joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d2ea
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push ecx
jo 0x10015a6f
mov bh, bh
jno 0x10015a6f

Function at 0x1000d7db
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push edi
jb 0x10018bc4
xchg bl, bl
jae 0x10018bc4
add dword [esp + 8], ebx
ja 0x10018bb5
nop
jbe 0x10018bb5
push 0x18
push eax
call fcn.100141ab
xchg ebx, eax
out 0xd5, al
call 0x14c92c97
call fcn.10014edc
mov dh, 0x37
adc eax, 0x5d59e800
ret 4

Function at 0x1000da32
Capabilities:
Encode data using base64
Get disk information

Disassembly:
popfd
jb 0x100127ec
mov dl, dl
jae 0x100127ec
in al, dx
adc al, 0xf7
mov dword [eax], 0xe8000000
xor al, byte [edi]
add byte [0xe802f811], dh
lea esi, [ebp - 0x20]
call fcn.10018fa5
lea eax, [ebp - 0xc]
push eax
call fcn.10014dc6
xor eax, 0xe8cc321f
push ebx
push 1
push ebx
call fcn.100189ef
iretd
add byte [eax], al
add byte [eax], al
pop esi
sub dword [esp + 8], edx
jb 0x1000ed80
mov dh, dh
jae 0x1000ed80
add dword [esp + 8], eax
js 0x100177d4
xchg ebx, ebx
jns 0x100177d4
xor eax, 0x33bf6299
ja 0x1000f575
xchg ch, ch
jbe 0x1000f575
test si, 0
call fcn.100141d9
mov dword [esi - 0x3317eb40], eax
call fcn.10017795
cmc
stosd dword es:[edi], eax
pop edx
mov dword [eax], 0x3935820f
add byte [eax], al
cmp esi, edx
jl 0x100174c8
jl 0x10019581
mov esi, edi
test si, 0
call fcn.1000e726
sbb ah, cl
into
call 0x18255491
call fcn.100185a5
push ds
pushal
mov gs, word [esi]
call 0x4e88e99a
jp 0x1000da42
add byte [esi + 0x36890fc0], al
ret
and byte [ebx - 0x7c000004], 0xc4
sbb byte [ebp - 0xd17138b], cl
mov dl, 0
ret
sub dword [esp + 8], edx
jb 0x1000ff06
mov edx, dword [edx]
jg 0x100151c3
mov si, si
jle 0x100151c3
je 0x1000e75c
inc esp
mov edi, dword [esp + 0x3c]
mov eax, esi
call fcn.100105f3
call fcn.10014191
retf 0xa508
call 0x8600e760
cld
invalid
jne 0x1000e75e
call dword [0x10024004]
test ax, 0
jo 0x10012696
call fcn.10014bd9
out 0x7e, eax
mov bh, 0x6f
call 0x7afeaf01
fld qword [esi]

Function at 0x1000e365
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push edx
js 0x10012a9f
nop
jns 0x10012a9f
mov edx, dword [esp + 4]

Function at 0x1000e5b7
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push eax
ja 0x1000ccc0
xchg esp, esp
jbe 0x1000ccc0

Function at 0x1000e8fd
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push eax
jo 0x1000de0b
mov bp, bp
jno 0x1000de0b

Function at 0x1000eb0e
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
jl 0x100117e8
mov edi, edi
jge 0x100117e8
mov ebp, dword [esp + 4]

Function at 0x1000eea5
Capabilities:
Execute anti-debugging instructions
Read .ini file

Disassembly:
pop edi
jo 0x1001684e
xchg ah, ah
jno 0x1001684e
push ecx
push ecx
rdtsc
push esi
mov esi, edx
mov ecx, eax
rdtsc
call fcn.1000dbd9
in eax, 0xff
xor al, dh
call sub.KERNEL32.dll_GetPrivateProfileStringA
popfd
jmp 0x1000dbca
ret
Function at 0x1000f07f
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ecx
jg 0x10014942
xchg al, al
jle 0x10014942
call fcn.1000fffe
call fcn.10019115
invalid
mov ecx, dword [esp + 4]

Function at 0x1000f304
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
jl 0x1000f3ab
xchg esi, esi
jge 0x1000f3ab
mov ebp, dword [esp + 4]
jl 0x10013d28
xchg bp, bp
jge 0x10013d28
mov ebp, dword [ebp]
jb 0x10012714
mov si, si
jae 0x10012714
push 0xde68
call fcn.10018a74
and eax, 0xe8179e6b

Function at 0x1000f602
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push eax
jp 0x100179eb
xchg dl, dl
jnp 0x100179eb
js 0x1001157e

Function at 0x1000f8e2
Capabilities:
Encode data using base64
Get disk information

Disassembly:
add dword [esp + 8], ecx
ja 0x10017afb
xchg dx, dx
jbe 0x10017afb
mov eax, ebx
call fcn.10016628
call fcn.100185a5
sahf
xchg ebp, eax
mov gs, word [esi]
call 0x5388e4ec
sahf
add byte [eax], al
push esp
enter 0xffffffffffffe804, 0xffffffffffffffcb
jbe 0x1000d810
add byte [esi - 0x17ffeac9], dh
pop ecx
pop ebp
mov ecx, dword [esp + 4]
jb 0x10016152
xchg edi, edi
jae 0x10016152
jo 0x1001637a
call fcn.1000ed36
and eax, 0xe8e4a9b2
jb 0x100165e7
call 0x8d4a6aab
add byte [eax], al
xor ebx, 0xac8311f8
push ebx
call fcn.10011516
and esp, dword [edx - 0x6e]
jae 0x1000e897
push ebx
push edi
call fcn.1000e5b7
imul esi, dword [edx], 0x40
int3
push ecx
jl 0x1000e876
mov eax, eax
jge 0x1000e876
pushfd
jb 0x10012e18
mov ebx, ebx
jae 0x10012e18
add ecx, 0xafc0ac8e
jb 0x1000d528
mov bl, bl
jae 0x1000d528
mov eax, dword [eax]
jmp 0x1000e08a
pop ecx
jb 0x1001305e
xchg di, di
jae 0x1001305e
test dl, 0
jnp 0x1000d809
xor eax, eax
mov ecx, dword [ecx]
jl 0x1000fee8
mov al, al
jge 0x1000fee8
jnp 0x1000ee53
call fcn.1000caf3
cmp eax, esi
push 0x3168e804
inc esp
add dl, byte [eax]
popfd
jl 0x100152a9
mov di, di
jge 0x100152a9
Function at 0x1000ff72
Capabilities:
Encode data using base64
Get disk information

Disassembly:
test edx, 0x820f0000
adc esp, dword [ebx - 0x3f7b0000]
je 0x100167e9
je 0x10017db1
push eax
jg 0x1000f7ce
mov bl, bl
jle 0x1000f7ce
jo 0x10018c34
xor ecx, ecx
test dh, 0
jo 0x1000e517
test edx, edx
jle 0x1000d640
call fcn.100136eb
invalid
xchg esp, eax
into
invalid
ror byte [edi], 0x84
dec esi
cmp edi, 0xffffffff

Function at 0x1001005e
Capabilities:
Encode data using base64
Get disk information

Disassembly:
test al, 0
jb 0x1001642c
call fcn.1000f8e2
ljmp 0xffc3
add byte [eax], al
add esp, 0xc
test dx, 0
jnp 0x10010314
test eax, eax
je 0x10011bb6
call fcn.100107bb
in eax, 0xeb
loopne 0x1000fff5
add ch, ah
jmp 0x1000ffad
call 0x39498be2
add byte [eax], al
jl 0x1001111e
shr eax, 0x10
mov edx, edi
test ecx, 0
jb 0x10016c16
add byte [ebx + 0x4488fce2], al
adc dword [edx], eax
and edx, 0xfffffffc
loop 0x1000ffeb
mov byte [ecx + edx + 2], al
call fcn.100197b5
xchg edi, eax
add byte [eax], al
jne 0x1000ffed
sbb esp, edi
call 0xe7e955c4
push ebp
call fcn.100160db
push ebp
call fcn.100160db
jns 0x1000ffc9
adc dword [eax - 0x18], 0x242483
push ebx
push esi
mov ebx, eax
push edi
lea eax, [esp + 0x10]
push eax
push 0x1000d4a1
call fcn.10012efd
push dword [ebp + 8]
call fcn.10010fa1
dec ecx
mov edx, 0xfe84557
mov esi, dword [ebp - 0x7d]
add byte [eax], al
cmp esi, 0xffffffff
jne 0x1000db46
call fcn.10016605
inc edi
pushfd
fist dword [eax + ebp*8 - 0x1707ba75]
je 0x100100a4
add byte [eax], al
lodsb al, byte [esi]
sub al, 0xe
pop es
call 0x124519c0
adc cl, ch
mov dh, 0x7d
add byte [eax], al
push 0x10024707
call fcn.1001669c
dec esp
or dl, byte [ecx - 0x623c17bd]
call 0x297085b8
add byte [eax], al
call fcn.100193a9
dec edi
or byte [edx - 9], bl
mov byte [eax], 0
add byte [eax], al
mov ebp, esp
push esi
sldt word [eax]

Function at 0x10010301
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov ebx, dword [esp + 4]
jb 0x1000ca33
push ebx
jp 0x1000d2d8
xchg ch, ch
jnp 0x1000d2d8
lea eax, [ebp + 8]
lea ecx, [edi + 8]
pop edx
Function at 0x100103f0
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edi, dword [edi]
jb 0x10013100
mov esi, esi
sub dword [esp + 8], ebp
jmp 0x1000e93b
mov ecx, dword [ecx]
jb 0x10013eac
popfd
jl 0x1001425a
mov cl, cl
jge 0x1001425a
sbb al, byte [edx]
add byte [eax], al
push ebx
je 0x100148fb
nop
jne 0x100148fb
jne 0x10011b91
jne 0x10015df1
call fcn.100189ef
jne 0x100103d5
mov eax, 0xc085e860
je 0x1000d50e
call fcn.1000db83
mov dword [0xe8e3bdf8], eax
add ebp, 0x6e5790ca
je 0x1000d914
xchg si, si
jne 0x1000d914
call fcn.100141ab
push ebx
inc ecx
out 0xd5, eax
call 0xb6882af2
push ebx
ja 0x10012848
mov di, di
jbe 0x10012848
jb 0x1000f154
and dword [esi + 4], 0
pop ecx
call fcn.100141ba
mov cl, 0xeb
mov eax, dword [0x7c8be83d]
and al, 4
jl 0x10015a5f
xchg edi, edi
jge 0x10015a5f
pop ebp
jl 0x10016704
mov cx, cx
jge 0x10016704
js 0x100119e5
xor eax, eax
call fcn.1000cfb0
sal byte [ebp - 0x39], cl
mov esp, 0x56fc68e8
neg byte [eax]
daa
loope 0x10014921
call 0x1425a58a
mov ebx, dword [esp + 4]
ja 0x10017ff1
mov sp, sp
jbe 0x10017ff1
push esi
call fcn.100185d9
outsd dx, dword [esi]
sub esi, dword [edx]
pop ecx
call 0xc4ed66e
call fcn.100185d9
jbe 0x100148f7
add byte [esi - 0x2d], dh
xor bl, byte [ecx - 0x18]
push 0x28
call fcn.10010720
inc byte [edx + 0x66e8039e]
test ecx, 0xc4e80000
mov ecx, 0x933cffff
js 0x100149b8
call 0x142595d1
jb 0x1000e6db
mov edi, edi
jae 0x1000e6db
test di, 0
call fcn.10017795
add ebx, dword [edx + 0x37]
pop edx
call 0xdc7ccb76
invalid
push ss
daa
wait
retf 0x8de8
mov edi, dword [edi]
ja 0x1000db0a
mov bl, bl
jbe 0x1000db0a
mov ecx, dword [esp + 4]
jp 0x10017dcd
mov ah, ah
jnp 0x10017dcd
call fcn.100105f3
lea esi, [esp + 0x20]
call fcn.10017e71
scasd eax, dword es:[edi]
dec ebp
inc ebp
mov ch, pe_nt_image_headers32
mov edi, dword [esp + 4]
jl 0x1000d373
nop
jge 0x1000d373
ret 0xe800

Function at 0x100107bb
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov ecx, dword [esp + 4]
jg 0x100100fa
xchg ch, ch
jle 0x100100fa
mov edi, dword [edi]
jp 0x100131d5
mov ecx, dword [ecx]
jo 0x10017320
xchg sp, sp
jno 0x10017320
push ecx
jb 0x1000f690
nop
jae 0x1000f690
call dword [0x100241cf]
lea esi, [ebx + 0x34]
call fcn.10017022
test dh, 0
jnp 0x1000fdbc
test edi, edi
jne 0x10015e75
Function at 0x1001138c
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov ecx, esi
call fcn.1000cc26
call fcn.1001253a
outsd dx, dword [esi]
mov bh, 0x74
or al, 0xe8
cmp eax, ebx
je 0x1000d5bc
call fcn.1001449d
or byte [esi - 0x1f], dl
lodsb al, byte [esi]
call 0x10048f91
add byte [ebx + 0xc2f7c8], cl
add byte [eax], al
add al, ch
fcmovne st(0), st(2)
add byte [eax], al
stc
leave
dec eax
test al, 0xe8
test al, 0
jnp 0x10017811
cmp esi, 2
call fcn.1000caf3
pop eax
aam 0x68
add al, 0xe8
call fcn.10016790
push ds
mov dword [eax], 0xf000000
test dword [ebp + 0x58], esi
add byte [eax], al
cmp eax, 0xbb8
call fcn.1000db83
invalid
push edx
ja 0x10012113
mov dx, dx
jbe 0x10012113
add esp, 0x10
mov edx, dword [esp + 4]
jg 0x10019105
mov cx, cx
jle 0x10019105
jo 0x1001565d
sub edi, dword [esi + 0x18]
lea eax, [esi + 0x24]
test dx, 0
jne 0x1000d3ab
sub edi, dword [esi + 0x14]
test ax, 0
jne 0x10018b37
sub edi, dword [esi + 0x10]
call fcn.10016790
inc esp
shr byte [eax - 0x7df017a3], cl
pop ds
je 0x1001215c
add byte [0x10000000], bh
jbe 0x1000ca82
jbe 0x1000ed66
call fcn.100185a5
inc ebp
invalid
adc bl, 0xff
invalid

Function at 0x10011a31
Capabilities:
Encode data using base64
Get disk information

Disassembly:
call fcn.10018d3b
sub dword [eax], ebp
shr al, cl

Function at 0x10011ad0
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
call fcn.10011248
pop eax
je 0x10011a87
pop ebx
call 0xb6832a32
push eax
jb 0x1001568b
xchg ebp, ebp
jae 0x1001568b
push 0x100244e9

Function at 0x10011ade
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push eax
jb 0x1001568b
xchg ebp, ebp
jae 0x1001568b
push 0x100244e9
jmp 0x10017e14
mov eax, dword [esp + 4]
je 0x10012e2c
xchg cx, cx
jne 0x10012e2c
Function at 0x10011b9b
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edi, dword [edi]
jb 0x10013100
mov esi, esi
sub dword [esp + 8], ebp
jmp 0x1000e93b
mov ecx, dword [ecx]
jb 0x10013eac
popfd
jl 0x1001425a
mov cl, cl
jge 0x1001425a
sbb al, byte [edx]
add byte [eax], al
push ebx
je 0x100148fb
nop
jne 0x100148fb
jne 0x10011b91
jne 0x10015df1
call fcn.100189ef
jne 0x100103d5
mov eax, 0xc085e860
je 0x1000d50e
call fcn.1000db83
mov dword [0xe8e3bdf8], eax
add ebp, 0x6e5790ca
je 0x1000d914
xchg si, si
jne 0x1000d914
call fcn.100141ab
push ebx
inc ecx
out 0xd5, eax
call 0xb6882af2
push ebx
ja 0x10012848
mov di, di
jbe 0x10012848
jb 0x1000f154
and dword [esi + 4], 0
pop ecx
call fcn.100141ba
mov cl, 0xeb
mov eax, dword [0x7c8be83d]
and al, 4
jl 0x10015a5f
xchg edi, edi
jge 0x10015a5f
pop ebp
jl 0x10016704
mov cx, cx
jge 0x10016704
js 0x100119e5
xor eax, eax
call fcn.1000cfb0
sal byte [ebp - 0x39], cl
mov esp, 0x56fc68e8
neg byte [eax]
daa
loope 0x10014921
call 0x1425a58a
mov ebx, dword [esp + 4]
ja 0x10017ff1
mov sp, sp
jbe 0x10017ff1
push esi
call fcn.100185d9
outsd dx, dword [esi]
sub esi, dword [edx]
pop ecx
call 0xc4ed66e
call fcn.100185d9
jbe 0x100148f7
add byte [esi - 0x2d], dh
xor bl, byte [ecx - 0x18]
push 0x28
call fcn.10010720
inc byte [edx + 0x66e8039e]
test ecx, 0xc4e80000
mov ecx, 0x933cffff
js 0x100149b8
call 0x142595d1
jb 0x1000e6db
mov edi, edi
jae 0x1000e6db
test di, 0
call fcn.10017795
add ebx, dword [edx + 0x37]
pop edx
call 0xdc7ccb76
invalid
push ss
daa
wait
retf 0x8de8
mov edi, dword [edi]
ja 0x1000db0a
mov bl, bl
jbe 0x1000db0a
mov ecx, dword [esp + 4]
jp 0x10017dcd
mov ah, ah
jnp 0x10017dcd
call fcn.100105f3
lea esi, [esp + 0x20]
call fcn.10017e71
scasd eax, dword es:[edi]
dec ebp
inc ebp
mov ch, pe_nt_image_headers32
mov edi, dword [esp + 4]
jl 0x1000d373
nop
jge 0x1000d373
ret 0xe800

Function at 0x10011e82
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push eax
jp 0x10014ff9
xchg dh, dh
jnp 0x10014ff9
call fcn.10019407
call fcn.10013d59
retf 0x6a1a

Function at 0x10012069
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push edi
jl 0x1001619f
xchg sp, sp
jge 0x1001619f
mov edi, dword [esp + 4]
jo 0x1001623f
mov ah, ah
jno 0x1001623f

Function at 0x10012357
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov ecx, dword [esp + 4]
ja 0x1000dc8c
mov dx, dx
jbe 0x1000dc8c
mov ecx, dword [ecx]
jg 0x1000f763
push ecx
jb 0x1000cd7d
mov bp, bp
jae 0x1000cd7d
push esi
mov edx, ebx
call fcn.10018326
ret
Function at 0x1001253a
Capabilities:
Encode data using base64
Get disk information

Disassembly:
xor ebp, 0xc741ba5
jb 0x1001888a
xchg cl, cl
jae 0x1001888a
mov eax, dword [esp + 4]
jb 0x1001380b
mov ah, ah
jae 0x1001380b
js 0x10012d9f
test esi, esi
jne 0x1001642b
jne 0x1000e018
call fcn.10017544
ret 0xe861
mov ebp, dword [ebp]
jl 0x100175fc
mov dl, dl
jge 0x100175fc
lea esp, [edi]
xchg dword [eax], eax
add bh, bh
jo 0x1000eee0
push dword [eax + 8]
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
mov eax, dword [ebp + 0x20]
push dword [eax + 8]
and bh, bh
jo 0x1000eeec
push dword [esp + 0x1c]
push dword [ebp + 0xc]
call fcn.10018d5c
insb byte es:[edi], dx
sahf
add byte [eax], al
ja 0x1000eed0
mov bh, 0x38
call 0xa88ffe96
xchg dword [eax], eax
add byte [esi - 0x6f71f001], al
xchg dword [eax], eax
add byte [esi + 0x57], dl
push ebp
jp 0x1001304c
mov edi, edi
jnp 0x1001304c
add al, byte [eax]
add byte [eax], al
jmp 0x10012da7
mov ebp, dword [esp + 4]
je 0x1000eec4
mov esi, esi
jne 0x1000eec4
ret
call fcn.10017386
ja 0x1001644c
invalid
mov dword [ecx - 0x17fffffa], ebp
loope 0x10016442
invalid
pushfd
js 0x1000ddf7
mov edi, edi
jns 0x1000ddf7
call fcn.1001156f
call fcn.10017e71
lodsd eax, dword [esi]
mov cl, 0x45
mov ch, pe_nt_image_headers32

Function at 0x10012828
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push edi
jb 0x10014593
xchg esp, esp
Function at 0x100129e3
Capabilities:
Encode data using base64
Get disk information

Disassembly:
call fcn.1000d1db
inc ecx
dec edi
cmp esp, dword [edx - 0x723c3618]
jae 0x10012a26
mov dword [eax + 8], edi
call fcn.1001392f
mov eax, dword [ebp - 4]
sahf

Function at 0x10012aa8
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
ror byte [edi], 0x85
adc ebx, dword [eax + eax]
mov eax, dword [0x10024703]
call fcn.100141ab
ljmp 0x4689
pushfd
jg 0x10017247
push eax
jl 0x10013ebb
xchg dh, dh
jge 0x10013ebb
jnp 0x10014507
call fcn.1000d2ea
lodsb al, byte [esi]
mov byte [esi + 0x23], bh
call 0x95aeb33
pushal
lea eax, [ebp - 0x24]
call fcn.10012069
mov edi, 0xe8f9227b
push ebp
mov ebp, esp
add dword [esp + 8], eax
jp 0x10016614
mov ecx, ecx
jnp 0x10016614
push dword [esi]
call fcn.1000ee16
in eax, 0x1d
invalid
mov ch, ch
xor al, 0
add byte [esi - 0x1a76f037], al
xor al, 0
add byte [edi + ecx + 0x4f6382], bl
add byte [edi + 0x5b830fed], al
dec edi
add byte [eax], al
mov ebp, dword [ebp]
jg 0x10018356
mov bp, bp
jle 0x10018356
test ax, 0
jnp 0x100150e1
add esp, 0xc
push dword [esi + 0xc]
call fcn.1001156f
call fcn.10016874
daa
shr byte [esi - 0x24], cl
call 0x1e09b7e4
add byte [eax], al
call fcn.10012d9e
mov ecx, eax
call int.1000e95d
mov dword [eax + 0xe04], ecx
call fcn.100190d1
loopne 0x10012f0a
ret 0xe820
sub eax, 0xc7a1cf97
jg 0x10012dba
xchg dl, dl
jle 0x10012dba
je 0x1001889e
test bl, 0
js 0x10010767
xor eax, eax
inc eax
pop edi
ret
mov eax, dword [esp + 4]
ja 0x10014028
xchg edx, edx
jbe 0x10014028
sbb eax, eax
call fcn.100128de
mov al, byte [0xe845a8d0]
lea eax, [esi + 0x18]
push eax
call fcn.100197b5
insb byte es:[edi], dx
adc ebx, dword [edi]
call 0x101e01d3
add byte [esi - 0x6f], bh
aad 0x65
call 0xf80201eb
loop 0x10013f18
add byte [eax], al
insb byte es:[edi], dx
fiadd dword [ecx + 0x168e850]
pop dword [ecx]
adc al, ch
cmc
out dx, eax
invalid
push 0x104
lea eax, [ebp - 0x208]
call fcn.1001437c
aam 0x86
xlatb
call 0x10c83697
add al, ch
add esp, esi
invalid
mov eax, dword [eax]
jg 0x10014fb2
xchg bh, bh
jle 0x10014fb2
leave
ret
adc eax, 0x10024615
call fcn.10012aa8
and ah, byte [edi - 0x5f]
invalid
pushfd
jo 0x1001370e
xchg al, al
jno 0x1001370e
mov ebp, dword [esp + 4]
jg 0x10012f26
mov esp, esp
jle 0x10012f26
mov eax, dword [eax]
je 0x100123ea
xchg esp, esp
jne 0x100123ea
jne 0x10011032
jne 0x1001849f
call fcn.1000f602
and al, 0x12
ret 0xe886
retf 0x850f
pushfd
jmp 0x10015f88
invalid

Function at 0x10012efd
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
call fcn.1001669c
insd dword es:[edi], dx
xlatb
outsb dx, byte [esi]
mov esp, 0x880f9de8
in eax, dx

Function at 0x10013415
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov edx, dword [esp + 4]
push edx
jg 0x10011df4
xchg si, si
jle 0x10011df4

Function at 0x100136eb
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
jl 0x10014be8
mov sp, sp
jge 0x10014be8
mov ebp, dword [esp + 4]
jp 0x10015dbc
mov ah, ah
jnp 0x10015dbc
pop eax
jb 0x10017c34
mov ebp, dword [ebp]
Function at 0x10013cc5
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov ebx, dword [esp + 4]
jb 0x100127b9
xchg edx, edx
jae 0x100127b9
push ebx
je 0x1000ea28
mov ah, ah
jne 0x1000ea28
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
test ax, 0
jb 0x10011c4b

Function at 0x10013d49
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov ebp, dword [esp + 4]
jb 0x100110d2
xchg edx, edx
jae 0x100110d2
neg ecx
call fcn.100185a5
sbb byte [esi - 0x1717d172], bh
invalid
mov ebp, dword [ebp]
jo 0x10017b39
mov edx, edx
jno 0x10017b39
call dword [0x10023fe6]
call fcn.1000cdde
xor bh, dl
scasb al, byte es:[edi]
mov al, byte [0x8a7a9ce8]
push ebp
ja 0x1000ede0
xchg dx, dx
jbe 0x1000ede0
pushfd
jb 0x100189cf

Function at 0x10013e70
Capabilities:
Encode data using base64
Get disk information

Disassembly:
add byte [edx + 0x5ccfe816], cl
add byte [eax], al
jno 0x1000e4d4
add byte [eax], al
mov ecx, dword [esp + 4]
jp 0x10012866
xchg edi, edi
jnp 0x10012866
adc al, byte [eax]
add byte [edi], cl
and byte [esi - 0x7affff8a], 0xc0
jo 0x10018cdc
test eax, eax
jne 0x10012b47
jne 0x1000e550
call dword [0x10024331]
call fcn.10016b32
jmp 0x1001162d
push dword [edi]
test di, 0
js 0x10018c65
call fcn.1000db83
ret
push ecx
ja 0x1001161e
xchg cl, cl
jbe 0x1001161e
xor byte [ebp + 0x33ffffcd], 0xc0
test byte [edx - 0x7400006c], al
dec esi
add al, 0xe8
dec ebp
pushal
invalid

Function at 0x10013e9c
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edx, dword [esp + 4]
jb 0x10017344
xchg ah, ah
push edx
js 0x10011da2
xchg si, si
jns 0x10011da2

Function at 0x100141ab
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov ebp, dword [ebp]
jp 0x10011dc5
mov bx, bx
jnp 0x10011dc5
push ebp
jg 0x10015085
mov dl, dl
jle 0x10015085
mov ebp, dword [esp + 4]
jb 0x10010e0e
xchg dh, dh
jae 0x10010e0e
push 0x7ddb982e
push 0x23db33c8
mov edi, eax
call fcn.10014c49
mov ecx, dword [esp + 0x10]
call fcn.10016e87
sbb ah, bh
test eax, 0xe859e84a
pop es
pop es
add byte [eax], al
mov dword [0xe8070dff], eax

Function at 0x100141d9
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edi, dword [esp + 4]
jg 0x10014c0a
mov di, di
jle 0x10014c0a
push edi
jo 0x10012231
xchg bh, bh
jno 0x10012231

Function at 0x1001421d
Capabilities:
Encode data using base64
Get disk information

Disassembly:
mov edi, dword [esp + 4]
jmp 0x10010990
push edi
jp 0x100120f2
xchg si, si
jnp 0x100120f2

Function at 0x1001446b
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push ebp
jp 0x1000f4cc
mov si, si
jnp 0x1000f4cc
jo 0x10019400
cmp dword [esi + 8], ebx
call fcn.1000f602
inc ebx
sar dword [0xf9ce879], 0x82
lcall 0xfd2, 0x8bffffb3
adc dword [edx + 0x57ffffb3], 0xf
push edi
invalid
xchg dword [ecx - 0x5f], edi
invalid
Function at 0x1001449d
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
jp 0x1000f4cc
mov si, si
jnp 0x1000f4cc
jo 0x10019400
cmp dword [esi + 8], ebx
call fcn.1000f602
inc ebx
sar dword [0xf9ce879], 0x82
lcall 0xfd2, 0x8bffffb3
adc dword [edx + 0x57ffffb3], 0xf
push edi
invalid
xchg dword [ecx - 0x5f], edi
invalid

Function at 0x100144c0
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
mov ecx, dword [esp + 4]
js 0x10014b8f
xchg esp, esp
jns 0x10014b8f
cmp eax, edi
call fcn.10014bd9
fdivr qword [edi + esi*4 + 0x6f]
call 0x6b49360d
nop
push edi
call fcn.10014c49
mov dword [esi + 0xe0c], eax
call fcn.10017a25
lea eax, fs:[esi - 0x18]
call 0x1092a5a8
add byte [esi], bl
ficom dword [edi - 0x5e]
call 0x1068d734
add byte [eax], al
sub al, 0xe8
imul eax, dword [eax], 0
mov ch, 0xb7
mov eax, dword [0xe8c3e83d]
mov ecx, 0x6200008a
sub esp, ecx
jns 0x1000d5ca
dec esp
and al, 4
push ecx
ja 0x1000d583
mov dx, dx
jbe 0x1000d583
mov eax, dword [ebp + 8]
test ah, 0
call fcn.100149d9
add edi, eax
push ebx
mov dl, pe_nt_image_headers32
pop ebx
div ebx
test eax, 0
call fcn.10015dcd
and bh, al
js 0x100144ae
call 0xf809baf5
cwde
push eax
add byte [eax], al
push ebx
push ebx
mov bh, 0x57
call 0xf69ca90
invalid

Function at 0x10014858
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
mov ebp, esp
call fcn.100141ab
mov bl, 0x8b
out 0xd5, eax
call 0x200142ec

Function at 0x10014888
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push edx
je 0x100136be
xchg ebx, ebx
jne 0x100136be

Function at 0x100149d9
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push eax
js 0x1001793f
mov esp, esp
jns 0x1001793f

Function at 0x10014c7b
Capabilities:
Encode data using base64
Get disk information

Disassembly:
pushfd
js 0x1001471c
xchg dl, dl
jns 0x1001471c
mov eax, edx
ret
mov ecx, dword [ecx]
jb 0x1000cf69
mov bx, bx
jae 0x1000cf69
push dword [ebp - 4]
invalid
push ebp
mov ebp, esp
call fcn.10014888
lea esp, [0xfe8d7ba]
test dword [0x34fffff0], edx
aas
test eax, 0
jo 0x100145b8
call fcn.10010720
sub dword [eax], esi
popal
cld
call 0x1825a0d2
sub dword [esp + 8], edx
xchg esi, esi
jae 0x1001943b
mov ecx, dword [esp + 4]
jmp 0x1000e74e

Function at 0x10014dc6
Capabilities:
Encode data using base64
Encrypt data using speck
Get disk information
Get number of processors

Disassembly:
push edx
js 0x100173aa
mov eax, eax
jns 0x100173aa

Function at 0x10015073
Capabilities:
Encode data using base64
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, eax
call fcn.10018d3b
in eax, dx
test byte [edi - 0x2e], ah
call 0x1425bd14