joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c2a0f7
Capabilities:
Encode data using xor

Disassembly:
mov word [esi], ax
sar cl, 7
sbb edx, dword [esp + 4]
mov eax, dword [ebp + edx - 0x64c11abf]
pop edx
adc ebp, 4
imul ecx, dword [esp]
xadd word [esp + ecx - 0x7fc937c3], cx
inc cl
xor eax, ebx
inc eax
lea edx, [ecx*2 - 0xc71f9ce]
add ecx, ecx
bswap eax
lea edx, [ecx + ecx*2 + 0x3621fb19]
jge 0x1178cda5
pop es
fld st(6)
imul ecx, dword [eax + 0x3c], 0x2598f15f
aad 0x2c
std
xchg ebx, eax
mov dl, 0x39
scasd eax, dword es:[edi]
or dword [ebp + edx*4 + 0x517d5381], eax
nop
mov al, 0x24
shl dword [0x92bd1c9c], 0x9b
sub eax, 0x44c08fb1
lodsb al, byte [esi]
xor ecx, esi
neg edx
salc
adc ebx, dword [ebp + 0x6f]
and dh, byte [esi]
inc esi
out dx, eax
xchg ebx, eax
pop eax
add cl, al
nop
stosd dword es:[edi], eax
mov edi, 0xc39ef1ed
mov edi, 0xc1c09a0f
add edi, ebp
or eax, 0x15ef08a6
pop ecx
popal
insb byte es:[edi], dx
and bh, 0x17
out dx, eax
mov eax, dword [ebx + 0x64]
insb byte es:[edi], dx
push ss
xor bh, byte [ecx]
insb byte es:[edi], dx
invalid

Function at 0x10c43eee
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
cdq
mov dword [esp + ecx - 0xc0ff], esi
ret
ror eax, 1
shr word [esp + 0x11], 0xac
mov byte [esp + 0xa], 0x24
jp 0x10b75783
not eax
ja 0x10bc689c
call int.10ad0301
mov ecx, 0x734da11
call fcn.10c0755b
not eax
dec edx
ror eax, 0x89
not edx
bswap edx
shr ax, 0x2a
shr eax, 0xfc
sets al
neg edx
btc eax, eax
lea eax, [eax + eax*4 + 0x632966ab]
xor ebx, edx
shl eax, 0x91
bts eax, eax
cbw
adc edi, edx
sal eax, 0xa8
sub eax, eax
not ax
mov eax, dword [eax + esi - 0xffff]
mov edx, 0xe3b9ca35
mov edx, dword [esi + 4]
call fcn.10d8d907
rol dword [esp + 0x16], 0xbd
xor eax, 0x3fa1fe19
mov dword [esp], 0xb214ea9e
jmp 0x10c40146
Function at 0x10c52bb0
Capabilities:
Encode data using base64

Disassembly:
push eax
dec ebx
push 0x9dac2b2b
lea esp, [esp + 4]
jne 0x10c51b4d
jmp 0x10b60d68
mov eax, dword [ebp]
call fcn.10afc6bf
lea esp, [esp + 0x1c]
je 0x10b375ff
mov eax, dword [ebp + ebx*4]
jmp 0x10b375ee
push 0xc09f5611
add eax, edx
push 0x7533dc20
mov dword [ebp - 4], eax
not dword [esp + 0x10]
push 0xa58f5136
test ebx, ebx
push 0x50883589
jmp 0x10c51b43

Function at 0x10c6d14a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call eax
mov esi, 0xd40385b3
mov ebp, dword [ebp - 4]
movsx ebx, si
lea edi, [esi + esi - 0x5e62d56c]
mov dword [edi + ebp - 0x49a435fa], eax
lea esi, [ebx + edi*8 - 0x1fd91247]
lea ecx, [esi + 0x6b91f71b]
call fcn.10a64a41

Function at 0x10c6d17c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax*2 + 0x5e399292]
xor ecx, ebx
sub ecx, 0x9eac900f
shr al, 0xa5
bswap ecx
mov dword [esp + eax - 0x9706], edx
xadd edx, eax
not dx
not ecx
add eax, eax
jae 0x10d99717
xor edx, ebx
neg edx
push 0xa488fa8a
inc edx
not dword [esp]
jmp 0x10c77ada
mov dword [esp + 4], 0x33953207
bswap edx
rol dword [esp], 0x82
jae 0x10da6972
jae 0x11795328
dec edx
xor ebx, edx
sal byte [esp + 3], 0x23
push 0x940b2fa3
call fcn.10dd3727
rol edx, 0x11
lea eax, [eax + ecx - 0x5bd7605e]
push edx
bswap eax
push ecx
adc dx, 0xba31
dec edx
xor ebx, eax
add ebp, eax
dec dword [esp + edx*2 - 0x3fcc235d]
setnp dl
mov dword [esp + ecx - 0x2bc0ff3f], ebp
ret 8
xadd word [esp + edx - 0x5e3ba6df], ax
ror ecx, 1
inc edx
shl ax, 2
mov word [esp + edx - 0x5e3ba6e0], 0x3008
xor ebx, ecx
dec eax
sar edx, 0x34
inc dword [esp + edx - 0x5e3]
add edi, ecx
movsx ecx, dl
mov dword [esp + edx - 0x5e3], edi
ret
movzx ecx, word [esp + edx]
add dl, byte [edi + edx*2]
neg dword [esp + eax*2]
call fcn.11761ea5
not ecx
mov dx, word [ecx + esi - 0x37d7e9fb]
bts ecx, ecx
adc esi, 6
push ecx
ror cx, 0xa6
ror cl, 1
mov word ss:[eax], dx
movsx eax, word [esp]
cwde
mov eax, dword [edi]
bt ecx, 0x1b
adc edi, 4
lea edx, [ecx*8 + 0x6d0100a7]
push edx
xor eax, ebx
and byte [esp + edx - 0x2bc0ff3b], 0xab
sbb ecx, ecx
shr dx, 0xa4
neg eax
rol eax, 1
rol ecx, 0x7b
pop ecx
neg eax
jmp 0x10d4cf39
Function at 0x10c7f7b0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xa882e23a
call fcn.10d98298
neg al
not ecx
bswap edx
jne 0x1177bf08
or cx, word [ecx + esi - 0x64cffffc]
inc edx
add dl, dl
adc esi, 2
shr cx, 1
push edx
mov byte [esp + 3], dl
pop edx
rcr eax, cl
btc dx, dx
movsx ecx, dx
shr ecx, cl
mov dword [esi + edx*4 - 0x9d83818], eax
or ecx, edx
xadd ecx, edx
jmp edi
bt edx, eax
bswap ecx
neg ecx
xor ebx, ecx
cwde
bswap edx
imul eax, eax
adc ebp, ecx
btc ax, ax
sbb dl, dh
mov ecx, dword [edx + esi - 0x76d6a3e2]
bts eax, eax
dec al
or edx, eax
mov edx, dword [esi + eax*4 - 0x53641348]
xor eax, eax
lea esi, [eax + esi + 4]
and ecx, edx
movzx edx, ax
bt edx, edx
shl al, 0x62
not ecx
sar al, 0x62
sub eax, edx
mov dword [esi + eax], ecx
btr edx, eax
shl edx, 0xe4
call fcn.10c91a4d
mov eax, dword [ebp]
mov edx, 0x212cf714
or edx, edx
lea ebp, [ebp + edx*2 - 0x4259ee24]
xor eax, ebx
lea eax, [edx + eax - 0x1d8f1567]
shr edx, 0xe1
movzx ecx, dx
xor eax, 0x87195b06
shl edx, cl
neg eax
btr dx, cx
shr dl, 2
ror ecx, cl
lea eax, [eax + edx*2 - 0x12c0c0da]
shr ecx, 0x53
dec edx
add ecx, ecx
not eax
lea edx, [ecx + ecx*4 - 0x5242907b]
inc eax
lea edx, [ecx*2 + 0x7cbaf304]
or dx, dx
not eax
cmovl ecx, edx
add edx, edx
xor ebx, eax
lea ecx, [ecx + 0x31a12c30]
imul dx, cx
add edi, eax
rol ecx, cl
lea eax, [edx + 0x7ba44af]
shl eax, 0xcd
mov eax, dword [ecx + esi - 0x64d031a1]
sbb cx, cx
and dl, cl
jbe 0x10d624b9
and eax, eax
mov edx, dword [ecx + eax - 0x6755e12f]
lea edi, [eax + edi - 0x6755e133]
mov dword [edi + eax - 0x6755e12f], edx
lea esi, [esi + eax - 0x6755e133]
mov edx, dword [esi + eax - 0x6755e12f]
movsx ecx, ax
xor edx, ebx
rol edx, 2
cbw
and ecx, eax
bswap eax
dec edx
neg ecx
rol edx, 1
neg eax
dec edx
xor edx, 0xd885781d
xor ebx, edx
dec ecx
lea eax, [ecx*4 - 0x1b632a48]
add ebp, edx
jmp fcn.10cf0654

Function at 0x10c9320c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10cd5dfa
xor edi, ecx
push 0x4f958996
mov dword [esp + 4], 0x548ae038
mov dword [esp + 8], 0x9d0aea16
and edi, 0xff
jmp 0x10dd1ffb
cli
sbb eax, 0xedad7903
call fcn.10afc94a
shr ecx, 8
call fcn.10d87ec9
mov dl, 0x82
fist word [eax]
cmpsd dword [esi], dword es:[edi]
aaa
push ds
cmp edi, edi
xchg esi, eax
test eax, 0xdf10c914
lcall 0x7661, 0x494f1575
push ds
fbld tbyte [edx]
inc eax
in eax, dx
inc eax
xchg ebx, eax
nop
cld
dec ebp
sbb eax, 0x15a70c2f
jg 0x10cd5def
add al, 0xe8
out dx, eax
inc eax
ret
mov edi, dword [edi*4 + 0x10c9d6fc]
jmp 0x10b779e5
Function at 0x10c9332d
Capabilities:
Encode data using base64
Encode data using xor
Execute anti-debugging instructions

Disassembly:
and dword [esp + 4], 0x953f3611
call fcn.10c51297
mov edx, 0xef0fb2bb
movsx ecx, dl
sub ecx, ecx
lea ebp, [ebp + ecx - 4]
mov eax, edx
mov edx, dword [ecx + ebp]
shr ax, 0xad
xor edx, ebx
not edx
neg edx
inc ecx
sal al, cl
adc edx, ecx
btr ecx, 0xbb
sal eax, cl
not edx
xor ebx, edx
xchg cx, ax
sub eax, 0x9c829a81
adc esi, edx
add ecx, eax
mov eax, dword [edi + eax - 0x419b6580]
mov edx, 0x72b5b21e
mov ecx, dword [edi + edx - 0x72b5b21a]
shl edx, 0x1d
shr dl, 0x21
push ebx
rol eax, 0x86
setae al
or edx, eax
neg ecx
pop eax
inc ecx
sar eax, 0xbc
adc edx, 0x36b8c3a7
or eax, eax
mov dword [esp], 0x9e90a8a1
bswap edx
lea edx, [eax + edx - 0x39d3d640]
xor edx, 0x79108703
lea ecx, [eax + eax + 0xf1bb139]
neg edx
or eax, eax
sal cl, 0x21
setbe al
xor edx, 0x903af89f
sar word [esp + ecx - 0xf1bb16c], 0xa8
xchg dword [esp + ecx - 0xf1bb166], eax
sar cl, 0xa7
xor ebx, edx
pop ecx
add eax, dword [esp + 4]
jae 0x10b6f389
add esi, edx
jmp 0x10b13ed3

Function at 0x10ca1d25
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, 0xb09f19b1
jmp 0x10d762f4
xor ecx, ebx
mov dword [esp + eax], 0x683e783
not ecx
sal byte [esp + eax], 0x46
sbb word [esp + eax], 0x789f
shr dl, 0x62
rol ecx, 3
and dword [esp + edx], edx
dec ecx
neg ecx
xor ebx, ecx
call fcn.10bfc0de
mov eax, 0x8ebce6b4
movsx ecx, ax
rdtsc
xchg ch, cl
call fcn.10bc30d5
inc ecx
dec dx
sar edx, 8
add ax, ax
not ecx
idiv eax
sub edx, eax
jno 0x10bcf50d
sal edx, 0x81
ja 0x10d847b6
inc ecx
add dl, 0x84
push edx
ror ecx, 1
dec ecx
cwde
rol eax, 0x7b
setb byte [esp + eax - 0x5ffffddd]
xor ebx, ecx
call fcn.10ad4989
shl dx, 0x8c
jne fcn.11780c4e

Function at 0x10ca7cdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ecx
ror dword [esp + edx - 0x76e1ad0a], 0x10
setb al
push edx
add esi, ecx
movsx ecx, dx
inc al
je 0x10e12d02
rdtsc
jne 0x10b99070
test ebx, ebx
jmp 0x10d91316
call fcn.10d1d877
dec esi
mov dword [esp + ebx - 0x23029], edx
mov eax, ebp
inc ebp
dec edx
mov dword [esp + ebx - 0x23031], eax
inc esi
xor dword [esp + ebx*4 - 0x8c0bc], edi
dec esi
mov edx, dword [esp + ebx*2 - 0x4605a]
shr bp, 0xaa
inc edx
xchg byte [esp + ebx - 0x23031], al
ja 0x10d81456
sub ebp, 4
mov ecx, 0xe90d7912
mov ecx, dword [ebp]
mov edx, 0xdbbc022e
xor ecx, ebx
sar edx, 0x41
mov eax, 0xf98dbc3f
dec ecx
bt ax, ax
add eax, 0xec3b1523
not ecx
add dl, dl
lea edx, [edx*8 - 0x66d6f1e6]
sub edx, 0x91376a80
lea ecx, [ecx + edx - 0x53c453fe]
sar eax, 0x71
neg al
jo fcn.10ae0f72
bswap ecx
push eax
jne 0x10baa1a2
lea esp, [esp + 8]
je 0x10cf2f92
mov eax, 0x472c938f
shl ax, 0xa8
mov eax, dword [ebp + ebx*4]
call fcn.10bae8ec
Function at 0x10ca87aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc edx
add dword [esp + ecx + 4], ecx
bswap eax
rol edx, 1
ror dword [esp + ecx + 3], 0x6b
shl dword [esp + ecx*2 + 4], 0xe4
not edx
xor edx, 0xfe0f599a
dec al
push eax
neg byte [esp + ecx + 0xa]
xor ebx, edx
add ebp, edx
add cx, 0xad1a
call fcn.10adc6a4
inc ecx
lea edi, [edi + ecx*2 - 0x5f7b135c]
movsx eax, cx
mov edx, dword [edi + ecx*2 - 0x5f7b1358]
lea eax, [eax + 0x60a5038f]
mov dword [esp + ecx - 0x2fbd89ac], 0x232b9ba7
dec ecx
xor edx, ebx
lea edx, [edx + eax - 0x367ac0fc]
bswap edx
and eax, 0x51070b18
sbb ax, 0x5a12
jle 0x10e22289
mov edx, 0x138ead33
movzx eax, dl
mov eax, dword [esi + edx - 0x138ead33]
mov ecx, 0xb434aab2
inc dx
neg ecx
mov edx, dword [esi + edx*2 - 0x271d5a64]
mov cl, byte [esi + ecx - 0x4bcb5546]
call fcn.10ca50a2
neg edx
xor edx, 0x560322bb
dec ecx
xor ebx, edx
shr eax, 0xb4
adc esi, edx
mov di, word [eax + edi - 0x809]
dec ecx
cmovo ecx, eax
cbw
jg fcn.10c088fe
mov edx, dword [edi]
mov eax, 0x6883e602
lea edi, [eax + edi - 0x6883e5fe]
mov ecx, eax
xor edx, ebx
rol edx, 1
xadd al, ah
bswap edx
bts ax, ax
sub ecx, ecx
sar cl, 0x66
inc edx
xadd eax, ecx
push eax
pop eax
bswap edx
rol cl, 0xe4
inc ecx
dec edx
xor ebx, edx
shr ecx, 0xe9
shl ecx, 0x5c
xor cx, ax
adc ebp, edx
cdq
rdtsc
lea ecx, [ecx + ecx*8 + 0x7bbf1084]
or ecx, ecx
dec ecx
lea esi, [ecx + esi - 0xbbf33b3]
xor cx, cx
ja 0x10e07b9a
mov dword [esi + ecx*2 - 0x177dfffc], eax
lea eax, [ecx + ecx + 0x2417212f]
call fcn.10c1786e
xor edx, ebx
jmp 0x10c29e88

Function at 0x10cb2b1e
Capabilities:
Authenticate hmac

Disassembly:
push 0x45119a80
ror ecx, 1
jmp 0x10c540b8
ror dword [esp + 0xb], 0xdf
call fcn.11770bf6
not ecx
jmp 0x10c176bc

Function at 0x10ced7ab
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
call fcn.10b98a3d
mov eax, 0xa8ba2907
push eax
xor eax, dword [esp]
adc eax, dword [edi + eax*2]
mov edx, dword [esp]
add edx, 0xb3bf9680
ror dword [esp + edx - 0x5c79bf87], 0xfb
mov edx, dword [edx + edi - 0x5c79bf83]
not word [esp + 2]
add byte [esp], 0x8f
adc edi, 3
jmp 0x10d9130f

Function at 0x10cf11f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ecx
shr dl, 0x87
bswap ecx
rol ecx, 3
add dword [esp + edx], 0x89847c1d
pop eax
div eax
xor ebx, ecx
add esi, ecx
xor edx, esi
jmp edx
sal dx, 0x69
lea edi, [edi + edx*4 - 0xfffe]
adc cl, al
movsx eax, dl
mov word [edi + edx*4 - 0x10000], cx
mov ecx, eax
sub ecx, eax
lea ebp, [ebp + edx*8 - 0x20004]
add ax, dx
btr cx, ax
xor ecx, dword [ebp + edx - 0x4000]
mov dword [esp + edx*4 - 0x10000], eax
xor ecx, ebx
not ecx
imul eax
xor ecx, 0xb9bdcb3c
mul dx
jae 0x10b90292
push 0xa2b3f684
rdtsc
sub edi, 8
mov dword [edi + 4], eax
ror dword [esp], 0xaa
mov ecx, 0xad23e49f
movzx eax, cl
mov dword [eax + edi - 0x9f], edx
imul dword [esp + eax*8 - 0x4f8]
btc edx, ecx
cwd
lea esi, [esi + eax - 0x18437127]
btc ecx, 0x20
pop ecx
shr dx, 0xa3
mov eax, dword [esi + eax*4 - 0x610dc48c]
dec cx
jle 0x11793e37
xor eax, ebx
shr ecx, 0x2a
xor ecx, ecx
shr cl, 0x26
xor eax, 0x6d20f904
btc edx, edx
bswap eax
call fcn.10ac1838
Function at 0x10d2170e
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 4]
call eax
mov ecx, 0xe09fb0b1
movsx edx, cx
lea esi, [ecx*8 - 0x1677bcd2]
mov ebp, dword [ebp - 4]
push esi
mov dword [ebp], eax
imul esi, esi
pop edi
add edx, edi
mov edi, ebp
shl dx, 0x43
movzx ebp, dx
pop ebx
js 0x10d933e1
pop esi
shl bp, 0xa3
ja 0x10c526dd

Function at 0x10d3faa1
Capabilities:
Encode data using xor

Disassembly:
and word [esp + 4], 0x40bb
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x10b43e3c
mov eax, 0x6837ef9c
xor al, 0x90
btr eax, eax
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jne 0x10b43e26
mov eax, dword [ebp]
push 0x2aa0810e
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov edx, 0xef132693
movsx edi, dl
mov esi, 0x7690c536
mov dword [ebp + esi - 0x7690c536], eax
movsx ecx, dx
pop ebx
bts ecx, esi
ror edx, 0x14
jae 0x10b3048d
mov eax, dword [0x4e1f5b33]
xchg esi, eax
inc ecx
push edi
mov edi, 0x745def70
mov edx, 0xb8471000
adc byte [edx - 0xa163ae], ch
cld
xchg esi, eax
scasb al, byte es:[edi]
adc byte [ecx + 0x4f72f727], cl
mul dword [ebx + ebx]
movsb byte es:[edi], byte [esi]
jns 0x10b43e7a
dec edi
ret 0x408a
mov ecx, 0x75a46695
lea ebp, [ecx + ecx*2 - 0xbf2d7c6]
mov edx, dword [ecx + edi - 0x75a46695]
mov esi, ebp
lea edi, [esi + edi - 0x54fa5bf5]
imul esi, esi
call fcn.10de34f3
add eax, edx
rol dword [esp + 4], 0x14
jb 0x10b43e0f
jmp 0x10d34f66
Function at 0x10d5250f
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + ecx*2]
sub cl, 0x9e
push ecx
lea ebp, [ebp + ecx*2 - 0xc0]
dec cx
sal dx, 0x4a
shr ecx, 0x30
xor eax, ebx
call fcn.10a37d8a
and eax, ecx
not eax
btr dx, dx
mov dword [edx + esi - 0x80000000], eax
mov dword [esp + edx - 0x80000000], edx
movzx ecx, byte [esp + edx - 0x80000000]
jae 0x10b4de8b
lodsd eax, dword [esi]
jno 0x10d52597
out dx, eax
mov ebx, 0x87edc0
popal
inc esi
out 0x77, eax
out dx, eax
xor byte [ebp - 0x7a], bh
stosd dword es:[edi], eax
mov al, 0xad
or eax, 0x20a0d5b9
in eax, dx
mov bl, 0x53
mov edi, 0xbe8bf75f
mov dword [0xab547bd0], eax
push esp
stosd dword es:[edi], eax
xor byte [edx - 0x40aee4dd], 0xe7
lodsb al, byte [esi]
sbb esp, dword [0x4fb570b7]
and eax, 0x4fb570b7
push es
mov dl, 0
add dh, byte [0x38b810b0]
out dx, al
push esi
call [ecx + 0x10a6e4de]
test al, 0xdd
test dword [edx + 0x4f], edi
push cs
jno 0x10d52557
jno 0x10d52562
and eax, 0x944082b0
in al, dx
arpl word [ebp - 0x1478d08e], di
salc
lahf
xchg ebx, eax
enter 0xffffffffffffb271, 0x6f
pop ss
test al, 0x85
push eax
sbb eax, 0xb51ecade
push ecx
mov ah, 0xa2
adc bh, bh
invalid

Function at 0x10d52f7f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x67d76d4e
not eax
sub ecx, edx
neg ecx
push edx
inc ax
bt cx, cx
mov byte [esp + edx*2 - 0x3966e], 0xa1
setb dl
xor bx, ax
xadd byte [esp + edx*4 - 0x72c03], dh
lea edi, [edi + edx*8 - 0xe580a]
mov word [edi + edx*2 - 0x39602], ax
mov eax, edx
call fcn.10c15939
dec dword [ebp - 0x58092844]
int1
jmp dword [esi - 0x77]
cld
dec dword [ebx + 0x29bae8c2]
in al, dx
dec dword [ebp + 0x460c0884]
lea eax, [eax + ecx + 0x7880460c]
invalid
dec esp
lea eax, [eax + ecx + 0x7880460c]
mov dword [esp], ecx
js 0x10d52f10
dec esp
and al, 0
rol eax, 1
or dword [esp + 4], ecx
mov edx, ecx
ror dl, 0x41
lea eax, [ecx + eax - 0x408937a2]
or edx, 0x48a3e90e
xor ebx, eax
call fcn.10e370a9
lea edi, [edi + ebp*8 + 0x35]
xchg byte [ecx - 0x32df7576], bl
in al, dx
jns 0x10d52f76
jl 0x10d52fbd
xchg ebx, eax
loope 0x10d52f45
shl byte [ebx + 0xb], 1
arpl word [ebx], cx
add dword [eax + 0x7b448ba9], 0x5b474fbf
inc esp
jnp 0x10d52f85
dec edi
inc edi
pop ebx
jp 0x10d52f68
jo 0x10d52fc3
invalid
Function at 0x10d63981
Capabilities:
Encode data using xor

Disassembly:
movsx edx, bp
popfd
lea eax, [ebp*8 - 0x6bf18d7d]
jb 0x10b9d61f
xchg esp, eax
pop edx
pop ebp
lea eax, [eax + eax*8 + 0x1d9254b7]
call fcn.10c1c879
mov eax, 0x1819e15
add byte [eax + 0x1819e15], bh
movsx edx, al
mov ax, word [edi + eax*2 - 0x3033c2a]
rol dl, 0xe7
or dx, 0xd13e
lea ecx, [edx + edx*2 - 0x65d870e3]
mov dx, word [edi + edx*4 - 0x346f6]
xadd cl, ch
ror cl, 0xe3
call fcn.11778d7b
jge 0x10b9d60f
int3
mov dword [esp + edx - 0x71840000], edx
mov eax, dword [edi + edx - 0x71840000]
jbe 0x10d76bf9
pop ecx
lea ebp, [eax*8 + 0x18d442c]
pop edi
rol ebx, 0x63
pop ebx
jae 0x10b9d607
push 0x238bc8d
inc ecx
invalid
xor eax, ebx
bts edx, edx
dec eax
mov ecx, 0xaeb028a7
rol word [esp + edx - 0x71840000], 0x21
or byte [esp + edx - 0x7183ffff], ch
ror eax, 3
inc byte [esp + edx - 0x71840001]
not dx
not eax
neg cx
push ecx
sbb cx, 0xd60f
inc eax
shr word [esp + edx - 0x7184fffe], cl
xor byte [esp + edx - 0x7184fffb], cl
ror dl, 0xc4
not eax
xor ebx, eax
call fcn.10d90699
lds ecx, [eax]
push 0x6aedf5af
loope 0x10d76beb
rcr byte [edx + 0x5380920b], 1
retf 0x6844

Function at 0x10d68ee1
Capabilities:
Execute syscall

Disassembly:
dec eax
rol ebp, 0x65
inc cx
mul edi
inc ecx
xor esi, edx
dec edx
mov dword [esp - 0x1ab2c], 0xe401d106
rol esi, 1
not esi
inc dx
shl dword [esp - 0x6acad], 0x2d
inc dx
mul dword [esp - 0xd592]
rol esi, 1
dec esi
shl dl, 0x25
dec eax
cwde
inc ecx
pop ebp
dec esi
mov dword [esp - 0xd58e], edx
call fcn.10b1dbb5
syscall
inc ecx
push eax
pushfd
dec ecx
mov eax, 0xfd05c72a
mov bh, bh
xchg esp, eax
nop
dec esp
mov eax, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xff6a9798
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.10c6db11
mov dword [esp + eax - 0xf367], ecx
add edi, edx
mov edx, eax
sal word [esp + eax*2 - 0x1e6ce], 0x4c
mov dword [esp + eax - 0xf367], edi
ret

Function at 0x10d71b2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esp
and al, 0
call fcn.10c20378
ja 0x10d71adf
cmpsd dword [esi], dword es:[edi]
inc ebp
sub al, 0xfd
in al, 0x17
idiv byte [edi - 0x57572043]
cwde
add esi, dword [0x68556ca]
cdq
xchg edi, eax
adc al, 0x10
mov cl, 0x98
loope 0x10d71bb5
rcr dword [edx + esi*4 + 0x26], 0x97
call 0xf74055bc
imul ebp, dword [esi + 0x33], 0x4eff87a9
mov ch, 0x99
test al, 5
mov cl, byte [eax + 0x37d53ede]
jmp 0xeaaa55a8
xchg ecx, eax
xchg byte [esi], ch
insb byte es:[edi], dx
cmp dword [0xe8b0e1d3], edi
js 0x10d71c33
dec esp
clc
retf 0x310b
invalid
Function at 0x10d722e3
Capabilities:
Encode data using xor

Disassembly:
jb 0x10c9cd37
call fcn.10d370d4
mov bh, 0xed
push ss
sbb dl, byte [edx - 0x2f]
out 0x65, al
push ds
shl esi, 1
push ds
dec edx
mov dl, 3
in eax, dx
aad 3
jae 0x10aebe26
push cs
sbb eax, 0x15e404ba
ljmp 0x23d5
xor ebx, edx
mov dword [esp + 8], 0x8bb262b6
rol byte [esp + 0xb], 4
jae 0x10d722c6
push 0x73a54a18
lea esp, [esp + 8]
call eax
mov edi, 0x2181ab9d
lea esi, [edi*8 + 0x68142c17]
mov ebp, dword [edi + ebp - 0x2181aba1]
mov dword [edi + ebp - 0x2181ab9d], eax
mov esi, ebp
call fcn.10e0554b
and ebx, 0xff
mov dword [esp], 0xf7a24320
mov ebx, dword [ebx*4 + 0x10b65794]
shr edx, 8
call fcn.10bb9922
mov dword [esp + eax*4 - 0x58], eax
add al, byte [esp + eax - 7]
ror dl, 1
sub dl, 0x24
add dword [esp + eax*2 - 0x166], eax
dec eax
xor dl, 0x30
sar ax, 0x46
not eax
xor bl, dl
rol eax, 0x12
lea edx, [esp + edx + 0x10]
jb 0x10aebe16
add byte [esi], 0x9b
xlatb
push dword [ecx + edi]
xor al, 0x39
test edi, ebp
xor bh, ah
cmp edx, dword [edx]
out dx, eax
pop esi
adc eax, 0xb700f4e0
jae 0x10d7230b
add al, 0xef
push es
mov al, 0x8b
fdiv dword [eax - 0x27e3cc9d]
shl dword [eax], cl
dec eax
mov esi, 0x79fabf20
sahf
mov bl, 0xd0
shr byte [esi + 0x59], 1
fadd dword [eax + 0x2216d6a4]
mov edi, 0x28561212
les esi, [eax - 8]
xor cl, byte [ebx]
rol dword [eax], 0x7f
cmp bl, al
adc dh, al
mov ch, 0xe3
and eax, 0xe92314ff
aad 0x10
push esi
or byte [eax + 0x43534f09], 0x5c
fild dword [edx]
fisttp word [eax]
mov ebp, 0xcdba40f1
jecxz 0x10d723d7
invalid
xchg edx, eax
loopne 0x10d723e8
enter 0xffffffffffffab05, 0x4a
mov esp, 0xffef0676
invalid
push ss
mov byte [0xe6921357], al
xor bl, byte [esi]
add edx, dword [edx + 0x6c2bd260]
jnp 0x10d72375
pop ebp
into
xor dword [ebp + 0x11], ebp
sal dword [esi], 0xe4
xchg ebx, eax
or byte [ebx - 0x486dfd88], ch
shl dl, cl
insd dword es:[edi], dx
loop 0x10d72436
mov dword [0x191a967d], eax
xchg edx, eax
push ds
scasd eax, dword es:[edi]
add byte ds:[esp + 0x15], ch
out dx, eax
add ebp, dword [ebp + 0x63]
jne 0x10d723a7
dec esp
adc edx, dword [eax - 0x2e0cd0ee]
jecxz 0x10d723ce
inc eax
push ss
test ecx, esp
fisttp qword [edi]
invalid
loope 0x10d723c7
jg 0x1bd5513c
jmp dword [eax - 0x33]
bound ebx, qword [ebx + 0x3b]
jmp 0xab2f921b

Function at 0x10d7ccb0
Capabilities:
Check for trap flag exception

Disassembly:
pushfd
add dword [esp + 4], 0xef26f8fd
mov dword [esp + 4], 0xd70ce785
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10c6db6e
xadd edx, ecx
mov ecx, dword [ebp + ecx - 0x4fa41ab5]
sbb edx, 0xb09b3d21
setns dl
adc ebp, 3
lea edx, [edx*4 + 0x66b5fd25]
btr edx, edx
add eax, ecx
sar edx, 4
movsx ecx, dx
mov dword [ebp], eax
movsx eax, cx
rol ecx, cl
and al, 0x2e
sbb edi, 4
sal cl, 0x27
neg ecx
mov ecx, dword [edi + ecx - 0x622f0080]
bswap edx
ror eax, 0x62
and eax, 0x3caa2d34
xor ecx, ebx
bts eax, 0xb9
mul dl
ror ecx, 1
sal al, 0x43
sar edx, 0xcc
bswap ecx
bts eax, 8
call fcn.10dc33b1
Function at 0x10db946f
Capabilities:
Encode data using xor

Disassembly:
push 0xe98b6814
xor esi, ecx
jmp 0x10d82e44

Function at 0x10dbfa78
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, ebx
mov dword [esp], ecx
shr word [esp], 0x44
bswap edx
ror edx, 2
inc edx
push ecx
bswap eax
cbw
bswap edx
sal cx, 0x89
setae al
xor ebx, edx
sub byte [esp + eax - 0x4ac2fef9], 0xa2
add ebp, edx
call fcn.10a3103f
mov eax, 0x7e0f5917
mov ecx, 0xb9b10c18
btc ecx, eax
rdtsc
sbb esi, 7
mov dword [esi + 4], eax
movsx eax, cl
mov dword [esi + eax*8 - 0xc0], edx
movzx edx, cl
bswap ecx
btc ecx, ecx
lea ebp, [ecx + ebp - 0x1a0c31bd]
mov ecx, dword [ecx + ebp - 0x1a0c31b9]
xor ecx, ebx
sal al, 0x83
dec ecx
not eax
shl eax, 0xd2
ror eax, 0xae
bswap ecx
not ecx
lea eax, [edx*8 + 0x432171c]
neg eax
dec edx
dec ecx
bts edx, 0x2d
xor ebx, ecx
lea eax, [edx*2 + 0x458f70a6]
or eax, eax
adc edi, ecx
movsx ecx, ax
neg al
jge fcn.10c1ca3f

Function at 0x10dca6d9
Capabilities:
Authenticate hmac

Disassembly:
neg cl
dec ecx
xor al, 0
ror dl, 0xc2
and ecx, 0xdb857e3b
not al
rol dl, 0xe1
and cl, 0xba
sbb al, 0x81
bts edx, ecx
neg al
sar edx, 0x69
xor bl, al
add eax, esp
shr edx, 0x52
btr edx, ecx
imul edx, ecx
mov cx, word [edx + eax]
lea esi, [edx + esi - 2]
movsx eax, dx
btr eax, edx
mov word [esi + edx*4], cx
btr eax, edx
mov ecx, edx
add edx, dword [ebp + edx*2]
or eax, ecx
sbb ecx, 0xb71db38c
sar cx, 0xe4
lea ebp, [ecx + ebp - 0x48e204c3]
inc ax
shl eax, 0xdb
or eax, eax
xor edx, ebx
inc edx
shr ax, cl
add ax, ax
neg ecx
not edx
ror edx, 3
inc edx
inc ecx
seto al
xor ebx, edx
not eax
add edi, edx
sal cx, 0xec
lea edx, [eax + ecx*4 - 0x15cb094b]
jp fcn.10b2e837
push 0xfa2af823
dec ebx
push 0x32853198
lea esp, [esp + 8]
jne 0x10c567d2
shr cx, 0x85
cwde
adc edx, eax
sal ecx, cl
bts ecx, eax
xor ebx, edx
add cl, ah
bt ax, cx
adc ebp, edx
bt ecx, 0xba
add eax, ebp
jmp eax
btc eax, 0x14
ror eax, cl
xor ax, ax
lea edx, [edx + eax*2 - 0x54b7fbdf]
dec ecx
ror edx, 3
jmp 0x10c46fa3
xor edx, ebx
push 0x4aa050b9
push 0xbe9c2a91
inc eax
sar byte [esp + 5], 6
xor edx, 0xd814ff90
mov dword [esp + 4], 0x16b5a818
dec ecx
push 0x1f3a3691
call fcn.10c91f23
mov ecx, dword [ebp]
mov eax, 0x92b3b485
or ax, 0xd20
movsx edx, al
mov dx, word [ebp + 4]
adc ebp, 6
inc eax
dec al
mov word ss:[ecx], dx
and eax, 0xa8a90f81
mov edx, dword [edi]
cwde
lea edi, [edi + eax*4 - 0x3600]
lea ecx, [eax*8 + 0x5c9abcaa]
sbb cx, ax
jbe 0x10cd57de
xor edx, ebx
btr eax, ecx
ror edx, 1
idiv al
bswap edx
ror cl, 0x64
ror edx, 3
shl eax, cl
call fcn.10dff101
mov eax, 0xacb93d0e
movzx eax, byte [ebp]
add ebp, 1
mov edx, 0x7374282
xor dl, dl
movsx ecx, dx
xor al, bl
shr ecx, 0xd9
xor dl, dh
adc al, 0xac
jmp 0x10adbdf8