joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b927c
Capabilities:
Encode data using xor

Disassembly:
call fcn.101f1297
int3
mov esi, 0xe6ad2d96
neg esi
mov dword [esp + 0xc], 0xb52a32cf
mov esi, dword [esp + 4]
jne 0x10256bde
jmp 0x7cc5f8a5
jno 0x100a5f1a
invalid

Function at 0x101bd5e2
Capabilities:
Encode data using xor

Disassembly:
add word [esp + edx - 0x70ba37b3], 0x6fb9
or edi, edx
lea edx, [edx + edx + 0x41a76589]
lea edi, [edx + edx - 0x76805ff7]
bswap edi
sub dword [esp + edi*2 - 0x6e956f86], 0xfebf4e17

Function at 0x101c1e89
Capabilities:
Execute syscall

Disassembly:
je 0x1013207f
not dword [esp + 4]
jbe 0x101deafd
cmp word [esp + 4], 0x79a4
push edi
push ecx
add dword [esp + 8], 0xfffcccff
push ebp
mov eax, 0xacb98f03
mov edi, dword [esp + eax + 0x5346710d]
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ebp, 0xa00dc2af
xor ebp, dword [esp + 0x10]
not word [esp + 0x10]
call fcn.101b0f0d

Function at 0x101c5107
Capabilities:
Packed with generic packer

Disassembly:
movzx bp, byte [esp + ebp + 0x659e71ce]
mov ebp, dword [esp + ebp + 0x659f002c]
jne 0x101ff7e8
add dword [esp + 0x30], 0x2993a1a5
js 0x10265c03
cmp dword [esp + 0x30], 0x4cbbd03f
push dword [esp + 0x38]
popfd
lea esp, [esp + 0x40]
ret
sub dword [esp + 0x1c], 0xb58944a0
xor ebx, ebx
lea ebp, [ebp + ebx*8 - 0x52d042c1]
cmp byte [esp + ebx*2 + 0x1c], bl
not byte [esp + ebx*8 + 0x1c]
mov ebx, ebp
jg 0x1025c6d6
or byte [esp + 0x1c], 0x9f
jns 0x1026bf5c
shr dword [esp], 0xa4
call fcn.101a2cb3
call fcn.102654cb
Function at 0x101c651b
Capabilities:
Encode data using xor

Disassembly:
jbe 0x1027b59f
push esi
add dx, 0xae30
call fcn.101f42d1
jns 0x101d96d6
shl dword [esp + ebp - 0x779fba09], 0xb8
mov ebp, dword [esp + ebp - 0x779fba1d]
not byte [esp + 0x20]
and byte [esp + 0x28], 0x89
cmp byte [esp + 0x28], 0xa6
call fcn.100dd847
xor dword [esi - 0x58], eax
adc eax, dword [ebp - 0x535db115]
or esi, dword [ebp - 0xf59d1d5]
add dword [ebp - 0x47d1f9ad], 0x53
test dword [edx], ecx
add eax, dword [0x7f0c689c]
push cs
dec esi
sub dword [eax - 0x5889a8], ebp
mov cl, 0x57
mov al, byte [0x4edf91e1]
sahf
and byte [edx + 0x5d], dh
mov ch, 0xca
ja 0x1022591c
popfd
mov dl, 0xdc
or bl, byte [edi - 0x19]
rol dword [esi], 1
pop edi
out 0xd1, eax
push es
fcom dword [edx]
outsd dx, dword [esi]
out dx, eax
test eax, 0xb0694e2
aas
loop 0x102258dc
push es
or esp, dword [edi + 0x3f]
pop eax
xor eax, 0xce498873
cmp eax, 0x77d36243
xchg ecx, eax
daa
mov al, 0x6d
cmc
pop edi
jbe 0x1022593d
xor dh, bh
cmp dword [eax + 0x4f870650], edx
push esp
mov edx, 0x87992124
leave
pop esp
and ch, byte [esi - 0xd8d6b8]
jmp 0x102259ac
and eax, 0xa780eac1
jo 0x10225946
mul dword [edi + edi*8]
add eax, 0xf5e5086c
add ecx, ebp
push ss
or bl, bl
add byte [edx + edi*8], 0xf
jg 0x10225a40
cmp bp, word [esi]
loopne 0x102259c0
or bl, bl
add byte [edx + 0x21], al
dec esp
or dword [esi], edi
cwde
int 0xa9
das
mov dword [esp + edi*4 + 0x9ba7424], edi
invalid
sbb dword [eax + 8], 0xffffffdb
or byte [edx - 0x4c], 0x41
mov eax, 0xd20f9d56
xor ah, ah
clc
dec eax
sal edx, 0xe5
int 0x5a
sbb al, 0x50
add edx, ebp
sbb eax, 0x70d0e543
fstp dword [ecx]
out dx, eax
push eax
fidivr word [eax - 0x42569bba]
and byte [ecx - 0x3dd33b5a], 0x41
out 0x26, eax
and al, byte [ecx + 0x46]
sbb dword [edi - 0x5feb74ae], 0x7f
into
dec edi
inc edi
test al, 0xfc
ret 0x3091
or ebp, 0x771c3a21
jae 0x102258e2
inc word [esp + 2]
sal byte [esp + 1], 6
sbb ebp, 1
sub dx, ax
call fcn.100e1180

Function at 0x101c7f3b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ebx*2 + 0x2c], ebx
not word [esp + ebx + 0x1c]
xor dword [esp + ebx], edi
call fcn.101d36b5
int3
jno 0x10190744
or dword [esp + ebx*8 + 0x1c], ebx
jne 0x100ad56d
call fcn.1022779f
jle 0x1021fb7f
push ebx
shr cx, 0x4e
add esi, 0x9c17acac
mov esi, 0xe517051c
mov edi, 0x8a2ce180
mov edi, dword [esp + ebp + 0x4c775b7f]
mov edi, dword [edi + ebp + 0x4c775b7b]
jno 0x1016b41f
mov dword [esp + ebp + 0x4c775b7f], esi
call fcn.10255e3d
mov ebp, 0xa03bfe2d
mov ecx, dword [esi]
mov ebp, dword ss:[ecx]
jmp 0x10274740
mov dword [esi], ebp
jmp fcn.101d6d95

Function at 0x101c812b
Capabilities:
Execute syscall

Disassembly:
lea esp, [esp + 0xc]
je 0x10254e33
mov eax, 0x718d92d
ror eax, 0x99
sal al, 0xa4
mov eax, dword [ebp + ebx*4]
jns 0x10110e52
ja 0x101ee2bd
jmp 0x100e9017
push eax
push 0xf2a2b48c
jae 0x10254e23
dec ebx
push 0xafa7c60b
lea esp, [esp + 8]
jne 0x100e9021
mov eax, 0x35059e85
lea eax, [eax*8 + 0x4f294521]
cwde
mov eax, dword [ebp + eax*2 - 0x7292]
jmp fcn.1021e632
Function at 0x101ccd1d
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x7e260d1b
and edx, 0x3a4a9be
sub edx, 0xa4b102b7
jne 0x1020b8ef
xchg dword [esp + ebp*2 - 0x36721da], edx
mov edi, dword [esp + ebp*8 - 0xd9c87f0]
shl word [esp + 8], 0x7a
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 0x18], edi
push 0xce1d85a9
jne 0x1015e54e
mov word [esp], si
push edx
push ebp
add dword [esp + 0x10], 0xfffc262d
mov ebp, esi
mov edi, 0x1f2244b6
mov edx, dword [esp + 8]
add esi, dword [esp + 8]

Function at 0x101d00b2
Capabilities:
Encode data using xor

Disassembly:
pop ecx
push ebx
pushfd
mov ebx, 0xb239aaba
xchg dword [esp + ebx + 0x4dc6554e], ecx
neg bl
not ebx
movzx bx, bl
shl bx, 0x87
xor ebx, 0xec92d089
lea ebx, [ebx + ebx*4 - 0x65e9ebdd]
test ebx, 0x4b91ac88
mov ebx, dword [esp + ebx + 0x3f432fb4]
mov dword [esp + 4], ecx
call fcn.101f0e1a
sbb edx, 0x39fd1fd5
push edi
add eax, 0xea3f8d57
ror dword [ebp + edi*4 - 0x38a3668c], 0x59
movsb byte es:[edi], byte [esi]
popfd
cmp bl, bh
jnp 0x101d00b6
mov edx, 0x87b239aa
mov word [esi + ecx*2], ds
push ebp
invalid
outsd dx, dword [esi]
sub bh, byte [edx + 0x36]
inc esi
invalid

Function at 0x101d1f21
Capabilities:
Packed with generic packer

Disassembly:
jle 0x101b9a0a
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
ret

Function at 0x101d3478
Capabilities:
Packed with generic packer

Disassembly:
not byte [esp + edx + 0x5fd51ffa]
add dword [esp + 4], 0xd7611
mov dword [esp + ebx*2 - 0x24778e72], edx
push 0x521c533b
not byte [esp + edx + 0x5fd51fea]
neg dword [esp + edx + 0x5fd51ffa]
and ebx, dword [esp + edx + 0x5fd51fea]
mov ecx, dword [esp + edx + 0x5fd51fee]
mov ecx, dword [ecx + edx + 0x5fd51fe6]
ja 0x10255c08
push ecx
jge 0x10183ec2
add ebp, 4
push 0x2d200380
push 0xe13bbabd
xor esi, esi
inc byte [esp + 2]
ror word [esp + 6], 0x8e
push 0x6117b208
test eax, eax
mov word [esp + 0xe], 0x5fbd
lea esp, [esp + 0x10]
je 0x1017dcdc
call fcn.101fa1bc
call fcn.10210304
shl edx, 0xdb
pop esi
add dx, 0x1ca1
mov dword [esp + esi - 0x521c5337], edx
or si, word [esp + esi - 0x521c5325]
call fcn.1016c921

Function at 0x101d7fd9
Capabilities:
Encode data using xor

Disassembly:
verr word [esi - 1]
dec esp
and al, 1
dec word [esp + 1]
sal esi, cl
mov dword [ebp], esi
push 0x8a95a388
call fcn.101d0fcf
clc
dec edx
or dh, byte [edx]
not byte [edx]
rcl al, 0x97
xchg esp, eax
pop ebx
cwde
dec ebp
xor di, word [edx - 0x54]
fild word [edx + 0x7c]
and dword [edx - 0x5c], 0x5afcd09d
mov cs, word [ebp - 0x49]
sahf
dec esi
dec eax
shl dword [ebp + eax*2 - 0x49], 1
push edx
fptan
wait
sbb ah, byte [ebx + 0x42156892]
dec ecx
xor cl, ch
jl 0x100f220e
invalid
mov dword [esp], 0x1485f18f
add ebp, 2
neg byte [esp + 3]
jne 0x100f2210
push 0x4e305793
pushfd
add edx, dword [esp + edx + 0x43478005]
shr dword [esp + 4], 0x6d
xchg dword [esp + 0x10], ebp
mov edx, dword [esp + 8]
call fcn.101591a7

Function at 0x101d82eb
Capabilities:
Packed with generic packer

Disassembly:
setae byte [esp + 0x20]
xor dword [esp + 0x1c], 0x5d28372e
mov edi, dword [esp + 0x2c]
neg dword [esp + 0x18]
Function at 0x101dc0c2
Capabilities:
Packed with generic packer

Disassembly:
mov edx, 0x7e236703
mov ecx, 0xabaf4607
movzx dx, byte [esi + edx - 0x7e236703]
lea ecx, [ecx + ecx*2 + 0x45926114]
rol ecx, 0xb0
mov cl, byte [esi + ecx*2 - 0x6652913e]
adc esi, 2
call fcn.100ad3bf
mov edx, dword [edx + ebp - 0x700e]
xor eax, eax
mov dword [esp + eax], 0xe13006a4
jne 0x101db4a3
or eax, dword [ebp + eax*2 + 4]
jmp 0x101d347f

Function at 0x101dc763
Capabilities:
Authenticate hmac

Disassembly:
jo 0x102513f6
or word [esp + 8], 0x6087
lea edx, [edx + esi + 0x5939978f]
lea esi, [esi + esi - 0x46b7b75]
call 0x100e1131

Function at 0x101dfbfa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], edi
or bl, 0xb4
neg word [esp + 0x2c]
lea esi, [esi + edi + 0x3b035439]
shr edi, 0x48
not byte [esp + 0x18]
xor dword [esp + edi*2 - 0x6a12d4], 0xa09d94a5
jae 0x1026afbc
jge 0x101b6c6e
mov esi, edi
mov dword [esp + 8], edi
xor bl, bh
mov esi, dword [esp + edi*2 - 0x6a12fffc]
mov esi, dword [esi]
jae 0x1016b5f4
pop ebx
cmp al, 0x5f
lds eax, [edi + 0x71b38172]
push edi
std
insb byte es:[edi], dx
out 0x89, eax
arpl ax, ax
shr dword [ebp + 0x53], cl
dec ebp
sar byte [ebx - 0x4d], 1
out 0xb8, al
xchg ebp, eax
mov fs, word [esi + esi*2 + 0x634fa5f2]
sub ebx, ecx
or dword [esi - 0x46], ebx
mov al, byte [0xc98387ed]
test edi, 0x859a1ec3
fisttp word [ebp - 0x4e7c708c]
xor edx, ebp
insd dword es:[edi], dx
xor eax, 0xb8866ac7
dec edx
std
je 0x101dfc42
push edi
lodsb al, byte [esi]
sbb eax, 0x436676d6
invalid
or word [esp + 0x2c], 0x2595
mov dword [esp + 0x2c], ebx
setl byte [esp + edi*4 - 0xd425e8]

Function at 0x101e37be
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + ecx + 0x6800c01a]
sub dword [esp + 0x18], 0x7a8d9321
sub byte [esp + 0x14], 0x21
call fcn.10176b72
fnstcw word [edi + eax - 0x41]
js 0x101c679c
xchg byte [ebx + 0x10], dh
test al, 0xb
dec esi
lds esi, [eax]
pop ds
cmpsd dword [esi], dword es:[edi]
or al, 0x29
salc
and ecx, dword [eax + 0x31]
out dx, eax
bnd call [ebx]
fadd dword [ebp - 0x12]
stosd dword es:[edi], eax
or byte [edi - 0x71], bl
inc esp
cwde
push es
fidivr word ds:[edx + ebp*2]
and al, 0xcd
invalid
add dword [esp], 0xefe9b9ab
or ecx, 0x91af17b6
js 0x101c6760
Function at 0x101e5901
Capabilities:
Encode data using xor

Disassembly:
cld
lodsd eax, dword [esi]
lea ecx, [ebx]
ror byte [ebx + 0x3be82704], 0xa3
add eax, dword [eax]
mov dword [ebp], ecx
lea esp, [esp + 0x14]
jmp fcn.1014eb23
call fcn.101352f9
ror byte [edi + 0x1f], 1
test eax, 0x22c1845a
mov dh, byte ds:[ebx - 0x47]
mov eax, 0xc203af51
je 0x101e58d2
mov ecx, 0x3af51b8
ret 0xb974
pop eax
dec esi
xchg edx, eax
jecxz 0x101e597d
invalid
xor ecx, ecx
mov bh, 0xce
cmc
aam 0xb9
pop ecx
lodsb al, byte [esi]
xchg esp, eax
adc eax, 0x9072b445
mov ah, 0x72
nop
out 0x61, eax
cwde
shl byte [ecx + 0x58], 1
shl byte [eax - 0x5b], 0x89
loope 0x101e5911
dec esi
mov esp, 0xa82e04a5
pushal
adc dword [ecx - 0x389265ef], ebx
cdq
adc dword [edx - 0x109b3893], ebx
out dx, eax
jg 0x101e5999
sal dword [ecx], 0x2a
adc dword [esi - 0x72], esp
dec ebp
sub byte [0x6f1f923f], ch
xor dword fs:[edx - 0x16e27769], edi
sbb eax, esi
add ebx, ebp
aas
push ebp
mov edi, 0x89e078a8
jle 0x101e5994
fnstsw word [edx]
call 0x73c15c6b
mov dh, byte [edx]
std
mov es, word [ecx + 0x26a4524f]
shr dword [ecx + 0x31e0234e], 1
pushal
call 0x79611e7a
loopne 0x101e5971
or esi, dword [ecx + 0x64]
sub ah, byte [edi]
pop ss
pop edi
mov ebx, 0xc5f74038
test al, 0x47
retf 0x1722
Function at 0x101eb750
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x18], eax
jb 0x10207a6a
ja 0x10208f1d
jmp 0x1017f80a
sbb esi, 2
jmp 0x101d08e1
jae 0x100f4194
lahf
pop edi
adc byte [eax + 0x69], 0x96
loop 0x101eb78a
popfd
push eax
mov ecx, 0xd26afb47
imul esp, edx, 0x3b340f6
rcl byte [ebx]
scasd eax, dword es:[edi]
add edx, ecx
adc cl, byte [ecx - 0x78]
fdivr dword ds:[ebx + 0x3d850601]
repne outsb dx, byte [esi]
lodsd eax, dword [esi]
outsb dx, byte [esi]
leave
clc
mov bl, 0x81
pushal
stc
jle 0x101eb734
outsb dx, byte [esi]
leave
clc
add dword [esi*2 + 0x7dcefc72], ecx
pop es
jne 0x101eb7ab
xchg edx, eax
shl ebp, cl
in eax, dx
adc byte [eax], ah
fdiv st(1)
pop ss
dec edi
movsb byte es:[edi], byte [esi]
fcmovbe st(0), st(1)
push edi
invalid
jnp 0x101eb797
jp 0x101eb805
dec ebp
sti
adc al, 0x69
mov dh, 0x73
inc esi
lodsd eax, dword [esi]
xor dh, byte [edi + eax*8]
in eax, dx
jl 0x101eb757
imul ebx, dword [ecx + ebx*4 - 0x5ec7aa8c], 0x9652aa78
push esp
sbb dword [edi + 0x10], 0xffffffed
fldenv [ecx + 0x11ae44cd]
xlatb
and bh, byte [ebx + 0x3a]
popal
sahf
xchg byte [edi], bh
push ebp
scasd eax, dword es:[edi]
inc esp
arpl dx, bp
cli
push edx
adc dword [edx + 0x34998b4a], edx
pop ebx
insd dword es:[edi], dx
cwde
sub bl, byte [ecx - 0x16]
nop
mov dword [0xf0c6d6c8], eax
clc
and eax, 0xb023504e
loop 0x101eb7ee
ljmp 0xf0c6:0xd6c8a390
rcl dword [eax - 0x36], 0xb5
pop eax
cmp al, 0x43
rol byte [edx - 0x39f7ced], 1
loope 0x101eb815
mov al, 0x6f
outsb dx, byte [esi]
fdiv dword [edi]
ror cl, cl
outsd dx, dword [esi]
pop ss
adc ah, ah
or word [edi], di
aaa
retf 0xf689
mov ebp, 0x68bb5485
or dword [esp + ebp - 0x68bb5481], 0x2c2550bc
and bp, bp
neg dword [esp + ebp - 0x68bb5481]
mov ebp, dword [esp + ebp - 0x68bb5485]
mov ebp, dword [ebp]
jl 0x1026fa51
push ecx
call 0x100e8101
mov esi, dword [esi]
jb 0x101dd4e6
jg 0x101b7466
lea esi, [esi - 0x5fe3d17d]
mov dword [esp + 0x10], 0xb13f1aaf
call fcn.101801b2

Function at 0x101f0170
Capabilities:
Encode data using xor

Disassembly:
and byte [ebp + 0x13], 0xeb
inc dword [ecx - 0x72c25e13]
mov esi, 0x626cfe8
add byte [ebp + 0x28ad8dd7], al
test edi, edx
lea ebp, [ebp + 0x39022e28]
call fcn.101beafa
pop edi
push ebp
call fcn.10236f63
mov esi, 0x180dc316
cmc
pop ds
lodsd eax, dword [esi]
dec edx
cli
sub dword [eax + 0x19a34efe], esi
test al, 0x5f
xchg dword [edi - 0x66], eax
dec esi
imul ecx, dword [esi + 0xf8b4286], 0x7cf79b8
xor cl, byte [edx - 0x5980618b]
mov al, 0xc8
jle 0x101f014e
outsb dx, byte [esi]
leave
clc
popfd
adc dword [ebx + 0x1d], eax
neg dword [edx + 0x6b]
daa
add esp, dword [edi]
adc ecx, dword [eax + 0x4e1a7e67]
aaa
adc dword [edx - 0x6f], 0xe6230736
retf 0x7ef0

Function at 0x101f0887
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push edi
push ebp
mov ebp, 0x5a2e45b0
mov ebp, 0xa9b1378a
pushfd
xor ebp, ebp
jg 0x1013c5a3
push ecx
mov edi, dword [esp + ebp + 0x10]

Function at 0x10200540
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov ebx, 0xba08fbb0
call fcn.1010e121
Function at 0x10201b9f
Capabilities:
Encode data using xor

Disassembly:
je fcn.10120175
shl edx, cl
call int.1010f091

Function at 0x10207dfc
Capabilities:
Packed with generic packer

Disassembly:
jl 0x101d2042
test dword [esp + 0xc], 0xd48e5180
jns 0x101a4ce4

Function at 0x1020d045
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], esi
call fcn.1010a65c
mov edx, dword [edi]
mov eax, 0xc1ab9e0e
mov eax, dword [edi + 4]
mov ebp, 0xc417613f
sub ebp, ebp
jno 0x100d432f

Function at 0x102106a1
Capabilities:
Packed with generic packer

Disassembly:
xor dword [esp + ebp*8 + 0x3acbd308], 0x5337cc88
sub dword [esp + ebp*2 + 0xeb2f4c8], ebp
push cs
jle 0x100cf53a
mov es, word [ecx - 0x37001412]
sahf
fmul dword [0x4a0275ac]
enter 0xffffffffffffd89e, 0xd
lodsb al, byte [esi]
jne 0x102106c2
dec edx
sbb bl, ch
clc
fnsave dword [esi]
clc
movsb byte es:[edi], byte [esi]
loopne 0x102106b4
xor eax, 0xc2d14588
or al, byte [ecx + 0x44]
fcomp dword [edx]
wait
aad 0x1e
mov byte [0x64e5a1a9], al
enter 0xffffffffffffd89e, 0xffffffffffffff9a
fild dword [edx + 0xf8855bb]
in al, dx
push ecx
loopne 0x102106f9
call 0xbb11ad3
out 0x2c, al
into
pop ds
add byte [edx], dl
fst qword [ebp + edi*8 - 0x46]
jmp 0x102106b2
mov edx, 0xd26fb6eb
sbb eax, 0x52b60a54
mov dh, 0x6f
rcr byte [0x52b60a54], cl
dec esp
popfd
mov bh, 0xda
das
cli
dec ecx
imul ebx, dword [edi], 0xa8bb74af
jg 0x102106fb
sbb bl, byte [ebx + 0x752fecad]
or al, 0x69
or byte [ecx], dh
lodsd eax, dword [esi]
in eax, 0x64
push edx
cmp ecx, ebp
mov bl, dl
cmp byte [esi + ecx*2], cl
sahf
xor eax, esi
jge 0x10210752
mov ah, 0x9b
dec edi
or esp, dword [ecx - 0x7b30e510]
pop esp
iretd
mov ecx, 0xd2379594
mov ah, 0xbc
sbb bl, byte [ebx - 0x2ef3aa2b]
sbb byte [ecx + 0x378e459b], cl
movsd dword es:[edi], dword [esi]
mov dh, 0xe4
stosb byte es:[edi], al
invalid

Function at 0x10212be7
Capabilities:
Packed with generic packer

Disassembly:
push 0x29bc58af
call fcn.101a24b8
push 0x59944b91
not ax
mov dword [esp], 0x8b8109a6
jmp 0x10126a23

Function at 0x1021492b
Capabilities:
Packed with generic packer

Disassembly:
push 0x8f1c1935
push edx
mov edx, dword [esp + 4]
pushfd
xor dword [esp + edx + 0x70e3e6d3], edx
xchg dword [esp + edx + 0x70e3e6db], eax
shr byte [esp + edx + 0x70e3e6d3], 0xee
js fcn.101ac1ef
push edx
call fcn.10277079
call fcn.101056cf
Function at 0x1021dd81
Capabilities:
Encode data using xor

Disassembly:
js 0x10218157
mov ebx, dword [esp + 0x10]
not dword [esp + 4]
not ebx
add dword [esp + 8], 0xffeff6c7
mov eax, edi
call fcn.101c266e
sbb esi, 8
jmp 0x10194a9f
lea edx, [edx - 0x54dc8cd0]
mov dword [esp + ebx - 0x6d1c00b4], 0xb29112d
mov edx, dword [esp + edx - 0x1ba865b0]
js 0x1017f839
or ebx, ebx
lea ebx, [ebx*2 + 0x1688899f]
add dword [esp + 4], 0xefebb62b
not dword [esp + 0x14]
and dword [esp + 0x14], 0x2200a488
mov ebx, dword [esp + 0x1c]
jb 0x10267b40
add dword [esp], 0xefebfeb9
xor byte [esp + 0x14], 0x33
test dword [esp + 0x14], 0xcc01f02a
push dword [esp + 0x20]
popfd
lea esp, [esp + 0x24]
ret
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x3c]
ret
call fcn.1024e42f
not ebp
xor esi, ebp
or ebp, ebp
lea eax, [eax + 0x59a5419]
xor si, word [esp + 4]
call fcn.1026ec37
mov dword [edi], eax
jmp 0x1024c8f3
jmp 0x1026f61f
jmp 0x1019380c
mov esi, ecx
mov esi, dword [esp + ecx + 0x13a5c892]
mov esi, dword [esi + edx + 0x13a5c886]
and ecx, dword [esp]
test cl, 0x2d
jo 0x101642fe
lea edx, [ebp + edx*2 - 0x4d5eebdd]
call fcn.1024df05
xchg dword [esp + edx - 0x7084f268], eax
mov ecx, dword [esp + ecx - 0x6d1cfbf8]
jne 0x10240432
and ecx, ecx
lea ebp, [ebp + edx + 0x1f381298]
cmp cl, 0x3e
lea esp, [esp + edx*2 - 0x7907e7fc]
ret 4
shr dword [esp + edx - 0x7084f278], 0x26
movzx bx, byte [esp + ebx - 0x6d1cfc26]
jb 0x1014f76e
push dword [esp + 0x34]
popfd
lea esp, [esp + 0x40]
ret 4
call fcn.1012d6cf
call fcn.1019c5f4
shr di, 0xf5
mov dword [esp + 0x10], edi
je 0x100e1898
mov dword [esi + 0xc], eax
jmp 0x10169321

Function at 0x10221d96
Capabilities:
Packed with generic packer

Disassembly:
sub ebx, dword [esp + ebx + 0x57689688]
mov ebx, dword [esp + ebx*4 + 0x3422d5fc]
mov ebx, dword [ebx]
call fcn.102725c0

Function at 0x102360ab
Capabilities:
Packed with generic packer

Disassembly:
not cx
inc ecx
movzx edi, byte [edx]
dec ecx
add edx, 1
add cx, cx
bt ecx, ecx
dec eax
sub ecx, ecx
inc eax
xor bh, dh
dec eax
xor ecx, ecx
push ecx
inc eax
not bh
dec eax
rol ecx, 0x72
setae cl
or ecx, ecx
inc eax
adc bh, cl
call fcn.101372c1

Function at 0x1023649d
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x20], ebx
pop esp
and al, 0x20
mov edx, dword [esp + 0x1c]
call fcn.101610bf
not cl
and ecx, 0xa02eb63c
call fcn.101f28dd
xlatb
push edx
aas
dec edi
test eax, 0x5f92a07e
adc ebx, ebp
xor bl, ah
arpl word cs:[edi - 0x2f], di
or bl, ah
inc edx
inc edi
mov dword [0xd543d10b], eax
inc ebx
jge 0x1023649e
cmp eax, 0xa95de47c
das
add eax, 0x8537bf7a
mov esp, 0x83bcf600
mov byte [0xda6d0970], al
test byte [edx + 0x67], dh
out dx, eax
mov ecx, 0x5732fc9a
ret

Function at 0x102367f9
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + edx - 0x4f32aafd], ebx
mov dword [esp + edx - 0x4f32ab01], edx
cpuid
ja 0x1025c6db

Function at 0x1023c964
Capabilities:
Encode data using xor

Disassembly:
call fcn.10225db4
sysenter
pushfd
xor al, 0x9c
mov dword [esp], 0x393e0bcf
call fcn.100a3b1c
adc byte [edi - 0x79], 3
lcall 0x9797, 0x3a2367c7
push edi
mov dh, 0x2b
or esi, dword [edi]
jle 0x101001e5
xlatb
invalid
mov dword [esi], eax
jmp 0x101001df
Function at 0x1023e367
Capabilities:
Encode data using xor

Disassembly:
call fcn.101916c7
mov edx, 0xd2986c9a
mov dx, word [ebp]
mov ecx, 0x41b0802a
sub ecx, 0xaa03233b

Function at 0x1023e60e
Capabilities:
Packed with generic packer

Disassembly:
push 0xb9ba8387
push 0x6fbd7c2d
pushfd
pop ecx
mov dword [esp + 0xc], ecx
mov ecx, 0x2caf2580
mov dword [esp + ecx - 0x2caf2578], ecx
not cx
mov ecx, dword [esp + ecx - 0x2cafda73]
call fcn.10209e8d

Function at 0x102428fe
Capabilities:
Packed with generic packer

Disassembly:
retf 0xc7bd
xor al, 0xb1
retf
call 0x100cfc4d
mov dh, 0xfb
push cs
mov edx, 0x67915784
jb 0x102428cf
movsb byte es:[edi], byte [esi]
mov ebx, 0x661efbf5
rcr byte [edi - 0xf], 1
push ds
push ds
cmp dword [eax], edi
cmp cl, byte [esp + ebp]
xchg edi, eax
pushal
jecxz 0x102428aa
out dx, eax
cmp eax, 0x600ef844
dec edx
jb 0x1024295d
test eax, 0x9e19b7e9
cmpsd dword [esi], dword es:[edi]
xchg dword [ebp + 0x14dac], ecx
lea ebp, [ebp + ecx*2 + 1]
add cl, 0xa1
test ecx, 0x2c8311b4
call fcn.1022618a
lodsb al, byte [esi]
xor al, 0x8a
sub dword [edx + eax*2 - 0x73], 0x34
mov ch, 0x9c
scasb al, byte es:[edi]
mov edx, 0xc8c897d
lds ebx, [ebx]
jecxz 0x10242924
mov dword [esp + 4], 0x429a3f89
call fcn.10108bb2

Function at 0x10242949
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, 0xe880a393
push ecx
mov ecx, 0x4c1ce43f
mov ebp, dword [esp + ecx - 0x4c1ce43b]
mov dword [esp + esi + 0x426c838a], ebp
lea esi, [esi*4 + 0x7dbaae9c]
mov dword [esp + ecx - 0x4c1ce43b], ecx

Function at 0x10244e97
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + ebx + 0x8f]
not dword [esp + ebx*2 + 0xd6]
jl 0x100acd5d
shl word [esp + ecx + 0x266b8693], cl
add byte [esp + ecx + 0x266b867f], bl
add word [esp + ecx*2 + 0x4cd70cd6], 0x9895
je 0x1012af3c
jne 0x1014c5e6
or dword [esi + 0x7983136], eax
lahf
pushal
int3
jge 0x102403a3

Function at 0x102478da
Capabilities:
Encode data using xor

Disassembly:
jae 0x101377b4
dec eax
mov dword [esp], 0x6e04e16a
call fcn.10243ebd

Function at 0x1024bd47
Capabilities:
Packed with generic packer

Disassembly:
xor ebp, 0x57bb2880
mov dword [esp + 0xc], ebx
xor ebp, 0x9d184698
neg ebp
push ecx
mov ecx, ebp
add dword [esp + 0xc], 0x2b708
or cx, 0xa97
push edi
jle 0x100dea57
mov edi, 0xb3b20e99
push ebp
mov ebp, 0x7d0d032c
xchg dword [esp + ebp - 0x7d0d0320], ebx
pushfd
xor ebp, 0x7db5d093
bswap ebp
jns 0x10165e97

Function at 0x1024e33b
Capabilities:
Authenticate hmac

Disassembly:
mov si, 0xa60c
neg esi
lea ebp, [ebp + esi*8 + 0x63081973]
jns 0x10251408
je 0x100ade40
call fcn.102156b0
je 0x101d1232
call fcn.100d0cee

Function at 0x102513b8
Capabilities:
Authenticate hmac

Disassembly:
xor cl, 0xbe
mov dword [esp + 4], 0x3a35e21d
ror dword [esp + 4], 0x77
ror cl, 1
call fcn.1016c35b