joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10191d2c
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xc0fff1b4], al
jl fcn.10191d2c
add eax, 0x2444fe03
or eax, 0x3df81
add byte [eax], al
push 0xa297ea91
call fcn.10254b4e
mov edi, dword [esp + edi*2 - 0x6015ca20]
mov dword [esp + 0xc], esi
call fcn.100f3ef9
fcomp st(2)
push esi
and ebx, esi
mov dword [edi], 0x4e2e7ae8
push ecx
rcr dword [edi + 0x235af8cf], cl
cli
sbb eax, 0xb1e99019
out dx, al
inc esp
ficom word [edi + 0x2e]
leave
pushal
jo 0x10191d01
inc ecx
fld xword [edx + 0x33]
cld
push ebp
cmp eax, 0xe18354ce
cmp eax, 0x8c5c36b5
or al, 0x83
xor dword [ebp - 0xb], edx
dec edx
invalid

Function at 0x1019365b
Capabilities:
Packed with generic packer

Disassembly:
push esi
push ecx
mov ecx, 0x33a25709
push edi
movzx ecx, cx
mov esi, dword [esp + ecx - 0x56fd]
mov cl, 0x9a
pushfd
shr cx, cl
xor ecx, ecx
mov edi, 0xa5168f1d
shl cx, 0x71
lea esi, [esi + ecx*4 + 1]

Function at 0x10193f3d
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x28], 0x82a98f19
shr word [esp + 0x10], 0x83
seta byte [esp + 0x10]
call fcn.1010eaf5
lea esp, [esp + 0xc]
jmp fcn.101bfa4c
cmp byte [esp + ebp*2 + 0x239b00f6], 0x3c
call fcn.101979b2
not byte [esp + 0x10]
add dword [esp + 0x28], 0x5a060b0a
mov dword [esp + 0x34], edi
jo 0x10125705
or byte [esp + 0x10], 0x2b
jle 0x100a3f5f
jmp 0x101b80cc
lea esp, [esp + 0x18]
jmp fcn.100aa4cf
jmp 0x101af002

Function at 0x10198c0f
Capabilities:
Packed with generic packer

Disassembly:
not edi
push 0xd80edb6
not byte [esp + 7]
mov dword [ebp], edi
call fcn.10108069
btr dx, dx
inc al
mov dword [esp + edx*4], 0x8bafdf2b
xor bl, al
shl dx, 0xa6
lea eax, [esp + eax + 4]
js 0x101439b1
and dx, 0xb59d
lea edx, [edx*4 + 0x7a71b92]
movzx dx, byte [edx + eax - 0x7a71b92]
push 0xc3145cab
jo fcn.101af011
jae 0x1020a75c
sbb ebp, 2
mov word [ebp], dx
push 0xba1fe81
lea esp, [esp + 0xc]
jmp fcn.1018295a

Function at 0x1019a392
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ebx*2 + 0x5d3c1a1c], 0x39358c9e
mov word [esp + ebx + 0x2e9e0d12], 0xceaa
mov byte [esp + ebx*2 + 0x5d3c1a1c], 0x17
xor word [esp + ebx*2 + 0x5d3c1a2c], 0x2481
or ebx, ebx
cmovo bx, word [esp + ebx + 0x2e9e0d23]
mov ebx, dword [esp + ebx + 0x2e9e0d1e]
add dword [esp + 8], 0xc4027c9b
mov byte [esp + 8], 0xa3
call fcn.101f3a0b
ja 0x1019a399
sahf
invalid
push esp
into
add edi, dword [esi - 0x1aa079f4]
adc ch, cl
aaa
in eax, dx
push eax
cli
sbb esp, dword [eax + 0x6f]
inc esp
push 0xffffffffffffffbc
salc
call [ebx]
or ebp, dword [edi]
inc eax
xchg edx, eax
popfd
pop ecx
aam 0x7d
jnp 0x1019a429
xchg esp, eax
adc dword [ecx + 0x4c45c8f2], 0xc6c59095
sub dword [ebx], ebp
retf
mov ch, 0x2f
mov bh, 0x88
neg dword [eax + ebx*2 + 0x1e1bb32c]
mov ecx, 0x39d51629
xchg ecx, eax
xchg esp, eax
test al, 0xae
mov ah, 0x6c
in al, dx
push 0x724eea8c
xchg edi, eax
out dx, al
aam 0xc
xchg ebp, eax
test byte [ecx], ah
lodsd eax, dword [esi]
add eax, 0x536d0903
mov bh, 0xe2
mov edi, 0xd4d31067
test eax, 0x9fb9c662
and esp, ecx
invalid
Function at 0x1019b5ba
Capabilities:
Encode data using xor

Disassembly:
mov ebp, edx
cmp bp, word [esp + 4]
push 0x4ab1c72b
mov ebp, dword [esp + 0x24]
mov ebp, dword [ebp]
ja 0x100fa6c6
jg fcn.10200d4a
shl word [esp], 0xef
je 0x101a77b5
shr edx, 0xd1
lea ebp, [ebp - 0x15db4249]

Function at 0x1019ba02
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + ebx*4 - 0x705ef850]
shr ebx, 0x6c
push ebx
pop edi
lea ebx, [ebx + ebx*8 + 0x7baeccae]
lea ecx, [ecx + edi*8 - 0xe0bd7]
xor di, 0x3e39
jns 0x10119019
neg bx
setl bl
mov dword [esp + ebx - 0x7bbe64e0], ecx

Function at 0x101a09e8
Capabilities:
Encode data using xor

Disassembly:
or dword [esp + 8], 0x8033f98a
lea ecx, [ecx + 1]
add dword [esp + 8], 0x5b3f369c

Function at 0x101a1260
Capabilities:
Packed with generic packer

Disassembly:
push 0xc125859d
neg edx
rol edx, 2
neg byte [esp + 0x16]
ror dword [esp + 9], 0x9a
push 0x3390990b
not edx
js 0x1021f8f3
mov dword [esp + 8], 0xf8873f8a
jnp 0x1018ae5b
bswap edx
dec edx
xor edx, 0x3e1b223f
push 0x47251321
dec edx
call fcn.1011cfbc
mov edx, 0x3a9b612a
rol edx, 0x14
mov ecx, dword [edx + ebp - 0x12a3a9b6]
mov esi, edx
lea edi, [edx + esi - 0x784fe257]
lea ebp, [edx + ebp - 0x12a3a9b2]
jb 0x1009f7bb
cmpsd dword [esi], dword es:[edi]
salc
out dx, eax
invalid
shr edx, 0x12
mov esi, ecx
movzx eax, di
jb 0x1014e4de
jae 0x1021f911
and al, 0xd2
invalid

Function at 0x101a4d66
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp], 0x8c074
xor byte [esp + ebx*2 - 0x4465595e], 0x38
cmp edi, 0x281eadbe
setl byte [esp + 4]
shr word [esp + 8], 0xde
je 0x101467fc

Function at 0x101aa66c
Capabilities:
Encode data using base64

Disassembly:
cmp dword [esp + 0xc], 0x38dd837
sets byte [esp + 0x2c]
test dword [esp + 0x18], 0x92cce3f
call fcn.101d8075

Function at 0x101aa686
Capabilities:
Encode data using base64

Disassembly:
neg ebp
call fcn.101edc33
call fcn.101955ac
pop es
mov edx, 0x6c8b58b5
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp + edi - 0x5703accf]
mov edi, 0xd730b484
shr edi, 0x77
mov di, 0x3d3d
xor dword [esp + edi - 0x3d35], 0xe5b58c25
sub dword [esp + edi - 0x3d39], edi
and byte [esp + edi - 0x3d35], 0x2e
lea ebp, [ebp + edi - 0x7bd68c2b]
shr edi, 0x48
mov dword [esp + edi - 0x2d], edi
jns 0x10198f7f
jmp [eax - 0x5c]
sub dword [esp + edi*2 - 0x6a], edi
call fcn.101fe094
push esp
stc
jns 0x10198fb3
jp 0x10198f70
mov bl, 0xe6
mov edx, 0x5c0cf177
adc dword [ecx + 0x44], esp
sar dword ss:[edi + 0xdf2cf9a], cl
fidiv word [eax]
xchg esp, eax
mov ebp, dword [edi - 0x3a50e647]
out 0xec, eax
xchg ebp, eax
lodsb al, byte [esi]
mov esp, 0x69010c9d
mov bl, 0x68
pop eax
fidiv dword [ebx]
mov cl, 0xac
add dword [ecx - 0x4d], ebp
push 0xb133da58
lodsb al, byte [esi]
insb byte es:[edi], dx
jmp 0x45660ad4
add esi, 0xa1841c2d
add dword [esp + esi + 0x71d55ec7], 0xefdf01f3
mov esi, dword [esp + esi + 0x71d55ecf]
mov esi, dword [esi]
call fcn.100a4c54
jb 0x1016ecf1
neg dword [esp + 0x24]
setbe byte [esp + 0x24]
jge fcn.10191c5a
test dword [esp + 0x20], 0xd93b9f8a
not dword [esp + 0x20]
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x38]
ret
Function at 0x101ace30
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x1935ccba
adc ebp, 2
mov word [ebp], ax
lea esp, [esp + 4]
jmp fcn.100aa4cf

Function at 0x101ade5c
Capabilities:
Packed with generic packer

Disassembly:
push ecx
lea edi, [edi*2 + 0x1784ae95]
jno 0x10127525
jno 0x101a0d50

Function at 0x101af60f
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
shl ecx, cl
shr edx, 0x37
mov edi, dword [esp + 0x28]
neg dword [esp + 0xc]
ja fcn.101e810a
test byte [esp + 0x10], 0xba
js 0x101da596

Function at 0x101b2b58
Capabilities:
Encode data using base64

Disassembly:
neg dword [esp + 8]
add dword [esp + 4], 0xeff0a51f
shl word [esp + 8], 0x5b
mov dword [esp + 0xc], ebp
lea esi, [esi - 0x5ece44f7]
shr ebp, 0xf8
sub ebp, ebp
cmp dword [esp + ebp*2 + 8], 0x39bee27
jns fcn.101892be
xchg dword [esp + ebp + 0x18], esi
mov ebp, dword [esp + ebp*2 + 0x10]
mov dword [esp + 0xc], 0x7183b98a
call fcn.1010a4c4

Function at 0x101b3b7c
Capabilities:
Packed with generic packer

Disassembly:
cmp al, ch
inc esp
adc eax, 0x535b000d
pop ebx
push ebx
pushfd
mov ebx, 0xa61f9a19
push esi
mov esi, 0x1fb4ff9a
call fcn.101f002a
jae 0x10257f44
jmp 0x10252a89
ja 0x100cef21
cli
shr ecx, 8
xor ecx, esi
or dword [esp + 6], 0x69ad0799
sbb byte [esp + 1], 0xe
inc edi
xor ecx, 0x4a8485a7
push 0xa32ec2b1
dec edx
call fcn.1012580a
call fcn.10220d07
scasb al, byte es:[edi]
lcall 0x769f, 0x5498f5de
sbb edi, 0xffffffa4
sar byte [esi + 0x572c8035], cl
push ds
adc ebp, dword [edi + 0x6dc6da0c]
fcmovb st(0), st(6)
insd dword es:[edi], dx
dec eax
in al, 0xd7
dec ebx
ja 0x100cef7c
inc edx
out 0xed, al
sbb byte [edi + ecx + 0x7d940e8d], dh
pop eax
cmpsd dword [esi], dword es:[edi]
adc bl, dh
out dx, eax
mov ebx, 0x2c62317c
inc esi
sal dword [ecx], 0xe6
jg 0x100cefe4
in al, dx
out dx, eax
lodsd eax, dword [esi]
push 0xffffffffffffffb2
xchg ebp, eax
in al, 0x69
bsf edx, dword [edi]
and ecx, ebp
out dx, al
aas
add al, 0x17
movsb byte es:[edi], byte [esi]
add byte [edx], 0xb5
test dword [ecx - 0x1ec81302], ecx
inc esp
nop
sub ebx, ebp
push ecx
mov edx, 0xd99073bf
cld
loopne 0x100cefbe
in eax, 0xb9
adc bh, byte [edi + 0x1c519873]
add bl, bl
or eax, 0xfbb77a91
invalid
mov dword [esi], edx
call fcn.10162b6c
inc ecx
mov dword [esi], edx
jmp 0x100cefa4
jmp 0x100d7ebf
mov dword [ebp], edi
jmp 0x101837d0
not cl
not al
mov dword [esp], 0xd51fcdae
call fcn.10202d7c
call fcn.1023e457
mov ecx, 0xb61a24a2
mov ecx, dword [esi]
mov eax, 0xe40eca16
ror ax, 0x64
xchg ah, al
mov eax, dword [esi + 4]
adc esi, 8
mov dword [ecx], eax
jmp fcn.100019eb
je 0x100eaee3
add ebp, 2
jmp 0x10154c56
push 0xea0b98f
jmp 0x1015158f
pushfd
pop edi
mov dword [ebp + 4], ecx
jmp 0x101ba6a1
call fcn.101732a6

Function at 0x101b8b79
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [esp + ecx - 0x37b136b0]
mov ecx, dword [ecx]
not dword [esp + 8]
call fcn.101af9b1
jl 0x101475bf
add dword [esp], 0xfffdffcc
mov ecx, dword [esp + 4]
add word [esp + ecx - 0x37b136a8], 0xde81
mov byte [esp + ecx - 0x37b136ac], ch
sub word [esp + ecx*2 - 0x6f626d58], cx
jl 0x1015200d
Function at 0x101b9428
Capabilities:
Packed with generic packer

Disassembly:
adc ebp, 4
jmp 0x1010cc2f

Function at 0x101b9812
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + eax - 0x278582b4]
mov eax, dword [eax + ebx + 0x2deb72d1]
mov bl, 0xab
jge 0x1011c723

Function at 0x101b9c7f
Capabilities:
Check for software breakpoints
Packed with generic packer

Disassembly:
bswap edi
mov di, 0x9512
lea eax, [eax + ebx + 0x4475ff4e]
neg ebx
add dword [esp], 0xfff74cf3
add edi, 0xfc3de2b8
push edi
mov bl, 0x23
add byte [esp + edi - 0x4c077ca], 0x38
call fcn.1015d890

Function at 0x101bd546
Capabilities:
Packed with generic packer

Disassembly:
jns 0x101eb6eb
call fcn.101603de

Function at 0x101bfe9a
Capabilities:
Packed with generic packer

Disassembly:
cmp word [esp + ebx*2 - 0x68070c48], bx
jo 0x101f53e8
test ecx, ecx
call fcn.101d0c54
mov dword [esp + ebx - 0x7c3583ae], edx
lea esi, [esi - 0x27567ed1]
add dword [esp + ebx - 0x7c3583be], 0xefed4b12
push edx
push ebp
mov byte [esp + ebx - 0x7c3583b2], bl
sub dword [esp + edx*8 + 0x1f635b88], 0xc0250b30
mov ebp, dword [esp + ebx - 0x7c3583b2]
xchg dword [esp + ebx - 0x7c35839a], esi
mov ebx, dword [esp + ebp - 0x7c3583ae]
sub word [esp + edx + 0x3ec6b86], bp
call fcn.1011cb2e

Function at 0x101c39fe
Capabilities:
Authenticate hmac

Disassembly:
sub ebp, 2
push 0xe00e2b11
call fcn.101235bf
xor dword [esi], edx
xor dl, byte [eax + 0x68]
push 0xc504c2a1
lea esp, [esp + 0x10]
jmp fcn.1018295a
pop edi
call int.100de6ec
jmp 0x1016903e

Function at 0x101c5267
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, 0xf317dd86
movzx bx, byte [esp + ebx*4 + 0x33a089fc]
mov byte [esp + ebx*2 + 0x19d1ff26], 0x12
lea edx, [edx + ebx - 0x3b6614d2]
jo 0x1024c48e
test ebx, 0xc5992f8d
js 0x10102758
mov ebp, dword [esp + 8]
mov ebp, dword [ebp]
setno bl
mov dword [esp], ebx
call fcn.1022f788
syscall
call fcn.10126736
mov dword [esp + 0x1c], ebp
xchg dword [esp + ebx*2 + 0x19d1ff42], edx
mov ebx, dword [esp + 4]
jle 0x101d0fa2
mov ecx, 0x820f2935
mov edi, dword [esi]
mov ecx, dword [esi + 4]
call fcn.102300e8
mov word [esp + 1], 0xb13b
lea esp, [esp + 4]
jmp fcn.101bfa4c
call fcn.101625d4
pop ebp
salc
xor al, 0xea
jnp 0x1018825b
into
mov word [ecx - 0x7d], ds
shr dword [ecx - 8], cl
jmp 0x10188249
outsd dx, dword [esi]
pop edi
popfd
mov dl, 0x12
cdq
mov bl, 0x66
lodsb al, byte [esi]
cld
inc edx
ror eax, cl
dec eax
popfd
dec ebx
sbb ecx, ecx
leave
pop eax
pop ds
jmp 0x56dce0ee
add ebp, 0xbb03721e
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
js fcn.1016b54e
add ebp, 0x4a152901
jno 0x101026eb
jno 0x10201525
mov edi, dword [esp + ecx + 0x6f460a71]
xor word [esp + ecx + 0x6f460a4d], 0x3db3
add word [esp + ecx + 0x6f460a65], cx
jb 0x10188217
call fcn.101776c2
mov ecx, 0x430423aa
mov ebp, dword [ecx + edi - 0x430423aa]
and cx, 0x6cab
bt ecx, ecx
mov ecx, dword [edi + ecx - 0x430420a6]
push 0xc93f9013
or byte [esp + 3], 0
adc edi, 8
mov dword [ebp], ecx
jmp 0x10138836
ret
Function at 0x101c56ef
Capabilities:
Authenticate hmac

Disassembly:
add ecx, 0xf0274cba
add dword [esp], 0x1ae87d
test esi, 0xca2e2c14
jg 0x10219636
call fcn.10191951
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
mov dword [ecx], edx
push 0xbe860f09
push 0x4c24980b
lea esp, [esp + 8]
jmp fcn.1011bbab

Function at 0x101c6bb1
Capabilities:
Packed with generic packer

Disassembly:
mov byte ss:[edi], cl
call fcn.10129d10
sysenter
push ebx
pushfd
mov dword [esp + 4], 0x755fb2d1
lea esp, [esp + 4]
call fcn.101c11f8
daa
xchg dword [ebp + 0x4cce9e40], edx
invalid
jle 0x1015d917
jg 0x101d2d19

Function at 0x101cc3cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx*2 + 0x44c508c0], 0x819e2880
add edx, dword [esp + edx + 0x22628488]
shr byte [esp + edx*2 + 0x2b2ae8e], 8
mov ecx, 0x79390803
mov ecx, dword [esp + edx + 0x1595753]
jns 0x1021cc12

Function at 0x101cc8ab
Capabilities:
Packed with generic packer

Disassembly:
test word [esp + edi - 0x789ff11b], di
xchg dword [esp + edi - 0x789ff113], eax
lea edi, [edi + edi*4 + 0x39197d89]
mov di, 0x9131
js 0x10116223

Function at 0x101cc8f3
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
setl byte [esp + ebp - 0x68191705]
sub ebp, ebp
add dword [esp + 0x18], 0xffe7e6e4
and byte [esp + ebp*2 + 0xc], 0xa3
mov esi, dword [esp + ebp*8 + 0xc]
mov ecx, ebp
and ecx, esi
call fcn.101cb5ba
push ebp
mov ebp, 0x68191711
push 0xdd27a9ad
lea esi, [esi + ebp - 0x68191710]
not dword [esp + ebp - 0x68191711]
push ebp
pushfd
cmp word [esp + ebp - 0x6819170d], 0x92a2
not dword [esp + ebp - 0x6819170d]
push esi
mov dword [esp + ebp - 0x681916f1], esi
push ecx
jb 0x100b23d8

Function at 0x101cd798
Capabilities:
Encode data using base64

Disassembly:
push edx
je 0x101fc0a1
shl byte [esp + 0x10], 0x23
xor dword [esp + 0x18], 0xfeb39535
add dword [esp + 0x1c], 0xfffc4584
mov dword [esp], 0xaf2452b6
call fcn.100f2c6f
inc cx
push cs
cmp ecx, dword [edx + 0x69]
sub cl, byte [edi]
dec esi
or ebp, dword [edx + 0x33]
push es
dec ecx
push ds
sub dword [esi + 9], edx
cmpsb byte [esi], byte es:[edi]
lds ebx, [edi]
cli
nop
pop ecx
cmp ecx, eax
out 0x80, al
push cs
dec edi
xchg esp, ecx
invalid

Function at 0x101cddbe
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov di, word [esp + edi - 0x77]
lea esi, [esi + 0x21251a1]
lea ecx, [edi + edi + 0x548d0d91]
add byte [esp + edi*2 - 0xee], 0x93
jle 0x101facb7
neg edi
bswap ecx
xchg dword [esp + 0x2c], esi
mov edi, dword [esp + 0x28]
test word [esp + 0xc], cx
mov cl, 0x92
jbe 0x1023d467
neg word [esp + 0xc]
call fcn.100a5e4d
call fcn.100a4d57

Function at 0x101cf355
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.100aa4cf
Function at 0x101d2f7f
Capabilities:
Encode data using xor

Disassembly:
push ecx
add dword [esp + edx + 0x40210008], 0xefea1d8d
mov ecx, edx
add dword [esp + edx + 0x4021000c], 0x8a2f2
mov eax, 0x5f271c2c
push edi
mov eax, dword [esp + ecx + 0x40210028]
mov eax, dword [eax + edx + 0x40210000]
mov dword [esp + ecx + 0x40210028], edx
not word [esp + edx + 0x40210014]
mov edi, 0x43186721
push ecx
push 0x592cbb9
shl cl, 0x5f
js 0x10195486
lea eax, [eax + 0x4432c02a]
xor dword [esp + edi - 0x43186705], ecx
neg dword [esp + edx + 0x40210000]
cmp dl, byte [esp + ecx + 0x40210000]
jle 0x1020c370

Function at 0x101d5311
Capabilities:
Encode data using xor

Disassembly:
movzx esi, byte [esp + ebp + 0x36204027]
xchg dword [esp + 0x34], eax
mov esi, dword [esp + 0x2c]
lea edx, [ecx + ebp + 0x65a5e890]
mov edi, 0x88b0a823
and edi, 0xa3011727
ja 0x100ef9a6
invalid

Function at 0x101d68e2
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
je 0x101842cc
mov word [ecx], dx
push 0xb624a80d
jp 0x101403fb
sal word [esp + 0xc], 0xe3
adc cl, 1
mov dword [esp + 4], 0xef3cf83e
shr word [esp + 0xc], 0x48
and dword [esp + 4], 0x5681b534
xor bl, cl
jmp 0x101ee67a
sal byte [esp + 0xf], 0x86
push 0x6f3fa286
lea ecx, [esp + ecx + 0x18]
jp 0x100e8238
mov ecx, 0x10304717
movsx eax, cl
mov eax, dword [ecx + edi - 0x10304717]
btr cx, cx
setae cl
setae cl
mov cl, byte [edi + ecx*2 - 0x20608dfe]
call fcn.10188960

Function at 0x101d9283
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
add dword [esp + ebx - 0x2010b8f5], 0xfff9400a
call fcn.100d3144

Function at 0x101db89c
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
ror edi, 2
dec edi
jmp 0x10209f5f
xor edi, 0x3e1b223f
sar word [esp + 6], 0xce
mov dword [esp + 4], 0x79797ae
xor edi, ebx
not dword [esp + 8]
jmp 0x1018fc41
dec dword [esp + 8]
not edi
neg edi
rol edi, 2
push 0x8e19e816
mov dword [esp + 4], 0x5595c4b9
sal dword [esp + 1], 0x44
not edi
adc byte [esp + 0xc], 0xa4
bswap edi
dec edi
jmp 0x101a4ced

Function at 0x101dbab1
Capabilities:
Authenticate hmac

Disassembly:
pop ecx
push 0x55344f27
push ecx
push ebp
pushfd
mov ecx, 0x5787bf86
push edi
mov ecx, dword [esp + ecx - 0x5787bf7a]
xchg dword [esp + 0x14], ecx
or dword [esp + 0x10], 0x32330e3c
mov dword [esp + 0xc], 0xed073c99
mov ebp, 0x46a909bd
bswap ebp
mov dword [esp + 0x10], ecx
mov edi, ebp
seto byte [esp + 0xc]
bswap ebp
lea ebp, [edi + ebp*2 - 0x6503859]
jb 0x1012db48
call fcn.100ebe9b
Function at 0x101dbb01
Capabilities:
Packed with generic packer

Disassembly:
or cx, 0xa6b8
push ebp
shr edi, 0xd3
jb 0x1016e7b6
mov edx, ecx
mov eax, dword [esp + ecx + 0x2d]
mov eax, dword [eax]
mov cx, dx
shr byte [esp + ecx*4 + 0x24], cl
call fcn.100db653
lea ecx, [ecx - 0xe7897ec]
mov dword [esp + 4], 0x9ab1e2bb
not word [esp + 4]
sub byte [esp + 4], 0xba
or byte [esp + 4], 0x1a
mov word [esp + 4], 0x1616
not dword [esp + 4]
call fcn.10218bf6
push edx
call fcn.1013c166
not byte [esp + 0x1c]
push 0x6d999a20
mov edi, dword [esp + 0x28]
mov edi, dword [edi + esi + 0x775c97f7]
js 0x1013edee
mov dword [esp + 0x28], ebp
push ebx
jge 0x10109f28
jle 0x10213a35
call fcn.102211dd

Function at 0x101dbb2c
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
pushfd
test dword [esp + 8], 0xee2716ac
not word [esp + 8]
push ebx
xchg dword [esp + 0x10], edi
not dword [esp + 0xc]
mov ebx, 0x8a225007
mov dword [esp + 0xc], edi
ja 0x10203f4f
cmc
mov eax, 0xec95bce1
mov ecx, 0xc9b299fa
in al, 0x9d
fidiv dword [ebp + 0x4ffaadfa]
aam 0x1f
add dl, bl
or esp, dword [eax - 0x70]
lahf
and dword [edx], eax
invalid
lea ebx, [ebx + ebx*8 + 0x14038c0c]
setno bl
add dword [esp + ebx + 0x10c7a407], 0xffeba35f
nop
push esi
call fcn.1021335d

Function at 0x101ddfc3
Capabilities:
Authenticate hmac

Disassembly:
pop eax
push ecx
mov ecx, 0x5d03e09c
pushfd
or cx, 0xa42f
call fcn.1013c0fb
mov word [ebp], di
call fcn.1020d9fa
mov edi, 0xb8b97b89
lea edi, [edi*4 - 0x70731a49]
dec di
mov edi, dword [esi + edi - 0x7272d3da]
add esi, 4
push 0x402a9e26
push 0x91096ca2
xor edi, ebx
mov word [esp + 4], 0xf38b
jmp 0x102083a7

Function at 0x101e024a
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x10], edi
call fcn.101604b0

Function at 0x101e085a
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
push 0x818c0a12
call fcn.100ee9a1
inc bp
movzx ebp, byte [esi]
inc ecx
mov ecx, 0xf626e6a6
inc ecx
dec ecx
inc ebp
mov cl, byte [esi + 2]
push ebx
push ecx
pushfd
mov ecx, 0xf51a9432
push 0xb6a2f32a
or cl, 0x3b
test cx, 0x153d
push ebp
mov ebx, dword [esp + ecx + 0xae56bd9]
movsx ecx, byte [esp + ecx + 0xae56bc9]
setge cl
shl cl, cl
lea ebx, [ebx + 1]
jl 0x101fef52
test word [esp + 4], 0xe82a
jno 0x101d0824
or bl, byte [ebp - 0x2d]
mov ecx, 0xb5e4c2eb
mov word [ebx + 6], fs
sub edx, edi
xor eax, 0x5e58312f
outsd dx, dword [esi]
pop eax
sub dword [edi + 0xe], ebx
and dh, byte [ecx + 0xf8d2ae]
sub eax, esp
movsd dword es:[edi], dword [esi]
daa
push edx
invalid

Function at 0x101e1998
Capabilities:
Packed with generic packer

Disassembly:
je fcn.101fa59a
push 0x70862228
xor dword [esp + ebp - 0x5b962f5], 0xafae9222
call fcn.101f08e3
Function at 0x101e1de1
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Packed with generic packer

Disassembly:
mov word [ecx], ax
not byte [esp + 0x14]
lea esp, [esp + 0x18]
jp fcn.101e7fb3
push edi
mov esi, edi
and word [esp], 0xf031
push edi
push 0x88bcf58c
mov edx, dword [esp + 0x24]
mov edx, dword [edx]
and word [esp + 0x1c], 0x3cbb
not dword [esp + 8]
seta byte [esp + 0x1c]
shr dword [esp + 0x1c], 0x3d
mov dword [esp + 0x24], edi
lea edx, [edx + 0x2ba40695]
not esi
shr byte [esp + esi - 0x4f04e508], 0xa7
push ebx
xchg dword [esp + 0x34], edx
mov esi, dword [esp + esi - 0x4f04e50c]
mov ebx, 0x2e00d4a3
sub bl, bl
xor word [esp + 4], 0x9d99
add word [esp + 8], 0x2b27
cmovae bx, word [esp + 0x21]
xor dword [esp + ebx - 0x2dffffd8], 0xe3affa37
mov ebx, dword [esp + ebx - 0x2e000000]
call fcn.1017cb86
retf 0x8570
ja 0x10101ed2
shr ecx, 0x82
mov ecx, dword [ebp + ecx*2 - 0x71d97b4a]
mov dword [esp], 0x7202232d
call fcn.101df634

Function at 0x101e600e
Capabilities:
Packed with generic packer

Disassembly:
push edi
mov edx, dword [esp + 0x14]
push 0xa97a3be
push ecx
mov edi, dword [esp + 4]
lea edx, [edx + 1]
mov ecx, 0x9b091394
cmovo bp, di
test ebp, 0xc508e5b4
mov edi, dword [esp + 4]
push esi
mov esi, 0x8334d87

Function at 0x101e730d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 8]
push edx
mov edx, dword [esp + ebx*8 - 0x406bcf3c]
xor ebx, 0xa088e106
setl dl
call fcn.101892be
cmpsd dword [esi], dword es:[edi]
inc ebp
dec ebp
cli
add cl, 0x26
cmpsb byte [esi], byte es:[edi]
dec ecx
xchg esp, eax
aaa
inc ebp
sbb bh, ah
push edi
fadd dword [ebp + 0x55]
in al, dx
mov edi, 0xc5028d36
mov ch, 0xa4
pop edx
mov dh, 0x7c
invalid
pop eax
push 0x300a7aaa
pushfd
neg dword [esp + 4]
sub dword [esp + 4], 0xafbf9db2
push ebx
shr dword [esp + 8], 0x62
xchg dword [esp + 0xc], eax
jns 0x101da836
mov dword [ebp], edx
mov ebx, dword [esp + 0x18]
call 0x1018f6b7
inc edx
neg byte [0xc97cf78b]
mov esi, edi
jl fcn.101e730d
test dword [esi], esp
dec edi
out dx, al
xor eax, 0xc9d45fa3
and eax, 0xe67abf76
jge 0x101e7340
lahf
xchg esp, eax
imul eax, ebp, 0x66dabf76
int 0xbb
mov edi, 0xbbcd66da
fbstp tbyte [ecx + edi]
push es
adc dword [0x8c4ec497], ebp
loope 0x101e735a
mov ebx, 0x8462317c
imul dword [ebx]
in eax, 0x26
xchg ebp, eax
mov bl, 0x43
xchg esp, eax
sbb eax, 0x966dee40
add byte [ecx + 0x17], ah
salc
cmp eax, dword [ebp - 0x1a]
invalid

Function at 0x101e957f
Capabilities:
Packed with generic packer

Disassembly:
jne 0x100dd2a9
and bh, ch
adc ah, byte [esi - 0x64]
inc edi
movsb byte es:[edi], byte [esi]
invalid
je 0x101a9183
call fcn.10253e4c
add word [esp + 6], 0x8904
ror al, 1
dec eax
shl dword [esp], 0x24
inc al
call fcn.101bfe33

Function at 0x101ec0c5
Capabilities:
Packed with generic packer

Disassembly:
pop eax
mov eax, dword [ebp]
call eax
mov ebp, dword [ebp - 4]
mov ebx, 0xa908d32b
mov dword [ebp], eax
jmp 0x101f1b49
push ebx
mov dword [esp], ebx
mov ebx, dword [esp + 4]
mov edi, dword [esp + 8]
jmp 0x1021c5fe
lea esp, [esp + 0xc]
jmp fcn.100aa4cf

Function at 0x101ed328
Capabilities:
Packed with generic packer

Disassembly:
jge fcn.10154c67
push edx
shr si, 0xe7
push ebp
call fcn.10186110