joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10134c01
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
push eax
push esi
push ebp
mov ebp, 0x54b1bb0d
push edi
pushfd
sub bp, 0x28a5
mov edi, ebp
jle 0x1023bd58
mov eax, dword [esp + ebp - 0x54b19254]
or ebp, 0xa8aa451c
jns fcn.10267742
sub edi, 0xf8bfb628
jle 0x10250a0e
push edx
push 0xf938441e
pop esi
lea eax, [eax + edi - 0x5bf1dc3f]
mov edx, 0x253ff9b7
call fcn.101ea9ef
push 0xf681162f
jmp 0x10123158
js 0x1019d13a

Function at 0x10140d05
Capabilities:
Packed with generic packer

Disassembly:
push ecx
call fcn.102491dd
xor ebp, 0x7d3c62a1
lea edx, [edx + ebp + 0x51ebff17]
js 0x101a397a
add dword [esp], 0xfff944e5
add dword [esp + 4], 0xefdd23bd
mov dword [esp + 0x18], ebp
xchg dword [esp + 0x20], edx
mov ebp, dword [esp + 0x10]
shl word [esp + 0x18], cl
jbe 0x1010ac34
xor cx, cx
call fcn.10104732
pop es
popfd
xchg ebp, eax
jae 0x10140dc5
jmp 0x10140d7e
mov al, 0xca
sbb bh, ah
test byte [edi + 0x11fc8cd1], 0x31
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
aas
je 0x10140d8a
not dword [ecx + ebp*4]
and dword [esi + 0x39], edi
jmp 0x10140db7
or byte ss:[edx], ch
push 0x3ac53dcf
push esp
xlatb
push edi
and bl, cl
mov dl, 0x18
jbe 0x10140db9
inc eax
dec eax
outsb dx, byte [esi]
outsd dx, dword [esi]
sbb ah, bl
or dl, ah
loop 0x10140d43
fsubr dword [eax + 0x2277dede]
mov byte [0x8ebaa3e2], al
dec ecx
jbe 0x10140dbb
mov cs, word [ecx + 0x76]
adc edx, dword [ebx + 0x7c]
stc
push ebx
jl 0x10140da4
js 0x10140d42
add eax, 0xafdf589
inc esi
out dx, al
jnp 0x10140e13
invalid
faddp st(4)
pushal
mov dh, 5
fcmove st(0), st(1)
cmpsb byte [esi], byte es:[edi]
int3
add eax, 0xcca6c9da
outsd dx, dword [esi]
xchg byte [eax - 0x26], cl
cmp bh, byte [edx]
xchg byte [eax + 0x5dca1564], ah
cmp al, byte [esi - 0x35ea9b60]
pop ebp
shr dword [ebx], 0x1c
xchg ebx, eax
dec ebp
push 0x4a856f17
add eax, 0xa5d845dd
mov esi, dword [edx + edx*8]
mov ch, 0xa3
lsl edi, word [edi - 0x1f09ae67]
ficom dword [eax + 0x50]
in al, dx
retf 0x7f0e
invalid

Function at 0x10145221
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ecx + ebx - 0xaffbe1c]
pushfd
or bl, 0x97
js 0x10234474
neg dword [esp + ebx - 0x6d31ffa3]
add word [esp + ebx - 0x6d31ffa3], bx
push ecx
xchg dword [esp + ebx - 0x6d31ff9b], ecx

Function at 0x10167d02
Capabilities:
Packed with generic packer

Disassembly:
shr word [esp + 9], 0x2e
xor ebx, eax
sub ebp, 4
jmp 0x101a2d04
call fcn.10185a64

Function at 0x10169db0
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp], 0xfffff96f
and cx, cx
Function at 0x10196b60
Capabilities:
Encode data using xor

Disassembly:
add al, ch
shl edx, 1
cli
inc dword [eax - 0x43cfdbbc]
add byte [esp + 0x30], 0xbc
add byte [esp + 0x30], 0xbc
call fcn.101f7f37
xchg byte [ecx - 0x12dd3c77], bh
in eax, dx
mov edi, 0x596d2ccf
xor dword [edx], 3
pop es
out 0x54, eax
daa
sbb dword [ecx - 0x16], esi
jne 0x10196bb8
ljmp 0xc9c9:0xec793775
jns 0x10196b6f
leave
leave
jp 0x10196b5a
jb 0x10196be0
shl byte [ecx - 0x77411a86], cl
sbb byte [ebx + 0x68a4384a], bl
xor byte [edx + 0x201113fa], dh
inc eax
invalid
inc eax
ja 0x10196bff
invalid
out dx, al
or dword [eax + 0x5c], esp
or byte [edi + 0x51d81a32], bl
add al, 0x34
sal byte [edi + 8], 0x2a
jb 0x10196b7e
ja 0x10196bea
sub dh, byte [edx - 0x67]
dec eax
dec ebx
mov dh, 0xfd
adc edx, dword [ecx]
add byte [eax], al
push cs
adc dword [eax], eax
add byte [esi], cl
out dx, al
xor bl, ah
sbb eax, 0x774bb12b
aas
dec esi
jge 0x10196bd3
bound ebx, qword [edi]
adc edx, dword [edx - 0xc42f4cd]
invalid
xor ecx, dword [ebx]
mov ebp, 0xa83d0ff3
mov esi, 0x7615f170
dec edx
bnd jns 0x10196bb7
int 0x32
in eax, 0xb5
xor byte [edx + 0x1493abb4], bl
and ebx, dword [eax + ebp*4 + 0x59]
int 0xd5
push edx
neg dword [ecx - 0x5dfcf207]
xchg esp, eax
adc eax, 0xce213e10
cmp bh, dh
fldenv [ebx - 0x67]
push ds
mov ebx, 0xccea36e1
test byte [ebx + ebp*2 + 0x7a5466ea], 0x6b
cmp eax, 0x29aecd01
mov word [ebp + 0x2a], fs
fsub qword [ecx + 0x2d15f8ad]
sub dl, bh
add ch, byte [eax - 0x1691fb7a]
dec esp
and al, byte [esp + edi*2 - 5]
int3

Function at 0x1019e2e0
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp - 0x2ac3c243]
mov dword [esp + 0x20], 0xc693c5be
mov dword [esp + 0x14], 0xef2aa6a0
mov dword [esp + 0x14], 0xaf037098
not word [esp + 0x14]
mov word [esp + 0x14], 0x26b3
call fcn.101b8534
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi + 0x46c8c33a]
call fcn.1019d1df
Function at 0x101a2d09
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1012f06f
jne 0x10255122
fcompp
out dx, eax
and cl, ch
popfd
rcl dword [esi - 0x1e10b125], cl
ja 0x101344c5
inc ebp
stc
pop es
dec esi
or edi, dword [edx]
arpl word [eax], di
insd dword es:[edi], dx
fidiv dword [edi + 0x39]
adc dl, byte [edx + edi*2 - 0x25]
imul edi, eax, 0x56423b1c
dec edx
pop ds
pushal
adc al, 7
inc edx
push 0xffffffffffffffc3
push 0x4c2f0416
dec esp
int 0x79
mov bh, 0xae
retf
setns byte [esp + 0x14]
jbe 0x1023448b
or dword [esp + 0xc], 0x2ca7eb15
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x28]
ret
mov ebp, dword [esp + ebp*2 + 0x67f4a5be]
mov dword [esp + esi + 0x60fa0430], 0x5b3fb72a
mov word [esp + esi + 0x60fa0438], 0x5e86
mov esi, dword [esp + esi + 0x60fa0440]
add dword [esp + 0xc], 0x93b39411
not byte [esp + 0xc]
sub dword [esp + 0xc], 0x28950bb6
cmp byte [esp + 0x10], 0x1c
ja 0x1015866d
add si, word [esp + ebp*2 + 0x67f4a5a6]
add si, si
cmp word [esp + ebp + 0x33fa52d9], 0xb832
jne 0x1017c691
call fcn.1019ab72
jmp 0x101d57d8
dec eax
not ecx
call fcn.1022c0f4
push 0x9e2b1909
mov edx, 0xd72def24
xor dword [esp], edx
mov esi, dword [edi]
push edx
movzx dx, byte ss:[esi]
jnp 0x10134488
sbb word [esp + 5], 0xe5b4
call fcn.101f0f85
mov ebx, dword [esp + ebx - 0x6d31ffa3]
not byte [esp + 0x18]
mov edi, dword [esp + 0x18]
mov di, word [esp + 0x19]
call fcn.101f7406
jmp 0x1025d79c
js 0x101fd51e
rol cl, 1
mov byte [esp + 4], 0x2f
sal dword [esp + 4], 0x8f
inc cl
push 0x9592b21a
jmp fcn.101e4eff

Function at 0x101a4828
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 8], ebx
call fcn.10101e23
popfd
push 0x32
dec esi
rcl dword [esp + esi*2 - 0x1c]
sub dword [bx], esi
add byte [0x333e815d], cl
cmp edi, dword [edi + 0x5457f38]
xchg esi, eax
pop dword [ebx + 0x6d5d08f1]
or edx, dword [esi + 0x40f12b01]
xor ecx, dword [0x1a05fa31]
mov bh, 0x1d
xor edx, edi
add eax, 0x1db7361a
fcom dword [eax]
adc dword [eax], eax
add byte [eax], al
mov al, 0xf5
sub dword [eax + ecx + 0x36], esp
mov edi, 0x4250deeb
xor ch, al
add dword [ebp + 0x610d88fe], eax
pop ds
push edi
sub bl, byte [esi]
cmp dword [ebx], ecx
or dword [eax + eax], ebx
rcl byte [eax - 0x740348e4]
das
inc ebx
cmc
push dword [eax + 0x248ea60b]
movsd dword es:[edi], dword [esi]
xchg esp, eax
nop
jo 0x101a4857
stosb byte es:[edi], al
xchg esi, eax
invalid

Function at 0x101ab37b
Capabilities:
Packed with generic packer

Disassembly:
shr dword [esp + 8], 0x3c
push 0x3b87203b
add eax, edx
sar dword [esp + 0xc], 0x91
jae 0x101b4185
cmp ecx, dword [edx - 3]
xor ah, byte [eax - 0x1c]
arpl word [esi + ebx], sp
pop esi
int 0x83
out 0x22, al
push 0x54
sbb bh, dh
mov dh, 0x82
xor al, 0xb9
add byte [esi + esi*8], ch
inc edi
in al, 0xca
push ss
test eax, 0x97087436
iretd
Function at 0x101ab534
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + edi*2 - 0xf5042], 4
add dword [esp + ecx*2 + 0xc], 0xefedbb37
xchg dword [esp + ecx*2 + 0x30], ebp
mov dword [esp + edi - 0x493ec24d], edi
shr dword [esp + edi - 0x493ec245], 0x9b
push ecx
mov ebp, dword [esp + edi - 0x493ec249]
mov ebp, dword [esp + ebp - 0x493ec23d]
mov ebp, dword [ebp + edi - 0x493ec25d]
not byte [esp + edi - 0x493ec249]
mov edi, 0xf505a627
shr edi, 0xcd
sete byte [esp + edi*2 - 0xf5046]
mov ecx, dword [esp + edi*2 - 0xf503e]
cmp dword [esp + edi - 0x7a819], 0x66a9bbbb
mov dword [esp + edi - 0x7a80d], edi
lea ebp, [ebp + edi*2 - 0x4070750]
push edx
jge 0x101521ff
jg 0x101c1ec7
js 0x10176ddd
mov dword [esp + 8], 0xfda0c28b
add byte [esp + 8], 0xd
mov dword [esp + 8], 0xbf61e4d6
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1014650c
mov edi, 0x13ae9819
dec edi
mov cx, word [edi + ebp - 0x13ae9818]
mov di, word [edi + ebp - 0x13ae9816]

Function at 0x101ba12b
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0x82d0e
push ebp
mov ebp, 0x7392dcb6
sub ebp, 0x1fae5f16
bswap ebp
mov eax, dword [esp + 0x10]
or ebp, 0x829db9b5
push esi
jge 0x100f0e68
mov esi, 0xd1ecc1c
test ebp, ebp
lea eax, [eax + 1]
lea ebp, [ebp + ebp - 0x65515af5]
not bp
push esi
call fcn.100f6bc1
call fcn.102288c9

Function at 0x101bc2fe
Capabilities:
Packed with generic packer

Disassembly:
cmp dl, 0x25
not dx
mov ebp, dword [esp + edx - 0x5a257c61]

Function at 0x101bc92a
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1010d885
int3
mov dword [esp + edx*2 - 0x542c9952], edx
neg word [esp + edx - 0x2a164ca3]
mov edx, dword [esp + edx*2 - 0x542c994e]
pushfd
add dword [esp + 0x10], 0x7235
mov edx, 0x2a164cab
or dl, 0x25
ja 0x1012b286
call fcn.10132317
mov edx, 0x2781bd07
mov eax, edx
bswap eax
rdtsc
jmp 0x1009c687

Function at 0x101bcea4
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [esp + 0x38], 0x12b69bbf
not byte [esp + 0x2c]
call fcn.1022dbbd
stc
int3
shl word [esp + ecx - 0x78bbc5e9], cl
mov ecx, dword [esp + ecx - 0x78bbc5e1]
jg 0x1012ad88
jo 0x100f557b
add eax, esp
push edi
jb 0x101bcf36
push cs
xchg ecx, eax
in al, dx
aam 0x98
ja 0x101bcf23
push 0x18
loope 0x101bcec7
hlt
hlt
mov cl, 0x5f
int 0x5e
invalid
Function at 0x101c3c06
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x101d922f
add edi, edi
mov dword [esp + 0x1c], ebx
jae 0x101eaeb9
jmp 0x1025fef7
push edi
mov dword [esp], 0x2c4ebb80
call fcn.1024f2bf
mov esp, ebp
pop ebp
jmp 0x100059d3
add edi, edi
sub edi, 0x13b75523
jo 0x101fa808
add edi, edi
adc esp, edx
invalid
mov bl, 0x4e
pop ebx
push 0xffffffffffffff8d
lea esp, [esp + 0xc]
jmp fcn.10260e02
cmp al, 0x1a
scasd eax, dword es:[edi]
jmp 0x101fa816
or word [esp + edi + 0xeebaf0e], 0x7f14
mov byte [esp + edi*4 + 0x3baebbd0], 0xb4
jae 0x10257f31
mov ebx, 0xfb43bae
adc dword [ecx], 0xffffffd7
add eax, 0x49ab1500
xor dh, al
adc eax, 0xf03249ab
loopne 0x101fa8a3
popal
wait
in al, 0x2e
jb 0x101fa803
pop ecx
xor dl, al
in al, dx
or cl, dh
jecxz 0x101fa7bb
salc
test eax, 0x4898160c
xchg edi, eax
mov word [edi + 0x6c], ds
xchg edx, eax
in eax, dx
add eax, 0x4b2e8a3c
ja 0x101fa7e0
test byte [eax + 0x27], cl
mov dword [0xf6244e3d], eax
push ds
invalid
test eax, 0x36bd5f30
les edx, [ebp + 0x6c]
mov al, byte [0xbcb7a515]
xchg dword [eax], esp
popfd
cmp eax, 0x6455c8b1
loop 0x101fa895
and byte [ebp + 0x55c8b13d], bl
loop 0x101fa895
mov byte [0x87eb1e69], al
dec ebx
stosb byte es:[edi], al
xor bh, byte [eax]
sub bl, byte [edx + 0x18]
stc
inc ebp
adc byte [ecx], 0x3b
xchg esp, eax
dec byte [esi + 0x3922e4c]
inc ecx
out dx, al
test byte [edi], al
cmp eax, 0x2b9705df
inc ebx
xor eax, 0x9bdab01f
aaa
je 0x101fa90a
or dword [edi - 0x11], ecx
out dx, eax
js 0x101fa90f
push ebp
bound esp, qword fs:[edx + 0x23]
pop esi
sub dword [ecx], eax
invalid
in al, dx
or eax, 0x6455f8b4
loop 0x101fa8d8
loop 0x101fa8d8
nop dword [ecx + 0x191341f0]
stosb byte es:[edi], al
wait
sahf
dec eax
mov edx, ebp
imul edi, dword [0x833fe507], 0xa21d9baa
mov ecx, 0xa81cffab
or al, 0xc5
mul ebp
xor ebp, dword [ebx - 0x72]
in al, dx
add al, 0x68
adc al, dl
retf
add dword [esp + edi*4 + 0x3baebbb8], 0xefee9655
mov edi, dword [esp + edi*4 + 0x3baebbbc]
or byte [esp + 0x18], 0x26
or dword [esp + 0x18], 0x681fa306
call fcn.101d211b
pop ebx
jmp 0x101d9370
jmp 0x1012933e

Function at 0x101de2d9
Capabilities:
Packed with generic packer

Disassembly:
push ebx
not word [esp + 0x10]
xchg dword [esp + 0x28], ebx
mov esi, dword [esp + 0x14]
je 0x1017c6b4
xor word [esp + 0x18], 0x52be
add dword [esp + 0x1c], 0xefde48fc
shl byte [esp + 0x10], 0x37
sub dword [esp + 0x10], 0xebbb8d19
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x28]
ret

Function at 0x101e4ef5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.1016453a
call fcn.102350e6

Function at 0x101e85f1
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
shr word [esp + 0xc], 0x6a
mov eax, dword [esp + 0x14]
and byte [esp + 0xc], 0xba
mov word [esp + 0xc], 0x8290
xor word [esp + 0xc], 0x4f85
jb 0x101152d2
mov dword [esp + 0xc], 0xcfbd7131
shr dword [esp + 0xc], 0x5a
sets byte [esp + 0xc]
sub byte [esp + 0xc], 0x2c
lea eax, [eax + 1]
call fcn.101dd238
Function at 0x101e8633
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
jge 0x1022caf9
jge 0x1024b722
shr dword [esp + 0x14], 0xb6
cmp byte [esp + 0x1c], 0x1c
setg byte [esp + 0x14]
push dword [esp + 0x28]
popfd
lea esp, [esp + 0x30]
add dword [esp + edi - 0x583bb168], 0xefea9cdf
mov dword [esp + esi*4 - 0x1a30d818], ebp
mov ecx, dword [esp + esi - 0x68c35f1]
mov ebp, edi
xchg dword [esp + edi - 0x583bb140], edx
mov edi, dword [esp + ecx + 0x3fff3e6a]
lea esi, [ebp + ecx*2 + 0x77a8588b]
lea ecx, [ebp + esi*8 + 0xb123637]
call fcn.101ffdb2

Function at 0x101ff147
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
setne byte [esp + 0x34]
and dword [esp + 0x34], 0xb5bc3013
shl dword [esp + 0x14], 0xf3
shr word [esp + 0x34], 0x49
jb 0x1017c6b4
call fcn.100a0ed8
call fcn.1021515c

Function at 0x102014ae
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
jg 0x1010209c
jo 0x10228c8c
lea ebp, [ebp + edx*2 + 0x679139bd]
shl si, 0xcb
test edi, 0xc0a5f037
lea edi, [esi + edx*4 - 0xf438158]
xchg dword [esp + edx - 0x50a06c8], ebp
mov esi, dword [esp + edx - 0x50a06dc]
call fcn.1010bb39
mov eax, dword [ebp]
push 0x10144420
mov esi, dword [esp]
lea ebp, [ebp + esi*4 - 0x4051107c]
sub dword [esp + esi - 0x10144420], 0xb52f9d1d
sal dword [esp + esi - 0x10144420], 0xb4
movzx ecx, byte [esp + esi*4 - 0x40511080]
mov edi, eax
jns 0x100dce81
sub bh, byte [esi - 0x2843c03e]
and esp, esi
insd dword es:[edi], dx
pop esi
inc edi
pop eax
jle 0x10201584
cmp ebx, ecx
sub ch, bh
out dx, eax
mov ecx, dword [edi]
mov eax, 0x96859505
jmp 0x1026864b
sub dl, byte [ecx]
add byte [eax], al
add byte [eax + 0x46], dl
sbb byte [ebp - 0x112a71], ah
invalid
stosb byte es:[edi], al
shr bp, 0xf0
setns dl
je 0x101044a5
mov ebp, 0x77f6b2e1
push ebx
add edi, ebp
fist word [ecx + 0x65]
mov ch, 0xdd
push ds
bound edx, qword [eax + eax + 0x3e6e1508]
sub al, 0x76
imul ebx, edi, 0xa0dc6c6c
imul ebp, dword [ebx + 0x59], 0xde0fadbb
movsb byte es:[edi], byte [esi]
xor dword [0x65b743], edi
xlatb
lodsb al, byte [esi]
add byte [ebp + 0x13], al
rcl dword [0xab4a714b]
push esi
pushal
sbb byte [ebp - 0x6edb5461], 0x89
sal byte [ecx], cl
pushfd
jecxz 0x10228c84
leave
in eax, dx
sub byte ss:[ecx], dl
jg 0x10228c9a
out dx, al
cmpsd dword [esi], dword es:[edi]
inc ebp
and ch, byte fs:[edx]
jne 0x10228d34
push eax
in eax, 0xa6
inc dword [ebx - 1]
mov edx, 0xb86cb92a
mov bh, 0x44
xchg esi, eax
pop ebx
inc ebx
invalid
xchg edx, eax
test bl, bh
xor eax, 0x9f7c0837
loopne 0x10228d6c
int 0x80
xchg esi, eax
cdq
cmp ebp, dword [eax - 0x750ae99e]
inc esp
xlatb
imul bl
jbe 0x10228d70
insd dword es:[edi], dx
imul ecx, dword [esi + ebp - 0x64c500bd], 0x8d04deac
cmp bl, byte [ebx - 0x72fb2154]
dec esi
fld dword [0xbcad9b]
inc ebp
sbb edx, dword [ebx*8 + 0x34ceef7c]
xchg esi, eax
mov esp, 0xd0ffc500
mov ch, 0xcd
inc eax
vaddsubps ymm6, ymm0, ymmword [ebp + 0x33bc40cd]
lea esp, [edx]
pop ebp
int 0x40
mov esp, 0x5d228d33
xchg ebx, eax
jo 0x10228d54
xchg esi, eax
or bh, ah
push edi
mov ecx, 0x13be5d37
invalid
cwde
mov al, byte [edi + 4]
call fcn.101d75c7
push 0xde9c1634
lea esp, [esp + 4]
jmp fcn.1013c06d
Function at 0x102047b0
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
not bx
mov ebx, dword [esp + edi + 4]
mov dword [esp + edi*4 + 0x28], ebx
mov dword [esp + edi + 4], edi
mov dword [esp + edi + 4], edi
movsx di, byte [esp + edi*8 + 6]
je 0x100f8c7d
push esi
add dword [esp + 4], 0xdd21e
push edi
or edi, dword [esp + edi*4]
push edi
mov ebx, 0xdd8d06a1
sub bx, bx
add byte [edi - 0x45], dl
mov eax, dword [0x66dd8d06]
sub ebx, ebx
mov esi, dword [esp + edi*2 + 4]
xor bx, bx
mov ebx, dword [esp + esi*4 + 0xc]
mov ebx, dword [ebx + edi*2]
test word [esp + edi*2 + 5], si
call fcn.10178f74
jno 0x101f9dbd
sub ah, byte [ecx + 0x3f]
sub byte [ebx], 0x37
je 0x101f9d27
cmp eax, 0x3a5905d8
add dword [edi], esi
mov dl, 0x3f
scasd eax, dword es:[edi]
invalid
mov cl, 0xac
jo 0x101f9d67
add ebp, dword [esi]
mov ebx, 0xa034822b
popfd
inc eax
mov esp, 0x167fd375
jecxz 0x101f9dc3
mov byte [0x502d1f1c], al
pop ecx
mov ebp, 0x2e73691a
aaa
adc edx, dword [edi + ebx]
and esp, esi
and ebp, ecx
jecxz 0x101f9e02
js 0x101f9df5
invalid
jo 0x101f9dc4
wait
popal
mov al, 0x8c
xor al, 0x10
xor al, 0x10
inc ecx
in al, 0x1b
mov bh, 0xe9
lds edx, [ebp + 0x7b5a35a3]
stc
add byte [0xe1980a48], bh
aaa
scasb al, byte es:[edi]
cwde
js 0x101f9d6c
movsb byte es:[edi], byte [esi]
salc
and byte [ebp - 0x5b], cl
and byte [eax], dh
xor eax, 0x17124653
out 0x66, al
in al, 0x95
outsd dx, dword [esi]
ret 0xdaf9
pop ecx
bound eax, qword [esi + 0x17]
mov dl, 0xc3
push ebx
invalid
rcr dword [edi + 0x645ac7a7], 0xbe
js 0x101f9e08
mov esi, 0x8507fd78
cli
pop es
test edx, edi
add esp, ebx
out 0x64, al
das
lodsd eax, dword [esi]
fmul qword [eax + edi*8 - 0x13]
iretd
push ebp
mov dword [esp + ecx*2 + 0x6aa60020], ebx
not cl
mov ebp, 0xf367930
jo 0x101f9ce9
push edx
nop
mov ebx, edi
test di, 0xfd30
lea ecx, [ebp*8 - 0x67416354]

Function at 0x10207b82
Capabilities:
Encode data using xor

Disassembly:
jno 0x102646ba
adc ebp, esi
aaa
xchg bp, ax
xor byte [ecx], dl
cmp eax, 0xab883994
movsb byte es:[edi], byte [esi]
dec dword ds:[eax]
xor dword [edx + 0x61], ebx
sahf
add dword [ebp + 0x16], ebx
and al, 0x50
push esp
invalid
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
add dword [esp], 0xefdb4f77
lea edx, [ecx*4 - 0x14fbec7e]
call fcn.10233f44
xor dword [esi + 0x50214b2e], eax
xor eax, 0x45eb268a
add al, 0x49
push cs
mov bl, 0x7d
jl 0x10264738
xchg esi, eax
out 0x6c, eax
xchg esi, eax
invalid
cld
scasb al, byte es:[edi]
push ss
int3

Function at 0x1021708e
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0x10142e90
jmp 0x100e3613

Function at 0x10225d52
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + ecx*2 + 0x5ca04816]
js fcn.10229b73
mov edx, dword [esp + ecx*4 + 0x61064f60]
mov dword [esp + 0x10], edi
add ecx, ecx
push esi
add dword [esp + ecx*2 + 0x61064f54], 0xc9d4a
add byte [ebp - 0x18], dl
invalid
shr ebp, 0xff
mov dword [esp + 0xc], 0x54af300a
lea esp, [esp + 0x10]
jmp fcn.10118b16
test dx, cx
jg 0x101fc93b
Function at 0x1022bbb7
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
ja 0x100f5ebb
mov edi, 0x2c9bffbe
lea eax, [edi + edi*2 + 0x3e37d901]
mov ecx, dword [edi + ebp - 0x2c9bffbe]
lea ebp, [edi + ebp - 0x2c9bffba]
movzx edx, al
neg eax
and edx, edx
mov esi, ecx
jg 0x101b418b
and al, 0xce
mov eax, dword [0xb29439a4]
test byte [ecx + 0x4ec3c6b5], bh
bound edx, qword [ebp - 0x364d51be]
or eax, 0x7623375
sub dh, byte [ebx - 0x77661643]
push ss
fcmovu st(0), st(4)
test byte [ecx - 0x43], 0x7c
ja 0x1022bc3b
pop ebp
or byte [ecx - 0x4cfbd1a8], ch
dec edi
out dx, al
int 0x7f
int3
cli
out dx, eax
fisubr word [ebx]
into

Function at 0x1022bf4c
Capabilities:
Authenticate hmac

Disassembly:
dec ecx
lea ebp, [esp + ebp - 0x78097296]
dec edi
lea eax, [eax - 0x780972a0]
inc ecx
shl esp, 0x28
inc ecx
sbb ah, 0x97
inc edi
movzx esp, word [eax - 0x12e53cd2]
inc sp
xor esp, edi
push 0xfda5dd04
inc cx
sub esp, 0x64e8e39a
ja 0x100a3880
add byte [esi - 0x7f], ah
je 0x100a38a3
add bh, byte [esi - 0x16d8cb87]
mov esi, 0xe9273479
out 0x97, al
add al, 0
movsb byte es:[edi], byte [esi]
wait
sub esi, dword [edx + 0x43b0800f]
add al, 0
mov dword [esp + ebp*2 + 0x5c99e1f0], ebp
call fcn.101a0886
mov ecx, dword [esp]
mov ecx, dword [ecx + ebp - 0x582905a6]
not word [esp + 1]
jmp fcn.1027c24f
not dx
or ax, dx
mov edx, dword [esp + 8]
lea edx, [edx + 0x19c641]
jmp edx
add dword [esp + ebp + 0x2e4cf0ee], 0xefee27d9
mov eax, dword [esp + eax + 0x73ed5c0f]
mov eax, dword [eax + edx + 0x9cf3345]
or dword [esp + edx*4 + 0x273ccd20], ebp
jno 0x1011adcc
inc ecx
mov esp, 0x7809729e
inc ebp
movsx edi, sp
inc ecx
sar bh, 0xc4
dec ebp
mov edi, dword [esp + ebp - 0x7809729e]
jbe 0x100a3846
push 0x7f2b9b9c
sub esi, 2
not ax
push 0x98ba05a5
jmp 0x1011daab

Function at 0x1022cb35
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
js 0x10127b69
call fcn.1025efa8
call fcn.100fd49b
jae 0x101a589c

Function at 0x10234b64
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor

Disassembly:
not byte [esp + ebp - 0x6bae2824]
jb 0x101504ae
add dword [esp + ebp - 0x6bae283c], 0xefe9b7d3
lea esi, [esi + ebp - 0xc77ca13]
xor ebp, 0x7f029316
shl bp, 0x41
xor ebp, ebp
jge 0x100fb01c

Function at 0x1024373c
Capabilities:
Encode data using xor

Disassembly:
ja 0x101fccd3
push edi
mov edi, 0xd0380115
or bl, 0xba
and edi, 0x1282be90
mov ebx, dword [esp + 0xc]
mov dword [esp + 0xc], ebp
bswap edi
jns 0x100d33d9

Function at 0x1024936b
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xeff16ade
call fcn.10243544

Function at 0x1024c72c
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x9f020aa5
jo 0x101094fb
sets dl
push ebx
mov edx, dword [esp + ebp*2 - 0xd5209f8]
mov edx, dword [edx + ecx - 0x5f9b7e31]
sub ebp, dword [esp + ebp*2 - 0xd5209f0]
test word [esp + ecx - 0x5f9b7e1d], 0x412
lea ecx, [ecx + ebp + 0x723ae7a4]
sets byte [esp + 0xc]
lea edx, [edx - 0x4d7275f2]
jle 0x10163bb5
call fcn.1011611e
lea edi, [edi + 1]
and dl, 0x12
xor dl, 0xbf
jge 0x10169dbb
or edx, 0xe89b5f9c
shl dl, 0x7c
je 0x1010887f
Function at 0x102562cd
Capabilities:
Encode data using xor

Disassembly:
call fcn.1016120b
std
mov ebp, dword [esi + 0x774547f8]
invalid

Function at 0x10267090
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop edx
push edi
pushfd
mov edi, 0x4badd0a7
shr edi, 0x59
shr di, 0x12
sub edi, 0xb8ba7ac
cmp edi, 0x2f8394
xchg dword [esp + 8], edx
jl 0x10119d44
retf

Function at 0x102776b6
Capabilities:
Packed with generic packer

Disassembly:
js fcn.101b7e9f
shl esi, 0x3e
call fcn.1021adbe

Function at 0x1027c232
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
adc edi, 5
shld eax, esi, cl
push 0xf6b3a506
call fcn.1019d113
call fcn.10118054
bt esi, 0x9e
mov esi, dword [esi + edi - 0x4b3139af]
mov cl, byte [edi + ecx - 0x39ab]
jb 0x100ce6fd

Function at 0x1027fde9
Capabilities:
Authenticate hmac

Disassembly:
mov bp, bx
bswap ebp
call fcn.1018142c
sub ebp, 2
mov dword [esp], 0xe1fb512
jmp 0x1014fba3
lea ebx, [ebp + edi*2 + 0x12ac4d1a]
xchg dword [esp + 0x20], edx
mov edi, dword [esp + 0x14]
jne 0x100b1d81
lea ebp, [edi + ebx - 0x7725613a]
jns 0x1012374e
jmp 0x1023628e
push 0x6711ceab
lea esp, [esp + 4]
jmp fcn.101b5453
pop edx
mov word [ebp + 4], ax
jmp 0x1026bab0
not al
not dl
dec dword [esp]
and al, dl
mov edx, 0xacb92fba
mov word [esp + 2], 0x3bb6
pushfd
pop edx
mov dword [esp], edx
mov edx, 0x3421f685
lea edx, [edx - 0x36e6327c]
jmp 0x101ff4cd
mov dword [ebp], edx
jmp 0x101ba07c
add dword [esp + ebx - 0x12bfd8bb], 0xdd2ff
add edi, ebx
lea edx, [edx + ebp + 0x70b60923]
shr edi, 0x4d
jne 0x10139240
mov word [ebp], ax
call fcn.101f2c1d
jmp 0x100d638a

Function at 0x102802b4
Capabilities:
Authenticate hmac

Disassembly:
or bx, word [esp + ecx - 0x6ebb3ce0]
mov dword [esp + esi - 0x7bba86a4], ebp
xchg dword [esp + esi - 0x7bba867c], edx
mov ebx, dword [esp + 0x24]
or dword [esp + esi - 0x7bba86ac], 0xa2118102
and byte [esp + esi - 0x7bba86a4], 0x29
and dword [esp + 0x14], 0xd00602b2
not byte [esp + esi - 0x7bba8698]
call fcn.101c0fb5