joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102801a6
Capabilities:
Encode data using base64

Disassembly:
lea eax, [ecx + eax + 0x126618a0]
neg eax
not dx
call fcn.10291e9e
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003bed
mov esp, ebp
pop ebp
ret
mov dword [esi], edx
mov edx, 0x51a4b016
mov dword [esp + edx - 0x51a4b016], edx
mov ecx, edx
lea edi, [edi + ecx - 0x51a4b01a]
mov eax, 0xb63cfb9c
imul ax, ax
cwd
mov eax, dword [ecx + edi - 0x51a4b016]
add dx, dx
and dl, 0x2c
xchg byte [esp + ecx - 0x51a4b015], ch
xor eax, ebx
inc word [esp + edx - 0x51a3ffff]
not eax
or dword [esp + ecx - 0x51a4b016], 0x213d223
jno 0x1028a8ed
mov dword [esi + edx - 0x3283b09b], ecx
call fcn.1011578c
jne 0x10001ba8

Function at 0x1028908e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, edx
mov bp, word [ebp + ecx - 0x1bff]
movzx edx, cx
inc eax
add ecx, ecx
pop ecx
pop ecx
pop ecx
jne fcn.101684c6

Function at 0x10289113
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol eax, 0x8f
shl byte [esp + eax*2 - 0x438b851a], 0xe6
lea edi, [eax + edi - 0x21c5c28d]
movsx ecx, ax
xor dl, bl
dec dword [esp + eax*2 - 0x438b851c]
not dl
sar byte [esp + eax*2 - 0x438b851b], 0xe6
not dword [esp + eax - 0x21c5c28e]
rol dl, 1
bt eax, eax
inc word [esp + eax*2 - 0x438b851c]
seto byte [esp + eax*2 - 0x438b851c]
sbb dl, 0x29
rol dword [esp + eax*2 - 0x438b851c], cl
xor word [esp + eax - 0x21c5c28c], cx
shl ecx, cl
not dl
ror dl, 1
neg dl
dec byte [esp + eax - 0x21c5c28d]
shr eax, 0xea
xor bl, dl
lea edx, [esp + edx + 4]
xor eax, 0xa08ea802
mov ax, word [edx]
and cl, 0x31
and byte [esp + 1], cl
lea edx, [ecx + ecx + 0x13360f27]
sbb esi, 2
ror cl, 0x45
mov word [esi], ax
neg ecx
jae 0x1009f459
movzx eax, dx
pop eax
jbe fcn.10232a4d
xor ecx, edx
btc dx, ax
mov dword [esp], 0x851c438b
sar eax, 0x2c
xor ebx, ecx
cwde
pop eax
add ebp, ecx
movzx edx, byte [edi]
jmp 0x1021c37c

Function at 0x10289246
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x4721e2a4
or eax, ecx
xadd word [esp + edx - 0x4721e29e], dx
mov dword [esp + edx - 0x4721a9ee], 0x76abd58b
mov cl, byte [edi + edx - 0x4721a9e6]
shl edx, 0xb0
sar edx, 0xc
shr eax, cl
lea ecx, [edx + edx + 0x231d55a2]
call fcn.100cb10d
mov eax, 0xc731fd1b
mov ecx, dword [edi]
cwde
btr eax, eax
sal al, 0x87
adc edi, 3
xchg ah, al
and ax, 0x7d25
xor ecx, ebx
lea edx, [eax + eax + 0x31b3dba3]
shl edx, 0x84
ror ecx, 1
inc ecx
bt eax, eax
rol ecx, 1
rol dx, 0xc7
adc ax, 0x423e
dec ecx
xor ecx, 0xa93127a5
dec ecx
sar eax, 0x66
call fcn.1010afa2

Function at 0x1028938f
Capabilities:
Packed with generic packer

Disassembly:
xor dx, 0xcbae
neg al
shr cx, 0xa
adc word [esp + 8], cx
dec dx
call fcn.100e9e46
xor ecx, 0xe3a88889
ror ecx, 3
imul edx, eax
add edx, dword [esp + edx - 0x28f4e578]
bt ax, dx
xor ebx, ecx
add esi, ecx
movzx edx, word [edi + edx*2 - 0x61fb0afc]
sub edi, 0xfffffffa
dec ax
sub dword [esp + 5], 0xd5921798
mov dword [esp], eax
xor dx, bx
neg byte [esp + 2]
movsx ecx, word [esp + 1]
ror dx, 1
dec word [esp + 0xa]
inc dx
jmp 0x1025d4a2
Function at 0x1028f492
Capabilities:
Encode data using base64

Disassembly:
push 0x5c9c9aa6
mov dword [esp], eax
dec ebx
push 0x932ad39c
lea esp, [esp + 4]
jne 0x1028f49e
mov eax, dword [ebp]
push 0x8ea37f2e
jmp fcn.100df99c
test ebx, ebx
lea esp, [esp + 4]
je 0x100fb443
mov eax, 0x1883d69d
ror al, 1
sbb eax, eax
mov eax, dword [ebp + ebx*4]
jl 0x100fb42a
mov ecx, 0x3ae6ca8
mov eax, dword [ebp + ecx*8 - 0x1d736540]
bts ecx, 0x94
lea ebp, [ebp + ecx - 0x3be6ca4]
mov edx, 0x1113eb97
xor eax, ebx
bswap edx
shr dx, cl
imul ecx, edx
lea eax, [eax + ecx - 0x7b9053fb]
bswap eax
btr edx, ecx
bt dx, 0xa0
call fcn.102a8023
mov ecx, 0xa50b1e2c
call fcn.101e1042
adc ebp, 4
push 0x413c5333
push 0xc1bbfd37
div ecx
mov ecx, 0x788dcf2b
lea ecx, [ecx + ecx - 0x74eb327f]
lea ecx, [ecx + ecx*8 + 0xd2091bc]
mov dword [ebp + ecx - 0x6ad45c4b], edx
movzx edx, cl
sar ecx, 0xc1
inc ecx
mov dword [ebp + edx - 0x47], eax
mov dword [esp + ecx - 0x356a2e26], edi
ret 4

Function at 0x102a0a85
Capabilities:
Execute syscall

Disassembly:
mov ecx, dword [esi + ecx*2 - 0x2525e82a]
mov eax, 0x7f0035ad
mov dword [esp + eax - 0x7f0035ad], eax
xchg byte [esp + eax - 0x7f0035ac], al
lea esi, [esi + eax - 0x7f003531]
sbb al, ah
sal eax, 0xf5
pop eax
xor ecx, ebx
inc eax
dec ax
xor ecx, 0x51ae53b4
ror al, 0x87
sal eax, 0xca
lea ecx, [ecx + eax*2 - 0x551e5936]
shr al, 2
bswap eax
xor ecx, 0x333f0900
rol al, 0xc7
btc ax, ax
shr al, 1
rol ecx, 3
cwde
or ax, ax
inc ecx
inc ax
xor eax, eax
not ecx
cwde
btr eax, eax
imul eax, eax
xor ebx, ecx
add eax, eax
adc edi, ecx
add eax, dword [ebp + eax*2]
mov ecx, 0x1a1b951c
bswap ecx
mov ecx, dword [ebp + ecx - 0x1c951b16]
call fcn.1020a3c7
syscall
inc ecx
push ebp
dec eax
mov dword [esp], 0x2112b2ce
call fcn.1023f94b
Function at 0x102a3c0d
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr edx, 0x4c
and dx, 0xf892
sbb ecx, 0x940039b3
lea edx, [edx*2 + 0x72b09332]
not ecx
dec ecx
bts eax, eax
rol ecx, 2
or dl, 0x93
sete al
not ecx
sbb al, al
adc ax, dx
bswap ecx
dec ecx
imul edx
lea eax, [eax + eax*2 + 0x1b46f8c]
push eax
xor ebx, ecx
cdq
sar dword [esp], 0xde
shr eax, 0xa1
add esi, ecx
mov eax, dword [edi + eax - 0x7a004a1f]
add edi, 8
inc word [esp + 1]
ror dword [esp], 1
seto dl
xor eax, ebx
inc eax
shl dx, 0x6e
sal byte [esp + 1], 0xe4
xor eax, 0xeca3fbb5
sal dl, 0xe4
lea ecx, [edx + 0x3dbfac16]
sbb eax, 0xd3b80fab
bswap ecx
sal dl, 0x21
ror dword [esp + ecx - 0x16acbe3d], 0xd0
not eax
xor ebx, eax
ror dword [esp + ecx - 0x16acbe3d], 0x29
mov dword [ebp + ecx*4 - 0x5ab2f8f8], eax
lea ebp, [ebp + ecx*2 - 0x2d597c7e]
pop ecx
jb fcn.1009dcc4
dec edx
xor ebx, eax
mov dword [esp + ecx - 0x3598115e], ecx
call fcn.1021f436
inc ecx
inc ebp
aam 0xef
dec eax
dec edi
lcall 0x9a0b, 0xc4a7bce6
out 0xbc, al
mov edi, 0xe69a5b14
mov esp, 0x896374e3
jnp 0x102a3c92
push esp
push ss
cwde
lahf
or ebx, ebx
dec esp
int 0xbc
fnsave dword [ecx + edx*8 + 0x6d1ed9a4]
sahf
inc eax
mov byte [0xe6879b6a], al
cmp dword [eax], esp
sub esi, dword [ecx - 0x5f]
add al, byte [eax]
inc ebp
cmp eax, 0x4382a8e
inc ebp
cmp eax, 0x4c0c668e
inc ebx
bound eax, qword [esi - 0xd17c254]
call 0x1022ed5e
neg ecx
call 0x10115299
movsx eax, cl
xor edx, ebx
bswap eax
inc edx
dec ecx
add eax, 0x968bc19a
xor edx, 0xeca3fbb5
sub edx, 0xd3b80fab
cwde
shr eax, cl
not edx
xor ebx, edx
lea ebp, [ecx + ebp - 0xb622]
call fcn.1027c6aa
jae 0x101b8c20
mov edx, 0xe486a32e
mov edx, dword [ebp]
mov eax, dword [edx]
mov edx, 0x642d80a6
and edx, edx
mov dword [ebp + edx - 0x642d80a6], eax
mov eax, 0x850bba8c
mov ecx, dword [edi + edx - 0x642d80a6]
sal ax, 0x28
sbb ax, dx
rol dx, 0x83
xor ecx, ebx
jmp 0x1021c24d
Function at 0x102b49ab
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0xf1bcaf1e
not dl
add cx, 0x3911
xor ebx, eax
imul ecx, edx
sub cx, dx
not edx
adc edi, eax
movzx eax, cx
inc al
movzx ecx, word [edx + esi + 0x254a1400]
imul eax
imul eax
adc esi, 1
mul dl
neg ax
xor cx, bx
rol eax, 0x8b
bts edx, 0x89
xor cx, 0xe82
shr al, 0x85
dec cx
mov edx, 0x816689ea
int1
or byte [esi], 0xc0
call 0xda259f52
ror edx, 0x9b
call fcn.10115f0d
xadd cx, ax
movsx edx, al
lea edi, [edi + edx*4 - 0x176]
pop edx
pop edx
pop edx
jl fcn.1023c514
invalid
fsubr st(7), st(0)
out 0xce, al
aad 0x6e
jae 0x102638bf
sahf
das
jecxz 0x1026394a
jae 0x102638c5
sahf
ret
xor ebp, dword [edx + esi*2 + 0x1fe59ecb]
mov al, byte [0x929faec5]
jo 0x102638eb
sbb dword [edi + 0x3cd5efce], esp
mov esp, 0x736b9c8a
salc
sub dword [esi + ebp*8], ebp
xchg esp, eax
in al, 0xc0
call 0xfd482893
outsd dx, dword [esi]
xchg edx, eax
out 0xd0, al
f2xm1
dec ch
mov cl, bh
fadd st(1)
ret 0x47b2
inc ecx
btr edx, esi
neg dl
ror dl, 1
dec ecx
not esp
inc esi
movzx ebx, byte [esp + 0x16b8]
not dl
dec eax
sar dword [esp + edi - 0x7b3d1686], cl
inc eax
mov byte [esp + edi - 0x7b3d168d], dh
ror dl, 1
inc esp
xor cl, dl
inc esp
sub ch, cl
inc ecx
shr al, 0x85
inc cx
xor eax, ebx
dec eax
lea edx, [esp + edx + 0x20]
dec esi
mov ebp, dword [edx + ebx*2 - 0x4a]
dec esp
lea esi, [esi + ecx*4 + 0x55a8c63e]
inc esp
adc byte [esp + edi - 0x7b3d168a], dl
dec eax
and dword [esp + edi - 0x7b3d1686], edi
dec edi
lea edi, [esp + edi + 0x1697]
dec esi
mov dword [edi + edi - 0x7b3d169e], ebp
pop ecx
pop edi
pop eax
pop ecx
jno fcn.100e3fc0
xor eax, ebx
pop edx
mov ecx, 0x6d95ba1d
or cx, 0xcda8
dec eax
add ecx, 0x210f5212
ror edx, 0xa2
neg eax
rol ecx, 0x32
rol eax, 3
neg ecx
jnp 0x10263884

Function at 0x102be227
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor bl, dl
mov dword [esp], eax
lea eax, [eax*2 + 0x68827bbf]
mov dword [esp + eax - 0x173227d1], edi
neg word [esp + eax*4 - 0x5cc89f72]
sar al, 5
mov dword [esp + eax - 0x173227f6], ebp
xadd word [esp + eax - 0x173227f9], ax
lea ebp, [eax + eax*4 + 0x201e0591]
cmovs bp, word [esp + eax*2 - 0x2e64afa6]
mov dword [esp + eax - 0x173257d2], ebx
mov ebp, esi
movsx ebx, al
mov ebx, edx
movzx edx, byte [esp + eax*2 - 0x2e64afac]
cdq
or dx, 0x8030
mov edx, ebx
shl edx, 2
btc eax, 0xad
inc al
mov eax, ebp
push 0xcd8ac80b
ror byte [esp + 2], 0xe1
sal dword [esp + 4], 0x71
add eax, edx
neg byte [esp + 6]
mov dword [ebp - 4], eax
shl dword [esp], 0xa4
push 0x382fca98
inc byte [esp + 0xa]
test ebx, ebx
jmp 0x1044e232
Function at 0x102be2ce
Capabilities:
Encode data using base64

Disassembly:
add ebp, eax
imul edx, ecx
mov eax, dword [esi + ecx*2 - 0x1e00]
mov dword [esp + ecx - 0xf00], edx
xadd ecx, edx
mov edx, dword [esi + ecx*8 - 0x4bc3effc]
shl ecx, 0xbd
dec dword [esp + ecx]
adc cl, byte [ecx + esi + 8]
add esi, 0xa
dec word [esp]
neg dword [esp]
sar dword [esp], 0xaf
shld eax, edx, cl
mov edx, 0x6cb43f9e
mov ecx, eax
movzx eax, byte [edi + edx - 0x6cb43f9a]
pop edx
add edi, 5
btr edx, edx
xor al, bl
bt edx, edx
shl dl, 0xc1
sbb al, 0x81
neg dx
btr edx, edx
and dx, dx
not al
btc edx, 0xb2
inc al
ror al, 1
sub al, 5
dec dx
xor bl, al
add eax, esp
shl edx, 0x28
dec edx
call fcn.103095a2
mov eax, dword [esi]
mov ecx, 0x758c3093
or cl, cl
xor ecx, 0x342228a4
mov edx, dword ss:[eax + ecx - 0x41ae1837]
movzx eax, cx
shl ax, 0xc4
bts eax, ecx
mov dword [ecx + esi - 0x41ae1837], edx
jae 0x103a5d2b
ror cx, 0x2d
adc edi, 4
xor eax, ebx
call fcn.10338d71
jb 0x1043cf61
mov ecx, dword [edi + ecx - 0x41ae1837]
lea edx, [eax*2 + 0x18b0ee0c]
shr eax, 0xa6
lea edi, [edi + eax*4 - 0x80830]
cmovb dx, ax
sbb eax, 0xd91161a7
xor ecx, ebx
neg edx
add al, dl
lea ecx, [ecx + edx - 0x154d13b6]
add eax, eax
sete al
xor ecx, 0x636f295
call fcn.103a7f2e
mov edx, 0x2d8a81b4
mov ecx, dword [esi + edx - 0x2d8a81b4]
shl edx, 0x27
btr dx, dx
mov eax, dword [ecx]
adc edx, 0x32851ab3
mov dword [esi], eax
lea ecx, [edx*4 - 0x2f4c2c54]
bt edx, edx
mov eax, dword [edi]
setae dl
adc edi, 4
sub edx, 0x9e3af118
imul ecx, edx
call fcn.104236c1
pop ecx
mov eax, dword [edx + eax - 0xc4662d]
push ecx
jns 0x102ca1a4
jmp 0x10465b34
ror cl, 1
add dl, dl
sbb cl, 0xa3
rol cl, 1
movsx eax, dx
xor bl, cl
btc dx, 0x31
cdq
adc ecx, esp
movzx ax, byte [ecx]
not dx
or dl, dl
lea ecx, [edx - 0x7f6f8bd5]
mov word [ebp - 2], ax
mov cx, word [ebp - 2]
movzx eax, byte [esi + 1]
not edx
imul edx, edx
lea edx, [edx - 0x41cb1d5f]
xor al, bl
bts dx, dx
ror al, 1
rol edx, 0xd0
inc al
btc edx, edx
neg al
inc al
bt dx, dx
xor bl, al
bt edx, 0xaa
add eax, esp
imul edx, edx
adc edx, edx
btc dx, dx
mov word [edx + eax - 0x192c8189], cx
movzx eax, dl
movsx ecx, ax
setb cl
mov ecx, dword [esi + edx - 0x192c8187]
sar edx, 0xea
xadd dx, ax
and ax, ax
lea esi, [edx + esi - 0x64ba3]
sub al, 0x3a
shl edx, 0xbb
xor ecx, ebx
lea edx, [edx*4 + 0x61b6439f]
lea ecx, [edx + ecx + 0x11d2e57e]
mul edx
shl eax, 2
xor ecx, 0xf1cdf98
dec ecx
call fcn.103b2547

Function at 0x102c5c0e
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp + 8]
call fcn.10345db3
mov ecx, 0x27b75114
mov eax, dword [edi + ecx - 0x27b75114]
lea edi, [edi + ecx*2 - 0x4f6ea224]
jmp 0x10394111
Function at 0x102c60f0
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x2488dd29
xor edi, edx
jmp 0x1039de0f
call 0x102d56cb
neg dword [esp + eax - 0xcffab]
pop edx
jg fcn.102d9ffd
pop edx
dec esi
mov esi, dword [esp + ebp - 0xd004]
dec edx
mov ebp, dword [esp + ebp*4 - 0x34080]
dec esi
mov ebp, dword [esp + ebp - 0xcff4]
dec esi
lea edx, [edx*4 + 0x76848ea4]
dec esi
mov edx, dword [esp + edx - 0x76848e64]
call fcn.104200d3
not word [esp + 4]
not dword [esp + 3]
and edi, 0xff
mov edi, dword [edi*4 + 0x103e6d28]
shr edx, 8
not dword [esp + 2]
sar dword [esp + 2], 0xc8
xor edx, edi
jmp 0x10417877
inc eax
xor edx, 0xa8a65413
jmp 0x1031f180

Function at 0x102c9ea3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xab9c22b9
shrd edx, eax, cl
mov dword [edi], edx
call fcn.10408c81
dec ecx
jmp 0x10408dae

Function at 0x102ca82e
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea ebp, [ebp + edi*2 - 0x166]
inc ebp
movzx edx, bp
inc esp
mov edx, dword [ebp + edi - 0xb1]
inc ecx
dec ebp
call fcn.103bd6a4

Function at 0x102d09df
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x5601a458
call fcn.1046d00f

Function at 0x102d09ec
Capabilities:
Encode data using base64

Disassembly:
inc edx
xor eax, 0x4b195615
xor edx, edx
rol edx, cl
js 0x103c9966
xor ebx, eax
mov dword [esp + edx], edx
rol ecx, cl
rol ecx, cl
adc edi, eax
rol byte [esp + ecx - 0x17ffffff], 0x22
sar dword [esp + edx*2], 0xb0
sbb dword [esp + edx], 0xf8b1e0a6
or cx, word [edx + ebp]
sar edx, 0x70
call fcn.104a22b5
Function at 0x102d2db6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp + ecx - 0x6d]
mov dword [esp + ecx*4 - 0x1b4], ecx
and byte [esp + ecx*8 - 0x367], 0x2f
shr dword [esp + ecx - 0x6d], cl
xor edx, ebx
add edx, 0xa2a15f83
lea ecx, [ecx + ecx*4 - 0x6b6db349]
movzx eax, cl
ror edx, 1
lea edx, [edx + eax*2 - 0x79b09e4c]
mov word [esp + eax - 0xd6], 0x28b1
add cl, ch
bswap edx
cbw
sub cl, ah
not edx
jne 0x1030c858
push 0xc5949b9b
test ecx, ecx
push 0xbc82181c
call fcn.104048d0
mov ecx, 0x1c16d216
push ecx
movzx eax, byte [ebp + ecx*4 - 0x705b4858]
dec cx
pop edx
and ecx, ecx
xor al, bl
lea edx, [ecx*8 + 0x592d6891]
bswap ecx
xchg dx, cx
rol al, 1
jmp 0x10420b15
sub al, 0x88
and edx, ecx
dec dl
not al
neg al
push ecx
xor bl, al
sub dx, word [esp + ecx - 0x15d2f938]
dec edx
dec edx
lea eax, [esp + eax + 4]
add dx, 0xd008
xchg edx, ecx
mov cx, word [eax + ecx - 0x11c20d24]
xor dword [esp + edx*4 - 0x574be4e4], 0x4210f69d
call fcn.103ffad0
dec ebp
arpl bx, bx
inc ebp
xchg al, dh
dec ecx
add ebx, ebx
dec eax
lea ecx, [edi + edx*2 + 0x3362411]
inc ecx
idiv dh
rdtsc
dec esi
lea edi, [esi + edi - 0x3e]
inc ecx
xchg ah, bh
inc cx
inc ebp
inc ecx
mov dword [edi + esi*4 - 0xd4], eax
inc eax
not dh
inc ecx
mov dword [edi + esi*2 - 0x192], edx
inc ecx
movzx eax, ah
dec esp
lea ebx, [edi*4 + 0x7952604]
dec si
jns fcn.1040c813
mov eax, 0xf9959890
shr eax, 0xfe
mov edx, dword [esi + eax*8 - 0x18]
xor edx, ebx
push eax
rol edx, 1
not eax
inc dword [esp]
inc edx
rol edx, 2
neg dword [esp]
rol eax, 0x7f
sbb edx, 0x53b66492
call fcn.104510bc
inc ecx
mov ebx, 0x40be6f1a
inc ebp
movsx ebp, bl
dec ebp
or ebp, ebp
dec ecx
lea ebp, [ebp + ebp - 0x1e]
inc ecx
movzx eax, bl
inc ebp
mov edx, dword [ebp + ebp - 0x1a]
inc ebp
xor edx, ecx
dec eax
cwde
inc ecx
neg edx
inc ecx
ror edx, 1
dec esp
lea esp, [eax*8 - 0x2c58c5d3]
dec ecx
lea esi, [esp - 0x1cc45049]
dec esp
xadd esi, esp
inc ecx
inc edx
movsx ecx, si
inc ecx
not edx
inc ecx
xor edx, 0xc0829686
dec ebp
lea eax, [esp - 0x2b6ecf62]
add cl, 0xba
bt ecx, ecx
inc ecx
not edx
cdq
not si
inc ecx
add edx, esp
inc edi
lea edx, [edx + ebx + 0x4bb6e7]
dec eax
cwde
inc ecx
bswap edx
inc esp
xadd cl, ch
inc ecx
push ecx
inc eax
sets dh
inc esi
xor dword [esp + ebx - 0x40be6f1a], edx
inc ecx
pop ecx
dec ebp
arpl dx, dx
inc esp
movsx esi, ax
jmp 0x10490db0
dec eax
xor edx, 0x489e634
dec ecx
adc ebx, edx
inc ebp
mov edx, esp
movzx edi, dl
inc edi
mov edi, dword [edi + ebx - 0x40be6f1a]
jmp fcn.1040c813
Function at 0x102e7d7d
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + ecx - 0xaee], ecx
cwde
not edx
sar eax, 0x93
setae al
xor ebx, edx
bswap eax
or eax, dword [esp + eax - 0xfffffc]
inc cx
adc edi, edx
not byte [esp + ecx - 0xae9]
or eax, 0xf32e5824
mov ebp, dword [ecx + ebp - 0xaef]
or cx, 0x11a2
shl dword [esp + ecx - 0x1beb], 0xd9
pop edx
pop ecx
jne fcn.104769e1
bt dx, 0x9d
jb 0x103b6cf6
mov edx, 0xa1b8300c
movzx ecx, dl
mov ecx, dword [edi + ecx*8 - 0x60]
call fcn.102fc0c9
push 0x901f9503
mov dx, word [esi]
mov ecx, 0xf917f2bb
movzx eax, cx
lea ecx, [eax + 0x5d9d270f]
lea esi, [ecx + esi - 0x5d9e19c8]
movzx eax, byte [edi + eax*2 - 0x1e576]
not dword [esp + ecx - 0x5d9e19ca]
rol ecx, cl
lea edi, [edi + ecx - 0x78672975]
xor al, bl
not cl
shl word [esp + ecx - 0x78672989], 0xa1
sbb al, 0x9d
not al
mov dword [esp + ecx - 0x78672989], ecx
xor cl, ch
jge 0x1046b677
dec al
add byte [esp + ecx - 0x7867299d], ch
inc cx
btc cx, cx
neg al
xor bl, al
btr cx, cx
xadd word [esp + ecx - 0x786729a3], cx
add ecx, 0x9f957baa
lea eax, [esp + eax + 4]
inc dword [esp + ecx*2 - 0x2ff94a66]
not byte [esp + ecx*4 - 0x5ff294ca]
mov byte [eax + ecx*2 - 0x2ff94a66], dl
adc byte [esp + ecx - 0x17fca530], ch
mov eax, dword [edi + ecx*4 - 0x5ff294cc]
sar ecx, cl
push ecx
dec ecx
lea edi, [edi + ecx*2 - 0x5f8]
xor eax, ebx
xor eax, 0xfd308d8e
ror byte [esp + ecx*2 - 0x5f5], 0x47
ror ecx, 0x43
neg eax
ror eax, 1
not eax
dec byte [esp + 5]
sal word [esp + 2], 0x61
shr ecx, 0x11
xor ebx, eax
lea edx, [ecx + ecx*8 + 0x4f05a3b5]
lea ecx, [edx*4 - 0x3dd5b758]
add ebp, eax
neg byte [esp + edx - 0x4f0903b1]
movzx eax, byte [esp + edx - 0x4f0903b1]
mov dword [esp + edx - 0x4f0903b5], ebp
ret 4
xor eax, 0x469adbba
add cl, 0x29
not edx
not eax
sal cl, 0x66
sal edx, 0x6e
sal ecx, 0x9c
neg eax
add cx, dx
inc cx
ror cx, 1
bswap eax
rol eax, 2
inc dl
neg eax
call fcn.102db8d7
call fcn.1045d3a2

Function at 0x102eafda
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x1c2f6c0b
sal dword [esp], 0x1b
adc eax, edx
call fcn.10376022

Function at 0x102eb711
Capabilities:
Encode data using base64

Disassembly:
mul dx
mov edx, dword [eax + ebp - 0x82300c]
lea ebp, [eax + ebp - 0x823008]
xor edx, ebx
xor edx, 0xbd31572a
mov dword [esp + eax*4 - 0x208c040], eax
rol edx, 2
xor edx, 0xbaa45f21
pop eax
dec edx
mov ecx, eax
neg edx
dec eax
rol eax, cl
idiv al
rol edx, 1
sar ecx, cl
inc edx
not cl
bswap edx
ror edx, 1
dec ecx
sal eax, cl
sbb al, cl
sbb edx, 0xee85739e
ror cx, 0x41
rol cx, 0xa9
xor ebx, edx
shl al, 0xe5
mov dword [edi + ecx - 0x7c02], edx
add eax, ecx
jp 0x104634db
Function at 0x102ed8fd
Capabilities:
Authenticate hmac

Disassembly:
pop eax
xor ecx, ebx
sub ecx, 0x8712c18f
mov eax, 0xe6256105
mul eax
bswap ecx
shl dl, 0xe1
rol dl, 0x61
rol ax, 0xc8
ror ecx, 1
jmp 0x10454607
not ecx
neg eax
sal ecx, 0x5c
btr ecx, ecx
sbb eax, 0x56ab511f
neg eax
sal edx, 0x4f
rol dl, 7
bswap eax
rol cx, 0xe2
sar edx, 0xf4
inc eax
sub edx, edx
add edx, ecx
xadd ecx, edx
xor ebx, eax
imul edx, edx
add edi, eax
mov eax, edx
cdq
mov ecx, dword [edx + ebp]
add dx, word ss:[edx + ecx]
lea edx, [edx + edx*2 - 0x72691ac5]
lea eax, [eax*4 - 0x26d26d74]
inc ecx
xchg edx, eax
cwd
btc edx, edx
bswap ecx
cwde
mul dx
btc dx, 0x3b
xor ebx, ecx
mul dl
not edx
ror eax, 0x3f
adc ebp, ecx
mov ecx, dword [esi + eax*2 - 4]
cwd
btc ax, dx
btr eax, 0x18
mov al, byte [edi + eax*8 - 0x11]
bt edx, edx
sar edx, 0xe3
je 0x1036c114
lea edi, [edi + edx*8 - 0x75fa0009]
inc dl
xor al, bl
add al, 0x36
xor al, 0xb7
btr edx, 0xab
dec dl
not dl
adc al, 0xb
xor al, dl
not edx
dec al
xor bl, al
lea edx, [edx*2 - 0x4e5bd8fe]
add eax, esp
sar edx, 0xf0
ror edx, 0xd2
mov dword [eax], ecx
jp 0x10417fc4
movzx eax, dx
xchg dl, al
jmp ebp

Function at 0x102f1ff7
Capabilities:
Encode data using base64

Disassembly:
sal dword [esp + eax - 0x7daa4a1f], 0xf6
cdq
neg ecx
btr eax, eax
lea ecx, [ecx + edx*4 - 0x56ab511f]
neg ecx
bswap ecx
shr dl, 0xa2
inc ecx
xor ebx, ecx
sar eax, 0x1b
add dx, word [esp + edx + 5]
adc edi, ecx
cwde
mov cx, word [eax + ebp - 0xd]
cwde
mov ax, word [ebp + eax*4 - 0x38]
or edx, dword [esp + edx*2 - 0x17ffc]
mov dword [esp + edx - 0x8c0c000], edx
or cx, ax
inc edx
not cx
mov eax, edx
dec dl
shl al, 0xa6
mov word [edx + ebp - 0x8c0bffc], cx
inc edx
lea ebp, [ebp + edx*2 - 0x11817ffe]
call fcn.103d49cf

Function at 0x102f205d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
jne 0x1039f277
pop edi

Function at 0x102f24b9
Capabilities:
Encode data using base64

Disassembly:
neg dl
btr eax, eax
ror ax, 0xc6
pop eax
xor bl, dl
sub byte [esp], 0x2a
inc word [esp + 4]
jo fcn.103a50e3
lea edx, [esp + edx + 8]
call fcn.10328df6

Function at 0x102f2bcc
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea esi, [ebp + ebp*4 + 0x20154386]
inc ebp
movsx edx, dh
inc ecx
not bl
not cl
dec edx
lea esi, [ebp*2 + 0x3134c406]
inc cx
bt edx, 0xb0
jae 0x1047d499
inc esp
and bl, cl
dec edx
mov dword [esp + ebp*2 - 0x4a44a050], 0xffae5e3f
call fcn.1039ca43

Function at 0x102f345e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec esi
lea ebx, [esp + ebx + 8]
dec eax
mov dword [esp + edi - 0x108000], 0x66074520
add al, 0x82
inc di
mov esi, dword [edx + ebx - 0x4aa91d21]
dec ebp
lea edi, [edi + edi*2 - 0x210002]
jp 0x10353ead
Function at 0x102f54cb
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dx, word [edi + eax*2 - 0x72330c48]
mov cl, byte [edi + eax*2 - 0x72330c46]
mov dword [esp + eax*2 - 0x72330c48], eax
lea edi, [eax + edi - 0x39198622]
shl dx, cl
mov word [edi + eax - 0x39198624], dx
shr word [esp + eax*2 - 0x72330c48], 0x66
invalid
shr dword [esp + eax*2 - 0x72330c48], 0x66
cdq
mov eax, dword [ebp + edx*4]
btc dx, dx
inc word [esp + edx*4 - 3]
inc esp
xchg ebp, eax
add byte [esi + 0xf], ah
mov ebx, 0x44ff66d2
xchg esp, eax
std
inc dword [esp + edx*4 - 3]
rol dword [esp + edx*2 - 2], 0x79
lea ebp, [ebp + edx*8 - 4]
xor eax, ebx
movsx ecx, dl
sub byte [esp + edx + 2], dh
xor word [esp + edx*8 - 8], 0x949d
rol eax, 2
neg byte [esp + edx*4 - 3]
seto dl
inc cx
adc eax, 0xa0823e9f
add ecx, edx
call fcn.104a0c3f
or al, cl
not al
call fcn.10409f65
jne 0x102f54e7
add byte [ebp - 0x60], dh
cwde
into
insb byte es:[edi], dx
out 0x74, eax
cmp dword [ecx + 0x76], esp
dec eax
xlatb
je 0x102f558c
popal
jbe 0x102f55cc
jecxz 0x102f55cc
cmp dword [ecx - 0x76], esp
je 0x102f54f4
pop esi
jns 0x102f55cf
mov ecx, 0x18bd66bb
jbe 0x102f54fe
pop es
rcl byte [edx + 0x6870b32], 0x65
loope 0x102f5506
sbb ch, byte [edx + 0x2b]
sub al, 0x72
xchg dword [esi + 0x31], edx
and cl, byte [edi]
push esi
jno 0x102f5544
jb 0x102f55c7
add eax, 0xbd7279a7
push edx
push ds
jge 0x102f559e
js 0x102f55a7
wait
invalid
mov edx, 0x2f06889f
aas
rcl edx, 1
cmp ebp, dword [eax - 0x2f9fef7]
add dword [esi], eax
std
jl 0x102f5593
and eax, 0x87ca423
jl 0x102f55b1
xor dh, byte [esi + edi]
scasb al, byte es:[edi]
and dh, byte [ebx + 0xe]
pop ss
adc dword [esi + 0x6b], eax
jmp dword [esi + esi*8]
ror dword [ecx], 0x3f
inc edx
xor dword [ecx + 0x4e], 0xffffffc3
jno 0x102f561c
ret
lahf
sub dl, byte [ecx - 0x5d]
jnp 0x102f5640
xchg edi, eax
int1
sbb al, 0x5a
and al, 0xc3
xchg esi, eax
xchg byte [ebp + 0x62512428], bh
outsd dx, dword ss:[esi]
into
dec ebp
dec esi
push ds
inc ecx
shr dword [esi - 0x4c49942b], cl
and edx, dword [ecx + 0x22]
das
or bl, ch
xchg dword [esi - 0x3a056978], esi
and dl, byte [ecx + edx*8 + 0x4e4f48d8]
bnd jbe 0x102f5606
inc dword [edi]
pop es
sub dword [ecx - 0x1e], edx
out 0xd2, eax
scasb al, byte es:[edi]
cmp eax, 0xd29cb6a4
scasb al, byte es:[edi]
sub ebx, ecx
mov al, byte [0xaf004374]
imul esi, edx, 0x294e71ca
ret 0xeb3a
bnd retf 0x4e71
and al, 0x32
fsubr qword [esi]
out dx, eax
push ecx
sar dword [edi - 0x2853d123], cl
adc ch, byte [eax]
hlt