joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001567c
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edx, dword [edx]
jg 0x10016c9d
xchg edi, edi
jle 0x10016c9d
call fcn.10018fa5
push dword [ebp + 0x20]
call fcn.10011248
sbb byte [ebx - 0x54], dl
pop ebx
call 0x5411ea7c
add dl, byte [eax]
mov ebx, eax
mov eax, dword [esi + 0xc]
lea edi, [eax + ebx + 1]
call fcn.10011e82
lcall 0xe853, 0xe80b80f3
mov esi, 0x5c0000b9
hlt
pop edi
pop esi
pop ebx
call fcn.10019592
mov al, 0xe6
dec eax
test al, 0xe8
test si, 0
call fcn.100144c0
push 0x38
cmp dword [eax + ebp*8 + 0xf00c1f6], ecx
test dword [ebx + ebx*4], edi
add byte [ebx], dh
not byte [ebx - 0x18]
ror dword [ecx], 1
add byte [eax], al
mov eax, gs
test cl, 0
jne 0x10017cd2
xor esi, esi
push ebx
call fcn.1000eb2f
or dword [ebx], edx
jge 0x1000e14b
call fcn.100103ce
les eax, [eax]
xchg byte [edx], dl
invalid
mov edx, dword [esp + 4]
jo 0x1000d457
xchg si, si
jno 0x1000d457
jmp 0x1000e131
add dword [esp + 8], edx
js 0x1001422d
mov cl, cl
jns 0x1001422d
pop edx
jo 0x1000f7e1
mov bl, bl
jno 0x1000f7e1
mov esi, eax
test cl, 0
call fcn.10017ab5
cmc
std
popfd
ja 0x10013d0a
mov al, al
jbe 0x10013d0a
jnp 0x10016e21
test eax, eax
jne 0x10018c5a
jne 0x1001663c
call fcn.10018a4a
push edx
jg 0x10012b2f
mov esp, esp
jle 0x10012b2f
invalid
pushfd
js 0x1001707c
mov bx, bx
jns 0x1001707c
test edi, 0
js 0x1000f974
call fcn.100185d9
inc edx
lodsd eax, dword [esi]
xor bl, byte [ecx - 0x18]
test bl, 0
jnp 0x10011559
add al, byte [edi + 1]
mov edi, dword [ebp - 4]
call fcn.10015a40
mov ebx, 0xe8619c7a
mov eax, 0x72d
call fcn.1000ff72
stc
mul dword [edi - 0x67]
call 0x154bf1fe
add byte [eax], al
call fcn.10017360
mov ebp, 0xe8fced5f
jne 0x1000e391
jne 0x100194b6
call fcn.1000d7db
paddsw mm0, qword [ecx]
mov dl, pe_nt_image_headers32
test dh, 0
jo 0x1000fa27
test eax, eax
call fcn.10012aa8
insb byte es:[edi], dx
mov eax, dword ss:[0xc383e8c7]
adc al, 0xe8
pushfd
jg 0x10016d2c
invalid
invalid
invalid
xor edx, 0x3564927f
jg 0x10012d63
mov esp, 0x8b66ffff
in al, 0xf
mov ss, edx
mov esp, 0x289ffff
mov sp, sp
jle 0x10012d63
mov dword [edx], eax
call fcn.100141d9
xor cl, byte [ebx + 0x3f]
jmp 0x10017085
and dword [esi + 0x1561ffff], 0x50e80e9b

Function at 0x10015743
Capabilities:
Encode data using base64
Get disk information

Disassembly:
add cl, byte [ebp + 0x4589f84d]
clc
push esi
call fcn.10015c18
xchg edx, eax
xchg edi, eax
lodsd eax, dword [esi]
adc al, ch
ret
mov eax, dword [esp + 4]
push eax
je 0x10013c90
xchg ecx, ecx
jne 0x10013c90
test eax, eax
jne 0x100173df
jne 0x1000fb2e
call fcn.100144c0
and al, 0x5e
invalid
mov eax, gs

Function at 0x100157c3
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push edi
jo 0x10017ff9
xchg si, si
jno 0x10017ff9

Function at 0x10015a40
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edx, dword [esp + 4]
push edx
jb 0x1001292a
xchg dx, dx
jae 0x1001292a
call fcn.10011a31
call fcn.100193a9
and edx, dword [esi]
lds eax, [eax + 0xf3f8be8]
xchg dword [ebx - 0x75000080], esp
fisttp dword [edi]
xchg byte [ebx - 0x74000080], bl
dec esp
and al, 4
Function at 0x10015c18
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov ebp, dword [esp + 4]
je 0x1001807d
mov edx, edx
jne 0x1001807d
sub ebp, 0x10ad6ab2
jb 0x1000de4e
xchg dx, dx
jae 0x1000de4e
push edi
mov edi, dword [esi + 0xc]
call fcn.1000caf3
and al, byte [esi + 0xfe80468]
test eax, edi
stosb byte es:[edi], al
add byte [eax], al
jne 0x10013060
call fcn.1000e9f7
push 0xe89d275a
push ebp
mov ebp, esp
call fcn.1000eb2f
xor al, 0xaa
xor eax, 0xbe68e87d
push esi
add dword [eax], edx
call fcn.10010ea1
bound esi, qword [ecx + ebp + 0x968e826]
inc esi
add dl, byte [eax]
jmp 0x10017e14
pushfd
jb 0x1000d3d3
xchg bl, bl
jae 0x1000d3d3
js 0x1001436e
invalid
add eax, ebp
js 0x1001305c
invalid
sal dh, 1
mov dword [eax], 0xffe423e8
call ecx
test dword [ecx - 0x34], ebx
call 0x659052d3
push ebx
jg 0x10017ad8
push ebp
jp 0x1000c927
xchg edi, edi
jnp 0x1000c927
mov ebp, dword [ebp]
jl 0x1000ec99
xchg ebx, ebx
jge 0x1000ec99
push edi
call fcn.1000dbf5
pop ecx
mov dword [0xebe875b3], eax
add ecx, dword [ecx - 0x17a90fa3]
mov ebx, 0x318ffff
mov esi, 0xc3f766e8
add byte [eax], al
jnp 0x100166cb
add ecx, esi
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
call fcn.10011248
call [ebx + ebp*4 + 0x75ffe85b]
or al, ch
retf

Function at 0x10016096
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
jp 0x10012346
mov esp, esp
jnp 0x10012346
call fcn.10016923
test edx, 0
call fcn.1001832c
outsb dx, byte [esi]
mov ah, 0xb7
insd dword es:[edi], dx
call 0x1825ccbf

Function at 0x10016577
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push edi
js 0x10015a94
mov dx, dx
jns 0x10015a94

Function at 0x1001669c
Capabilities:
Encode data using base64
Get disk information

Disassembly:
inc ebp
clc
ret 0
mov ebx, dword [esp + 4]
push ebx
js 0x10015cb9
xchg bh, bh
jns 0x10015cb9
jne 0x1001247e
cmp eax, edx
ja 0x1000e6ef
ja 0x10011b40
test bh, 0
jo 0x10014d37
add esi, eax
mov cl, byte [esi]
Function at 0x10016790
Capabilities:
Encode data using base64
Get disk information

Disassembly:
pop ecx
test ebx, 0
jne 0x10010128
cmp eax, dword [ebp + 8]
je 0x10015bc5
je 0x1000ee3b
call fcn.10017a25
mov edx, dword [edx]
jb 0x10019716
mov ah, ah
jae 0x10019716
js 0x1001755a
test eax, eax
call fcn.100136eb
mov eax, 0xe8528bce
cmp al, 1
invalid
invalid
mov edx, dword [esp + 4]
jb 0x1000eba7
mov ch, ch
jae 0x1000eba7
push dword [ebp - 0x3c]
push 0
push 0
push edx
jmp 0x10010b83
mov dword [eax], 0xf000000
mov ecx, dword [edi]
idiv bh
invalid
call 0x243ee4d6
add dword [eax], eax
add al, ch
call fcn.10013d49
jns 0x10015b6d
test dword [ebx - 0x36991718], 0xa53ffff
je 0x10015be4
call 0x5ffdd2e2
movsd dword es:[edi], dword [esi]
pop ecx
js 0x1001006d
xchg dl, dl
jns 0x1001006d
pop ecx
mov eax, dword [ebp + 8]
call fcn.10014ab1
test eax, 0
call fcn.1000d1db
sub dl, byte [esi + 0x3b]
mov byte [0x1515ffe8], al
inc esi
add dl, byte [eax]
test dl, 0
jo 0x1000f86a
call fcn.1000ed36
pop ds
sub byte [ecx + 0xf57e8e4], 0x84
push edi
je 0x100191cd
mov ebp, ebp
jne 0x100191cd
je 0x10014f73
mov esi, eax
invalid
aaa
invalid
invalid
invalid
pop ecx
loop 0x10017784
invalid
jmp dword [esi - 9]
popfd
jp 0x100181de
mov edx, edx
jnp 0x100181de
call fcn.10015743
jno 0x10017782
div bh
call 0xb858759
invalid
invalid
popfd
jb 0x100126e7
mov ah, ah
jae 0x100126e7
jne 0x1000df54
call fcn.1001836b
salc
pop ebp
js 0x100178ad
call 0xf809028c
mov eax, dword [ecx]
add byte [eax], al
neg dword [edx + ebx*4 + 0x62]
call 0xe88188cf
add eax, 0x8b660000
dec dword [edi]
or edi, 0x8b000005
inc esp
and al, 4
sub ebp, 0xc64b5981
jo 0x1000ccad
xchg ebp, ebp
jno 0x1000ccad
mov dword [eax + 8], edx
call fcn.10018326
mov ebx, 0xe85aafff
push 0x34
test ecx, 0
call fcn.10017a25
fsubr dword [eax - 0x1717ba]
jne 0x10017c73
call dword [0x10023fcd]
push eax
call dword [0x1002472b]
adc eax, 0x1002472b
test edx, 0
jb 0x1001442c
test eax, eax
jne 0x10015b34
jne 0x1000df89
call fcn.10013e9c
push cs
xor al, byte [ecx + 0xf5de842]
invalid
sub edx, 0xad635c61
jp 0x10018f39
xchg edx, edx
jnp 0x10018f39
popfd
jb 0x10016750
mov ax, ax
jae 0x10016750
call fcn.100129e3
mov eax, dword [ebp + 0x1c]
push dword [eax + 8]
call fcn.10014191
lcall 0xf766, 0xe8f8a5b7
mov byte [eax], 0
call fcn.1000f07f
scasd eax, dword es:[edi]
mov edx, 0x9de8543e
pop edx
jb 0x10013a66
xchg esi, esi
jae 0x10013a66
xor edx, 0xfc61126a
jmp fcn.10016053
sbb dword [esi - 1], ebp
call eax
push edx
ret 0xe886
add dword [esp + 8], edx
jp 0x100177e3
xchg si, si
jnp 0x100177e3
pushfd
ja 0x10017c35
xchg esi, esi
jbe 0x10017c35
pop ecx
jl 0x1000dd54
xchg esi, esi
jge 0x1000dd54
mov ebp, esp
test edi, 0
jb 0x100187e5
sub esp, 0x80
push esi
push edi
call int.1000e95d
mov edi, eax
movzx eax, byte [edi + 2]
imul eax, eax, 0x1c
test esi, 0
call fcn.10014dc6
or ebx, dword [esi]
int 0x33
call 0x57eb532d
aam 0xff
invalid
pushfd
je 0x100180d6
xchg bh, bh
jne 0x100180d6
sub edx, 0x8c782a5e
jmp fcn.1000cede

Function at 0x100167c5
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov ebx, dword [esp + 4]
jb 0x1000e355
push ebx
jo 0x1000e034
mov eax, eax
jno 0x1000e034
Function at 0x10016874
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov ecx, dword [ecx]
jb 0x10015d0d
xchg sp, sp
jae 0x10015d0d
or dword [eax], 0x65
add byte [eax], al
test cl, 0
jb 0x10012c7d
cmp edx, ecx
jne 0x1000d6d3
call fcn.10011526
insb byte es:[edi], dx
or al, 0x69
in al, dx
call 0x2f9cbdc
wait
call fcn.10011b9b
movsd dword es:[edi], dword [esi]
and ch, byte [ebx + 0x1105e852]
jp 0x1000f800
cmpsb byte [esi], byte es:[edi]
mov ecx, dword [esp + 4]
jmp 0x1000f7f4
xlatb
push ecx
jg 0x10010133
xchg ch, ch
jle 0x10010133

Function at 0x10016f66
Capabilities:
Encode data using base64
Get disk information

Disassembly:
call fcn.100189ef
dec ebx
fidivr word [eax - 0x7df017a0]
invalid
pushfd
jmp 0x10011ec1
popfd
jp 0x10018e28
nop
jnp 0x10018e28
xor esi, 0x117ae6b
jb 0x10018abd
mov dh, dh
jae 0x10018abd
xor edi, edi
call fcn.1000e726
mov esp, 0x9ce865ce
mov esi, dword [esi]
js 0x1000f792
xchg si, si
jns 0x1000f792
mov esi, dword [esp + 4]
jo 0x10015ac6
xchg dl, dl
jno 0x10015ac6
test edi, 0
jne 0x1000ccdf
call fcn.1000db83
ljmp 0xe99d
ret
push esi
jl 0x1001696b
nop
jge 0x1001696b
sub dword [esp + 8], esi
jo 0x10010f93
nop
jno 0x10010f93
pop edx
jmp 0x100120fb
pop esi
jl 0x10016999
nop
jge 0x10016999
popfd
jmp 0x1001352c

Function at 0x10017022
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
invalid
lea eax, [esi + 0x18]
push eax
call fcn.1000eb2f
jns 0x10017025
jge 0x10017018
sub ecx, 0x5eb39aa8
ja 0x1001967a
mov esi, esi
jbe 0x1001967a
call fcn.10010110
lea eax, [esp + 0x20]
call fcn.10010110
push dword [ebp + 8]
call fcn.100195b5
xchg edi, eax
push 0xf7e8c64b
mov dword [eax], 0xf000000
mov byte [ebx + ebp*8], al
invalid
popfd
jl 0x1000ec11
xchg ebp, ebp
jge 0x1000ec11
add dword [esp + 8], ecx
jb 0x10017535
xchg bh, bh
jae 0x10017535
pushfd
jmp fcn.10011b10

Function at 0x1001729a
Capabilities:
Encode data using base64
Get disk information

Disassembly:
les ecx, [edi + esi*8]
mov byte [eax], 0
add byte [eax], al
les ecx, [ebx + ecx*4]
into
test ecx, ebx
mov esp, 0x75ffffff
or al, 0x8b
jne 0x1001729a
push ebp
mov ebp, esp
test ebx, 0
jnp 0x1000d948
and esp, 0xfffffff8
call fcn.10017795
inc edi
insb byte es:[edi], dx
aaa
pop edx
call 0x560288b9
add dl, byte [eax]
test ah, 0
jb 0x10013e1a
call fcn.10014888
mov eax, dword [0xe8d7ba74]
je 0x10017287
xlatb
call 0x1825bed4
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.1001437c
sub ch, dl
xlatb
call 0x9c10b290
loope 0x100172cb
invalid

Function at 0x100172f0
Capabilities:
Encode data using base64
Get disk information

Disassembly:
les ecx, [edi + esi*8]
mov byte [eax], 0
add byte [eax], al
les ecx, [ebx + ecx*4]
into
test ecx, ebx
mov esp, 0x75ffffff
or al, 0x8b
jne 0x1001729a
push ebp
mov ebp, esp
test ebx, 0
jnp 0x1000d948
and esp, 0xfffffff8
call fcn.10017795
inc edi
insb byte es:[edi], dx
aaa
pop edx
call 0x560288b9
add dl, byte [eax]
test ah, 0
jb 0x10013e1a
call fcn.10014888
mov eax, dword [0xe8d7ba74]
je 0x10017287
xlatb
call 0x1825bed4
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.1001437c
sub ch, dl
xlatb
call 0x9c10b290
loope 0x100172cb
invalid
Function at 0x10017360
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov eax, dword [eax]
js 0x10011a3b
xchg bp, bp
jns 0x10011a3b
push 0x57
pop ebx
pushfd
jmp fcn.10014b30
mov eax, dword [esp + 4]
ja 0x1000ca69
nop
jbe 0x1000ca69
push eax
js 0x10012188
xchg ebp, ebp
jns 0x10012188
push edi
lea esi, [esp + 0x20]
call fcn.10014d46
mov eax, dword [ebp + 0xc]
call fcn.1001014f
cld
xlatb
sub al, 0xfa
call 0x138982e1
push edi
js 0x10015190
invalid
invalid

Function at 0x10017544
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
test ah, 0
jnp 0x10018aa2
cmp word [ebx + edi*2], 0x5c
je 0x1001881e
call fcn.10012828
mov edx, 0xe82fc940
test eax, eax
je 0x10015fad
je 0x1000e456
call fcn.10017e71
inc ebx
mov al, byte [0x8be8b545]
in al, dx
test eax, 0
jne 0x100142a5
sub esp, 0x24
push ebx
push esi
push edi
call fcn.1000e726
stosd dword es:[edi], eax
lahf
into
call 0xbfea5b43
invalid
push edx
je 0x10010cad
mov ebp, ebp
jne 0x10010cad
jg 0x10016a61
jg 0x10018f29
call fcn.10010a95
sub dword [esi + esi*8 + 0xf9ce828], esp
test byte [edx - 0x7500001c], al
ror byte [edi], 0x85
jp 0x1001755a
invalid
call fcn.10017386
sub eax, esi
invalid
push esi
call fcn.10011248
cmc
stosd dword es:[edi], eax
pop ebx
call 0x9010ca3c
sub ebx, edx
invalid
call dword [0x10024098]
call fcn.100103f0
invalid

Function at 0x10017795
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov esi, dword [esp + 4]
jo 0x100121dc
xchg ah, ah
jno 0x100121dc
push esi
js 0x100105a2
nop
jns 0x100105a2
pushfd
je 0x100178ee
xchg bx, bx
jne 0x100178ee
add ecx, 0xd9d60b21
je 0x1000d8c1
xchg bx, bx
jne 0x1000d8c1
Function at 0x1001817b
Capabilities:
Encode data using base64
Encode data using xor
Get disk information

Disassembly:
mov edi, dword [esp + 4]
push edi
jg 0x10011bc0
xchg cl, cl
jle 0x10011bc0
add al, byte [edi]

Function at 0x1001832c
Capabilities:
Encode data using base64
Get disk information

Disassembly:
ret 0x135f
les eax, [eax]
js 0x10016834
cmp word [esi + eax*2], 0x5c
je 0x1000f031
call fcn.10011e82
fnstenv [eax + eax*4 - 0x74aa17f5]
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 0x537cee08
out dx, al
jl 0x1000ebd7
test ch, 0
call fcn.100185d9
test eax, 0xe85932b8
push ebp
mov ebp, esp
test dh, 0
js 0x1000d280
call fcn.10011248
jns 0x1000eb81
stosd dword es:[edi], eax
pop ebx
call 0x920ffe36
stosd dword es:[di], eax
add byte [eax], al
push ebp
mov ebp, esp
test si, 0
jb 0x1000db1f
sub esp, 0x14
test dl, 0
call fcn.100103f0
push ebx
test byte [ebp + edx + 0xa9e8], 0
add al, ch
xchg edi, eax
je 0x1000ebfe
add byte [eax - 0x17861eaf], al
mov eax, dword [ebp - 4]
call fcn.10016874
xchg dword [eax + 0x59e8dc6f], ecx
call fcn.10013fdb
inc eax
je 0x1000f09c
lodsd eax, dword [esi]
call 0x4d66744e
add byte [eax], al
push ebx
call fcn.1000d26a
aam 0x9d
movsb byte es:[edi], byte [esi]
pop esp
call 0xf3e947a6
cld
invalid
call 0x18253cca
invalid
ret
push ebp
jb 0x100188ba
nop
jae 0x100188ba
js 0x1000eb5d
call fcn.100103ce
bound ecx, qword [ebx - 0x17af17a7]
push edi
cmpsd dword [esi], dword es:[edi]
invalid
mov ebp, dword [esp + 4]
je 0x1000cda3
mov al, al
jne 0x1000cda3
push 0xafc2a89d

Function at 0x10018654
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov eax, eax
push ebp
call fcn.10010ea1
add dword [eax - 0x7217d9d6], 0x50fe4344
call int.10014c7b
call fcn.100197b5
jmp 0x10018636

Function at 0x100188df
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push esi
jp 0x10011f3d
xchg bx, bx
jnp 0x10011f3d
mov ebx, eax
call fcn.10011ade
fdivr qword [edi - 0x72]
lodsb al, byte [esi]
call 0x95115284
invalid

Function at 0x100189ef
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push eax
jp 0x1001007d
xchg di, di

Function at 0x10018a4a
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
ret
mov eax, dword [esp + 4]
ja 0x10010dc8
xchg ebp, ebp
jbe 0x10010dc8
test ebx, 0
call fcn.100149d9
adc eax, 0xe84dac59
push eax
je 0x10017f8d
mov bh, bh
jne 0x10017f8d
test ch, 0
jo 0x1000d829
test eax, eax
je 0x1001598e
call fcn.10015c96
lahf
add dword [ebx + 0xf55e85e], esi
push ebp
invalid
invalid

Function at 0x10018d3b
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push edx
jl 0x10018b06
mov ebx, ebx
jge 0x10018b06
jnp 0x100196dc
test eax, eax
call fcn.1000f07f
enter 0x3e27, 0x54
call 0x4b899cb6
push esi
invalid
mov byte [ebx], bh
inc edx
invalid
les ecx, [esi + esi*8]
rol dword [eax], 0xf
test dword [ebp - 0x17000084], edi
mov ecx, esi
invalid

Function at 0x10018e56
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
je 0x10018396
nop
jne 0x10018396
Function at 0x100190d1
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
test byte [eax], ch
invalid
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
invalid
push ebp
jp 0x10014fc1
xchg edi, edi
jnp 0x10014fc1
js 0x10012c13
call fcn.10018a74
mov byte [ecx], ah
call 0x9ec312db
jne 0x100190ae
pop ss

Function at 0x100193a9
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push eax
jp 0x1000cebe
nop
jnp 0x1000cebe

Function at 0x10019592
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
test dword [ecx + 0x1e], edi
add byte [eax], al
push 8
call fcn.10017795
popfd
call 0x6de955f3
push eax
jo 0x10018a2d
mov dx, dx
jno 0x10018a2d
test ch, 0
jb 0x1000fbab
call fcn.1000ee16
cmp byte [esi - 0x39], dh
mov al, byte [0x840f55e8]
push ebp
invalid
test byte [ecx + 0x64], cl

Function at 0x100195b5
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
test edx, 0x8be80000
jne 0x1000e4b4
add byte [edi], bh
out dx, eax
pushfd
popal
call 0x1e45cd14
add byte [eax], al
invalid
mov ebp, dword [esp + 4]
mov ecx, dword [ebp + 0x2ffffa8]
inc edi
add dword [ebx + 0x69e8fc7d], ecx
in eax, dx
invalid
push ebp
je 0x1000fa05
nop
jne 0x1000fa05
test cx, 0
jo 0x10016cc7
cmp dword [ecx + 0xe04], 0
call fcn.10017795
ror dword [eax - 0x7617a5c9], 0x45
cld
test di, 0
jb 0x1000e4ac
call fcn.1001836b
test dword [esi + 0xfe88c78], ebp
xchg dword [eax - 0x4a], ebx
invalid

Function at 0x100197a5
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push edi
jb 0x100179a8
mov sp, sp
jae 0x100179a8
Function at 0x100197b5
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
pushfd
jl 0x1001938d
mov sp, sp
jge 0x1001938d
mov ecx, dword [esp + 4]
js 0x1000e7aa
xchg ecx, ecx
jns 0x1000e7aa
test edx, 0
call fcn.10016096
pop eax
sub al, 0xe1
jns 0x1000d4de
add bl, 0
add byte [ebx + 0x66000866], al
test esi, 0x820f0000
fisttp word [eax]
add byte [eax], al
and dword [esi + 0xc], 0
pop ecx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
test ah, 0
jb 0x1000ef8b
call fcn.10016e87
leave
ljmp 0x4c01
mov ecx, dword [ecx]
je 0x10015e8b
mov ah, ah
jne 0x10015e8b
mov dword [esi + 0xc], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
call fcn.1000da32
mov eax, esi
pop esi
leave
ret
mov ebp, dword [esp + 4]
js 0x100117c3
xchg ch, ch
jns 0x100117c3
ret
mov ebp, dword [ebp]
jp 0x1001968c
xchg al, al
jnp 0x1001968c
sub ecx, 0x468d9c0
jmp 0x10011aa8
mov ebp, dword [ebp]
jb 0x1000d4c4
xchg dx, dx
jae 0x1000d4c4
jo 0x100131fd
and dword [esi], 0
call fcn.100185a5
aaa
add dword [edi + 0x6c8be82e], ecx
and al, 4
js 0x1000f06e
mov si, si
jns 0x1000f06e
lea eax, [esp + 0x38]
pushfd
je 0x10011613
invalid
mov di, di
jne 0x10011613
mov eax, dword [esi + 8]
call fcn.100126f7
stc
cwde
pop ds
jle 0x10015e90
test si, 0
call fcn.1000d1db
sub al, 0x6d
cmp esp, dword [edx + 0x246c29e8]
or byte [edi], cl
test byte [ecx], bl
sar edi, 0xff
test esi, 0x880f0000
mov esi, 0x33ffff8e
fisttp dword [ebp + 0xee83477]
invalid
push ebp
jp 0x1000e94a
mov ebx, ebx
jnp 0x1000e94a
mov edi, esi
test ax, 0
call fcn.10014888
jbe 0x1001978c
xlatb
call 0x1425e463
Function at 0x474411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub edi, 4
stc
pushfd
stc
cmc
push dword [edi]
pop dword [esp + 0xc]
clc
clc
cmc
clc
cmp edi, ebx
push edi
call fcn.004791ad
add byte [eax], al
inc edi
je 0x474473
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x4744a3
insb byte es:[edi], dx
dec ebp
outsd dx, dword [esi]
add al, bh
invalid
add eax, dword [eax]

Function at 0x474a87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or dl, ch
btr dx, ax
add esi, eax
setno dh
dec dx
clc
pushal
mov edx, dword [esi + 0x78]
bt cx, 0xd
mov byte [esp], 0x6c
call fcn.004c2d0e
test eax, eax
mov byte [esp + 4], 0x2e
pushal
mov word [esp + 4], 0x6840
jmp 0x474b13
lea esp, [esp + 0x28]
je fcn.004a4ef0
jmp 0x4a0a51
neg dx
mov si, sp
rcl si, 6
mov esi, dword [eax + 0x3c]
jmp 0x4744a5

Function at 0x4c2b01
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [esi*2 - 0x60765c33]
rol al, cl
mov eax, dword [ebp + 8]
cmp ch, 0x30
push 0x1ae2c631
clc
call fcn.00474a87
lea esp, [esp + 0x24]
je fcn.004a4ef0
sub dh, dl
sar si, cl
and esi, ecx
mov esi, dword [eax + 0x3c]
bsf dx, sp
add esi, eax
inc dh
shr edx, 1
mov edx, dword [esi + 0x78]
call fcn.004a48a1
shrd ax, dx, cl
aad 0xdb
lea eax, [esp + 0x4c87c9e1]
mov dword [esp], edx
jo 0x4c2899
neg al
push ebx
mov eax, dword [ebp + 8]
pushal
test eax, eax
jmp 0x4c28b3

Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shr byte [edi + 0x40ffc8], 1
push eax
push edx
rol dword [eax + 0x68], 0x74
rol byte [eax], cl
push ecx
push dword [ebx + esi - 0x3f]
cmpsb byte [esi], byte es:[edi]
or dword [ecx - 0x6764fd54], esp
outsd dx, dword [esi]
les ecx, [eax*4 + 0x500f74c0]
push 0xc040d22e
call dword [0x40c1fa]
add esp, 0x44
fild dword [ecx]
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
retf 0x8146