joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1080ccc0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor eax, ebx
xor eax, 0x4d9dee88
neg dl
mov dword [esp + edx - 0x3925200b], 0x3ab38915
bswap eax
rol byte [esp + edx - 0x3925200b], 0x83
rol dx, 0xeb
inc eax
xchg byte [esp + edx - 0x392558fd], cl
not eax
dec byte [esp + edx*2 - 0x724ab200]
lea eax, [eax + edx - 0x14241e6c]
shr byte [esp + edx - 0x392558fd], 0xa2
xor eax, 0x10902231
neg dx
rol byte [esp + edx*2 - 0x724b4dfd], 0xa4
add word [esp + edx - 0x3925a6ff], 0x4c98
dec eax
shl edx, cl
not eax
or cx, cx
sal dl, 0xc2
dec cx
lea eax, [eax + edx*8 - 0x28304d26]
bswap eax
add edx, ecx
shl ecx, cl
xor ebx, eax
push edx
xadd ecx, edx
add dword [esp + edx - 0x71ffffff], 0x5da6e8a4
add edi, eax
movsx eax, word [esp + edx - 0x71ffffff]
mov ax, word [esi + eax - 0x6cdf]
or byte [esp + ecx - 0x48843b38], 0x10
rol edx, 0x73
add word [esp + ecx - 0x48843b33], cx
lea esi, [ecx + esi - 0x48843b37]
xchg byte [esp + edx - 0x38fff], cl
inc dx
movzx ecx, byte [ecx + ebp - 0x48843bdf]
xchg word [esp + edx - 0x39000], dx
add dx, 0xa5ad
xor edx, edx
lea ebp, [ebp + edx*2 + 1]
xchg byte [esp + edx*8 + 6], dh
xor cl, bl
call fcn.10920bc1

Function at 0x1080cde5
Capabilities:
Execute syscall

Disassembly:
or eax, dword [edi + edx*2 - 0x404]
sal edx, 0xde
or dword [esp + ecx*2 - 4], 0xbb1f0a31
dec ecx
lea edi, [edx + edi - 0x7ffffffc]
pop ecx
call fcn.107a6753
lea ebp, [ebp + eax - 4]
mov dword [esp + eax*8], edx
shr edx, 0x56
mov dword [edx + ebp - 0x202], ecx
xor byte [esp + eax + 3], ah
movzx ecx, dl
jno 0x1072ae9e
call fcn.10a97d71
syscall
call fcn.10b361d7

Function at 0x1082bda4
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp]
adc ebp, 4
mov ecx, 0x7139c4b0
call fcn.10bf0125
push 0xce296cc6
das
std
push ebp
clc
adc dword [ecx + 0x47], esi
push edx
mov ebx, 0x90eeeb73
invalid

Function at 0x10871584
Capabilities:
Encode data using base64

Disassembly:
pop eax
xor dl, bl
xor dl, 0x3f
push 0x699c470e
add dl, 0x99
rol dl, 1
inc dl
xor bl, dl
mov eax, dword [esp + 8]
mov dword [esp + 8], esi
and eax, 0x4f2bf4b4
mov word [esp + eax - 0x4f0000b1], 0xb198
mov dword [esp + eax - 0x4f0000b0], edi
dec word [esp + eax - 0x4f0000b4]
shl eax, 0x90
add eax, eax
mov dword [esp + eax*2 - 0x2d00000], ebx
lea ebx, [eax - 0x4f53dce2]
mov ebx, edx
sub ax, 0x8bac
mov edx, ebx
call fcn.10b27f17

Function at 0x1089d709
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
mov dword [esp], eax
xor cl, al
setno cl
adc edi, edx
sub byte [esp + 1], cl
mov eax, dword [esi]
neg cx
mov edx, dword [esi + 4]
xadd cl, ch
mov cl, byte [esi + 8]
xor word [esp], 0x2317
jns 0x109612c0
adc esi, 6
inc word [esp + 1]
shld eax, edx, cl
mov dword [esi], eax
inc dword [esp]
call fcn.10a37092
inc esp
xor ebx, dword [esp]
inc edi
lea ebp, [ebp + ebx - 0x7fb8f917]
and byte [esp + 2], 0x3f
inc ecx
ror ebp, 3
inc cx
sar eax, 0x6e
inc ecx
not ebp
inc ecx
xor ebp, 0xab1ecb90
jmp 0x1083a9bf
Function at 0x108c1abc
Capabilities:
Encode data using xor

Disassembly:
not eax
neg dword [esp + edx*4 - 0x2c]
neg eax
ror edx, cl
bswap eax
call fcn.10a90939
dec ecx
add ecx, 4
inc ebp
mov ebx, ebp
dec esp
mov dword [esp], ebp
inc word [esp + 4]
inc ecx
xor edx, esp
jmp 0x108ea01e
inc edx
dec ebx
lea eax, [edx + ebx*8 + 0x769a458c]
not edx
movsx edi, ax
push eax
lea edx, [edx + edi - 0x299d60a1]
inc cx
rol edx, 0xc1
not edx
mov ecx, dword [esp + edi - 0x460a]
bswap edi
rol edx, 1
dec edx
lea eax, [ecx + ebp - 0x70c60deb]
sar cx, 9
inc ebp
movzx edi, dx
dec esp
mov dword [esp + edi - 0xd45fff8], esp
inc ebp
movsx esi, bl
sbb di, word [esp + ecx*4 - 0x14]
dec ecx
sal ebx, cl
xor dword [esp + edi - 0xd46b9ea], edx
inc esp
sub dword [esp + edi - 0xd46b9ee], edi
inc bp
xchg edi, edx
mov esi, dword [esp + edi*8 - 0x6a35cf8c]
dec esp
mov esp, dword [esp + edi*4 - 0x351ae7c0]
jbe 0x10acc8a1
xor eax, ebx
sub eax, 0xbd2007a7
shl ecx, cl
push ecx
rol eax, 1
call fcn.10bab100
mov eax, 0x9aa30f2a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add esi, 4
add eax, ecx
mov dword [esi], eax
sub edi, 4
mov ecx, 0x7599b402
lea edx, [ecx*8 + 0x5da83f15]
mov edx, dword [edx + edi - 0xa75df25]
add ecx, 0x631d33b9
mov eax, 0x17176c1e
inc cx
xor edx, ebx
ror edx, 1
inc edx
not edx
xadd ecx, eax
shr ax, 0x89
ror edx, 1
xor ebx, edx
call fcn.1084da27
mov byte [ebx + 0x1b], 0xf0
xor ecx, dword [ebx + 0x2e]
call 0xc225a0c5
jne 0x108ea0d1
scasb al, byte es:[edi]
cld
nop
inc esp
and eax, 0x84fa9352
fisttp dword [eax - 7]
push esp
add byte [ecx - 0x4cac7ade], ch
sbb bh, ah
stosd dword es:[edi], eax
jbe 0x108ea17c
jg 0x108ea191
dec ebp
fbstp tbyte [ebx - 0x210fa8f2]
stosb byte es:[edi], al
xchg ebx, eax
push ds
and esp, dword [ebx + 0x5fabdd09]
push es
lahf
mov dword [ecx - 0x460365ed], ecx
lodsd eax, dword [esi]
nop
movsb byte es:[edi], byte [esi]
mov ebx, 0x79e14546
push ebx
invalid
invalid
mov ch, 0x9d
mov dword [ecx + 0x2c], ebp
pushfd
pop ds
movsd dword es:[edi], dword [esi]
int1
xchg ecx, eax
or al, 0x92
inc esi
insb byte es:[edi], dx
push cs
xchg ecx, eax
arpl si, cx
and dword [ebp - 0x15d23b4e], edi
arpl word [eax + 0x51], sp
int3
Function at 0x108e8df6
Capabilities:
Encode data using base64

Disassembly:
shr eax, 0xa2
xor dl, bl
lea eax, [eax + eax*2 + 0x7bb54f01]
rol dl, 1
dec dl
not ax
not al
sar eax, 9
xor dl, 0x10
and al, al
sar ax, 0xe1
sbb dl, 0xb5
xor bl, dl
rol eax, 0x30
dec eax
push esi
push edi
or eax, 0xcb85a390
adc ax, 0xc96
sub al, ah
push ebx
dec eax
mov ebx, edx
mov edx, ebx
sal edx, 2
push eax
mov eax, ebp
jmp 0x10c9e6be
bswap eax
xor eax, 0xba142187
rol eax, 3
sub dl, ch
xchg ch, cl
add dx, cx
lea eax, [eax + ecx*2 - 0x3bc8446d]
xchg ch, cl
xor ebx, eax
push ecx
add ebp, eax
pop edx
jmp fcn.10c06711
ror dl, 0xa6
sar edx, 0x69
mov ecx, dword [ebp + 4]
sar dx, 1
and dl, dl
adc ebp, 4
neg dx
shl edx, 0x90
adc eax, ecx
mov dword [ebp], eax
mov eax, dword [esi]
add esi, 4
xor eax, ebx
bswap eax
movzx ecx, dx
sub eax, 0xa5154639
sal edx, 0x88
xor eax, 0xa4868336
not eax
rol ecx, 0xd2
sar cx, 0xc4
je 0x10af6299
push 0x9903d92
ror edx, 3
bswap edx
dec edx
call fcn.1083f0db
call fcn.109d91a9
setae byte [esp + 4]
and dword [esp + 2], edx
dec eax
call fcn.109cf49e
sub edi, 4
mov eax, 0x2097e51f
mov edx, eax
call fcn.10b092da
pop ecx
inc edx
rol eax, 1
mov ecx, 0x5530000e
xor edx, 0x24a6a5a7
adc edx, 0xc0bf013c
lea eax, [eax + ecx - 0x735419a8]
je 0x1072a92a
ror eax, 1
sar cl, 0x63
jb 0x10b817b9
add esi, 4
xor edx, ebx
jmp 0x10cbf414
xor ebx, eax
dec dx
lea edx, [edx + edx + 0x192bb4b3]
add edi, eax
rol cl, 0x27
xor ecx, edi
jmp ecx
xor ebx, eax
inc cl
lea esi, [esi + ecx - 0x55300006]
inc dx
not edx
and dx, cx
mov dword [esi + ecx - 0x55300002], eax
lea edi, [edi + edx - 0x63e70006]
shl edx, cl
ja 0x1085f829
mov eax, dword [ecx + edi - 0x55300002]
bswap edx
sbb dl, cl
not edx
xor eax, ebx
ror dx, cl
jb 0x107eca9b
jmp 0x108bc847

Function at 0x108ffdca
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], ebx
mov ebx, 0x591d578c
movzx ebx, byte [ecx + ebx - 0x591d578c]
xor ebx, edx
push 0x10aa025
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x10b6fd64]
shr edx, 8
inc word [esp + 1]
xor edx, ebx
inc ecx
xor edx, 0x8f9b5f05
dec eax
lea esp, [esp + 4]
jne 0x108ffdcd
mov eax, 0x6f266330
push eax
mov ebx, dword [esp + eax - 0x6f26632c]
lea esp, [esp + 8]

Function at 0x109374f2
Capabilities:
Encode data using xor

Disassembly:
dec ebx
push 0xff9eb406
push 0xb68f1f0f
lea esp, [esp + 8]
jne 0x108b8be3
dec ax
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
jno 0x10757ecb
movzx edx, cl
jmp 0x10aee3ef
lea eax, [eax + edx + 0x213af208]
shr cl, 0x85
sbb cx, cx
jle 0x10b6ca8c
bswap eax
push ecx
cmovbe dx, cx
call fcn.10ab4225

Function at 0x109396fc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
dec ebp
lea ecx, [ecx + edx*2 - 0x14578]
call fcn.10927c96
mov ecx, dword [edi]
add edi, 4
mov eax, 0x22bed7b6
mov edx, eax
xor ecx, ebx
not ecx
not eax
rol ecx, 3
and ax, dx
xadd dx, ax
not ecx
call fcn.10ca2a61
Function at 0x10939a93
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor edx, ebx
bswap edx
mov dword [esp + eax*8 - 0x36810], ecx
rol edx, 1
sub word [esp + eax - 0x6d00], 0xdcbf
not edx
sar ax, 0xc1
or eax, 0xa809600d
xor ecx, 0xc9bfd53a
rol edx, 1
lea edx, [ecx + edx + 0x2e7f1f67]
rol ecx, cl
shl eax, cl
dec word [esp + ecx*2 - 0x70933d6e]
bswap edx
lea edx, [edx + eax - 0x174b805f]
sal al, 0x82
dec ecx
xchg ecx, eax
rol edx, 3
xor ebx, edx
lea ecx, [eax + eax*4 - 0x37f4ae68]
push ecx
add esi, edx
not dword [esp + eax - 0x38499eb6]
mov ecx, dword [ebp + eax*2 - 0x70933d6e]
call fcn.1077c0a1
ja fcn.10939a93
sbb dh, byte [eax]
cwde
sub eax, 0x4478f95b
popfd
aam 0x96
push ebx
xchg esi, ebp
hlt

Function at 0x109877b1
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esp
mov esp, dword [esp + edx - 0x3cc]
dec esp
mov dword [esp + edx*4 - 0xf48], edi
dec ebp
arpl si, si
dec eax
mov dword [esp + edx - 0x3d4], ecx
ror dword [esp + edx*2 - 0x7a1], 0x7d
dec ecx
add ebx, esi
call fcn.10cf44ba
mov eax, 0xde9f6620
mov edx, eax
mov eax, dword [ebp]
movzx ecx, dl
sar edx, 0x25
add ecx, ecx
lea ebp, [ebp + ecx - 0x3c]
and cx, dx
jp 0x10bf7a6f

Function at 0x109b0660
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx*2 - 0x560e6000], esi
call fcn.10b89f72
mov esp, 0x3e29757d
mov bl, 0x46
dec esp
clc
invalid

Function at 0x109be4dc
Capabilities:
Execute syscall

Disassembly:
call fcn.10c7e51c
mov edx, 0x673a7418
lea edi, [edi + edx - 0x673a741c]
mov eax, edx
movsx ecx, ax
ror ax, 0x44
mov edx, dword [edi + edx - 0x673a7418]
jb 0x10ca8f7b
inc ecx
pop esp
jmp 0x108e0a58
shl ecx, cl
inc edx
not eax
ror ecx, cl
xor ebx, eax
add esi, eax
mov eax, dword [ebp + edx*4 - 0x64]
mov dword [esp + ecx - 0x2a771846], ecx
or dword [esp + edx - 0x19], edx
neg cl
mov cl, byte [ebp + ecx - 0x2a7718b6]
shr edx, 0x5a
je 0x108cd4d2
sub edx, 0xe7a7fd0a
add cx, ax
bswap ecx
add cx, ax
xor edx, 0x8a89408f
lea ecx, [ecx*8 - 0x71424156]
push eax
dec edx
dec ecx
bswap edx
xor ebx, edx
add word [esp + eax - 0x673a873f], ax
shl ax, 0x6f
mov dword [esp + eax - 0x673a8000], 0xb4196b1a
adc esi, edx
shr dword [esp + eax - 0x673a8000], 0x4a
call fcn.10beb548
xor ecx, ecx
xor edx, ebx
jmp 0x10c05cea

Function at 0x109cf841
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ecx
jmp 0x10b30c2b
ror edx, 3
not edx
jmp 0x1085d98e

Function at 0x109dd6c4
Capabilities:
Encode data using base64

Disassembly:
not eax
mov dword [esp], ecx
jae 0x10ac1566
call fcn.10b0a45c

Function at 0x109eb71c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x10c8e377
lea esp, [esp + 0xc]
jne 0x1071d27d
push 0xe2a8642a
rol dword [esp], 0x22
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
Function at 0x10a1df38
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor eax, esp
inc ecx
ror eax, 1
inc ecx
not eax
inc ecx
ror eax, 1
dec esi
lea ebp, [ecx + esi*8 - 0x74f9bace]
inc ecx
neg eax
inc ecx
rol edi, cl
call fcn.1092826e
call [edx + 0x3414b6f5]
xchg edi, eax
cmc
mov dh, 0x14
xor al, 0x97
fdiv dword [esi + 0x7b08324b]
dec ebx
inc ecx
mov ch, 0x65
sal byte [0x31855eb4], cl
salc
dec ebx
pop ecx
mov eax, 0x734b1082
jge 0x10a1df59
nop
mov ah, 0xc9
jb 0x10a1dfea
adc dh, byte [ecx + ecx*8 + 0x35b5f906]
into
cmp dl, dh
mov ah, 0xd5
test dword [edi], edi
push esp
add byte [ebx - 0x23], cl
sbb byte [ecx + ecx*2 + 0x16], cl
mov byte [ecx - 0xe], bl
iretd
test ebp, 0x71fbfd00
pop es
test dword [ebp - 0x7ce51f89], ecx
mov al, byte [0x7520795]
test eax, 0x3f92015
cmp esi, dword [ecx - 0x7e8025f5]
stc
mov dword [ecx], edi
dec edi
xchg byte [edx - 0x3a], bh
push ss
invalid

Function at 0x10a2ade7
Capabilities:
Manually build aes constants

Disassembly:
rol ecx, 0x27
lea edx, [ecx*8 + 0x330d8a37]
not eax
jb 0x107af414
mov dword [esp + edx - 0x43314122], ecx
popfd
mov ecx, 0xc4297ca2
ror cl, cl
jmp ebp
pop edx
pop edx
inc eax
call fcn.10975b43
mov ecx, 0x1fa1620e
lea eax, [ecx + ecx*4 - 0x2f63d4e]
mov edx, dword [ecx + ebp - 0x1fa1620e]
shr eax, 0xaf
lea ebp, [ebp + ecx*2 - 0x3f42c418]
ja 0x10b30c46
not eax
ror dx, 1
not dx
xor bx, dx
dec ax
or cx, cx
seta cl
lea esi, [esi + eax - 0x77ce]
mov word [eax + esi - 0x77cc], dx
sub cl, al
lea ecx, [ecx*2 + 0x5e0a7a8f]
sar cl, 0xc4
mov edx, dword [ebp + eax - 0x77cc]
lea ebp, [ecx + ebp - 0x5e0a7afb]
xor edx, ebx
dec ecx
call fcn.109b04b1
xor ebx, edx
add esi, edx
call fcn.109549f7
not al
mov cl, byte [ebp + eax*2 - 0x7e2a28e2]
jmp 0x10ab3e55
rol ecx, 2
mov edx, eax
not dx
mov dword [esp], eax
bswap ecx
shr word [esp + 1], 0xa5
inc ecx
sal byte [esp], 0xc1
inc eax
cmovbe dx, ax
xor ebx, ecx
sub al, 0x34
shl word [esp], 0x68
jb 0x10cce89c
adc edi, ecx
call fcn.10833007
mov ecx, 0x9fb59305
push ecx
mov edx, edi
mov dword [esp], ecx
sub edi, 2
push ecx
sal byte [esp + 4], 0x22
jae 0x10aae9ca
mov eax, 0x111aa18
call fcn.1076d8b8
mov word [edi], dx
movzx edx, cl
movzx eax, dl
mov eax, dword [edx + ebp - 5]
jae 0x10c14aa6
shr eax, cl
xor edx, ebx
not edx
ror ecx, cl
ror edx, 1
jmp 0x10b8fe4b
lea ebp, [edx + ebp - 1]
rol cx, 0x22
xor eax, ebx
jmp 0x107556d2
xor dword [esp + eax*4 - 0x239b8], eax
sub dword [esp + eax*2 - 0x11cd6], eax
push eax
mov eax, dword [ebp + eax*2 - 0x11cde]
call 0x10c1b8f4
mov eax, 0x44a4e90f
movsx edx, ax
mov edx, dword [ebp + eax - 0x44a4e90f]
mov ecx, eax
lea ebp, [ebp + ecx - 0x44a4e90b]
shr cx, 0x8d
setbe al
xor edx, ebx
ror ecx, cl
bswap edx
cmovae eax, ecx
ror ax, 0x8c
sal cx, 0x63
ror edx, 2
rol ax, 0xc8
shr eax, 0x69
lea edx, [edx + eax - 0x11992c2c]
xadd ecx, eax
dec ecx
xor ax, 0xe4a3
neg edx
sub ax, 0xec00
xor ax, cx
lea edx, [edx + eax*8 + 0x5cee438a]
or ax, ax
xor edx, 0xbf28b338
jmp 0x10818e44

Function at 0x10a39c31
Capabilities:
Encode data using xor

Disassembly:
shr dword [esp + 4], 0x5f
xor dword [esp + 4], 0xa102f188
add dword [esp + 4], 0x2d910b3a
jg 0x10a39c36
call fcn.109e50df
Function at 0x10a459e6
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
call fcn.1095c40a
lea ecx, [ecx + eax - 0x4692ac65]
not ecx
shr ax, 0x22
mov edx, eax
shr edx, 0x7d
ror ecx, 1
add al, ah
jae 0x109b6aeb
js 0x109c0b1b
jb 0x109c0ad5
salc
das
dec edx
dec ebx
clc
adc esi, eax
pop ecx
push edx
out 0x93, eax
jecxz 0x109c0b12
invalid
inc dword [ebx + 1]
sub al, 0x78
test eax, 0x78b0a7c2
jo 0x109c0b38
push ds
out 0x6b, al
jmp 0x75f20326
cmp ah, ch
test dword [edi], edi
inc esp
out dx, al
leave
xchg ecx, eax
push esi
je 0x109c0ae3
cmp dl, ch
sub edi, dword [ebx + 0x60]
salc
leave
fcomp qword [ebx - 0x627c5a20]
salc
mov ebx, dword [edi]
sub al, 0x1d
out 0x1e, eax
inc eax
sar dh, 0xb3
test al, 1
sal dword [edx - 0x60ff9cc8], cl
mov dl, 0x38
arpl word [eax], ax
lahf
mov eax, dword [0xe6911a4]
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
add dword [ebp - 0x77], 0xc2006ece
sbb byte [ecx + 0x65b395b], dh
push ebp
adc al, ch
invalid
push 0x3736eb04
mov eax, dword [ebp]
lea esp, [esp + 0xc]
call eax
push 0x85ba1f27
jmp 0x109c0a73

Function at 0x10a4c8d1
Capabilities:
Encode data using base64

Disassembly:
movsx edx, al
movzx eax, byte [edx + edi - 0x14]
lea ecx, [edx*4 + 0x4d1898a0]
lea edi, [edx + edi - 0x13]
xor al, bl
sal cl, 0xe7
sub edx, 0xd372a1a
sub al, 0x18
sar ecx, 0xab
shr ecx, cl
or ecx, ecx
ror al, cl
xor dx, 0x4333
setns dl
not al
adc al, 0x16
rol cl, cl
jno 0x10bbe8e1
call fcn.10b3ad95
mov eax, 0xd10bf014
jmp 0x10a4087a
xor bl, al
ror cl, cl
lea ebp, [ebp + ecx - 0x82]
call fcn.107d84c4

Function at 0x10a5a05f
Capabilities:
Encode data using base64

Disassembly:
jae 0x10cc42d6
add byte [esp + edx*4 - 0x4b17fceb], ch
movzx eax, byte [esi + edx - 0x12c5ff3b]
lea esi, [esi + edx*4 - 0x4b17fceb]
shl dword [esp + edx - 0x12c5ff3b], 0x82
jbe 0x10c0fbed
lea ebp, [ebp + edx*2 - 0x1505661a]
xor eax, ebx
xor word [esp + edx - 0xa82b30b], cx
dec eax
ror dword [esp + edx*2 - 0x1505661a], 0x3a
ror eax, 2
call fcn.10a3c990

Function at 0x10a70b7a
Capabilities:
Encode data using base64

Disassembly:
xor edx, 0x9ebf29b3
ror eax, 1
sar cx, 1
lea edx, [edx + ecx*4 + 0x65834d05]
rol edx, 1
not eax
call fcn.10a4e7ff
Function at 0x10a7b13c
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [ecx*2 - 0x5a5fc25d]
rol al, 1
setbe cl
pop edx
mov eax, dword [esi + ecx*2 - 0x1224c600]
shl cx, 0x6b
lea esi, [esi + ecx*2 - 0x1223fffc]
xor eax, ebx
dec eax
push edx
ror eax, 1
shr cl, 0xc5
call fcn.10c3e5d8
lea edx, [edx + eax*2 + 0x6b3765a0]
movzx ecx, al
bswap edx
neg ax
xor ebx, edx
add ax, 0x9bb0
add edi, edx
mov eax, dword [esi + eax*2 - 0x104a76da]
not ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, 0xe304092f
jmp edi
fld dword [edi - 0x6afbab6c]
invalid
ror cl, 1
and eax, edx
jge 0x10717014
and al, 0x25
sbb cl, al
sal al, 0xe1
rol al, 0x43
not cl
mov dword [esp], edx
ror byte [esp], 0x21
setb al
xor bl, cl
lea ecx, [esp + ecx + 8]
call fcn.10af26f9
out 0x4d, eax
xchg esp, eax
jl 0x10a7b0ff
inc edi
lahf
push 0x2bdc7c74
mov edx, dword [edi + 0x38567783]
push ecx
sub ebp, 0xffffffab
pop ebx
sar dword [edi + edx - 0x60], 1
xlatb
push ebx
jl 0x10a7b1a1
mov esp, 0x8cf7db8
xor byte [ebx - 0x5eb8d484], 0xee
inc ecx
add dword [ebx - 0x5e], 0xd
and dword [eax - 0x40], 0x7c6cba67
ret 0xa16a
jl 0x10a7b1fc
jl 0x10a7b1d2
adc ebp, edx
push ebp
mov ds, edi
fdivr dword [edi + 0x46]
cmc
insd dword es:[edi], dx
fidivr dword [esi - 0x5e]
jp 0x10a7b1d2
invalid
sub eax, 0x65727de
sbb byte [ecx - 0x38], cl
fiadd dword [ebx + 0x764ccdf]
cmpsb byte [esi], byte es:[edi]
int 0x54
pop edx
popal
hlt
xchg ebp, eax
salc
cmp al, 0x82
jecxz 0x10a7b23b
ror byte [eax], 1
and dword [eax + 0x68], eax
sub eax, 0x1ad45a4c
invalid
sti
xor dh, byte [esi]
test dword [eax + 0x8d5d133], 0x1362560f
or byte [edx - 0x6c], bh
outsd dx, dword [esi]
bound ebx, qword [edi + 0x29]
xor al, 0x1e
cmc
push cs
pop esi
add al, 0x6b
neg byte [esi + 0x7a744b83]
cdq
mov al, 0x82
xchg ecx, eax
sbb byte [edi + 0x5e106b0b], cl
lahf
or byte [ebx], dh
xor byte [ebx - 0x37], 0x5f
xor al, 0xa6
or dh, byte [ebp + 0x162bb6cd]
push esi
out dx, al
mov edi, 0x63939a86
dec esi
sbb byte [ebx], cl
cmpsb byte [esi], byte es:[edi]
and dword [edx - 0x4e0b92da], ebx
sub bl, cl
popfd
xor byte [edi], 0x36
invalid

Function at 0x10a7c970
Capabilities:
Encode data using base64

Disassembly:
dec ecx
xor ebx, ecx
add ebp, ecx
lea ecx, [eax - 0x6ef76cf9]
call fcn.10a9503f

Function at 0x10ab73a1
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x8414fbf
lea esp, [esp + 4]
call fcn.10bfd4f4
bound ecx, qword [eax]
inc ebp
sub eax, eax
sub eax, 0x13f87c33
mov edi, 0x81cd526e
outsb dx, byte [esi]
push edx
int 0x81
xor dword [eax], esp
mov ecx, 0xef9837f0
mov bl, 0x21
inc esp
mov byte [0x82e61cf1], al
ja 0x10ab73bd
and dword [ecx + 0x4afc8767], ebx
popfd
pop ds
mov dl, 0x87
jb 0x10ab7431
retf 0x7486
pop edi
cmp eax, 0x72d0239d
cmp dword [eax], ebx
xor al, 0xbf
inc edx
cmp dh, byte [esi]
mov byte [0xb16f3462], al
xor bh, ch
and eax, 0xdf92d92
stosd dword es:[edi], eax
invalid
jl 0x10ab740d
jno 0x10ab743a
shl ah, 1
iretd
push cs
mul byte [esp + esi*8 + 0x59]
rol dword [0x25f7401], 1
movsb byte es:[edi], byte [esi]
cmp eax, 0x9acea2ac
invalid
Function at 0x10ae213a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + ebx*4]
push 0xfc0dab8c
mov dword [esp], eax
call fcn.10ae213a
dec ebx
lea esp, [esp + 4]
jne 0x10806c23
push 0x4993af8e
mov eax, 0x7821e7af
mov eax, dword [eax + ebp - 0x7821e7af]
push 0x81810abe
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov edi, 0xd2020307
mov dword [ebp], eax
mov ebx, 0x65081b8e
call fcn.10c23c8f

Function at 0x10b02b54
Capabilities:
Execute syscall

Disassembly:
sal ax, 0xa2
lea ebp, [ebp + ecx - 0x15ec4334]
xor edx, ebx
add word [esp + ecx - 0x15ec4332], 0x39a9
je 0x10bbda90
not ecx
ror edx, 2
ror ecx, 0x73
neg edx
pop eax
add eax, 0x295062
jmp eax
neg ecx
inc eax
call fcn.10befe6a
syscall
call fcn.10a6ddd7
Function at 0x10b19157
Capabilities:
Encode data using xor

Disassembly:
inc edx
sal eax, cl
sets cl
shl cl, 0x81
ror edx, 3
call fcn.1079bfb5
shr cl, 0xc2
xor eax, 0xa33ebe98
xor ecx, edx
add edx, 0x493d5d01
not eax
ror ecx, 0x9e
xor ebx, eax
rol ecx, 0xf5
not dx
add edi, eax
call fcn.108c800c
dec edx
not al
call fcn.10710dc7
mov ecx, 0xcd1eb681
call fcn.107d65c1
mov eax, 0x7282d514
mov edx, dword [edi + eax - 0x7282d514]
push eax
lea edi, [edi + eax - 0x7282d510]
sub ax, ax
xor edx, ebx
xor edx, 0xf3af5796
lea ecx, [eax + eax - 0x64c52d4a]
rol cx, 0x6d
not edx
adc eax, dword [esp + eax - 0x72820000]
jne 0x1075ce6c
dec ax
movzx cx, byte [edx]
call fcn.10c20881
mov ecx, 0x493730be
dec ecx
lea eax, [ecx + ecx + 0x5330a598]
mov edx, dword [edi + ecx - 0x493730bd]
lea edi, [edi + ecx - 0x493730b9]
xor edx, ebx
and al, ah
dec cx
rol edx, 1
bswap edx
shr eax, cl
sbb edx, 0x81abdf28
sub cl, ah
sar eax, 0x8e
inc eax
not edx
ror ax, 0x24
sal al, 0x84
or eax, ecx
rol edx, 1
sub ax, 0x1f2a
neg cx
neg edx
rol edx, 2
push ecx
ror al, cl
xchg word [esp + ecx - 0x4937cf43], cx
xor ebx, edx
jmp 0x108c9ff0
add edi, eax
mov eax, ecx
mov dword [esp + ecx*2 - 0x534c6b10], edi
ret 8
xor eax, ebx
or ecx, ecx
add ecx, 0x7611b8ba
lea eax, [eax + ecx*2 - 0xa439843]
sar dl, 0x64
bswap eax
ror eax, 2
jmp 0x107ab3de
lds eax, [edx]
add byte [eax], al
add byte [esi - 0x3f], ah
cli
or ax, cx
not ax
call fcn.10afc376
mov ecx, 0x90abf8b4
movsx eax, cl
push eax
mov eax, dword [esi]
pop edx
add esi, 4
jmp 0x1093039a
dec eax
lea edx, [ecx*4 - 0x22c41df0]
dec ecx
ror eax, 1
shl dl, 7
sbb dword [esp + ecx - 0x29a63586], ecx
pop ecx
salc
dec eax
ror dword [esp + ecx*2 - 0x534c6b08], cl
xor ebx, eax
neg byte [esp + ecx - 0x29a63585]
jne 0x10886a2f
psadbw mm7, qword [eax + 0x2a]
fdivr dword [edi + 0x14]
dec esp
sahf
or eax, dword [ebp + 0xa]
jecxz 0x109972a6
dec ebp
sbb byte [edx + ebx*8], cl
and byte [eax + 0x2062b11b], bh
push ebp
jl 0x10997268
pop esp
xchg ebp, eax
popal
invalid
xor eax, ebx
xor eax, 0x5a24e112
sar word [esp + edx - 0x7cf920fe], 0xe4
bswap ecx
jbe 0x10997293
mov edx, eax
mov dword [esp + eax - 0x7cf92100], 0xbc226695
mov dword [esi + edx - 0x7cf92100], ecx
mov ecx, dword [esp + edx - 0x7cf920fc]
mov eax, dword [ebp + edx - 0x7cf92100]
sal byte [esp + edx - 0x7cf92100], 0x61
dec word [esp + edx - 0x7cf920ff]
lea ebp, [ebp + edx - 0x7cf920fc]
dec word [esp + edx - 0x7cf920fc]
push edx
jbe 0x10afcc47
add cx, 0x39aa
sbb eax, edx
neg cx
xor ebx, eax
xchg ecx, edx
add ebp, eax
not dx
lea edx, [edx + ecx + 0x75145690]
mov ecx, dword [ecx + esi - 1]
mov ax, word [esi + edx - 0x751490bd]
lea esi, [esi + edx - 0x751490bb]
shr edx, 0x7f
mov word [ecx + edx*2], ax
call fcn.10c1ec80
Function at 0x10b3f503
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 4
mov edx, ecx
xor eax, ebx
dec dl
rol ecx, cl
ror cl, 0x63
not eax
dec edx
sub cl, 0xa
rol eax, 1
neg eax
sub dl, 0x80
dec ecx
add dl, dh
rol eax, 1
xor ebx, eax
jmp 0x109c591d
sbb ebp, 8
mov dword [ebp + ecx - 0x7ffffffc], eax
sub cx, cx
lea eax, [ecx + ecx + 0x1bb0fb1b]
not ecx
mov dword [ebp + eax*2 - 0x3761f636], edx
sar eax, 0x95
jb fcn.10abd498
call fcn.10b30d39
not cl
bswap edx
add esi, eax
sal ecx, 0x9f
lea eax, [edx*8 + 0x250dd527]
rdtsc
jne 0x10864357
mov ecx, 0x4625a0bd
call fcn.1081b2fe
xor eax, ebx
shl dx, 0xee
not eax
jne 0x10ab9a8e
dec eax
xor eax, 0x49363426
lea edx, [edx + edx*4 - 0x5ffee47d]
inc edx
bswap eax
jno 0x107a3848
mov dword [esp], 0x259e1314
sal dword [esp], 0xac
mov eax, dword [ebp]
mov edx, 0x38a94519
lea ecx, [edx - 0x4c53bb65]
ror dx, 0xab
lea ebp, [ebp + edx - 0x38a9a324]
jp 0x1075b731
mov ecx, 0xa599d686
mov eax, dword [edi]
jmp 0x10740cc5

Function at 0x10b47fcf
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
adc ebx, edx
dec edx
sal dword [esp + ebp*2 + 0x15], 0xec
inc esi
adc dl, byte [esp + ebp + 0x1d]
inc ecx
pop edi
inc ecx
pop edi
inc ecx
pop edi
inc ecx
pop ebx
inc ecx
pop ebx
jae fcn.10ccf5b3
ror cx, 0xee
lea eax, [edx - 0x43f45a72]
jae fcn.10bff091