah, 0x81
inc bx
mov dword [ecx + ebp - 0x9471], edi
inc ecx
movzx edi, cl
inc ebx
mov ecx, dword [eax + ecx*2 - 0x128e2]
dec edx
lea ebp, [edi + ecx*8 - 0x526f7080]
dec eax
bswap ebp
dec edi
lea eax, [eax + ecx*2 - 0x128de]
movzx eax, bx
jl 0x1010f8d3
mov edx, 0xc4ba8d05
call fcn.1010fcff
Function at 0x1015f146
Capabilities:
Encode data using base64

Disassembly:
jae 0x10139552
lea ecx, [ecx + edx*2 - 0x3fcb6a4e]
rol edx, 0x27
mov dword [esp + eax - 0x2f866000], eax
bt eax, 0x9a
not ecx
pop eax
xor ebx, ecx
imul eax
push edx
add dword [esp + edx*4 - 0x234a7720], 0xc4923aa9
adc esi, ecx
call fcn.100d51db
mov ecx, 0x64a58404
mov edx, dword [ebp + ecx - 0x64a58404]
mov eax, ecx
ror eax, cl
lea ebp, [ebp + eax - 0x464a583c]
sub eax, eax
cbw
sal cl, cl
xor edx, ebx
shr al, 0xc6
add ecx, 0xcb154785
sar ecx, cl
rol edx, 3
bts ecx, 0x3d
add ax, ax
bts ax, 8
sbb edx, 0xe024d09f
ror edx, 2
bts ax, 0x1b
adc cx, cx
btc eax, eax
lea edx, [ecx + edx + 0x2beb377]
push eax
xor ecx, dword [esp + ecx - 0x217dacbc]
sbb ax, cx
xor ebx, edx
sal dword [esp + ecx - 0x217da5bd], 0x3f
xor eax, 0x7487d5be
adc esi, edx
dec cl
sar word [esp + ecx - 0x217da5bc], 0x83
mov eax, dword [ecx + edi - 0x217da5bc]
add byte [esp + ecx - 0x217da5bc], 0x91
lea edx, [ecx + 0x66aa3b0b]
mov ecx, dword [ecx + edi - 0x217da5b8]
neg edx
xchg byte [esp + edx - 0x77d81f38], dl
xadd byte [esp + edx - 0x77d81f00], dh
mov dword [esp + edx - 0x77d89100], ebx
movsx ebx, dl
lea ebx, [edx*4 - 0x77e5f95f]
cpuid
call fcn.100b3b42

Function at 0x101636a3
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edi + edx*4 - 0xcbc640]
movsx eax, dx
lea edi, [edi + edx - 0x32f18c]
movzx edx, byte [ebp + edx - 0x32f190]
dec eax
mov dword [esp], 0x6387708a
and al, 0x27
Function at 0x101cde6a
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x10111076
neg al
pop ecx
add ecx, ecx
ror cl, 0x84
dec al
jmp 0x101d31a9
ror eax, 0x41
ror ecx, cl
not edx
imul eax, ecx
xadd eax, ecx
ror edx, 2
xor edx, 0x4000c3ad
dec edx
inc eax
and ax, ax
add ecx, 0xbc924cb4
ror edx, 3
btc ecx, ecx
xor ebx, edx
lea ecx, [eax*4 - 0x5951195c]
add esi, edx
cdq
or edx, esi
jmp edx
bswap ecx
idiv eax
xor ebx, ecx
add esi, ecx
lea edx, [eax + eax + 0x72bd80bb]
mov ecx, edx
mov di, word [edi + edx - 0x72bd33e3]
not cx
xor eax, ecx
ja fcn.1010fc47
dec ecx
mov esi, dword [ebp]
inc ecx
mov ebx, 0x7cbeae28
inc ecx
mov edi, ebx
dec edi
lea ebp, [ebx + ebp - 0x7cbeae20]
inc esp
movsx ecx, bh
inc ecx
movsx ecx, cx
call fcn.100fbe8c
mov ebp, 0xb52b930c
dec eax
lea edi, [ebp + ebp*2 + 0x38ba7d9d]
inc ecx
mov eax, dword [eax]
dec ecx
add eax, 4
neg ebp
inc ecx
xor eax, edi
inc esp
movsx ebx, bh
inc eax
not ch
inc ecx
movzx edx, bx
lea eax, [ebp + eax + 0x5a4c0c79]
neg eax
dec eax
lea ecx, [edi*2 + 0x7bbda794]
inc esp
mov esi, edx
neg dl
dec eax
rol eax, 3
dec ecx
shl ebx, 0xa6
neg eax
inc ecx
add cl, bl
lea eax, [edx + eax - 0x688a4ff9]
inc ecx
sal dh, 0xe3
sal dl, 1
inc ecx
push edi
dec esp
lea esp, [edx*8 + 0x1707b32a]
mov esi, ebp
xor dword [esp + edx*2 - 0x1fefc], eax
inc ecx
pop edi
dec eax
arpl ax, ax
inc esp
movsx ecx, di
call fcn.100a9683
mov edx, 0xd4bdb707
movzx eax, dl
mov ecx, edx
mov ax, word [edi + eax - 7]
btc ecx, edx
movzx ecx, byte [ebp]
xor cl, bl
add edx, edx
btc edx, edx
dec cl
btr edx, 0xaf
imul dx, dx
sub edx, edx
xor cl, 0x1b
bswap edx
rol cl, 1
inc cl
shl edx, 0xf6
xor bl, cl
sub edx, edx
adc ecx, esp
btr edx, edx
rol edx, 0x98
call fcn.100bfdc7
sub ecx, 0xadb61396
xchg edx, eax
not ecx
xor ebx, ecx
add eax, edx
btr eax, edx
add esi, ecx
movzx eax, byte [ebp + edx*8 - 0x5233bd08]
movsx ecx, dx
lea ebp, [ebp + edx*2 - 0x148cef41]
xor al, bl
pop edx
pop edx
mov dword [esp + ecx*2 - 0xef42], ecx
add al, 0x2b
ror al, cl
not ecx
inc dword [esp + edx - 0x4cb8291e]
sub al, 0xa7
imul cx, dx
neg ecx
shr cl, 0xe3
ror al, 1
call fcn.10161ff2
mov edx, dword [ebp]
mov ecx, 0x11911d8d
lea eax, [ecx*2 + 0x150aa1bd]
xor edx, ebx
btr eax, 0xd
adc cl, cl
cwde
xor edx, 0xbdad521a
ror edx, 1
ror cl, 0x43
and ecx, eax
not edx
not ecx
adc cl, 0x91
rol edx, 1
bts ax, ax
sal ax, cl
xor ebx, edx
add esi, edx
mov ecx, dword [edi]
mov edx, 0x8b22b491
mov edx, dword [edi + 4]
add edi, 8
add ecx, edx
xor al, al
mov edx, 0xfbae1433
rol eax, 0x87
mov edx, ecx
adc eax, eax
movzx ecx, al
movzx eax, byte [ebp + ecx*2 - 0x1fa]
sbb ecx, ecx
jnp 0x1009a34e
sbb ebp, 0xfffffffa
sub ecx, ecx
xor al, bl
not cl
sub al, cl
xor al, cl
push ecx
jmp 0x1009ff12
btr cx, 0x3c
neg al
dec ecx
bts ecx, 0x29
xor bl, al
ror cl, 0x61
neg ecx
jo 0x1016196e
add eax, esp
neg cx
bts ecx, ecx
mov dword [eax], edx
lea edx, [ecx - 0x414b4dde]
jmp esi

Function at 0x101cf504
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x5b149b21
lea esp, [esp + 4]
call eax
jmp 0x100a5fb6
jmp 0x100f940a
Function at 0x101d0c87
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + edx - 0x48af], edi
push edi
inc esp
xor dword [esp + edx*4 - 0x122cc], ebx
dec esp
mov edi, dword [esp + edx*2 - 0x915e]
dec eax
imul edi, dword [esp + edx*8 - 0x245b0]
dec ebp
arpl bx, bx
sal cl, 0xc5
inc ebp
btc esp, esp
dec ebp
adc edx, ebx
sal word [esp + edx - 0x48b1], 0x8e
inc bp
movzx ebx, byte [ebp + edx*2 - 0x916e]
push edi
inc ecx
mov bh, byte [ebp + edx - 0x48b5]
dec eax
sar dword [esp + edx*4 - 0x122cc], 0x94
dec esp
mov dword [esp + edx*2 - 0x9156], esp
call fcn.101d7816
xchg ebx, eax
jns 0x100fb460
enter 0x7058, 0xffffffffffffff8d
and eax, 0x348c2363
lea esp, [0x688c2f63]
lea esp, [0xa4d0b263]
inc ecx
arpl si, bx
push eax
mov ecx, dword [ebp - 0x65]
xor cl, byte [0xb0329bf9]
push ebp
test al, 0xc8
movsb byte es:[edi], byte [esi]
mov byte [0x27effac3], al
fcomp dword [eax + 0x52]
popal
mov byte [ebx], dl
lahf
push cs
das
xor esi, 0xff8f6a48
invalid
movzx esi, dx
inc ecx
rol ebx, 3
dec eax
lea edi, [edx + ebp*4 + 0x7b0077ae]
inc ecx
dec ebx
dec eax
mov dword [esp + edx - 0x48b7], edi
jmp 0x100fb460

Function at 0x101d5cab
Capabilities:
Encode data using xor

Disassembly:
call fcn.100f3291
inc ecx
pop ecx
inc ecx
pop ecx
dec esi
mov ecx, dword [esp + ecx - 0xc0a63c6]
jmp 0x100f4dd9

Function at 0x101dc272
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec ecx
bt esp, 0x3d
and di, cx
dec edi
lea ebp, [ebp - 0x9e]
rol bx, 0xe7
jbe 0x101510a6
mov esi, 0x299fdea4
push esi
inc eax
mov byte [esp + esi - 0x299fdea1], dh
inc edx
movzx edx, word [esi + eax - 0x299fdea4]
dec esi
lea eax, [esi + eax - 0x299fdea2]
call fcn.1016046c
inc di
mov esi, dword [esi + ebp - 0x32bfe3a0]
jae 0x100c667b
dec ebp
lea ebp, [ebp + edx*2 - 0x1dfec]
inc esi
mov dword [edx + ebp - 0xeff4], ecx
push edi
inc ecx
pop esp
jne fcn.100e032f
dec esp
lea ecx, [edx + eax + 0x4ba469bd]
inc ecx
xor ebp, edi
mul dword [esp + eax - 0x59b40794]
movzx esi, word [esp + eax*2 - 0x32b3dff9]
and byte [esp + eax - 0x1959eff7], ch
ror ebp, 2
inc ecx
push esi
inc ebp
sub cx, 0x1121
ror ebp, 3
jmp 0x1010375e
inc esp
xadd edx, esp
dec ebp
arpl bx, bx
dec ebp
adc edx, ebx
or eax, 0x64a9c508
dec ebx
mov esi, dword [ebp + esi - 0x32bfe3a8]
jns 0x100e533b
dec edx
mov dword [esp + esi - 0x32bfe3a8], 0x132d5b02
inc ecx
movsx ebx, ah
inc ebp
xor ebx, edi
inc ecx
not ebx
inc edx
movsx eax, word [esp + esi*2 - 0x657fc74e]
inc ecx
mov edi, esi
inc ecx
neg ebx
inc ecx
movzx edx, dh
inc edx
mov dword [esp + esi - 0x32bfe3a6], 0x183d508
inc ecx
bswap ebx
inc edx
and byte [esp + 0x72a6cc06], 0x22
inc ecx
inc ebx
inc ecx
rol ebx, 1
dec edx
not dword [esp + esi - 0x32bfe3a8]
dec esi
mov dword [esp + esi*2 - 0x657fc750], edi
inc ebp
movzx ecx, dh
inc cx
rol esp, 0xc9
inc esp
xor dword [esp + eax*4 - 0x4cb4], ebx
movsx ecx, bl
inc cx
bt esp, ebx
dec ebp
lea edi, [esp + ecx*8 + 0x120dea33]
inc ecx
pop edi
jb 0x101164da
jmp 0x101dc36c
dec dword [edi]
test dword [ebx], esi
adc ebp, ebp
inc dword [ebx - 0x3d09bf16]
mov cl, 0xf8
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 8
pxor mm7, mm7
push ecx
movd mm6, ebx
mov ebx, 0x80008000
push edx
punpckldq mm6, mm6
movd mm5, ebx
push edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
punpckldq mm5, mm5
movq mm0, qword [edx]
movq mm2, qword [edx + 8]
movq mm4, qword [edx + 0x10]
movq mm1, mm2
psrlq mm2, 0x20
punpckldq mm2, mm4
paddd mm0, mm2
movq mm3, mm4
psrlq mm4, 0x20
sub eax, 4
jl 0x401109
jmp 0x401060
pxor mm5, qword [ecx]
add edi, 8
add ecx, 8
movq mm2, qword [edx + 0x18]
punpckldq mm4, mm2
paddd mm0, mm2
paddd mm1, mm4
movq mm4, mm5
punpcklwd mm5, mm7
punpckhwd mm4, mm7
pcmpeqd mm7, mm7
psubd mm0, mm5
pslld mm7, 0x12
psubd mm1, mm4
pslld mm5, 4
pslld mm4, 4
psubd mm5, mm0
movq mm0, mm6
paddd mm5, mm7
paddd mm4, mm7
psrld mm7, 0x1e
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm5, mm0
movq mm0, qword [edx + 0x20]
psrad mm5, 3
paddd mm1, mm0
add edx, 0x10
psubd mm4, mm1
movq mm1, mm6
sub eax, 4
pand mm1, mm4
paddd mm4, mm7
psrld mm1, 3
paddd mm4, mm1
movq mm1, mm2
psrad mm4, 3
psrlq mm2, 0x20
packssdw mm5, mm4
movq mm4, mm0
movq mm0, mm3
punpckldq mm2, mm4
movq mm3, mm4
psrlq mm4, 0x20
movq qword [edi - 8], mm5
movd mm5, ebx
paddd mm0, mm2
punpckldq mm5, mm5
pxor mm7, mm7
jge 0x401060
add eax, 4
jle 0x401193
pxor mm5, qword [ecx]
movq mm2, qword [edx + 0x18]
punpckldq mm4, mm2
paddd mm0, mm2
paddd mm1, mm4
movq mm4, mm5
punpcklwd mm5, mm7
punpckhwd mm4, mm7
pcmpeqd mm7, mm7
psubd mm0, mm5
pslld mm7, 0x12
pslld mm5, 4
psubd mm1, mm4
psubd mm5, mm0
paddd mm1, qword [edx + 0x20]
pslld mm4, 4
paddd mm5, mm7
psubd mm4, mm1
movq mm2, mm6
paddd mm4, mm7
psrld mm7, 0x1e
pand mm2, mm5
paddd mm5, mm7
psrld mm2, 3
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
paddd mm5, mm2
paddd mm4, mm6
psrad mm5, 3
psrad mm4, 3
packssdw mm5, mm4
cmp eax, 2
jl 0x40118d
movd dword [edi], mm5
je 0x401193
psrlq mm5, 0x20
add edi, 4
movd edx, mm5
mov word [edi], dx
pop edi
pop edx
pop ecx
pop ebx
ret
Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x632042]
mov cl, byte [0x632049]
mov edx, dword [0x63203c]
xor cl, al
mov eax, dword [0x632048]
and edx, 0xc
and eax, 0xff
sub esp, 0x14
imul edx, eax
mov eax, dword [0x632038]
mov byte [0x632049], cl
mov ecx, dword [0x632034]
push ebx
mov ebx, dword [0x632030]
and ecx, 4
add ebx, ecx
xor eax, edx
push esi
mov dword [0x632030], ebx
mov dword [0x632038], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x635c7c
mov esi, eax
call fcn.00627afc
add esp, 4
test eax, eax
je 0x417c82
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ecx, dword [0x632030]
mov eax, dword [0x632034]
mov dword [esp + 0x18], 0
mov ebx, 1
lea edx, [ecx + ecx]
mov dword [esp + 8], 0
or edx, eax
lea eax, [esp + 8]
mov dword [esp + 0x14], edx
push eax
fild qword [esp + 0x18]
push ebx
push 0
push str.CLSIDa893aa73_054f_4dbc_9e53_f4ee5fe07fd3InProcServer32
push 0x80000000
fadd qword [0x632058]
fstp qword [0x632058]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x63af9c], eax
jne 0x417d4b
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push 0x635c7c
push edx
push eax
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0x63af9c], eax
jne 0x417d13
cmp dword [esp + 0xc], ebx
je 0x417d15
xor bl, bl
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x417d2c
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
mov eax, dword [0x63af9c]
test eax, eax
jne 0x417d4b
test esi, esi
jle 0x417d45
and esi, 0xffff
or esi, 0x80070000
mov dword [0x63af9c], esi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x14
ret

Function at 0x42b0c1
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
fadd dword [edx - 0x5ce000ab]
inc esp
cld
cmpsd dword [esi], dword es:[edi]
iretd
rcl dword [ebx - 0xc], cl
xor ebp, dword [eax - 0x1e]
fninit
sub ax, 0xfa33
mov byte [0x750f5f5a], al
mov cl, 0x17
jne 0x42b03e
pop ss
cli
adc eax, 0xd4da9d42
std
xor esp, ebp
dec ebx
jg 0x42b08b
ret
add byte [eax + 0x6b], bl
xor al, 0xd6
pop ebp
mov esp, 0xff855ba5
dec ebp
cmp eax, 0xb60d1404
div dword [ecx - 0x1d]
jle 0x42b07b
ret 0xc472
Function at 0x628ee9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632428
cmp edx, dword [eax]
je 0x628f0b
add eax, 8
inc ecx
cmp eax, 0x6324b8
jl 0x628efc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632428]
jne 0x629039
mov eax, dword [0x63afb4]
cmp eax, 1
je 0x629013
test eax, eax
jne 0x628f3c
cmp dword [0x632354], 1
je 0x629013
cmp edx, 0xfc
je 0x629039
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628f73
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006298d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629d60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628fb6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629d60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea8c
push edi
call fcn.0062bc30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006298d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006298e0
lea eax, [ebp - 0xa0]
push 0x62ea6c
push eax
call fcn.006298e0
push dword [esi + 0x63242c]
lea eax, [ebp - 0xa0]
push eax
call fcn.006298e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062bba4
add esp, 0x2c
pop edi
jmp 0x629039
lea eax, [ebp + 8]
lea esi, [esi + 0x63242c]
push 0
push eax
push dword [esi]
call fcn.00629d60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret