joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0xecedeeef
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x12f58828
mov ebx, 0x6d0a77d7
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x12f58828]
mov ecx, eax
xor ecx, ebp
or ecx, ebx
lea edi, [ecx + ecx]
not edi
add edi, ebx
lea ecx, [eax + ecx*2]
add ecx, 0xed0a7801
and ecx, ebp
not ebp
and ebp, edi
sub ecx, ebp
add cl, 0x38
mov byte [esp + eax - 0x12f58828], cl
inc eax
dec ebx
cmp eax, 0x12f5882f
jne 0x446010
mov eax, dword [esp]
mov ebx, dword [0x452d58]
test ebx, ebx
je 0x44609e
xor ebp, ebp
mov edi, dword [0x452d5c]
nop
nop
cmp dword [edi + ebp*8], 0xd41f89d1
je 0x446070
inc ebp
cmp ebx, ebp
jne 0x446060
jmp 0x44609e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44609e
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x452d60]
push ebx
call fcn.004427e0
add esp, 0x30
cmp eax, 0x103
jne 0x446159
mov dword [esp], 0xecedeeef
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x12f58828
mov ecx, 0x6d0a77d7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x12f58828]
mov esi, eax
xor esi, edx
or esi, ecx
lea edi, [esi + esi]
not edi
add edi, ecx
lea ebx, [eax + esi*2]
add ebx, 0xed0a7801
and ebx, edx
not edx
and edx, edi
sub ebx, edx
add bl, 0x38
mov byte [esp + eax - 0x12f58828], bl
inc eax
dec ecx
cmp eax, 0x12f5882f
jne 0x4460d0
mov eax, dword [esp]
mov ecx, dword [0x452d58]
test ecx, ecx
je 0x446151
xor edx, edx
mov edi, dword [0x452d5c]
nop
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x446130
inc edx
cmp ecx, edx
jne 0x446120
jmp 0x446151
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x446151
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x452d60]
push ecx
call fcn.004427e0
add esp, 0x18
test eax, eax
js 0x446159
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x446170
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44616e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x446330
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 8], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xecedeeef
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x12f58828
mov edi, 0x6d0a77d7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x12f58828]
mov ecx, eax
xor ecx, ebx
or ecx, edi
lea ebp, [ecx + ecx]
not ebp
add ebp, edi
lea ecx, [eax + ecx*2]
add ecx, 0xed0a7801
and ecx, ebx
not ebx
and ebx, ebp
sub ecx, ebx
add cl, 0x38
mov byte [esp + eax - 0x12f58828], cl
inc eax
dec edi
cmp eax, 0x12f5882f
jne 0x4463c0
mov eax, dword [esp]
mov edi, dword [0x452d58]
test edi, edi
je 0x446445
xor ebx, ebx
mov ebp, dword [0x452d5c]
nop
nop
cmp dword [ebp + ebx*8], 0x9ecf05eb
je 0x446421
inc ebx
cmp edi, ebx
jne 0x446410
jmp 0x446445
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x446445
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push dword [0x452d60]
push edi
call fcn.004427e0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f573
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f5b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f5b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f5b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f5b2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f5b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x431790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4317bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4317bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41f250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x413015
lea edi, [esi - 0x12015]
push edi
or ebp, 0xffffffff
jmp 0x41f272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f268
mov eax, 1
add ebx, ebx
jne 0x41f28b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f280
jne 0x41f29c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f280
xor ecx, ecx
sub eax, 3
jb 0x41f2b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f322
mov ebp, eax
add ebx, ebx
jne 0x41f2bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f2c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f2ec
inc ecx
add ebx, ebx
jne 0x41f2d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f2cd
jne 0x41f2e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f2cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f30c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f2fd
jmp 0x41f26e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f30c
add edi, ecx
jmp 0x41f26e
pop esi
mov edi, esi
mov ecx, 0x3c9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f32a
cmp byte [edi], 7
jne 0x41f32a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41f32f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f39e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f3a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f3f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f35c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f3f4]
or eax, eax
je 0x41f398
mov dword [ebx], eax
add ebx, 4
jmp 0x41f379
call dword [esi + 0x1f3f8]
popal
jmp section.UPX0
Function at 0x10010d20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x10096098]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x10010deb
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.10029ad0
add esp, 0xc
test eax, eax
jne 0x10010deb
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.10029ad0
add esp, 0xc
test eax, eax
jne 0x10010deb
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10010d74
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.10029aa0
add esp, 0xc
test eax, eax
je 0x10010da8
sub eax, esi
push eax
push 0x2e
push esi
call fcn.10029aa0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10010daa
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10010dd6
mov al, byte [esi]
push eax
call fcn.1001e3b0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10010db8
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1005413c
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1005413c
add esp, 0x18
ret

Function at 0x1001ac00
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x608], 0
je 0x1001ac44
push esi
push 1
push edi
call fcn.1000cc30
push dword [edi + 0x59c]
mov eax, dword [edi + 0x608]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.1000cc30
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x1001ac59
sub ecx, 1
je 0x1001ac59
sub ecx, 1
jne 0x1001ac8a
push dword [edi + 0x598]
lea eax, [edx*2 + 0x1007b86c]
push 1
add eax, edx
push 2
push eax
call fcn.1005c0ce
push dword [edi + 0x598]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.1005c0ce
add esp, 0x20
xor eax, eax
pop edi
ret
Function at 0x1009e904
Capabilities:
Packed with generic packer

Disassembly:
cmovbe edi, dword [esp + ebx - 0x4825ffd3]
test dword [esp + ebx - 0x4825ffd3], ecx
movsx ecx, byte [esp + 0x2c]
xchg dword [esp + ebx - 0x4825ffcf], ebp
mov ecx, dword [esp + edi - 0x4825ffef]
lea edi, [edi + ebx*8 + 0x7f3be988]
jae 0x1024a529

Function at 0x100a0a40
Capabilities:
Encode data using xor

Disassembly:
mov ebx, ecx
mov edx, 0xe0ab2fae
mov ebp, edx
lea esi, [esi + 1]
sub dl, bh
or ebp, 0xdb890a0d
push esi
call fcn.1026c463
mov ebp, 0xee836918
movzx ecx, bp
mov ecx, dword [ecx + esi - 0x6918]
xor ebp, ebp
or ebp, dword [esi + ebp*2 + 4]
jmp 0x100cecab
push 0x9b8b57b9
rol byte [esp], 0xa5
adc esi, 3
jmp 0x100ed95a
push 0x8f1fe888
xor edx, edx
shr dword [esp + 2], 0xac
mov dword [esp + 1], 0x769390a3
call fcn.100dbfed

Function at 0x100a3145
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
jge 0x101f3fe7
setns byte [esp + esi - 0x153d3761]
jl 0x101361c8
neg bp
and ebp, dword [esp + ebp - 0x1c81d33a]
shr byte [esp + ebp*4 - 0x52060000], 0xe5
mov esi, dword [esp + esi*4 - 0x54f4dd74]
test bp, bp
not dword [esp + ebp - 0x14817fe2]
js 0x10271246
mov esi, dword [ebp]
mov edx, 0x2c3108b8
bt edx, 0xbb
xor dl, 0x2d
mov edx, dword [ebp + edx - 0x2c310891]
push 0xd101cb1d
adc ebp, 4
shr word [esp + 2], 0xaf
inc word [esp + 2]
push 0x5d2f79b3
and esi, edx
push 0x5f3ec828
call fcn.10274d1f
syscall
call fcn.10263bd1
adc dword [ebx - 0x25cd3fb3], eax
cmp dh, byte [eax - 0x2cca2aaa]
and dword [ecx - 0x37f10f87], esi
push ds
das
shr dword [eax + 0x23], cl
mov ah, 0xbd
fist word [ebp + 0x2e147406]
mov eax, 0xe4265fb
mov al, byte [0x1c6994f4]
pop ss
push ds
sbb al, dl
mov esi, 0xa7540440
sal bh, 0xba
stosb byte es:[edi], al
and eax, 0xef7810f
invalid

Function at 0x100ae129
Capabilities:
Packed with generic packer

Disassembly:
adc al, 0x3c
rol al, 1
add esi, dword [esp + esi - 0xfff8]
bt esi, 0xbf
shl word [esp + esi - 0x2780fff4], 0x86
not al
shl esi, 0xf0
mov dword [esp], 0xb004f711
xor bl, al
lea eax, [esp + eax + 0xc]
push esi
or si, word [eax]
sub ebp, 2
call fcn.1027422a

Function at 0x100aff74
Capabilities:
Authenticate hmac

Disassembly:
call fcn.10228d40
int3
pop ecx
push ecx
pushfd
mov ecx, 0xa3320989
sub ecx, 0xf9241ab
jle 0x1024bbf6
jle 0x100a87f4
sub ecx, ecx
mov ecx, dword [esp + 4]
xchg dword [esp + 8], ecx
jb fcn.10222cec
mov dword [esp + 4], ecx
jno 0x10133cf4
push 0x8ca718b3
sal dword [esp + 4], 0x13
sbb ebp, 1
not dword [esp + 0x10]
call fcn.10106d97

Function at 0x100b2828
Capabilities:
Packed with generic packer

Disassembly:
push eax
pushfd
push 0x5284bb34
neg word [esp]
push ebx
mov ebx, dword [esp + 4]
and word [esp + ebx - 0x528444c8], 0xac3a
Function at 0x100d3237
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xd5e7e900
add eax, dword [eax]
push 0xc1b1a50e
sub edi, 1
mov edx, 0xfe86b9bf
inc dl
movzx edx, byte [edi]
jno 0x1011d9dd
shl ebx, 0xcd
call fcn.1027967d
mov word [eax], ds
imul edx, ebx, 0x5c
jns 0x100d31cc
jae 0x100d32b8
enter 0x267, 0xffffffffffffffd5
and byte [edi - 9], ch
pushal
add eax, 0x77046f9a
das
push eax
mov byte [0xecc06075], al
or dword [ecx - 0x6bbcd635], edi
insd dword es:[edi], dx
cmp al, 0x78
xchg ebx, eax
and dword [esi - 0x7f], 0xffffffd6
in eax, dx
xor eax, 0x3867a877
push ss
pop esp
out 0x32, eax
and eax, 0xa86b2ebd
pop ebp
jp 0x100d325e
retf
cmp eax, 0x79b2c758
loope 0x100d32fd
aas
pushfd
fdiv dword [esi]
invalid
mul al
xor dword [eax], ebx
invalid
outsd dx, dword [esi]
jmp 0x100d3298
hlt
xor dl, bl
rol dl, 1
ror dword [esp], 0xd0
inc dl
call fcn.101b0017

Function at 0x100d444f
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, edx
mov ebx, dword [esp + edx - 0x62a45124]
mov dword [esp + 0x18], ebx
ja 0x1022a1b6
mov dword [esp + edx - 0x62a45124], edx
or edx, 0x15a4eea2
or dl, dl
bswap edx
cmp dword [esp + 8], edx
add dword [esp], 0xfffd33d4
lea edx, [edx + edx*8 + 0x6c2b5a00]
bswap edx
not edx
sub dl, dl
mov ebx, dword [esp + 8]
push edx
mov ebx, dword [esp + ebx - 0x62a45128]
mov ebx, dword [ebx]
and dl, dh

Function at 0x100d7a0a
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
sub byte [esp + 0x14], 0xa2
and byte [esp + 0x14], 0x8a
or dword [esp + 0x14], 0x3481dd3f
jns 0x1016c4e9
ror dword [esp + 4], 0xc4
push 0x629d9f3e
or cx, ax
mov eax, dword [esp + 9]
pushfd
pop eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov word [ebp + 4], cx
mov dword [ebp], eax
call fcn.1017186d
not dword [esp + 2]
jmp 0x101e26b9
jbe 0x10169f86
mov al, 0xe0
in eax, 0xc1
pop edi
fdivr qword [edx - 0x78]
lds ecx, [ecx + 7]
aam 0x12
or ch, dl
push ecx
mov edx, dr4
retf
mov dword [esp + 0x1c], 0x4daa4dae
xor word [esp + 0x1c], 0x1f97
xchg dword [esp + 0x20], ebx
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x20]
ret
shr dword [esp + 0x14], 0xa3
ja 0x1011089a
lea ebx, [ebx + 0x5f08218e]
jbe 0x1012d3ce
mov esi, 0x8ca571a5
neg si
lea eax, [esi + esi + 0x4736bf26]
lea ebp, [ebp + eax - 0x6081dbdd]
movzx eax, byte [ebp + eax - 0x6081dbdc]
js 0x101b047c
sub esi, esi
xor al, bl
btc esi, esi
adc al, 0xbe
or si, si
sar esi, 0x9a
adc esi, esi
ror al, 1
btr si, si
lea esi, [esi*8 + 0x320c300c]
xor al, 0x34
inc esi
bt si, si
dec al
and esi, esi
xor al, 0x39
call fcn.1011b6f9
shl dword [esp + 4], 0xc
sbb edi, 3
jmp 0x101e620a
lea esp, [esp + 8]
jmp fcn.102609f2
not dword [esp + 1]
jmp 0x10237f92
mov dword [edi], eax
jmp 0x10101a76

Function at 0x100d7ff3
Capabilities:
Packed with generic packer

Disassembly:
push esi
pushfd
call fcn.102626f1
call fcn.100cd3e3
mov ebp, 0xd83013bb
mov ebp, dword [esi]
mov ecx, 0x788e215
btr cx, cx
movzx cx, byte [ebp + ecx - 0x788e215]
push 0x5088bbc
jae 0x1012c4a5
push 0xeda7ef23
adc esi, 2
jmp 0x1016d104
call fcn.101da08b

Function at 0x100d8024
Capabilities:
Packed with generic packer

Disassembly:
sbb esi, 4
mov dword [esi], eax
call fcn.1010b8a8
Function at 0x100d8031
Capabilities:
Packed with generic packer

Disassembly:
nop
mov ecx, 0x95acabad
shl cl, 0x53

Function at 0x100dd863
Capabilities:
Encode data using xor

Disassembly:
push eax
call fcn.101bf82f
call fcn.100ecc92

Function at 0x100e54c9
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, dword [esp + 0xc]
cmp esi, edx
mov dword [esp + esi - 0x6e270bec], 0xca1d92a1
jo 0x100ff90f

Function at 0x100efb9d
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x3be331c4
pop esi
invalid
clc
jp 0x100efaf7
adc ebp, dword [ecx + ebx*4 - 0x3b]
or eax, 0x39205199
cwde
and ebp, dword [ebp - 0xb]
jle 0x100efbe9
out dx, al
int1
pop ebx
clc
int1
mov eax, 0x2505acc0
or al, 0x15
out dx, al
shr edx, 0x88
inc edx
push 0x5fe6400
jg 0x100efc0a
call 0x1017da02
stosd dword es:[edi], eax
jnp 0x100efb80
add dh, byte [ebp + 0x21]
jge 0x100efb61
cmpsb byte [esi], byte es:[edi]

Function at 0x100f1ec7
Capabilities:
Encode data using xor

Disassembly:
and ax, dx
mov dword [esp + eax*4 - 0x260400], ebx
mov ebp, esi
jne 0x100f2687
mov ebx, ecx
dec dl
mov edx, ebx
call fcn.10233dfb
call fcn.1012227d

Function at 0x100f4a4b
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, byte [esp + 0x10]
add dword [esp + 8], 0xfffaefba
mov ebp, ecx
push ebp
xor word [esp], 0x4594
pop edx
mov edx, dword [esp + 0x10]
push 0x608ea62c
mov ebp, dword [esp + 0xc]
je 0x100f4a83
add byte [ebp + eax*2 + 0x24548b5a], dl
adc byte [eax + 0x2c], ch
cmpsb byte [esi], byte es:[edi]
mov fs, word [eax - 0x75]
insb byte es:[edi], dx
and al, 0xc
mov ebp, dword [ebp]
mov dword [esp + edx - 0x429a3f7d], edx
xor dword [esp + 0xc], esi
neg byte [esp + 0xc]
jns fcn.102604c3
cmp esi, dword [esp + 0xc]
jb fcn.1023d7e7
lea ebp, [ebp + edx*2 - 0x6eaa60d8]
sub word [esp + 0xc], dx
call fcn.101c2551
insd dword es:[edi], dx
mov edi, 0x30a306b8
sbb al, 0xb6
imul ebp, edi, 0x3df5c752
or byte [eax + 0x7a9cd24b], ah
sbb ebx, ecx
add eax, 0x4af061dd
sti
cmp byte [edx + ebp - 0x178ca61f], al
add eax, 0x7ed8fb19
lodsd eax, dword [esi]
outsb dx, byte [esi]
leave
clc
cmp byte [edi - 0x7a], al
inc esp
jns 0x100f4a5d
xchg byte [ecx + edi*2 - 0x7a], al
loope 0x100f4ad3
inc ebx
invalid
not dword [esp + 1]
mov dword [ebp + 4], eax
lea esp, [esp + 0x10]
jmp fcn.101f2249

Function at 0x100f6bfe
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x8b859445
lea esp, [esp + 4]
call fcn.10147a24
mov edx, 0xfb942314
neg dl
mov edi, dword [ebp]
add dl, dl
sub dx, dx
shl dl, 0xa1
mov edx, dword [ebp + 4]
jbe 0x101c5b6f
lea ebp, [ebp + ebx*4 + 0x6f0359d2]
call fcn.10266613
mov ecx, 0x23b43e86
call fcn.101733ae
jae 0x10184eae
Function at 0x101020d8
Capabilities:
Authenticate hmac

Disassembly:
jb 0x1014f22f
pop ss
shl dword [ebx - 0x3f], 0x5f
in al, dx
pop esp
xchg esp, eax
adc al, 0xba
xor byte [ebp - 0x1c9c4ab1], bh
sbb esp, dword [eax - 0x66118a95]
add byte [eax], bh
cmp dword [edi - 0x1218780], ebx
dec edx
cmp ah, dl
mov ah, 0x88
imul edi, dword [eax], 0xc2644a0b
mov word [esi + edi*2], fs
or al, 0xc1
in al, 0xcb
xor byte [esi - 0x18], bl
pop esi
call fcn.101c64bb
jl 0x101c7ef6
adc edi, 2
shr cx, 1
invalid
daa
mov al, 4
push 0x22032b27
mov dword [esp + 4], 0x91e0ca3
mov dword fs:[eax], ebp
call fcn.1027b82f
pushfd
push ecx
mov ecx, 0xb58907b6
push dword [esp + ecx + 0x4a76f84e]
popfd
mov dword [esp + 4], 0xfb61244b
mov ecx, dword [esp + ecx + 0x4a76f84a]
call fcn.1021e750
mov edx, 0xee3e5b30
mov ecx, dword [ebp]
dec dx
jp 0x101a251d
jg 0x101303fe
mov edi, 0x7abe21bb
je 0x100e73cc
jae 0x101f9d78
add ebp, 4
push 0x1597e716
shld si, dx, cl
call fcn.101c513d
call fcn.10169bb4
mov esi, 0xd38b811a
movzx edx, si
mov si, word [ebp + edx*2 - 0x10234]
bt edx, edx
mov dx, word [ebp + edx*4 - 0x20466]
mov ecx, 0xb830c20d
shl cx, 0x6e
add cx, cx
xor cl, byte [ebp + 4]
jmp 0x10134092
lea esi, [esi + edi*8 - 0x5ac88a51]
lea edx, [edx + edi + 0x1c0138c8]
jbe fcn.1023d3a3
mov si, 0xa2b4
xor si, 0xa4a9
neg si
xor esi, edi
shl esi, 0x49
xchg dword [esp + 0x18], edx
mov esi, dword [esp + 4]
js 0x100eba33

Function at 0x10102139
Capabilities:
Authenticate hmac

Disassembly:
add edi, 6
mov word ss:[edx], cx
call fcn.100b2e61

Function at 0x10102148
Capabilities:
Authenticate hmac

Disassembly:
push 0x46afc533
mov word [esi], ax
call fcn.102285f0

Function at 0x1010216d
Capabilities:
Authenticate hmac

Disassembly:
add bp, 0x218
jns 0x101148cc
jmp 0x101e5eba
jbe 0x100a4665
mov ecx, 0x5bb6a99e
mov eax, dword [ebp + ecx - 0x5bb6a99e]
mov cx, word [ebp + ecx - 0x5bb6a99a]
add ebp, 2
jmp 0x100fe9db
js 0x10192607
xchg dword [esp + ebp + 0x7fffe0c], eax
mov ebp, dword [esp + 8]
sub edi, edi
mov ecx, edi
not edi
setge byte [esp + 0x18]
sub di, 0xa1b1
xor di, word [esp + ecx + 0x18]
mov edi, dword [esp + ecx + 0x10]
or cx, cx
neg cx
and dword [esp + ecx*2 + 0x18], ecx
mov ecx, dword [esp + ecx*4 + 0xc]
sub dword [esp + 0x18], 0x7f843913
jle 0x101aee04
jmp 0x101f2d34
shr cx, 1
push 0x7d1edabb
rcr eax, cl
jmp 0x1013de10
and dword [esp + 0x18], 0xae8bf5a5
or byte [esp + 0x18], 0xaf
mov word [esp + 0x18], 0x904
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x24]
ret
jmp 0x101a0e6f
call fcn.1012e6f5
Function at 0x101021ab
Capabilities:
Packed with generic packer

Disassembly:
test cx, di
mov dword [esp + 0x14], edi
jg 0x101f24de
push 0x3899169a
jmp 0x1020d0c3
mov ecx, dword [esp + 8]
shr edi, 0x48
shl word [esp + 0x14], 0x71
js 0x100dbe5d
sub byte [esp + 0x14], 0xa4
lea ebx, [ebx + ecx - 0x21e466d3]
or edi, 0x5c01d129
shl cl, 0x6f
shl cl, 3
xchg dword [esp + 0x18], ebx
mov ebp, dword [esp + 0x10]
movzx di, byte [esp + edi + 0x4c0016]
xor edi, dword [esp + 0x14]
and edi, 0x4935b31b
ja 0x101a3c53
sub ebp, 2
neg word [esp + 2]
push 0x1b8d3025
inc dword [esp + 2]
sub dx, cx
call fcn.1022e336
mov eax, 0xe99b1b07
mov edx, dword [ebp]
push eax
mov ax, word [ebp + 4]
add ebp, 6
push 0x31832fa0
call fcn.10002003
or al, 0x4a
scasd eax, dword es:[edi]
pop ebp
add dl, bl
mov ecx, dword [esi - 0x14]
push edx
leave
pop es
adc ch, bl
inc ebp
lahf
lock or ebx, dword es:[edx + 0x5c916bc]
sbb dh, cl
add eax, 0xa342e8c9
mov edx, 0xa54219c1
jae 0x1020d149
xchg edx, eax
shr byte [esi - 0x53], 1
outsb dx, byte [esi]
leave
clc
invalid
cmp byte [ebp + 0xdf8215c], cl
push ebp
mov byte [0x4cddfa67], al
mov al, 0x5b
add byte [edx + 0x5e17e261], dl
inc ebx
sub eax, 0xd4023c7e
popal
xor al, 0xad
sub eax, 0xbd7325bc
xchg byte [edi - 0x6de536c6], ah
jp 0x1020d172
push edx
lodsd eax, dword [esi]
pop esi
xchg edx, eax
inc eax
jno 0x1020d1b6
ror dword [ecx + 0x39], 1
xchg edx, eax
adc dh, ch
dec esp
int3
xor ebx, dword [ebx + 0x654555e5]
wait
mov dword [eax + 0x4f], edi
rcl dword [esp + edi*8 - 0x7e], 0x32
mov al, byte [0xc12cbca2]
cmp edi, esi
push edi
dec edx
add ebx, dword [esi]
call 0x1160ce1
push es
test byte [ecx], cl
sbb edx, esi
int 0x84
imul eax, dword [0x20a764f5], 0x95204f5a
inc byte [eax - 0x2c8eddaf]
add byte [ebx + 0x6308bdad], dh
pop esi
in eax, dx
adc al, 0xfd
iretd

Function at 0x101098db
Capabilities:
Packed with generic packer

Disassembly:
push edx
call fcn.10273115
mov edx, 0xee2ef196
sub esi, 2
neg edx
movzx edx, word [esi + edx*4 - 0x474439a8]
jb 0x101dd9b6
call fcn.1016626b

Function at 0x1010b124
Capabilities:
Packed with generic packer

Disassembly:
cmovbe edx, dword [esp + ecx + 0xdf44d27]
push edx
xchg dword [esp + ecx*2 + 0x1be89a52], ebp
mov ecx, dword [esp + 0x2c]
add dword [esp + 0x24], 0xefdf34a6
not si
add dword [esp + 0x20], 0xb03f6f14
and dword [esp], esi
jle 0x101df022
add si, 0x4e1b
mov edx, dword [esp + 0x14]
xor esi, esi