joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017befe
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + edx - 0x2a90], edx
xor ecx, ebx
lea ecx, [ecx + eax - 0x6521e674]
sub word [esp + edx - 0x2a8d], dx
jne 0x1026dc73
xchg ah, al
ror ecx, 2
not ecx
ror ecx, 1
bswap ecx
pop eax
sar edx, 0x7a
neg ecx
ror ecx, 1
xor ebx, ecx
add edi, ecx
add dl, byte [edx + ebp - 5]
movzx ecx, byte [esp]
shl ecx, 0x85
lea ebp, [ebp + ecx*8 - 0x6f05]
inc eax
shl ecx, 0x10
shr eax, 0xe9
xor dl, bl
and dword [esp + ecx - 0xde00000], 0x98b733e
dec dl
ror dl, 1
xor dl, 0xac
pop ecx
dec dl
not dl
xchg cx, ax
shr cx, 0x21
xor bl, dl
shr ax, cl
dec al
sete al
mov word [esi + ecx*2 - 0x316000a], dx
jb 0x101f1925
sar cx, cl
lea esi, [ecx + esi - 0x18afff6]
jmp edi

Function at 0x101835dc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.1038bbd0
push edx
rol dword [esp + edx - 0x43090018], 1
inc eax
mov ecx, edx
not eax
dec dword [esp + ecx - 0x43090018]
not dword [esp + edx - 0x43090018]
sal edx, 0x61
lea eax, [eax + edx*2 - 0x420d2159]
xor byte [esp + ecx - 0x43090018], 0xa7
ror cx, 0xed
call fcn.101b6667

Function at 0x101877bc
Capabilities:
Encode data using base64

Disassembly:
not ecx
dec al
add ebp, edx
inc cl
mov dword [esp + ecx*2 - 0x390f062c], ecx
mov edx, dword [esp + ecx*4 - 0x721e0c4c]
mov dx, word [ecx + edi - 0x1c878318]
call fcn.1017c7c0

Function at 0x10189095
Capabilities:
Encode data using xor

Disassembly:
xor ecx, 0x1f0c6310
jmp 0x102a077a
not edx
mov dword [esp + ecx - 0x5e434d3f], ecx
or dword [esp + ecx - 0x5e434d3f], 0x991af6a4
shr cl, 0xc7
or eax, edx
not ecx
sar cx, 0xa1
mov dword [ebp + 4], eax
jle 0x103e7b86
xor ecx, ebx
dec ecx
lea eax, [edx*8 + 0x513bc39c]
bswap ecx
not edx
jmp 0x101689c6
mov ecx, dword [esi + 4]
sub esi, 0xfffffff8
mov edx, 0x3d0ffc3c
jmp 0x10200e36
Function at 0x10196f43
Capabilities:
Encode data using base64

Disassembly:
xchg byte [esp + edx - 0x11657a54], al
mov edx, dword [edx + edi - 0x11657a57]
sal eax, 0xee
mov cx, word ss:[edx]
lea eax, [eax*8 - 0x7c4c3852]
sar al, 0xe7
mov word [edi + 6], cx
mov ecx, dword [edi + 6]
or eax, eax
adc edi, 0xa
movzx edx, byte [esi - 5]
sub esi, 5
xor dl, bl
mov dword [esp], eax
add dl, 0x29
push eax
xor dl, al
and dword [esp + 1], eax
call fcn.101ca7db
xor ecx, ebx
mov edx, 0x6d01fe1e
lea ecx, [edx + ecx - 0xd438d62]
lea eax, [edx*4 + 0x49b49e97]
neg ecx
dec al
jnp 0x101d547b
lea ecx, [ecx + edx - 0x7a993b24]
sal eax, 0x77
setbe al
xchg al, dl
xor ecx, 0x622b1818
ror ecx, 1
dec eax
xor ebx, ecx
and eax, eax
adc esi, ecx
call fcn.101d0faf
mov ecx, 0x9919e635
movsx eax, cl
mov edx, dword [esi + eax - 0x39]
rol al, 3
jb 0x1023176c
lea ebp, [edx + ebp - 0x7bb53a3]
pop edx
pop eax
jg fcn.1034425b
mov eax, 0x84b23410
shr al, 0x42
sal eax, 0x94
lea esi, [esi + eax - 0x40400004]
mov ecx, dword [esi + eax - 0x40400000]
adc eax, eax
sal eax, 0xf8
lea edx, [eax*8 + 0x423e101e]
xor ecx, ebx
xor dl, dl
jb 0x103d8799
bswap ecx
xor ecx, 0xec805029
and eax, eax
jle 0x10215c5f
ror ecx, 2
jmp 0x10307c5d
xchg ecx, eax
xor edx, 0xc136c018
jmp 0x103817d8
shr ecx, cl
lea esi, [esi + ecx*4 - 0x1324]
neg eax
xor edx, ebx
sub eax, 0xdabdd88b
inc eax
bswap edx
neg ecx
jnp 0x101da186
not ecx
xadd edx, eax
rol eax, 0x79
inc ecx
ror ecx, 3
bswap edx
dec al
inc ecx
rol ecx, 1
dec ecx
and eax, edx
dec al
ror al, 0x61
rol ecx, 1
push edx
push eax
call fcn.101e5bb5

Function at 0x1019ae97
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp], edx
shr cl, 0xc1
mov dword [esp], 0xca2ad4aa
mov dword [ebp + 4], eax
call fcn.102aaae5
add dh, byte [edx - 0x68]
sal esp, 0xef
xlatb
ficomp dword [eax - 0x2e2aefda]
rcr byte [eax - 0x5842efda], cl
ffree st(6)
test cl, dh
insd dword es:[edi], dx
push es
pushal
sti
xchg edi, eax
mov dword [ecx], ebx
out 7, al
out 0x56, al
pop esp
dec ebp
jg 0x1019af36
push esi
mov esp, 0x900924a0
insb byte es:[edi], dx
jno 0x1019af1f
xchg ebp, eax
insd dword es:[edi], dx
xor byte [edx], dl
movsb byte es:[edi], byte [esi]
lahf
jl 0x1019af0a
stosb byte es:[edi], al
xor eax, 0x5bbfd1ed
daa
test eax, ecx
dec ecx
mov edx, 0x3ec6d144
pop ebx
jne 0x1019af0d
arpl word [edx + 0x7fceda61], bx
out dx, al
xchg ecx, eax
lcall 0x91ee, 0x7fceda61
and eax, 0xf3880b5b
jbe 0x1019aee0
out dx, eax
xor eax, dword [ecx - 0xe9781d2]
xor esp, edi
loope 0x1019af48
push 0xe1e733f1
out 0xe1, eax
cmp byte [edi + 0x125b42a5], ch
rcl dword [ebx + 0x10], 0x5b
and esp, edx
fist dword [ecx - 0x1e]
mov dword [0xeaabeb5b], eax
add edx, esp
mov dword [0x4dfbf65b], eax
stc
call dword [eax - 0x75]
mov word [edx], cs
pop edx
sub ecx, esp
int3
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
inc edx
pop ebx
adc al, cl
push ebx
adc byte [ebx + 0x23], bl
loop 0x1019aef7
push ecx
loop 0x1019aec2
pop ebx
jmp 0x1019aecd
and eax, 0x246480fc
add ah, byte [ecx]
sbb ebp, 4
mov ecx, 0x830bf53a
pop ecx
pop ecx
pop edx
jmp fcn.1031e0c1
Function at 0x1019c7da
Capabilities:
Encode data using xor

Disassembly:
pop ecx
movsx ecx, dx
rol al, 1
neg ecx
xor al, dl
ror dx, 0x41
and dword [esp + ecx*2 - 0x8ffa], 0xbf8d7424
pop edx
adc al, cl
xor bl, al
pop ecx
lea eax, [esp + eax + 4]
call fcn.101c172e

Function at 0x1019fa82
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x9a314980
add dword [esp], 0xefdd6a92
sub bx, bx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0xc], 0xe022c513
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10322342
neg ecx
mov eax, 0xd633e500
ror ecx, 1
mov edx, 0x248b4229
xor ecx, 0xa18fa90
inc dx
not al
add eax, eax
xor ebx, ecx
sar ax, 0xcb
or ax, dx
sbb edx, edx
adc edi, ecx
mov eax, dword [ebp + edx*8]
jmp 0x102decff
sal byte [edx], cl
fld dword [ebx]
int3
lea ebp, [ebp + edx + 2]
call fcn.10243f5f
rol dword [edx], 0x98
add esi, esi
mov es, edx
push edi
lahf
add dword [edx - 0x60a8751e], esp
mov dl, byte [edi - 0x61]
add edx, ebp
loop 0x101ecd34
push edi
lahf
add esi, esp
mov esi, 0xdd2efa12
movsb byte es:[edi], byte [esi]
mov eax, dword [0x461f0332]
and bl, byte [edi]
stosd dword es:[edi], eax
xor dword [esp + ecx*4 + 0x37], esi
mov al, 0xb1
cmp ebx, ebp
inc esp
dec eax
das
sal byte [esi - 5], 0xdf
in al, 0xeb
add eax, 0xd001b83a
xor al, 0xf5
mov cl, 1
or al, 0x16
xchg ebx, eax
nop
sub bl, ch
or eax, 0xe3abc3e8
outsd dx, dword [esi]
out 0xa6, eax
sar byte [edx + 0x4d952b28], 1
cmc
rcl byte [ecx + ebx - 0x65c2a647], cl
and edi, edx
aam 0xd2
fidiv dword [esi]
cmp ah, byte [esi + 0x28]
stosd dword es:[edi], eax
push cs
pop edx
mov esi, 0xab286612
push ss
jnp 0x101ecd97
sbb dl, byte [ebx + 0xf]
retf 0xc822
mov ecx, edx
push edx
xor cl, byte [edx + ebp + 4]
jmp 0x101ecd82

Function at 0x101b43df
Capabilities:
Parse pe header

Disassembly:
push eax
xor ebx, edx
add cl, 0x99
adc edi, edx
sal byte [esp + eax + 0x17], 4
mov cl, byte [eax + ebp - 5]
call fcn.10268925
Function at 0x101c2ce6
Capabilities:
Encode data using xor

Disassembly:
ror al, 1
ror word [esp + edx + 2], 0x6c
dec cx
dec al
bswap ecx
and cx, cx
rol al, 1
mov dword [esp + edx - 2], edx
adc al, 0xfe
xor bl, al
shl cx, 0xa1
call fcn.1028c73e
not edx
jecxz 0x101c2cfc
mov eax, dword [0xc9a35e8]
add bh, dh
shl bl, cl
out dx, eax
in al, 0xf4
lodsb al, byte [esi]
call edx
jecxz 0x101c2d03
mov eax, 0xf5e3ecb8
out dx, eax
mov edx, 0xb2aa92fe
pop esp
adc al, 0xdc
out dx, eax
into
aam 0x5c
sub cl, bl
mov esi, 0x17a1c43a
mov ecx, 0x95ed31ce
xor al, 0x30
cmc
pop edi
push 0x792b0aef
xor al, byte [edi + ebp - 0x6f]
xchg ecx, eax
iretd

Function at 0x101ed289
Capabilities:
Packed with generic packer

Disassembly:
inc cl
shl eax, 0xc7
xor bl, cl
mov word [ebp + eax*2 - 0x3b13e002], cx
mov dword [esp + eax*2 - 0x3b13e000], eax
shr dword [esp + eax - 0x1d89eff2], 0x45
lea ebp, [eax + ebp - 0x1d89f002]
and ax, word [esp + eax - 0x1d89efee]
pop eax
pop edx
pop edx
pop ecx
pop eax
jbe fcn.1031e0c1
mov word [ebp - 2], es
pop ds
in al, dx
les ecx, [ecx + 0x20004484]
in al, dx
invalid
outsb dx, byte [esi]
cmp dword [eax*4 + 0x10171d4c], eax
inc edi
xchg edx, eax
sbb byte [0x210f1017], bl
pushal
sbb eax, 0x74fb1017
pop esp
sbb eax, 0x1a531017
mov ah, 0xda
js 0x101ed2f1
inc esp
pop eax
rol esi, 0x27
mov esi, 0x37c2bdef
outsd dx, dword [esi]
fsub st(3)
xchg esp, eax
sub esp, edx
movsd dword es:[edi], dword [esi]
sub ch, byte [edi - 0x2e]
or dl, byte [ebx - 0x205d4e6a]
inc esp
salc
adc dword [eax + 0x10], 0xd75a8b25
out dx, eax
pop es
cmp esp, dword [ebx + 0x7c]
mov bl, 0x85
ja 0x101ed292
mov edi, 0x225f5fb3
int1
mov ebx, 0xff321f7e
and dword [ebx - 0x4b], ecx
cmp byte [eax*4 + 0x10171c97], al
xor dword [ebx + 0x10171c8f], 0x1cbf351d
pop ss
adc byte [esi + 0x171ce768], dh
adc bh, ch
cmp byte [ebx - 0x7defc380], al
push edx
push eax
push ecx
pop edi
pop edi
adc byte [0x2c80da4e], cl
fsubr dword [0xfa082bdb]
cld
out dx, eax
add byte [eax + 0x319701ef], 0x48
mov dh, 0xc7
aad 0xb1
and al, 0xcc
outsd dx, dword es:[esi]
and ah, cl
daa
adc ecx, dword [edx]
invalid

Function at 0x101f30b7
Capabilities:
Encode data using base64

Disassembly:
sal cx, cl
lea edx, [edx + eax - 0x6dbb862c]
ror edx, 1
mov dword [esp + eax - 0x4100dffe], ecx
ror eax, 0x9b
xor ebx, edx
add edi, edx
pop ecx
pop ecx
jmp fcn.102e41c2
Function at 0x101f3320
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*2 - 0x60000000], edx
xor ecx, 0x9908e03f
dec dx
inc edx
not word [esp + eax - 0x2fffffff]
neg ecx
call fcn.1029984f
mov edx, dword [edi]
add edi, 4
mov ecx, 0x6b1e108c
xor edx, ebx
adc byte [esi], bl
imul esi, dword [ebx], 0xffffffd3
lea eax, [ecx + ecx*4 - 0x684527cb]
test byte [ecx - 0x684527cb], cl
lea ecx, [eax*8 + 0x4fb7b2bc]
dec edi
neg edx
sub cx, 0x1794
bswap edx
ror cl, 0x62
shl eax, 0x19
shl al, 0x26
ror edx, 3
sal ecx, cl
inc edx
or eax, 0x4d95189e
add ecx, eax
xor ebx, edx
add esi, edx
call fcn.10217df8
pushal
or bh, dh
sbb esi, dword [edx + 0x51]
jl 0x101f3347
dec edi
js 0x101f33e7
jl 0x101f334d
dec edi
xor byte [eax + 0x35], 0x7c
mov ebp, 0x2d30ec4f
jl 0x101f3359
dec edi
or bh, byte [eax]
pop ebx
mov esi, 0xafecaa58
adc al, 0x74
fadd qword [esi + ebx*2 + 0x79]
xchg edi, eax
push es
invalid
cdq
mov dl, 0x32
cmpsd dword [esi], dword es:[edi]
xchg byte [ecx], cl
test al, 0xc
mov ebx, 0x5ad8c7c
leave
push esp
add dword [edi + 0x79f2c523], 0xa1f2c3ea
nop
dec ebx
xchg ebp, eax
dec esp
add bl, byte [0xb4965b0]
mov edi, 0xb8183f5e
lodsd eax, dword [esi]
push cs
sbb eax, 0x2f4faae9
pop ds
adc al, 0xce
mov dword [ebx + ebx*4], esp
scasd eax, dword es:[edi]
add ah, al
mov edi, 0x90bc67d0
dec ebx
ljmp 0x912f
bnd jns 0x101f33d4
ret

Function at 0x101f9e4a
Capabilities:
Encode data using base64

Disassembly:
xor cl, byte [ebp + ecx - 0x724f0ffa]
mov dword [esp], eax
shl edx, cl
mov dword [ebp + 4], edx
lea ecx, [eax*8 - 0x6bd78e77]
movzx eax, word [esi + ecx*2 - 0x31c7e318]
push ecx
lea esi, [esi + ecx*2 - 0x31c7e318]
dec word [esp + ecx*2 - 0x31c7e30e]
call fcn.1028b8f8

Function at 0x10213f7f
Capabilities:
Packed with generic packer

Disassembly:
pop eax
jmp esi
mov dword [esp + edx + 4], 0x1abb5239
xor ebx, eax
not cx
call fcn.10373c68
inc cl
not dl
add cl, cl
rol dl, 1
lea ecx, [ecx + ecx*2 - 0x51f1a871]
dec ecx
xor dword [esp], ecx
xor bl, dl
lea edx, [esp + edx + 4]
xadd cl, ch
inc word [esp + 1]
add cx, word [esp + 2]
mov dword [edx], eax
jne 0x1020e77f
mov edx, 0x191c5516
neg dx
lea edi, [edi + edx*4 - 0x6472aba4]
lea edx, [edx + edx*4 - 0xaf1a6fc]
jb 0x1035c90b
mov edx, 0x99baa89c
movsx eax, dx
mov ecx, dword [esi]
xadd eax, edx
mov eax, dword [esi + 4]
jbe 0x1022db7b
sar edx, 0xfe
add esi, 8
rol dl, 0x47
inc edx
sbb dl, dl
mov dword ss:[ecx + edx - 0xff], eax
lea ebp, [ebp + edx*2 - 0x202]
call fcn.102f96f3
mov ecx, 0x4e0c79a2
mov edx, ecx
mov eax, dword [edx + ebp - 0x4e0c79a2]
sal cx, cl

Function at 0x102169e5
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [edx + ebp + 2]
mov dword [esp + edx*4], 0x67220091
or cl, al
neg edx
dec dl
xor cl, dl
movsx eax, word [esp + edx - 0xfe]
not dword [esp + edx - 0xfe]
inc dl
mov word [ebp + edx*2], cx
Function at 0x10217c68
Capabilities:
Encode data using xor

Disassembly:
add edx, 0x16892c85
ror edx, 3
call fcn.102c3529
movzx ecx, byte [edx + edi - 0x68188b87]
shr dword [esp + edx - 0x68188b87], 0xfe
sar dx, 0x6b
xor cl, bl
neg edx
ror cl, 1
sub edx, edx
adc cl, 0x12
rol cl, 1
inc cl
xor bl, cl
ror edx, 0x5d
lea ecx, [esp + ecx + 8]
sar dl, 0xa7
mov byte [ecx + edx*8], al
mov ecx, edx
movzx eax, byte [edx + edi + 5]
dec edx
call fcn.102a0715
mov eax, 0x32bc70bc
mov eax, dword [edi + eax*2 - 0x6578e178]
mov ecx, 0xd283f7a9
mov ecx, dword [edi + 4]
mov edx, 0x93929830
ror dx, 0x42
adc eax, ecx
mov ecx, edx
mov dword [edi + 4], eax
movzx eax, cl
xor al, 0x86
cmovo edx, ecx
mov ecx, dword [ebp + eax - 0x8a]
shl al, 0xc4
xor ecx, ebx
neg dx
xor edx, edx
bswap ecx
and ax, dx
xor ecx, 0xe9b21ead
add ecx, 0xbeb74fb8
xor ecx, 0x8a23161f
or edx, eax
xor ebx, ecx
add esi, ecx
call fcn.102168ec
test byte [eax + eax*8 + 0x1b], 0xc2
mov esi, dword [edx]
or dword [edi + 0x52], 0xffffff98
mov edi, 0x8a4f8332
jp 0x10217cb5
xor al, byte [ebx - 0x100763b1]
xor al, byte [ebx - 0x2e25cbb1]
mov ecx, 0xf0904287
cmpsd dword [esi], dword es:[edi]
adc dl, dh
sti
and dword [eax + 0x52], edi
test eax, 0xf2b89aa6
mov byte [0x7bd13227], al
mov byte [0x688b8e8f], al
add byte [bx + di + 0x10e2], dl
dec esp
and eax, 0x6b9e4252
xor eax, 0x44f17ba2
sahf
sbb eax, 0x756a19ce
das
fsubr qword [edi]
push eax
xor eax, 0x3b3ba42f
push eax
xor eax, 0xf524a02f
push es
sub byte [edi], ch
dec ebp
mov edx, dword [ebp]
mov ecx, 0x4907f2a1
movsx eax, cx
mov cx, word [ebp + ecx - 0x4907f29d]
bswap eax
add ebp, 6
not eax
mov word ss:[edx + eax - 0x5e0d0000], cx
lea ecx, [eax*8 - 0x4d5670d1]
sal ecx, 0x90
mov eax, dword [edi + eax - 0x5e0d0000]
mov edx, ecx
and dl, 1
sal ecx, 0xc4
adc edi, 4
shl cx, 0x84
xor eax, ebx
sar edx, 0xa9
rol edx, 0x41
push edx
inc eax
push ecx
sub dx, 0x3e19
xor eax, 0x753634a2
lea eax, [ecx + eax - 0x563fee4]
inc dx
ror cl, 0x81
ror eax, 2
and byte [esp + 1], 0x10
xor ebx, eax
add esi, eax
xchg word [esp + 6], cx
pop ecx
pop edx
jmp esi
Function at 0x10225007
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp + edx*4 - 0x149a9178], edx
mov edx, 0
neg dword [esp]
sub ebx, edx
lea esp, [esp + 4]
lea ebp, [0x1022501c]
sub esi, 4
mov edx, 0x10170e37
sub edx, edx
lea eax, [edx + edx*8 + 0x751cb418]
mov ecx, dword [edx + esi]
inc eax
lea eax, [eax + eax + 0x6311c681]
shr edx, 0x9d
xor ecx, ebx
lea eax, [edx + eax*2 - 0x59dcb8ff]
jmp 0x102bd436
call fcn.1028ffe4
sal dword [esp + ecx*2], 0x5e
ror dl, 1
xor bl, dl
lea eax, [ecx*8 + 0x3e21d185]
lea edx, [esp + edx + 4]
xadd eax, ecx
ja 0x102ba85a
sub eax, dword [esp + ecx - 0x3e21d185]
mov ecx, dword [edx + eax - 0x7e21d185]
movzx edx, word [esp + eax - 0x7e21d185]
push eax
ja fcn.1024d912
lea esi, [esi + edx*2 - 4]
mov dword [esi + edx*4], ecx
or al, 0x9e
pop edx
pop eax
jp fcn.10360cf3
pop eax
dec ebp
sub dword [edi], 0x53
lea ecx, [ecx + eax*4 - 0x7fb614f4]
not ecx
lea ecx, [edx + ecx + 0x4a8cde0f]
or edx, eax
bswap ecx
and eax, edx
shl eax, 0x58
rol edx, 0xb2
not ecx
ja 0x1026cd04
std
lds ebx, [ebx - 0x5e]
and dword [eax - 0x981a63b], 0xa4c882be
xor edx, 0xa4c896c2
and esi, 0x3c7b1ace
imul ebx, ebp, 0x47
sal esp, cl
mov ebx, 0x95ab3e7a
push eax
xlatb
push eax
jle 0x102bd431
fdivp st(7)
invalid

Function at 0x1022a222
Capabilities:
Encode data using xor

Disassembly:
neg dl
mov dword [esp + ecx - 0x14adc8ae], eax
xor bl, dl
lea edx, [esp + edx + 0x10]
inc ecx
mov eax, dword [edx + ecx*2 - 0x295b915e]
mov dword [ebp + ecx - 0x14adc8b3], eax
ror word [esp + ecx - 0x14adc8a1], 0x66
lea ebp, [ebp + ecx*4 - 0x52b722c0]
lea eax, [ecx*2 - 0x1afccae1]
sar eax, 0x9d
xor eax, 0xf8c1e503
popfd
mov edx, dword [ecx + edi - 0x14adc8ac]
shl al, 0xc1
lea edi, [edi + ecx - 0x14adc8a8]
xor cx, ax
xor edx, ebx
not ecx
sar cl, 0xa3
not edx
xadd word [esp + eax*2 + 3], ax
pop eax
xor edx, 0x968cf521
dec edx
or ax, ax
call fcn.101ae69f
loop 0x1022a254
leave
pop ds
xor ebp, dword [ecx - 0x67]
add eax, 0x330231d8
sub ebx, 0xffffff9f
adc al, byte [eax + 0x1c]
xor ebp, dword [edi + 0x403ee35f]
sbb al, 0x33
arpl bx, bx
sub dword [edx], 0x64
cmp al, 0x3b
mov dh, 0xb7
dec esp
push ecx
add eax, 0xfbec52bd
adc edx, dword [eax - 0x3de5905a]
cmc
and ah, byte [edi + ebp*2 + 0x22c19e1a]
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
invalid

Function at 0x1023214b
Capabilities:
Packed with generic packer

Disassembly:
push eax
xor ebx, edx
sub ecx, ecx
adc ecx, ecx
jge 0x10283709
Function at 0x1023947c
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [ebp]
mov edx, ecx
xor eax, ebx
ror cl, 0xa1
seto dl
sal dx, 0x8f
ror eax, 1
ror edx, 0x50
xadd cl, ch
call fcn.103cba45
mov eax, dword [edi]
mov ecx, 0x7c127fa3
sar ecx, 0x53
mov edx, dword [edi + ecx - 0xf7e]
xchg ch, cl
ja 0x103c0591
sar dx, 0x4e
mov byte [ecx + edx*4], al
movsx eax, dl
mov dword [esp + edx], eax
not eax
mov ecx, dword [esi + edx - 5]
neg dx
jle 0x1025a6b9
sub esi, 4
mov edx, 0x2602c8bf
shr edx, 0x1c
mov ecx, dword [edx + esi - 2]
shl dx, 5
xor ecx, ebx
movsx eax, dx
rol ecx, 2
lea ecx, [ecx + edx*4 + 0x6131a33]
or edx, 0xf08f620
sub ax, 0x9f15
not ecx
add eax, 0x41a20cb9
rol edx, 0x4c
lea ecx, [ecx + edx - 0x4acf34ba]
shl dl, 0x61
sal al, 0x27
xor ebx, ecx
ror dx, 2
add ax, dx
xadd al, ah
adc edi, ecx
sar edx, 0x1d
mov ecx, eax
call fcn.10364fa8
ror dl, 0xc7
lea esi, [edx + esi - 5]
xor ecx, ebx
dec ecx
and eax, 0xa6a98303
or dword [esp + edx*8 + 1], edx
neg ecx
not dx
call fcn.101f69d7
mov ecx, 0xe512cabe
jmp 0x10200305

Function at 0x102396d5
Capabilities:
Encode data using xor

Disassembly:
xor bl, cl
lea ecx, [esp + ecx + 0x14]
call fcn.102a2391
Function at 0x1023f06c
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + ecx*2 - 0x6bfa0008]
add ecx, ecx
bswap eax
ror cx, 0xad
xor edx, ebx
sal ax, 0xec
call fcn.1025b3b6
xor cl, 0x8a
jmp 0x103dd373
mov ecx, dword [ebp + edx*8 - 0x206c4]
lea ebp, [ebp + edx*8 - 0x206c0]
inc edx
jno 0x102dd4d6
xchg dword [esp + ecx*2 - 0x1affaf04], eax
xor ebx, edx
ror ax, 0xee
mov dword [ecx + esi - 0xd7fd789], edx
mov edx, 0x8d2feab5
dec dx
lea esi, [esi + ecx*8 - 0x6bfebc1e]
sbb ecx, dword [esp + ecx*2 - 0x1affaf06]
mov edx, dword [ecx + ebp - 0x35fd0008]
jno 0x1023a5a9
add edx, edx
mov dx, word [ebp + ecx - 0x7f35aab9]
ror ecx, cl
lea ecx, [ecx + ecx*2 + 0x5eb0be03]
lea ebp, [ebp + ecx - 0x4bb8bfbe]
mov word ss:[eax + ecx - 0x4bb8bfc4], dx
mov eax, dword [edi + ecx - 0x4bb8bfc4]
movsx edx, cx
cmovb dx, cx
lea edi, [edi + ecx - 0x4bb8bfc0]
seta dl
xor eax, ebx
rol edx, 0x21
inc eax
xor eax, 0x753634a2
add edx, ecx
or dl, ch
lea eax, [eax + ecx*4 - 0x4156fdf4]
inc cx
sal cl, 0x41
ror eax, 2
shl ecx, 0x67
xor ebx, eax
add esi, eax
lea eax, [edx - 0x17d3ca62]
jmp esi
mov eax, dword [ebp + ecx*4 - 0x33814]
call fcn.101f6cd9
lea edx, [edx + 0x571b8a82]
mov dword es:[eax + edx - 0x571bcb5c], ecx
mov eax, 0x8080373e
not dl
mov ecx, dword [esi + edx - 0x571bcba3]
ror byte [ebx + 0x345d168c], cl
in al, 0xa8
sal ax, 0x29
lea esi, [esi + edx - 0x571bcb9f]
rol eax, 0x42
xor ecx, ebx
push eax
rol ecx, 2
mov dword [esp + eax*4 - 0x807c004], eax
sar dword [esp + eax - 0x201f002], 0x3b
bswap ecx
sar ax, 0xa2
add edx, 0xd90b181c
sub edx, 0xe71e269f
sub ecx, 0xc5af96a0
rol dword [esp + eax*4 - 0x807effd], 0xfb
and word [esp + eax - 0x201fbfe], ax
add al, 2
add al, 0xfe
std
not ecx
sal edx, 0x23
jne 0x103027fe
call fcn.10384825
loopne 0x102dd4ea
cld
cmp esi, dword cs:[ebx - 0x23]
out dx, eax
xor byte [eax + ebp*2], al
pop ebx
jae 0x102dd538
out dx, eax
insb byte es:[edi], dx
jo 0x102dd5bf
outsd dx, dword [esi]
push esp
adc bh, ch
adc dl, byte [edx]
push cs
jbe 0x102dd5b2
sub al, 0x90
hlt
add al, 0x2a
rol ecx, 0xbb
pop eax
pop eax
pop eax
js fcn.102de7c4
add byte [edi], cl
leave
jne 0x1033b3cf
xor ebx, ecx
ror byte [esp + edx - 0x4845e8f9], 0x61
adc edi, ecx
movzx ecx, dl
call fcn.101b9ba7
mov edx, 0x253dce05
movzx ecx, dx
lea ebp, [edx + ebp - 0x253dce09]
jmp 0x1023f121
rol cl, 1
jmp 0x10284034

Function at 0x102591af
Capabilities:
Encode data using xor

Disassembly:
mov cx, word [edi + ecx - 0x3c7]
add al, ah
xor cx, bx
add al, ah
bswap eax
sub cx, 0xf820
sal byte [esp + eax - 0x14cffdf4], 0xa5
call fcn.1022acc1
sub bh, byte [esi + 0x50]
add ecx, dword [edi + 0x35]
mov cl, byte [esi + 0x354ee348]
stosb byte es:[edi], al
out dx, al
adc al, 0xe3
dec esi
xor eax, 0xe358eaf6
dec esi
xor eax, 0xe36882ba
dec esi
xor eax, 0xe334868a
dec esi
xor eax, 0xf1ea0191
test byte [esi - 0x35242bdc], bh
popfd
invalid
Function at 0x10278c08
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add al, cl
sbb edx, 0xcfa9479c
xor ebx, edx
not al
push eax
shl byte [esp + eax*4 - 0x22d], 0xc4
movzx ecx, byte [ebp + ecx - 0x74c97ffc]
neg eax
lea ebp, [ebp + eax*2 - 0x362109e1]
js 0x102c7839
sal al, 0xc6
xor cl, bl
shl eax, 1
dec cl
pop eax
add eax, 0x51456
jmp eax
push eax
jmp 0x1024e56e

Function at 0x1027d692
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add edi, eax
movzx edx, word [ebp + ecx*2 - 0x77feaef6]
mov eax, ecx
jmp 0x101baebf
lea ebp, [ebp + ecx - 0x3bff577e]
jmp 0x101d5879
xor dx, bx
xor dx, 0x6522
neg cl
call fcn.101a10a9
ror dl, 1
lea ecx, [ecx + ecx*4 - 0x4144e4d6]
inc cl
dec ecx
xor dl, 0x3f
not dword [esp]
push ecx
or word [esp + 2], 0xf51b
sbb dl, 0xa5
neg dl
shr ecx, 0x5f
neg cl
sub dl, 0
xor dl, 0x83
inc ecx
not dl
shr cx, 0x61
shr cl, 0xa7
ror dl, cl
xor bl, dl
xor ecx, ecx
xor ecx, 0x4b22b7b1
sar cx, 0x6f
lea edx, [esp + edx + 8]
xchg byte [esp + ecx - 0x4b22fffe], cl
mov word [edx + ecx - 0x4b22ff96], ax
mov eax, dword [esi + ecx - 0x4b22ff9b]
sal ecx, cl
call fcn.10271323
sub edx, 0xd4b5a7a1
or edx, edx
mov word [edx + esi - 0x2b4a57ad], ax
mov eax, dword [ebp + edx - 0x2b4a57b3]
mov ecx, edx
neg cl
xor eax, ebx
neg eax
not ecx
and ecx, 0xc508e888
ror edx, 0xc
lea eax, [eax + ecx - 0x7a4fc5e0]
neg ecx
ror dl, 0x21
add edx, 0x21333f87
not eax
bswap eax
xor ebx, eax
inc dx
jno 0x101b4b6d
call fcn.103b27b8
rol eax, 1
dec eax
mov edx, 0xf2ba26b6
xor ebx, eax
call fcn.101c35b7
xchg ecx, edx
xor eax, ebx
shl dx, 0xeb
bswap eax
ror dx, 0x62
dec edx
neg eax
bswap eax
ror eax, 1
xor ebx, eax
add edi, eax
xor dx, 0xa8b4
jmp edi
mov dword [esp + edx*4 - 4], ecx
mov dl, byte [esi + edx*2 - 3]
pop ecx
xor dl, bl
ror ecx, 0x24
sbb dl, 0x89
mov dword [esp + ecx*4 - 0x3186300], ecx
and ecx, ecx
jge 0x102063f3
call fcn.101ee0df

Function at 0x10281ac5
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword ss:[ecx]
push 0xb41796a9
mov dword [esi], edx
push 0x3a00cbb2
sub ebp, 4
mov eax, 0x7e9ae3b9
ror dword [esp + eax - 0x7e9ae3b6], 0x94
mov eax, dword [ebp + eax - 0x7e9ae3b9]
xor eax, ebx
call fcn.10322bd4
sub edi, 0xfffffffb
not ax
xor cl, bl
shr eax, 0x7a
neg cl
call fcn.1022f107
mov ecx, 0xb5397c87
mov edx, 0xb53006bf
ror edx, 0xbe
mov edx, dword [ebp]
add ebp, 4
not ecx
lea eax, [ecx + ecx*2 - 0x28c17243]
push eax
xor edx, ebx
shl dword [esp + ecx - 0x4ac68378], 0x85
inc edx
bswap edx
push ecx
xor cx, ax
inc edx
not edx
or eax, ecx
seta byte [esp + ecx - 0x4ac69b5c]
xor ebx, edx
add edi, edx
sar ecx, 0xb0
bswap ecx
fmul qword [esi]
jne 0x10398279
not dl
mov eax, dword [ebp + edx*8 - 0x34d0]
lea ecx, [edx*2 - 0x13ebecd9]
mov cl, byte [ebp + edx*2 - 0xd30]
jle 0x103b4237
call fcn.102d7ab4
mov ecx, dword [esi]
jmp 0x101b85f7
shr dl, 0x81
pop edx
shl eax, cl
mov dword [ebp + 2], eax
mov ecx, 0x3e84019f
lea edx, [ecx*4 - 0x1f412179]
mov edx, dword [ebp + ecx - 0x3e84019d]
movzx ecx, byte [edi + ecx - 0x3e84019b]
mov eax, 0xe78e142a
jmp 0x1023565c