joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1035242c
Capabilities:
Encode data using base64

Disassembly:
adc ebp, ecx
movzx ecx, word [edx + edi - 7]
xadd dx, ax
setbe dl
dec ax
lea edi, [edi + edx - 0x1807]
dec al
mov dword [esp + edx*4 - 0x6000], eax
sub ax, dx
xor cx, bx
pop eax
sar edx, 0x2c
mul edx
ror cx, 1
neg cx
btc eax, eax
and ax, ax
not cx
rol eax, 0x41
adc dl, ah
adc dl, dh
sbb cx, 0xefbc
rol cx, 1
neg cx
add eax, 0xcd83248b
xor bx, cx
rol eax, 1
mov word [edx + esi - 5], cx
movsx ecx, ax
lea esi, [esi + edx*2 - 6]
setno cl
bswap edx
inc dx
ja fcn.102d9ffd
mov dx, word [esi]
mov ecx, 0x9c0a0d32
movzx eax, byte [edi]
xor al, bl
push ecx
sub al, 0x9d
ror word [esp + 1], 0x26
adc ecx, dword [esp]
not al
neg cl
dec al
neg al
or ecx, 0xf09ff23b
xor ecx, dword [esp]
sal ecx, cl
xor bl, al
bts ecx, ecx
shl dword [esp + ecx - 0x7bf1a001], 0xae
shr ecx, 0x59
lea eax, [esp + eax + 4]
mov byte [eax + ecx - 0x3d], dl
mov ecx, dword [edi + ecx - 0x3c]
mov edx, dword [esp]
movzx eax, dl
lea edi, [edi + edx - 0xa0c7ffb]
xor ecx, ebx
sub ecx, 0xef0bbe1f
imul dl
setno dl
ror ecx, 1
sub edx, eax
bswap edx
shl edx, 0xb3
dec ecx
cwde
ror ecx, 1
mul ax
and edx, eax
jg 0x10329dc1
xor ebx, ecx
mov byte [esp + edx*2], 0x2e
add ebp, ecx
add edx, dword [edx + esi + 2]
mov cl, byte [esi + eax + 6]
ror eax, 0xe3
adc dword [esp + eax], 0x311d0329
sbb byte [esp + eax*2 + 1], al
shr edx, cl
movzx ecx, al
mov dword [eax + esi + 4], edx
shr ax, 0x81
bt cx, 0xbb
ror cx, 0x4e
lea esi, [esi + eax*8 + 4]
mov dword [esp + eax], ebp
ret

Function at 0x10353312
Capabilities:
Encode data using base64

Disassembly:
push 0xf93d27b6
dec ebx
lea esp, [esp + 0xc]
jne 0x10316103
Function at 0x10353c38
Capabilities:
Encode data using base64

Disassembly:
call fcn.102f0b30
add edi, 4
neg cx
jo 0x103f83cb
xor eax, ebx
add cx, 0x5124
movzx edx, cx
neg eax
ror eax, 1
btr cx, dx
bswap eax
dec eax
xchg ecx, edx
btr dx, dx
xor ebx, eax
lea ecx, [ecx - 0x3868c778]
add esi, eax
shr cl, 0x45
neg ecx
movzx eax, dx
mov eax, ebp
bswap edx
or ecx, ecx
lea ebp, [ecx + ebp - 0x3868c701]
mov dword [ebp + ecx*2 - 0x70d18dfa], eax
lea ecx, [ecx + 0x2ab83eb8]
jae fcn.1044af2a
inc ecx
mov edx, 0x97279abe
inc ecx
mov edi, edx
dec eax
sub ebp, 4
inc di
inc esp
mov esp, dword [ebp]
dec esp
lea ebp, [edi*8 + 0xbb2148d]
dec ecx
lea eax, [edx + edi + 0x18022432]
inc esp
movsx esi, ax
inc ebp
xor esp, ecx
inc ecx
bswap esp
inc ecx
shr edx, 0x4a
inc ecx
neg ebp
inc ecx
dec esp
dec eax
lea edx, [edi*8 + 0x1487f217]
inc ecx
bswap esp
inc ecx
not esp
inc esp
mov eax, edi
inc ecx
push ecx
not ax
dec esi
lea edx, [edx*4 + 0x3c070426]
inc esi
xor dword [esp + ebp - 0x3b11157b], esp
mov ecx, edx
inc ecx
pop ecx
dec ecx
sal eax, 0x16
dec esp
lea eax, [eax*4 + 0x598c8d35]
dec ebp
arpl sp, sp
dec ecx
adc ebx, esp
xchg ah, dl
ror ecx, cl
inc di
mov ebp, dword [edi + ebp*2 - 0x76222af6]
inc ebp
movzx esp, si
inc ecx
rol edx, cl
dec edi
lea edi, [edx + edi - 0x3c577c77]
dec edx
lea ebp, [ebp + edx*2 - 0x78aef8f3]
inc ecx
movzx esi, al
inc sp
adc esp, ecx
inc edx
mov dh, byte [ebp + edx - 0x3c577c79]
inc ecx
xor dh, cl
inc ecx
idiv al
dec ebp
lea ebx, [eax - 0x85dd9d9]
inc eax
dec dh
inc cx
inc edx
dec ebp
lea edx, [esp + 0x2e988d3b]
inc eax
rol dh, 1
cbw
inc eax
add dh, 8
inc ebp
or eax, esp
inc eax
rol dh, 1
cwd
inc eax
dec dh
inc cx
sar esp, 0x8e
inc sp
cmovnp esp, edx
inc esp
xor cl, dh
dec eax
add esi, esp
inc bp
mov dword [edx + esi - 0x2e998274], ebp
dec eax
sub ecx, 0xf3b4a821
imul edi
inc cx
sub edx, edx
jmp ebx
xor ebx, ecx
add edi, ecx
lea esp, [esp + 8]
push 0x95b86495
push 0xfe15ac9c
lea esp, [esp + 8]
jmp 0x102c3eb4
movzx ecx, byte [edx + esi - 0x24022622]
push edx
bt dx, 0x95
lea esi, [esi + edx*2 - 0x48044c43]
mov eax, 0xdd969321
sar al, 0xc3
xor word [esp + edx*2 - 0x48044c43], dx
xor cl, bl
cdq
rol dword [esp], 0x1f
not dword [esp]
add cl, dl
jmp 0x10324fcd
Function at 0x10358521
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol eax, 3
lea edx, [edx + ecx*4 - 0x30e890f4]
bts dx, dx
call fcn.103d2feb
mov eax, 0xfb809707
mov ecx, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x45
cwde
xchg ah, al
lea esi, [esi + eax*2 - 0x17000]
btc eax, 0x93
dec al
mov dword ss:[ecx + eax*8 - 0x45c018], edx
cdq
cwd
lea edi, [edi + eax*8 - 0x45c01c]
jb 0x104ae063
xor dl, 0x1f
mov edx, dword [edi + eax*2 - 0x117006]
movsx ecx, al
xor edx, ebx
or ecx, 0xfa3b1c1d
sbb edx, 0xc8bf6e04
rol edx, 1
not cx
push ecx
dec eax
lea edx, [edx + eax*2 + 0x7bfa431a]
add al, al
shr eax, 0x8f
not edx
imul eax, eax
xor ebx, edx
lea eax, [eax*2 + 0x7a2f5eb7]
neg ax
add ebp, edx
and eax, eax
lea edx, [eax*8 + 0x4c3962a8]
mov dword [esp + edx*4 - 0x76d96b80], ebp
ret
mov eax, dword [ebp + edx - 0x7e484ffc]
lea ebp, [ebp + ecx*4 - 0x3e3ff8]
sar ecx, 0xc5
add ecx, ecx
sar dx, 0x21
xor eax, ebx
jmp 0x102fb423
call fcn.102f6e05
mov ecx, dword [ebp]
mov eax, 0xe8be5fad
imul eax, eax
xor ecx, ebx
add ax, 0x3a28
lea edx, [eax*4 + 0x263b953c]
setb dl
bswap ecx
cdq
rol ecx, 2
dec edx
add dl, ah
jl 0x1049ccc3
neg ecx
idiv eax
not ax
not ecx
imul eax
ror eax, 0x78
dec ecx
xor ebx, ecx
sub dx, ax
lea edx, [edx + eax*8 - 0x68e3e4c5]
sal edx, 0x2b
mov dword [eax + edi - 0x6cf261fd], ecx
btr edx, edx
movzx ecx, al
rol ecx, 0x8c
lea eax, [edx + edi - 0x7e485004]
mov dword [edx + edi - 0x7e485008], eax
movzx eax, cx
lea edi, [edi + edx - 0x7e485008]
setb dl
jae 0x1031dba7
btc eax, ecx
rol ax, 0x49
ror cl, 0x44
xor edx, 0x7bbe582e
bswap eax
btc eax, eax
neg edx
not al
not al
imul cx, ax
xor ebx, edx
add ebp, edx
mov edx, ecx
rdtsc
sub esi, 8
sal cl, 0x25
jns 0x10341c20

Function at 0x10360ac7
Capabilities:
Encode data using base64

Disassembly:
inc ecx
ror ch, 1
or ecx, edi
inc ecx
inc ah
inc ebp
xor cl, ch
call fcn.103e9ade

Function at 0x10361214
Capabilities:
Encode data using base64

Disassembly:
dec ebx
jne 0x1048a083
mov eax, dword [ebp]
call eax
call fcn.10455304
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
mov edx, 0x69d2a07
push edx
add dl, dl
lea ecx, [ecx + edx*4 + 0x79ba89e7]
btc dx, 0x12
xor ecx, 0xe294d014
xadd dword [esp + edx*8 - 0x34e95050], edx
seto dl
bswap ecx
push edx
inc ecx
xor dword [esp + edx - 0x69d29fe], edx
adc edx, edx
ror ecx, 1
push edx
mov eax, edx
inc byte [esp + edx - 0xd3a53fc]
bswap ecx
bt edx, 0xbe
push eax
jb 0x10445aaa
xor ebx, ecx
add esi, ecx
movzx ecx, ax
mul eax
mov ecx, dword [ebp + eax - 0x2b900000]
xchg dword [esp + edx*4 - 0x2bbe73d], edx
imul word [esp + edx*2 - 0x74a5184c]
lea eax, [edx*2 - 0x14ece870]
mov edx, dword [edx + ebp - 0x3a51fffc]
call fcn.1037af77
rol dword [ebp - 0x6d17a0aa], 0x3e
sbb eax, 0x5ae7b2e1
retf 0xe129
jae 0x1048a077
test ebx, ebx
lea esp, [esp + 0x10]
je 0x103379ec
mov eax, 0x8a913f84
sar eax, 0x8f
mov eax, dword [ebp + ebx*4]
push eax
jp 0x103379e5
syscall
call fcn.1035283e
Function at 0x10361500
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea edx, [edi + esi*4 + 0x1bdada0]
inc esp
xor dword [esp + eax], eax
call fcn.103c3538
mov ecx, 0x3aa3f7be
movzx eax, byte [edi + ecx - 0x3aa3f7be]
xor al, bl
lea edx, [ecx*8 - 0x69f13fd9]
sub ecx, ecx
ror al, 1
sub edx, edx
adc cx, dx
sbb al, 0x28
and ecx, ecx
neg al
not al
xchg ecx, edx
sar edx, 0x85
call fcn.103940db
jmp 0x103160f7
mov dword [esp], eax
bts eax, ecx
not dl
inc dl
call fcn.10394f39
dec eax
sub ebp, 4
inc ecx
movzx eax, ch
cwde
inc ecx
movsx ecx, bp
inc esp
mov eax, dword [ebp + eax*2 - 0x160]
dec eax
lea edi, [ecx*8 + 0x54a3fa13]
inc esp
movsx edx, cx
inc ebp
xor eax, ecx
movzx esi, cx
inc esp
sub edx, esi
inc ecx
neg eax
dec edx
lea eax, [esi + ebp*8 + 0x61a1ed13]
sal ecx, cl
dec eax
inc esi
inc ecx
ror eax, 2
inc esp
movsx ebx, cx
inc ecx
sub eax, 0x8787e7b0
btr si, cx
dec edx
lea ecx, [ebx*8 - 0x305cf7eb]
inc ecx
xchg ebx, eax
inc ecx
not eax
dec ecx
bts ebp, 0x24
inc ecx
push ecx
jae 0x1031f1c1
Function at 0x10365418
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, dword [eax + ebp - 0x83e1bbc]
imul ecx
push 0x5e350633
mov dword [esp], 0xc88fcf36
mov dword [ebp], edx
mov ecx, 0x12be88a6
lea edx, [ecx + ecx*8 + 0x4c9b5739]
dec word [esp + ecx - 0x12be88a4]
mov dword [ecx + ebp - 0x12be88a2], eax
sal byte [esp + ecx - 0x12be88a6], cl
sub edx, 0x899c0018
mov dword [esp + ecx - 0x12be88a2], edx
mov edx, dword [ecx + edi - 0x12be88a6]
inc dword [esp + ecx - 0x12be88a2]
lea edi, [edi + ecx - 0x12be88a2]
sub byte [esp + ecx - 0x12be88a1], ch
xor edx, ebx
push ecx
sub word [esp + ecx - 0x12be88a3], 0xdc0c
xor edx, 0x6b9ae03a
movsx eax, word [esp + ecx*4 - 0x4afa2298]
inc al
add ecx, ecx
lea edx, [edx + ecx*8 - 0x30d5ab45]
dec ecx
rol edx, 2
neg cx
mov dword [esp + ecx - 0x257deeb2], 0xbe818fb4
lea edx, [edx + ecx*2 - 0x5d0b1604]
add byte [esp + ecx - 0x257deeab], cl
xor ebx, edx
call fcn.1044669f
mov eax, dword [ebp]
mov edx, 0x39c539f
lea ebp, [ebp + edx - 0x39c539b]
bt edx, edx
xor eax, ebx
rol edx, 0xec
neg dl
sbb eax, 0x5e364382
bswap eax
ror eax, 2
sub edx, edx
xchg dh, dl
not eax
rol edx, 0x6a
xor ebx, eax
add dx, dx
lea edx, [edx - 0x30e24df5]
not dx
adc esi, eax
movsx eax, dl
mov edx, dword [edi]
mov eax, dword [edi + 4]
jmp 0x103bdce1
test eax, eax
jmp 0x1039f289
add edi, 4
push 0x7d1ee910
push 0x9cb1319e
xor ecx, ecx
sub dword [esp + 4], 0x487ac88
ja 0x10378dca
mov eax, 0x7e8970be
mov edx, dword [eax + ebp - 0x7e8970be]
movzx eax, byte [esi + eax - 0x7e8970be]
mov ecx, 0xd0aa250b
push ecx
bts cx, cx
xor al, bl
jmp 0x1048af31
imul ecx, eax
bswap edx
or eax, 0xbb08ab3f
btr cx, ax
rol edx, 2
neg ax
neg edx
not edx
push eax
sar ecx, cl
xor ebx, edx
xor eax, eax
push eax
jb 0x10491258
mov dword [ebp + eax*4], edx
movzx edx, al
ror dword [esp + eax + 2], 0x14
jns 0x10496b70
dec dword [esp]
inc byte [esp + 1]
dec al
xor al, 4
sal byte [esp], 0x41
neg al
and ecx, ecx
dec al
sal ecx, 0xe
inc word [esp]
sal ecx, 0x30
xor bl, al
shr byte [esp + 2], 0x47
pop ecx
adc eax, esp
btc ecx, ecx
push ecx
bts ecx, ecx
mov dword [eax], edx
sar dword [esp], cl
sete cl
mov edx, dword [esi + 1]
sal cl, 0x42
pop eax
xor edx, ebx
not ecx
dec edx
rol ax, 0xc9
rol eax, cl
setae al
xor edx, 0x469adbba
inc ecx
shl ecx, 0x26
not edx
lea ecx, [eax - 0x4276dee8]
adc al, ch
neg edx
sar al, 0x42
js 0x1046c7a3
stc
mov ecx, dword [esi + eax*2 + 5]
ror word [esp + eax*4 + 1], 0xaf
lea esi, [esi + eax + 9]
xor ecx, ebx
idiv word [esp + eax*2 + 6]
imul dx, word [esp + eax*4 + 3]
imul eax, eax
xor ecx, 0xdd87cfaf
ror ax, 0xc
ror byte [esp + eax + 3], 0x47
rol ecx, 1
dec ecx
not ecx
bswap eax
xor ebx, ecx
shl dx, 0x81
adc edi, ecx
xchg word [esp + eax + 5], ax
mov dword [esp + eax*2 - 0x1fe20], edi
ret 4

Function at 0x1036cbb7
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + esi*4 + 0x28], edx
lea esi, [esp + esi + 8]
mov eax, 0xf0030b39
mov dword [esp + ebp - 0x501a9036], ecx
lea ecx, [esi + ebp - 0x501a9102]
sub ebp, eax
mov esp, ecx
Function at 0x1036ea2e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jae 0x102ea22e
or edx, dword [edi + edx]
xchg dword [esp + ecx*4], eax
ror byte [esp + eax + 2], 0xc3
setae byte [esp + eax + 2]
lea edi, [edi + eax + 4]
xchg dword [esp + ecx*2], ecx
shr cl, 0x41
xor edx, ebx
neg edx
ror edx, 1
sar eax, 0x7b
sal eax, cl
bswap edx
inc eax
rol al, 0xa5
xchg word [esp + eax*8 - 0xff], ax
dec edx
or eax, ecx
xor ax, 0xe7bf
xor ebx, edx
add cx, ax
setbe byte [esp]
add eax, eax
add esi, edx
pop edx
jmp fcn.1044af2a
rol ax, 1
add dl, 0x38
xor bx, ax
sar ecx, 0x3b
inc dword [esp + edx*2 - 0x2e3bf676]
mov word [edi + edx*4 - 0x5c77ecee], ax
push ecx
movzx eax, byte [ebp + edx*4 - 0x5c77ecea]
xor dword [esp + edx*4 - 0x5c77eceb], edx
and edx, 0xb18b11bf
setp byte [esp + edx*2 - 0x22122272]
xor al, bl
add al, cl
shr cl, 0x87
bswap edx
xor dword [esp + edx - 0x3b11090d], edx
neg al
dec dx
and dword [esp + edx*2 - 0x7622121c], ecx
sbb al, cl
xchg ch, dl
rol dl, cl
cmovno cx, dx
ror al, 1
shr dword [esp + edx - 0x3b1109fc], cl
shl byte [esp + edx*2 - 0x762213f7], 2
or dword [esp + edx*2 - 0x762213fc], 0xc18f6db9
adc al, dl
sal byte [esp + edx - 0x3b1109ff], 0xe5
and ecx, 0xb68bb484
xor bl, al
mov word [edx + edi - 0x3b110a03], ax
lea edi, [edi + edx - 0x3b110a03]
movzx eax, cx
xchg dword [esp + edx - 0x3b1109fb], ecx
neg cx
mov eax, dword [ebp + edx - 0x3b1109fc]
lea ebp, [ebp + edx - 0x3b1109f8]
ror ecx, 0xa2
xor eax, ebx
and byte [esp + edx*2 - 0x762213f7], 0xb3
xor cx, word [esp + edx - 0x3b1109ff]
not eax
bswap eax
or dword [esp + edx - 0x3b1109ff], edx
not dword [esp + ecx - 0x6c00cb78]
xchg dword [esp + edx - 0x3b1109fb], edx
neg eax
push ecx
inc eax
and dword [esp + ecx - 0x6c00cb76], edx
ror byte [esp + edx - 0x4d74ff77], 0xe4
xor ebx, eax
or cx, 0xe127
adc esi, eax
dec cx
shr dl, 7
pop eax
pop eax
pop edx
jb fcn.10315919
rol ax, 1
inc ax
sal ecx, 0xec
mov dword [esp + edx*4 - 0x5c77ec0c], edx
not ax
js 0x102f3488
dec esi
popal
xor edx, dword [eax + 0xda8a4b3]
inc ebx
sbb byte [ebx - 0x44], dh
test al, 0xd
inc ebx
xor al, 0x8f
mov al, byte [0x430da8]
xchg edi, eax
sub byte [eax + 0x7b1c430d], 0xac
mov al, 0x9e
dec ecx
out dx, al
sub eax, 0xe9b2426b
int1
loope 0x1036ea67
push esp
loop 0x1036eaae
mov bh, 0x9c
push es
pop ebp
inc edi
adc dl, ch
popal
xor eax, 0xea106f53
popal
sub eax, 0x4814e365
invalid
xchg ebp, eax
cwde

Function at 0x10370791
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], eax
mov dword [esp], 0x86b26287
jmp 0x103eec2e
dec word [esp]
dec ebx
lea esp, [esp + 8]
jne 0x103d8f54
Function at 0x1037a3f2
Capabilities:
Encode data using base64

Disassembly:
dec edx
lea edx, [0x352f7a88]
inc ecx
xor ecx, ecx
inc ecx
sar ah, 0x27
rol ecx, 2
xor ecx, 0x4390752e
movzx eax, dx
inc sp
xadd esi, esp
sbb ecx, 0x8d04e893
xor ecx, 0x1b8f4e8b
dec esi
inc esp
movzx esi, dh
inc bp
xor esi, esp
bswap ecx
dec ecx
sbb eax, esp
dec esp
mov dword [esp + esi - 0x55bf5b3d], ecx
dec ebp
lea eax, [esi - 0x2c5e9b79]
dec si
xor dword [esp + esi - 0x55bf5b3c], ecx
dec eax
lea eax, [edx + edx - 0x5c548950]
inc esp
movsx ebp, ax
inc ecx
pop ecx
cbw
call fcn.102cfbca
inc ecx
xor eax, ecx
bswap eax
rol cx, 0x41
inc edx
lea eax, [eax - 0x581fade4]
inc ecx
ror ah, 0xa7
inc ecx
pop ebx
neg eax
dec eax
dec ecx
btc eax, 0x88
inc ecx
push ecx
inc cx
not eax
inc ebp
movsx ecx, ax
dec ecx
bt ecx, 0x8c
xor dword [esp], eax
inc esp
movsx ebx, si
inc ebp
movzx ebp, ax
dec ecx
or ecx, 0x30b1d5a7
inc ecx
pop ecx
dec eax
arpl ax, ax
jg 0x1042cc72
dec esp
cmovge ebx, edx
dec eax
adc ebx, eax
inc ecx
ror ch, 0x85
jmp ebx

Function at 0x1037a775
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0xfeb1e63a
push 0x2f9d2a06
lea esp, [esp + 0x20]
jmp 0x1044a940
push ebx
mov dword [esp], 0x56041bc3
call fcn.1046d00f
Function at 0x1037d755
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x103fea6f
mov edx, 0x17bd39b3
not eax
mov dword [edx + esi - 0x17bd39b3], eax
mov dword [esp + edx - 0x17bd39b3], edx
mov eax, dword [esp + edx - 0x17bd39b3]
xchg dword [esp + edx*2 - 0x2f7a7366], eax
lea edi, [edi + edx - 0x17bd39b7]
lea ecx, [eax + eax*2 + 0x563c850e]
neg ecx
mov edx, dword [edi + edx - 0x17bd39b3]
call fcn.1039ff82
mov dword [esp], ebx
mov ebx, 0xd6a21585
and bx, bx
movzx ebx, byte [ecx]
jno 0x10404c44
mov eax, 0x9116d3bf
push eax
inc al
movzx edx, byte [edi]
sub ax, ax
cwde
push eax
xor dl, bl
mov edi, eax
xadd word [esp + eax + 5], ax
push edi
neg dl
bts edi, edi
bswap edi
sbb dl, 0x8b
sal eax, 0xe1
neg dl
dec dl
sal edi, 0xd1
inc eax
movsx ecx, di
xor bl, dl
lea edx, [esp + edx + 0xc]
xadd dword [esp + eax*2 - 0x5b46], ecx
mov eax, dword [eax + edx - 0x2da7]
inc edi
ror word [esp + edi*2 + 7], 0x6e
mov edi, eax
lea edx, [ecx*8 - 0x267e29fe]
mov eax, ecx
pop ecx
pop eax
pop ecx
jne 0x10445255
xor ebx, eax
jmp 0x102ed19d
Function at 0x1037d7cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx*8 - 0x46dfe541]
mov dword [esp + ecx*4], eax
sub eax, 0xef169aaa
ror edx, 3
bts ecx, ecx
ror cx, 0xd
xadd word [esp + ecx*8 - 0x3d], ax
xor edx, 0x11b5c893
bts ecx, 0xb0
cwde
xor ebx, edx
add esi, edx
and byte [esp + ecx*8 - 0x8003b], 0x1f
sar cx, cl
mul dword [esp + ecx - 0xfffc]
mov dword [esp + ecx - 0x10000], esi
ret 4
add cx, cx
xor bl, dl
ror cx, 0xc1
sal dword [esp + ecx + 0x7fff8003], 0x2f
sbb ecx, ecx
lea edx, [esp + edx + 0xc]
xor dword [esp + ecx*8 + 0xd], ecx
call fcn.102d62cf
sbb eax, 0x9fadfc9f
shl ecx, cl
and dword [esp + 3], edx
jno 0x104b4bfc
rdtsc
lea esi, [ecx + esi - 0x102a074b]
sal cl, 0x85
dec ecx
mov dword [esi + ecx - 0x102a075b], eax
mov eax, 0xcb9b4abd
not ecx
mov dword [esi], edx
inc dword [esp]
cdq
pop edx
jae fcn.102d9ffd
bts ecx, ecx
or dl, al
not cx
jmp 0x104b9728
mov dword [esp + ecx + 0x7fff9c59], ecx
sub cx, cx
ror dl, 1
neg cl
je 0x104197e0
sal cx, 0xe8
lea edi, [edi + edx - 0x8c37]
neg cx
imul edx, edx
sbb dx, dx
xor eax, ebx
sal edx, 0x46
sub ecx, edx
bswap eax
ror eax, 1
sub eax, 0xfa3e453e
sal dx, 0x86
dec dx
and dx, dx
not eax
inc eax
xor ebx, eax
bswap ecx
add esi, eax
jmp esi
movzx edx, cx
inc edx
mov edx, dword [eax + edi - 0x4907fb07]
lea eax, [ecx + ecx - 0x42477657]
jl 0x102c9172
lea edi, [edi + ecx - 0x4907fb03]
setnp cl
lea eax, [eax*8 + 0x76b4fb27]
xor edx, ebx
xadd cx, ax
xor edx, 0x8eba8b3b
inc eax
not edx
bt ecx, eax
neg edx
or al, cl
adc cl, ah
sbb edx, 0x753aa105
inc ecx
xor edx, 0xfe0db01f
sar eax, cl
xor ebx, edx
inc ecx
add esi, edx
movsx edx, al
shr eax, cl
mov edx, dword [ecx + ebp - 0x4907f3db]
mov ecx, dword [ebp + eax*4 - 0x16]
bts ax, ax
add ax, ax
adc edx, ecx
lea ecx, [eax + 0x1232530b]
sub ecx, eax
mov dword [ebp + eax*2 - 0x216], edx
mov edx, eax
div ecx
mul cl
lea ebp, [ebp + eax - 0x92c]
setb cl
jmp esi
shr cl, 0xa2
xor dl, 0xb2
shl cl, 1
jp 0x104609f5
ror dl, 1
push ecx
imul cx, word [esp]
xor dl, 0xa
push ecx
not cx
neg dword [esp + ecx + 0x7fff0003]
add dl, cl
jmp 0x1033597b
xor ebx, eax
add esi, eax
pop edx
pop eax
jmp esi
mov eax, ecx
mov word [ebp + ecx - 0x4907fb05], dx
jmp 0x1038bfca
Function at 0x10382a43
Capabilities:
Encode data using base64

Disassembly:
xor bl, al
pop edx
mov dword [esp + edx - 0x575da5f8], ebp
sal dl, 0x62
sbb dx, dx
bts edx, edx
mov dword [esp + edx - 0x575cfffd], esi
shr edx, 0xcd
sal dx, 0xa6
mov dword [esp + edx*2 - 0x57400], ebx
lea ebp, [edx*4 + 0x1f958306]
mov ebp, edi
mov ebx, eax
lea eax, [edx*2 - 0x647c03f6]
ror eax, 0x41
mov edx, ebx
neg eax
bt eax, eax
btc eax, eax
shl edx, 2
inc eax
sal eax, 0xf4
mov eax, ebp
push 0xbb3812d
or word [esp + 2], 0xbbbf
adc eax, edx
mov dword [ebp - 4], eax
rol dword [esp], 0x14
push 0x7c202dbe
jae 0x1045644a
mov edx, 0xbe0c348d
movsx eax, dl
sub edi, 4
mov ecx, edx
xor eax, eax
mul edx
or eax, dword [edi + edx]
btr dx, cx
xor eax, ebx
not cl
not dx
neg edx
lea eax, [eax + ecx - 0x14d0e54e]
xor eax, 0xbc1dc286
shl edx, 0x2f
dec eax
rol edx, cl
ror edx, cl
xor eax, 0xea39db4
ror eax, 3
shr edx, 0x5d
inc dx
sbb eax, 0xc0190c0b
lea ecx, [ecx + edx*8 - 0x12fb35dd]
bswap eax
not eax
lea eax, [eax + edx*2 - 0x6ab1329c]
shl edx, 0xe3
neg dl
xor ebx, eax
add ebp, eax
dec cl
movzx ax, byte [esi + edx*4 - 0x360]
mov cl, byte [edx + esi - 0xd6]
and dx, 0xa7b1
or edx, edx
lea esi, [esi + edx - 0x8e]
neg dl
adc dl, 0xa4
shr al, cl
rol edx, 0x79
mov ecx, 0x2830142e
shr cx, cl
mov word [edx + esi - 0x2a000000], ax
jmp ebp
push edx
xor al, 0x19
mov dword [esp + edx - 0x575da5fc], edx
neg dl
jge 0x102c38a7
call fcn.1047a63d
retf
test ebx, ebx
lea esp, [esp + 8]
je 0x104aad55

Function at 0x10387835
Capabilities:
Encode data using base64

Disassembly:
neg al
xor ecx, 0x469adbba
xchg dword [esp + eax - 0x78e48bf6], eax
btr ax, dx
not ecx
xor byte [esp + edx - 0x36488268], al
dec byte [esp + edx*2 - 0x6c9104e0]
neg ecx
xor ax, 0xc422
bswap ecx
add eax, edx
rol ecx, 2
inc word [esp + eax - 0x1ad54689]
je 0x103e19bc
shr edx, 0x51
neg ecx
or eax, dword [esp + eax - 0x1ad5468b]
btr eax, edx
not ecx
call fcn.10401b50

Function at 0x10394ebf
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jne 0x1031fb72
pop edi
mov edx, 0xb031a12d
mov eax, edx
inc ax
not ecx
mov dword [ebp], ecx
movsx ecx, al
mov ecx, dword [ecx + edi - 0x2e]
btc eax, eax
adc edi, 4
inc dl
xor ecx, ebx
sub eax, edx
cwde
inc ecx
inc eax
bswap ecx
shl dx, 0xc7
neg ecx
and edx, 0x7e24b32c
bswap edx
ror ecx, 1
ror edx, 0xd1
bt edx, edx
xor ebx, ecx
xchg edx, eax
inc eax
shr eax, 0xbe
adc esi, ecx
and eax, edx
ror dx, 0x85
bt eax, eax
adc eax, esi
jmp eax

Function at 0x10398b44
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jne 0x10314482
mov ecx, 0xf30a20bb
movzx eax, cx
pop esi
shl byte [esp + 7], 0xa4
xor edx, 0x2c91613b
jmp 0x1040227e
xor dword [esp + 4], 0xa92db412
dec eax
push 0x532b87b6
jmp 0x10446bae
jmp 0x1031b341
Function at 0x1039a2a8
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor eax, ecx
mov ecx, 0xac2aac39
inc ecx
movzx esi, bl
inc ecx
dec eax
inc eax
not bh
dec eax
xadd edi, ecx
inc esp
movsx ebp, dh
inc ecx
rol eax, 1
inc esp
movsx esi, cl
dec ebp
lea edx, [esi + esi*8 + 0x409c5e0e]
inc ecx
bt ebp, 0xaa
inc ecx
not eax
inc cx
dec edx
dec ecx
not esi
inc ecx
not ah
inc edi
lea eax, [esp + eax + 0x511506cb]
call fcn.102ded60
add ecx, 0x5ac4f0c
shl dword [esp + 5], 0x53
je 0x103d79f3
ror ecx, 2
jmp 0x10479312
shr cx, 0x6d
adc ebp, eax
add cl, byte [edi + edx*2]
neg edx
lea eax, [edx*4 + 0x239490bc]
sbb edx, eax
lea edi, [edi + eax*2 - 0x47292177]
lea edx, [edx + eax*4 - 0x41c1b8e1]
ror dx, 0x63
xor cl, bl
cdq
div eax
neg edx
not cl
jae 0x102cb0f6
mov edi, 0xf06389b
inc esp
movsx esp, di
dec eax
lea ebp, [ebp + edi*2 - 0x1e0c713a]
dec esi
lea ebx, [0x3429c62b]
inc ebp
and esp, esp
dec ecx
shl ebx, 0x4c
inc esp
mov eax, dword [ebp + edi - 0xf06389b]
inc di
jns 0x103866c6
nop
mov cx, ss
mov ss, cx
jmp 0x1041503d
call fcn.102d09df
mov edx, 0x64886385
mov cx, word [ebp + edx - 0x64886385]
shr edx, 0xf2
movzx eax, dl
ror al, 0x43
mov dx, word [ebp + edx*4 - 0x6486]
and eax, eax
adc eax, eax
lea ebp, [ebp + eax*4 - 0x21e]
btc eax, eax
or cx, dx
not cx
mov word [ebp + eax*2 - 0x310], cx
movsx ecx, ax
xadd ecx, eax
mov ecx, dword [esi + eax - 0x188]
mov edx, eax
lea esi, [eax + esi - 0x184]
shl edx, 0x76
xor ecx, ebx
rol eax, 0xd4
sal edx, 0xd9
neg ecx
bswap eax
ror eax, 8
add ax, ax
bswap ecx
xadd edx, eax
add al, 0xab
xor ecx, 0xb352e26
dec edx
mul eax
call fcn.1043a979
jns fcn.10315919
fcmovnu st(0), st(1)
xchg dword [esp + ecx*2 - 0x10], ebp
inc esi
push es
iretd

Function at 0x1039f1ce
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x41bfff6a], ecx
lea esi, [esi + ecx - 0x41bfff64]
or ecx, ecx
rol cx, 0x8f
movsx edx, cx
mov edx, dword [edi + ecx - 0x41bf7fba]
add ecx, ecx
lea eax, [ecx + ecx*2 - 0x486205f2]
xadd dword [esp + eax - 0x421af844], eax
adc edi, 0xfffffffa
bt eax, eax
adc ax, ax
xor edx, ebx
or dword [esp + 8], ecx
rol edx, 1
sal word [esp + 9], 0x8b
xor edx, 0x34bac090
call fcn.10403620

Function at 0x1039f273
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edi
push 0xc0bad98f
mov edi, dword [esp]
movzx edi, byte [eax]
call fcn.102c60f0
call fcn.10441c70
push ecx
sbb edx, dword [esp + edx - 0x2a417633]
xor eax, ebx
ror eax, 2
inc eax
lea edx, [edx + edx*4 - 0x6dd5084f]
pop ecx
rol eax, 1
lea eax, [eax + ecx - 0x440fdf0e]
dec dx
xor edx, 0xb83d3a37
xor eax, 0x8407463b
call fcn.103235aa
Function at 0x103a05c5
Capabilities:
Execute syscall

Disassembly:
movzx eax, dx
xor ecx, 0x45b11430
dec al
jno 0x10338fd4
mov esi, 0xd1ae6f1f
inc esp
movzx esi, word [ebp - 2]
inc bp
xor esi, ecx
movzx edi, si
dec eax
imul esi, edi
inc cx
dec esi
dec esp
lea edx, [edi + esi*2 + 0x32af20a8]
inc cx
not esi
inc esp
movsx esp, si
inc cx
xor esi, 0x6de8ce93
idiv edi
pop eax
xor bl, byte [esp + eax*8]
loopne 0x103a0630
mov ebp, 0x30ce7cd4
dec ecx
sbb eax, 0x30ce5c94
dec ecx
popfd
cld
into
xor byte [ecx + 0x5d], cl
invalid
lea edx, [esi + ecx*8 + 0x30]
dec ecx
aad 0xf4
push es
pop edi
dec ecx
pop ds
inc ebp
inc ebx
mov eax, dword [0x1324f6a6]
pop ebp
sar bh, cl
invalid

Function at 0x103a50e3
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 8
mov dword [esp], 0x8c8ed081
ror byte [esp], 0x85
mov dword [ebp + 0xc], eax
not dword [esp]
mov eax, dword [esp]
not dword [esp + eax - 0x73712ff3]
mov dword [ebp + eax - 0x73712feb], ebx

Function at 0x103aa667
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], eax
dec bx
call fcn.10400b80