joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101085b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.101081c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101085e2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101a72a8]
call dword [ebp - 8]
jmp 0x101085ec
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10169fe0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10169680
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1016a014
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101a72a8]
call dword [ebp - 8]
jmp 0x1016a01a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1016a070
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.101696c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1016a0a4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101a72a8]
call dword [ebp - 8]
jmp 0x1016a0ae
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1016a0c0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.101696e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1016a0f8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x101a72a8]
call dword [ebp - 8]
jmp 0x1016a106
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1016a1d0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10169780
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1016a210
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101a72a8]
call dword [ebp - 8]
jmp 0x1016a22e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1016a590
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10172860
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100f5560
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x102caad0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10172a38
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10172987
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10172987
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10172965
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x101728e9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101729f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10172a58
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10172a33
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10172a58
jmp 0x101728c2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
mov esp, ebp
pop ebp
ret
Function at 0x10172a70
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100f5560
mov eax, dword [0x101f3540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x102caad0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x10172c5b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10172ba6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10172ba6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10172b82
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x10172af9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10172c14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10172c7b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10172c56
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x10172c7b
jmp 0x10172ad2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3240
mov esp, ebp
pop ebp
ret
Function at 0x1018b720
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1018b5c0
lea ecx, [ebp - 4]
call fcn.1018b6f0
movzx eax, al
test eax, eax
jne 0x1018b75d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x18]
jmp 0x1018b885
lea ecx, [ebp - 4]
call fcn.1018b6c0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1018b680
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.1018b6c0
push eax
push 0
push 0
call fcn.1018b500
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1018b7c3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x20]
jmp 0x1018b885
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.101678b0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.100fa960
lea ecx, [ebp - 8]
call fcn.100fa9e0
movzx edx, al
test edx, edx
jne 0x1018b80c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.100fa9a0
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x24]
jmp 0x1018b885
lea ecx, [ebp - 8]
call fcn.100faaa0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.1018b6c0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.1018b500
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1018b867
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.100fa9a0
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x34]
jmp 0x1018b885
lea ecx, [ebp - 8]
call fcn.1012ed90
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.100fa9a0
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x1018b890
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1018b5c0
lea ecx, [ebp - 4]
call fcn.1018b600
movzx eax, al
test eax, eax
jne 0x1018b8cd
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x14]
jmp 0x1018b987
lea ecx, [ebp - 4]
call fcn.1018b6c0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1018b680
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.101678b0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.1012ec40
lea ecx, [ebp - 8]
call fcn.1012ecc0
movzx ecx, al
test ecx, ecx
jne 0x1018b93d
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.1012ec60
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x1c]
jmp 0x1018b987
lea ecx, [ebp - 4]
call fcn.1018b6c0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.1012edf0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.100f7980
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.1012edc0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.1012ec60
lea ecx, [ebp - 4]
call fcn.1018b5e0
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x1019d480
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.10188b60
lea ecx, [ebp - 0x34]
call fcn.10188b60
call fcn.1017ec50
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10187930
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1019d4d3
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.10188c80
lea ecx, [ebp - 0x4c]
call fcn.10188c80
mov eax, dword [ebp - 8]
jmp 0x1019d548
call fcn.1017ec50
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10187930
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1019d50e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.10188c80
lea ecx, [ebp - 0x4c]
call fcn.10188c80
mov eax, dword [ebp - 0x10]
jmp 0x1019d548
lea ecx, [ebp - 0x34]
call fcn.10189280
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.10189280
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.10188c80
lea ecx, [ebp - 0x4c]
call fcn.10188c80
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10003ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jle 0x10003f18
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
push ebx
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
and edx, 0xff
xor bx, word [edx*2 + 0x10018770]
inc ecx
dec esi
mov eax, ebx
jne 0x10003ef2
pop ebx
pop esi
ret
mov ax, word [esp + 0x10]
pop esi
ret
Function at 0x10008eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword ss:[ebp + 0x4c], 0
jmp 0x10008ec3
Function at 0x10024a64
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 0x20], esi
not dl
movsx edx, word [esp + ecx + 0x528775fe]
push 0x611426a8
jbe 0x101f61bd
js 0x1012b4a6
add dword [esp + ecx + 0x5287760e], 0x24da71
cmp dword [esp + ecx + 0x52877602], 0x3902d0d
je 0x10211391
nop
test cx, dx
mov dword [esp + 8], 0xcfa3a5ac
call fcn.1016f236
or word [esp + 0x10], 0xcfb2
jne 0x101fd29d
shr ebp, 0x3f
shl dword [esp + ebp - 1], 0x33
movzx eax, byte [edi + ebp*8 - 8]
ror ebp, 0xc
xor al, bl
push ebp
push ebp
not al
add al, 0x15
push ebp
xchg word [esp + ebp*4 - 0x3ffff4], bp
not al
mov word [esp + ebp*4 - 0x3ffff3], 0x2534
not ebp
call fcn.10277856
mov ecx, 0x562f0392
mov ecx, dword [edi + ecx - 0x562f0392]
mov eax, 0x862c482d
sub al, 0x86
mov eax, dword [edi + 4]
jmp 0x1010d4fb
Function at 0x10085472
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 8], 0xffe0c044
mov dword [esp + 0x10], 0xf31d14a4
mov dword [esp + 0x10], ebp
push ebx
add dword [esp + 0x10], 0x7223ac98
mov ebx, 0x613de6a3
mov dword [esp + ebx - 0x613de693], ebx
or ebx, dword [esp + ebx - 0x613de693]
nop
mov ebp, dword [esp + ebx - 0x613de693]
sub ebp, 0x1626aca4
and bl, bl
or dword [esp + 0x10], 0xb131a0b9
test word [esp + 0x10], 0x2907
lea ebx, [ebp + ebx*8 + 0x77ad0fa1]
lea ebx, [ebx*4 - 0x28fe08d0]
pushfd
frstor dword [ecx - 0x728852f1]
sbb al, 0x9d
xor bh, dh
add edi, edx
mov ebp, dword [esp + ebx - 0x9cff204]
mov ebp, dword [ebp + ebx*2 - 0x139fe420]
jg 0x1024567c
push edx
clc
pop ss
push esp
daa
sbb bh, ah
inc edx
test eax, 0x703358c9
jo 0x100854c2
insd dword es:[edi], dx
xchg esi, eax
sbb byte [ebp + ecx*2 + 0x45], 0xa8
mov ah, 4
fisubr word [ecx]
xor edx, dword [ecx - 0x37]
mov edi, 0x7266bf64
aam 0x28
add dword [esp], edx
or ch, ah
sal dword [edx + 0x37b6fb00], cl
add eax, 0x6941600c
ret 0x684
test byte [esp + ebx - 0x9cff200], 0x11
lea ebp, [ebp + ebx + 0x1cd45004]
not dword [esp + ebx*2 - 0x139fe410]
jle 0x10275258
shl word [esp + ebx*8 - 0x4e7f9070], 0xd6
sub ebx, 0x54a12eb9
call fcn.1023aa12
pop edi
outsb dx, byte [esi]
out 0xba, eax
jnp 0x102456eb
mov cl, 0xb5
in eax, dx
xor byte [ecx + 0x7f1e2ddc], ah
jnp 0x102456c0
into
pop ss
push 0xfffffffffffffffb
sti
test eax, 0x89753d39
mov ebp, edx
aad 0x97
bndstx [ebx - 0x79], bnd1
out dx, eax
or byte [ebx], 0x3b
add edx, dword [esi]
out dx, al
lahf
stosd dword es:[edi], eax
or esp, edi
cld
mov ebp, 0x1bbf384c
mov ah, 0x4e
fimul dword [ecx - 0x67435fb5]
cmp dword [ebx + 0x27], ebp
in eax, dx
invalid
in eax, 0x4c
add eax, 0x22665c9d
xchg edx, eax
jmp 0x102456d8

Function at 0x100afb4f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0xa8a48220
inc ecx
shl dl, cl
inc bp
mov dword [ecx], edx
call fcn.101815d6
push esp
fsubr dword [edx - 0x6b]
mov esp, 0xce8b2daf
repne insb byte es:[edi], dx
and al, 0xb1
js 0x100afb8e
inc byte [eax - 0x5134ba89]
mov ecx, 0xef76f286
adc ebp, dword [edx + ebp*2 + 0x68]
sub bl, ah
dec ebp
xor al, 0xdf
inc ebx
in al, 0x94
sti
in eax, dx
shl dword [ecx + 0x15], 1
inc ebx
aam 0xa8
mov ah, 0x36
pop es
popal
adc eax, 0xb4a8d443
pop es
xchg ebx, eax
cmc
rcr byte [0xfabea126], 0x5c
imul edi, ebp, 0xffffffbf
cmp eax, 0x76f4e79e
rcl byte [ebp - 0x55a0803a]
adc byte [ebp - 0x36], al
mov dword [0xfddf46f3], eax
invalid

Function at 0x100e80fa
Capabilities:
Execute syscall

Disassembly:
call fcn.102971c3
syscall
inc ecx
push esp
dec ecx
mov esp, 0xd90dc19c
cdq
lcall 0x2464, 0x8b4cacaf
add byte [eax - 0x39], cl
inc esp
and al, 0
inc esp
ret
Function at 0x100f29df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov edx, dword [esp + edx + 0x647c0014]
mov ebp, 0xb7220513
and ebp, 0xaf978c11
neg ebp
call fcn.102631e5
lea esp, [esp + 0xc]
jmp fcn.100a6054
push edx
pushfd
mov edx, 0x9b84a912
sub dx, dx
jl 0x1020c33a
cdq
adc dword [eax], eax
jae 0x100b844a
push 0x363ce9b7
sbb ebp, 4
call fcn.1002b8b0
inc eax
push es
mov dh, 0x3d
xchg ecx, eax
or byte [edi], bl
leave
mov ecx, 0x281fcae6
xchg dh, dl
inc ebp
leave
dec esp
out dx, eax
xor al, 0x50
ja 0x100f29ec
hlt
pushfd
mov esi, 0xdca2b0a4
add dword [esp + esi*2 + 0x46ba9ec4], 0xffe28356
push ebp
mov ebp, esi
lea edi, [edi + esi*2 + 0x6a78fe38]
mov esi, dword [esp + esi*2 + 0x46ba9ec0]
push dword [esp + ebp*2 + 0x46ba9ebc]
popfd
mov ebp, dword [esp + ebp + 0x235d4f5c]
lea esp, [esp + 0x10]
ret

Function at 0x101022be
Capabilities:
Get number of processors

Disassembly:
push edi
push edi
pushfd
mov edi, 0xfbbd34ab
not edi
and edi, 0x9ae5d91
call fcn.101da39c

Function at 0x101022d3
Capabilities:
Get number of processors

Disassembly:
jns 0x1020568d
mov ebp, dword [esp + 8]
and edi, dword [esp + 0x18]
shl dword [esp + edi - 0x2116], 0xb9
add dword [esp + edi - 0x211a], 0xefe0ddef
call fcn.1023e800
call fcn.101199be

Function at 0x101022f9
Capabilities:
Get number of processors

Disassembly:
jb fcn.101aff59
or dword [esp + ebp + 0x5deabf6c], 0xf22f8da7
mov ebp, dword [esp + ebp + 0x5deabf78]
shl dword [esp + 0xc], 0x64
jns 0x1024c4d5
jbe 0x1029d025
mov eax, 0x273c6336
mov eax, dword fs:[edx + eax*2 - 0x4e78c66c]
call fcn.102655bb
xchg dword [esp + ebp + 0x5deabf84], ecx
mov esi, dword [esp + esi + 0x14ff42f5]
add byte [esp + ebp + 0x5deabf80], 0x16
jns 0x10193138
jno 0x10022ecf
seta byte [esp + 0x28]
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x2c]
ret
neg byte [esp + 0x14]
neg dword [esp + 0xc]
not dword [esp + 0x20]
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x24]
ret

Function at 0x1010cd68
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0xcc2ab198
mov ebp, edi
jae 0x1029fe8d
movsx cx, byte [esp + 0x18]
jge 0x10216113
mov dx, word [esi + eax*2 - 0x9d0]
rol eax, 0xc1
sbb eax, 0xba89ee3d
mov ax, word [esi + eax - 0x45761b91]
jp 0x10110c44
not dx
call fcn.1016129b
and ebp, dword [esp + 0x18]
jne 0x1020d8b4
mov ebx, dword [esp + 0x20]
mov ebx, dword [ebx]
mov ecx, 0xed1a2e8a
je 0x1003318d
mov dword [0xbe4d35a7], eax
insb byte es:[edi], dx
prefetchw byte [ebx + 0x78]
sbb edx, dword [edx]
xor eax, 0xf6cbe4d
or eax, 0x121b784b
push cs
insd dword es:[edi], dx
arpl bp, bp
push es
push ds
test al, 0xda
inc esi
pop edx
out dx, al
pop ds
xor ecx, dword [edx - 8]
je 0x1010cd85
pop eax
not cl
leave
wait
dec ebp
invalid
sbb esi, 1
jmp 0x100e2100
call 0x101214d0
cmovl bx, word [esp]
mov dword [esp + 0x10], ebp
call fcn.1019d869
lea ebx, [ebx + ebp + 0x74742f7b]
jg 0x10256b8b
mov eax, dword [ebp + 4]
add ebp, 4
not esi
push 0x76038f22
sar dword [esp], 0x8c
js 0x1008460e
not eax
push 0xf33244a7
push 0x73851b1f
and esi, eax
jmp 0x101b3cea
or dword [esp + 0x18], edi
not ecx
add bp, 0x739f
sub cl, byte [esp + 0x1a]
xchg dword [esp + 0x24], ebx
mov ebp, dword [esp + 8]
jle 0x1001f4e9
Function at 0x1012ecca
Capabilities:
Authenticate hmac

Disassembly:
add dword [esp + ecx - 0x4f4255e3], 0xeff22735
shr dword [esp + ecx - 0x4f4255cf], 0x6c
cmp dword [esp + ebx + 0x6988d266], 0x528a4d9f
mov ecx, dword [esp + ecx - 0x4f4255db]
jge fcn.102908b2
or dword [esp + ebx + 0x6988d266], ebx
mov edx, ebx
movsx dx, dl
call fcn.100d2713
adc edx, 0xdfb7bdba
neg edx
movzx edx, byte [esi + edx*2 - 0x408e842c]
jne 0x1023b592
push ecx
pushfd
mov ecx, 0xf9b847b3
push ebp
mov ebp, 0x429b1836
mov ecx, 0x82385fbf
movsx ebp, bp
mov edi, dword [esp + ebp - 0x1826]
not ebp
xor cx, 0x560d
sub ebp, 0x89a4b133
push ebx
cmp cx, 0x6685
lea edi, [edi + ecx + 0x7dc7f64f]
mov ebx, 0x2611853a
push edi
jo 0x100e2820
jno 0x1013cc2e
mov eax, 0x4685c688
rdtsc
call fcn.10214521
sbb byte [eax], bh
dec eax
or al, dl
div byte [esi - 0x51413d85]
cld
sub al, 0x28
adc ch, bl
adc al, 9
call 0x8ec24ec3
ret 0xcfa2
lea ebx, [ebx + ebx + 0xdb2a13b]
not bx
add dword [esp + 0x10], 0x238aad
push esi
mov ebp, ebx
mov esi, 0xb52d4d0e
cmp esi, 0x679b8f0a
mov ebp, dword [esp + 0x14]
mov ebp, dword [ebp + esi + 0x4ad2b2f2]
js 0x100a9bad
not si
add esi, 0x20027f93
mov dword [esp + 0x14], ebx
call fcn.1008eab7
sub word [ecx + edi*2 + 0x24], bx
xchg ebp, eax
outsb dx, byte [esi]
pushfd
mov dword [edx - 0x69d401e9], ebx
retf
call fcn.101181e8
lea ebx, [0x10029dc4]
call fcn.10071373
mov eax, 0x6491dc30
movsx edx, al
mov ax, word [eax + edi - 0x6491dc30]
bts edx, edx
lea edi, [edi + edx - 0x1002e]
jae 0x100a0e4c
mov ecx, 0x5b290f3f
shl cl, 4
not cl
dec edx
mov ecx, dword [ecx + ecx - 0x5b290f0f]
dec ecx
mov ebp, dword [ecx + 8]
dec ecx
adc ecx, 0xb
push 0x29a1a4b2
call fcn.100c4ece
lea ebx, [ebx + edx*4 + 0xc97512f]
add dword [esp + edx + 0xdc02], 0xffff116f
push ecx
add word [esp + edx + 0xdc0e], dx
movzx edx, dl
xchg dword [esp + 0x18], ebx
mov edx, dword [esp + 8]
mov ecx, 0xb49ccdb0
call fcn.100adb02
call fcn.1016313d
jne 0x101f61a5
jno 0x100b11f3
mov dword [esp + ecx + 0x7dc7f666], edi
shr bl, cl
mov edi, 0xa8a80291
sub bp, bx
not ebx
jb 0x100c8f35
push edi
lea eax, [eax + ecx - 0x69ad5817]
mov ebp, dword [esp + esi - 0x63dffffd]
mov ebp, dword [ebp + esi - 0x63e00001]
xor word [esp + esi - 0x63dfffe9], 0x533a
jbe 0x101afe5a
shr byte [esp + esi - 0x63dfffe9], 0x36
shr esi, 0x7c
lea ebp, [ebp + esi*2 + 0x641b291e]
sub word [esp + esi + 0x12], si
je 0x1025c444
add dword [esp + esi*4 - 0x18], 0xeff0d9ac
mov dword [esp + esi*2 + 0xc], esi
movzx esi, byte [esp + esi*2 + 0xc]
mov word [esp + esi + 0x12], 0xe093
add esi, esi
jo 0x1026f9f4
xchg dword [esp + esi*8 - 0x40], ebp
mov esi, dword [esp + esi*4 - 0x14]
add dword [esp + 0x18], 0x3ab0a993
shr byte [esp + 0x18], 0xb3
js 0x1015b9ea
call fcn.100f8000
adc esi, 0
jmp 0x10111329
lea ebx, [ebx*4 + 0x299e323d]
neg bl
add dword [esp + ebx - 0x500cbfeb], 0xeff8931f
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + ebx - 0x500cbfe3]
call int.1027fbda
neg ebx
xor dword [esp + esi - 0x7e903eba], 0x54a86f8b
mov bl, 0xb6
push edx
not ecx
xchg dword [esp + ecx - 0x4f4255c3], eax
mov esi, dword [esp + ecx - 0x4f4255df]
jle 0x10032770