joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10187008
Capabilities:
Read file on windows
Terminate process

Disassembly:
rol edx, 2
lea edx, [edx + eax*2 + 0x2a8fbde]
or ecx, 0x36ba978b
sub cx, word [esp + eax - 0xb37fe98]
bswap edx
lea ecx, [ecx + ecx*4 + 0x21b2b59f]
sbb byte [esp + eax*2 - 0x166ffd32], cl
neg dword [esp + eax*2 - 0x166ffd32]
xor ebx, edx
dec ecx
add edi, edx
and word [esp + eax*2 - 0x166ffd31], 0x4bb2
adc ax, cx
sub cx, cx
mov eax, ebp
sub dword [esp + ecx - 0x61a80000], ecx
mov edx, ecx
lea ebp, [ebp + edx - 0x61a80002]
mov word [ebp + ecx - 0x61a80000], ax
dec dx
shr word [esp + ecx - 0x61a7fffe], 0x28
sar ecx, 0x3e
pop eax
jbe fcn.1018699d
pushfd
pop dword [esp + 8]
mov dword [esp + 4], 0xb1a9691c
mov dword [esp], 0x6522c02e
jmp 0x1024ba75
push ecx
and cl, dl
adc esi, eax
movsx eax, cx
add eax, ebp
lea ebp, [ebp + edx - 0x3ded1622]
mov word [ebp + edx - 0x3ded1620], ax
pop ecx
inc dx
jno fcn.10190646
xor ebx, eax
jmp 0x101acfec
ror dx, cl
mov dx, word [ebp + ecx - 0xff8d]
mov cl, byte [ebp + ecx*8 - 0x7fc66]
sal ax, 0xa5
adc ebp, 2
bswap eax
cwde
call fcn.10211271
mov dword [esp + 4], ebx
sal dword [esp], 0x36
mov ebx, 0
push 0x4c383b3d
sar byte [esp + 7], 0xa3
shl word [esp + 5], 1
mov dword [esp + 4], ebp
push 0x622ed5a3
mov ebp, dword [esp + 4]
or ebp, 0xd7186225
mov dword [esp + 4], edi
lea edi, [ebp + ebp - 0x6d6430c9]
setl byte [esp + edi - 0x510cc5b0]
jno 0x102249ca
inc eax
rol edx, 1
or cx, ax
xor ebx, edx
push eax
add esi, edx
imul ecx
jae 0x101c31b3
push 0x3737fe9a
sub esi, 4
mov edx, dword [esp]
movzx eax, word [esp + edx*2 - 0x6e6ffd34]
movzx ecx, ax
mov edx, dword [esi + edx*2 - 0x6e6ffd34]
xor ecx, 0xa30b5790
imul eax, ecx
xor edx, ebx
ror edx, 3
shr byte [esp + 3], 0x85
xor byte [esp + 3], cl
inc edx
neg cx
ror al, 0x64
cbw
ror edx, 2
btc ax, cx
dec byte [esp]
not edx
or ecx, dword [esp]
xadd dword [esp], eax
rol edx, 2
xor edx, 0x2123b7b3
ror ecx, 0xf8
jae 0x10183fa7
mov edx, 0xda2c41af
mov eax, dword [edi]
rol edx, 0x17
adc edi, 4
movzx ecx, dl
dec cx
shl ecx, cl
xor eax, ebx
sal ecx, 0xa1
ror eax, 1
xchg ch, cl
sub cl, dh
dec eax
bswap ecx
rol eax, 3
xor edx, ecx
xor eax, 0xd58bd0bf
jmp 0x101af416

Function at 0x101871d1
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov ebx, dword [esp + 8]
push 0xdf20990d
call fcn.101c8ddc
Function at 0x10188418
Capabilities:
Read file on windows

Disassembly:
shl byte [esp + ecx - 0x777afbc8], 0x43
not cx
xor bx, ax
imul ecx, edx
lea ebp, [ebp + ecx - 0x50a86fc4]
and cl, byte [esp + ecx - 0x50a86fba]
mov dword [ebp + ecx - 0x50a86fc0], eax
mov ecx, dword [edi + ecx - 0x50a86fc0]
adc edi, 4
lea edx, [edx + edx*8 - 0x68fd284f]
xor dx, 0x2620
neg edx
xor ecx, ebx
imul dx, dx
or dword [esp + edx - 0x780b3315], 0xc7124328
movzx eax, word [esp + edx - 0x780b3315]
dec ecx
neg edx
neg ecx
shr word [esp + eax - 0xfffd], 0x61
ror ecx, 2
not ecx
push edx
rol ecx, 2
not dword [esp + eax - 0xfff6]
sub dl, 0x22
xor ebx, ecx
add esi, ecx
mov ecx, edx
cwde
add dx, 0xe287
pop edx
pop eax
pop ecx
jne fcn.1024af8a
sub esi, 4
rol dword [esp + 4], 0xd0
mov edx, dword [esi]
jae 0x101dc9f3
xor edx, ebx
pop eax
mov ecx, 0xa2b6bd22
rol edx, 1
xchg dword [esp], ecx
mov eax, ecx
inc edx
mov word [esp + ecx*2 - 0x725a6810], ax
not edx
neg dword [esp + ecx - 0x392d3409]
xor edx, 0xf819fe92
sub word [esp + ecx - 0x392d3408], 0x96be
dec word [esp + eax - 0x392d3409]
sal ecx, cl
xor ebx, edx
rol eax, 0x75
sbb word [esp + ecx - 0x5a6811fe], 0xf90e
add ebp, edx
mul ecx
mov dx, word [ecx + edi - 0x5a681200]
xchg dword [esp + ecx - 0x5a681200], ecx
xor ax, ax
lea edi, [eax + edi - 0x6814fffe]
sub dword [esp + eax - 0x68150000], 0xf23bc78c
lea esi, [esi + eax - 0x68150001]
neg dword [esp + eax - 0x68150000]
jne 0x101c7577
mov edx, dword [ebp]
mov eax, 0x328551a0
not eax
add ebp, 4
cbw
add eax, eax
xor edx, ebx
movsx ecx, ax
rol edx, 1
ror eax, 0xcb
adc cl, ah
btr eax, eax
bswap edx
jae 0x101addbb
movzx ecx, byte [esi + eax - 0x68150000]
cwde
xor cl, bl
cwde
xor cl, 6
neg cl
cwde
call fcn.101b5e4d
btr edx, 0x98
ror ecx, 0x9d
neg ax
or dword [esp + ecx - 0x777afbfa], ecx
ror cl, 0xe4
inc ax
jmp 0x1018551b

Function at 0x10188958
Capabilities:
Read file on windows
Terminate process

Disassembly:
xor cl, bl
lea edx, [eax + eax*4 + 0x3c0cd399]
inc ax
mov dword [esp], eax
ror cl, 1
inc edx
jle 0x101b69f9
not cl
sub cl, 0x39
inc byte [esp + 3]
cmovp edx, eax
neg cl
neg dl
xor bl, cl
add byte [esp + 1], dh
not ax
shr dword [esp], 0x7a
lea ecx, [esp + ecx + 4]
div dl
xchg dword [esp], eax
rol ax, 0xa2
mov ax, word [ecx + eax*8 - 0x580]
jae 0x1025c1b6
not eax
xor cx, dx
pop ecx
imul ecx, ecx
bswap eax
shl edx, 0xfd
xor ebx, eax
rol cl, 0x63
setb dl
adc esi, eax
jmp fcn.101eb011

Function at 0x1018ee37
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
dec cl
inc ax
xor bl, cl
lea ecx, [esp + ecx + 0xc]
xchg dword [esp + eax - 0x718afffe], edx
mul ax
mov al, byte [ecx + eax - 0x718b0010]
neg byte [esp + 0xb]
sbb ebp, 1
lea ecx, [edx + edx*2 - 0x1542f74e]
mov word [ebp], ax
pop eax
bt ecx, ecx
mov ecx, dword [edi]
lea eax, [edx + 0x4ca922b8]
shl dword [esp + eax - 0x485c22b5], 0x29
call fcn.1025d785
mov eax, dword [ebp + eax*2 - 0x1aa1e428]
bt cx, cx
jae 0x1022254c
Function at 0x10190a01
Capabilities:
Read file on windows
Terminate process

Disassembly:
add esi, ecx
mov dword [esp + eax*8 - 8], edx
sub dword [esp + eax - 1], 0x5533818c
mul dword [esp + eax*8 - 8]
mov ax, word [edx + ebp]
bt dx, dx
push edx
add dx, word [ebp + edx*8 + 2]
mov ecx, dword [esp]
add cl, byte [ecx + ebp + 4]
push 0x859a198a
dec word [esp + 6]
call fcn.1025c36c

Function at 0x1019200b
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
ror ecx, 2
xor ecx, 0x951999b8
sal dl, 0x65
cwd
ror ecx, 1
mov dword [esp], eax
shr eax, 0xe
bswap ecx
push edx
rol byte [esp + eax*2 - 0x6ae70], 0x21
xor ebx, ecx
xchg dh, al
sar eax, 0xd2
add edi, ecx
call fcn.101d9ffe

Function at 0x1019234a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
xadd ecx, edx
inc cl
inc eax
dec dword [esp + edx - 0x7a082815]
sub ecx, 0xde99653d
call fcn.1024132d
cbw
bswap edx
or eax, 0x629c095
neg edx
btr ecx, 0x92
sbb edx, 0xea15022b
ror eax, cl
call fcn.1026d35d

Function at 0x10192c6e
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp + eax], eax
neg byte [esp + eax*2 + 2]
lea edi, [edi + eax*2 - 4]
xor eax, dword [eax + edi]
xor eax, ebx
not ecx
neg byte [esp + ecx - 0x55343dc0]
sbb eax, 0x6496e93a
movzx edx, word [esp + ecx - 0x55343dc2]
xor eax, 0x19b4990f
xor word [esp + edx*2 + 1], 0x91a3
add dl, ch
rol eax, 3
shr byte [esp + edx - 0x3c], cl
bt edx, 0x13
neg eax
push edx
xor ebx, eax
btr ecx, edx
adc ebp, eax
and dword [esp + ecx - 0x55343dc2], 0xf29bfc09
dec edx
shr ecx, cl
pop eax
pop edx
jnp fcn.1022ca3e
sub ebp, 4
mov eax, 0x222c79be
cdq
or edx, eax
mov eax, dword [ebp + edx*2 - 0x4458f37c]
mov ecx, edx
btc ecx, ecx
imul edx, edx
xor eax, ebx
shl dx, 0xa1
rol cl, 0x41
ror eax, 2
dec eax
xor cl, 0x34
sal dx, 0x2b
inc dl
bswap eax
xadd ecx, edx
inc eax
xor ebx, eax
call fcn.10223f3c

Function at 0x10198d50
Capabilities:
Authenticate hmac

Disassembly:
ror ecx, 1
mov dword [esp + eax - 0x7ea8a0a], edx
mul eax
not ecx
inc dx
shl word [esp + edx - 0x3eaa6b], 0x8d
cdq
rol ecx, 2
dec ecx
imul eax, eax
call fcn.10231dff
mov eax, 0x6386b099
lea edx, [eax*2 + 0x3e80db98]
mov eax, dword [eax + edi - 0x6386b099]
jmp 0x101f6a97
push edx
lea ecx, [edx*2 - 0x6365c8eb]
lea edi, [edi + edx*8 - 0x2c71e64c]
imul dx, dx
btr edx, ecx
xor eax, ebx
sub ecx, edx
rol dx, 0x8d
call fcn.101bc400
mov edx, 0x96a4499a
movzx eax, dl
lea ebp, [eax + ebp - 0x9e]
btr edx, 0x8c
cdq
add edx, dword [edx + ebp]
sub al, al
add ax, 0x6604
xor edx, ebx
cbw
mov ecx, eax
bt eax, 0x29
xor edx, 0xbd87c91b
ror edx, 2
rol cl, 0xc5
cwde
sbb edx, 0xb1b0399c
xchg ecx, eax
or eax, eax
neg edx
xor ebx, edx
shr ecx, 0x8e
sal al, 7
add eax, 0x711b8abc
adc esi, edx
sal al, 0xe2
movzx edx, ax
sar cx, 0xaf
or ecx, dword [ecx + edi]
push edx
mul edx
cmovae edx, dword [esp + edx*2 - 0x7ac4]
mov eax, dword [edx + edi - 0x3d5e]
sal edx, 0xab
lea edi, [edx + edi - 0x1eb0ff8]
ja 0x102427b1
Function at 0x10199d6c
Capabilities:
Read file on windows
Terminate process

Disassembly:
movzx eax, byte [ecx + edi - 0x2989801]
mov edx, ecx
sar ecx, 0xf6
bswap ecx
lea edi, [ecx + edi - 0x9ffffff]
xor al, bl
add al, dl
lea edx, [edx + edx - 0x37de826f]
neg al
pop edx
inc al
or ecx, ecx
movsx edx, cx
add edx, 0x349c1309
xor al, 0x96
sub dx, dx
xor bl, al
not edx
lea ebp, [ebp + ecx*8 - 0x50000002]
xchg ch, dl
mov word [ebp + ecx*8 - 0x5007f800], ax
inc dx
bswap edx
js fcn.10190646
mov ecx, 0xf4a88582
add cl, cl
sbb edi, 3
call fcn.10219762
mov dword [esp + edx*2 - 0x1057db16], edx
mov eax, dword [esp + edx - 0x82bed85]
ror ecx, 3
lea ecx, [ecx + eax*2 + 0x2812cf8f]
sub dword [esp + edx*2 - 0x1057db17], eax
and al, dh
lea eax, [edx + edx - 0x31ebab65]
not ecx
btc ax, dx
idiv eax
dec ecx
xor ebx, ecx
add esi, ecx
movsx ecx, byte [esp + edx*2 - 0x3618bec2]
btr edx, 0x80
sal dword [esp + edx - 0x1b0c5f60], 0xaf
mov dword [esp + edx - 0x1b0c5f64], esi
ret 8

Function at 0x1019bcda
Capabilities:
Read file on windows
Terminate process

Disassembly:
xor edx, 0x49b8570d
xor ebx, edx
add eax, ecx
sbb cl, 0x3f
jnp 0x10213bf1
adc ebp, edx
mov dword [esp + eax*2 - 0xa], ebp
ret 0xc

Function at 0x1019bced
Capabilities:
Read file on windows
Terminate process

Disassembly:
cwde
not ax
mov dword [ebp], edx
call fcn.101dd12a
mov ecx, 0x2d1e80a0
lea esi, [esi + ecx - 0x2d1e80a4]
call fcn.1020e9cc
mov eax, 0x1cb71f95
mov ecx, eax
shl cl, 0xa3
mov ax, word [eax + edi - 0x1cb71f95]
lea edx, [ecx*8 + 0x70a5d3aa]
setne cl
lea edi, [edi + ecx - 0x1cb71eff]
shl dl, cl
xchg dx, cx
lea ebp, [ebp + ecx*4 - 0x72df4351]
movzx ecx, byte [ebp + edx - 0x565e1f01]
bts edx, edx
jae 0x101b2249

Function at 0x1019ee5c
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
push edi
pushfd
pop esi
mov dword [esp + 4], esi
sal di, 0x81
mov esi, edx
jno 0x102119b5
cld
rep movsb byte es:[edi], byte [esi]
push dword [esp + 4]
popfd
mov esi, 0xaf263803
not byte [esp + 2]
call fcn.10215880
bswap edx
sar eax, cl
xor ebx, edx
idiv cl
add ebp, edx
movzx edx, cl
add eax, dword [esi + eax*4]
call fcn.1024d878
mov edx, 0x91a3438f
mov ecx, dword [edi]
mov eax, 0x3e2ff993
not eax
jmp 0x101f797a
mov eax, dword [edi + 4]
rol dl, 0x21
push edx
bt edx, edx
adc edi, 3
xor dword [esp], edx
sbb dword [esp], 0xd0b5aae
lea edx, [edx + edx*8 - 0x1d78dedd]
not ecx
call fcn.101a23fd
mov eax, 0x7095b3bf
mov edx, dword [esi + eax - 0x7095b3bf]
push eax
pop ecx
sub al, ch
mov ax, word ss:[eax + edx - 0x7095b30c]
lea esi, [esi + ecx - 0x7095b3bd]
movzx edx, cx
dec edx
and ecx, 0x9f9fcd8a
mov word [esi + ecx - 0x1095818a], ax
lea edi, [edi + ecx - 0x1095818e]
shl dl, 0xe6
mov ecx, dword [ecx + edi - 0x1095818a]
adc edx, edx
xor ecx, ebx
mov eax, edx
bts edx, edx
not ecx
setae al
lea ecx, [ecx + edx + 0x7329dbad]
neg ecx
dec ecx
xor ebx, ecx
lea eax, [eax + eax*8 - 0x60604143]
div eax
cwde
add ebp, ecx
jmp ebp
xchg word [esp], di
mov edi, eax
jg 0x101caae5
Function at 0x1019f715
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
bt ecx, eax
xor ebx, edx
mov dword [esp + ecx - 0x5000c4], eax
add esi, edx
lea ecx, [ecx*4 + 0x322e7e81]
and eax, 0xc98a7c35
inc byte [esp + ecx - 0x336e818a]
pop eax
pop edx
jle fcn.101eb011
or eax, eax
sets dl
bswap ecx
and ax, 0xa22a
mul al
rol ecx, 1
bswap ecx
lea ecx, [ecx + eax*8 - 0x75e66f33]
mul edx
neg ecx
inc edx
xor ebx, ecx
bts ax, 0xba
adc ebp, ecx
imul dx
movsx ecx, dl
lea edi, [edi + eax - 0x23379801]
sal edx, 0x19
lea eax, [eax + ecx*4 + 0x20b9e118]
movzx ecx, byte [eax + edi - 0x43f17878]
jb 0x101b7636

Function at 0x101a12d5
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
jmp 0x10255e89
pop edi
push esi
mov esi, edi
pushfd
mov esi, edx
ror edi, 0x1f
dec di
mov edi, eax
cld
call fcn.10241839
ror dx, 0x64
movzx ax, byte [esi]
mov cl, byte [esi + 2]
adc edx, edx
lea esi, [esi + edx - 0x252721ff]
add edx, edx
bt dx, 0x8d
shl al, cl
mov word [esi + edx - 0x4a4e4402], ax
lea edi, [edi + edx - 0x4a4e4406]
lea eax, [edx + edx*8 + 0x578740a6]
mov edx, dword [edx + edi - 0x4a4e4402]
shl eax, 0x9b
not eax
movsx ecx, ax
xor edx, ebx
call fcn.101984ae
mov ecx, 0x263b1f0a
mov dx, word [edi + ecx - 0x263b1f0a]
mov eax, ecx
mov ax, word [ecx + edi - 0x263b1f08]
shr ecx, cl
call fcn.1022262b
xor al, 0x98
add ecx, ecx
sbb cl, 0x8d
dec edx
xor al, dl
push edx
bswap edx
sal edx, 0x2a
xor bl, al
jmp 0x101d8ddc
push 0xa023a225
mov dword [esp + 4], edi
jmp 0x102404ad

Function at 0x101a14eb
Capabilities:
Read file on windows
Terminate process

Disassembly:
xor bl, cl
xor eax, 0x4e3b8da0
mov dword [esp + edx], eax
lea ecx, [esp + ecx + 0xc]
movzx ax, byte [ecx + edx*8]
inc dl
mov ecx, 0x82170ba5
lea edi, [edi + edx*2 - 4]
xadd ecx, edx
pop ecx
adc edx, 0xbbb5d6ad
mov word [edi + ecx - 0x4e3bb001], ax
shr cx, cl
movsx eax, cl
shl cx, 0xc7
pop edx
pop eax
jbe fcn.1017fa23
sar edx, 0x44
rol dx, 0xce
xor eax, 0x5021e430
shl dx, 0xcd
dec dx
not dx
sbb eax, 0xdc00cf9e
btr cx, dx
pop edx
xor ebx, eax
call fcn.101e604f
Function at 0x101a3c4d
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp], edx
mov word [edi], ax
xchg word [esp], dx
sub esi, 4
xchg dword [esp], edx
mov edx, dword [esi]
mov ecx, dword [esp]
jmp 0x1020ff58
lea eax, [ecx*4 + 0x722bb92e]
xor edx, ebx
push ecx
shr eax, 0xab
jnp 0x1026194d
bswap edx
bts ecx, eax
lea edx, [ecx + edx + 0x1263f02f]
bts eax, 0xa1
bts eax, 0x35
not edx
btc ecx, 0x18
cwde
pop ecx
neg edx
shl al, 0xe4
imul ecx, dword [esp]
neg eax
xor ebx, edx
neg eax
add ebp, edx
push ecx
movsx edx, al
mov dword [esp + edx*2 - 0xe0], ebp
ret 4

Function at 0x101a8804
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
lea edi, [edi + ecx*2 - 0x4593a812]
ror dx, 0xc3
mov word [edi + ecx*2 - 0x4593a810], ax
sar dword [esp + ecx - 0x22c9d408], cl
or dword [esp + ecx - 0x22c9d405], edx
inc dx
pop ecx
pop edx
jnp fcn.101b3e0d
movzx ecx, dx
rol eax, 1
inc dx
neg eax
pop ecx
xor eax, 0x7016fc85
mov dword [esp + edx*2 - 0x533520aa], 0xad1d5813
xchg dword [esp + edx - 0x299a9055], edx
dec edx
xor ebx, eax
sub edx, edx
sub dl, byte [esp + edx*2 + 1]
not dword [esp + edx - 0x70]
add esi, eax
movsx ecx, dx
lea ebp, [ebp + edx*2 - 0xe2]
movzx eax, word [ebp + edx*4 - 0x1c0]
ror ecx, cl
shr word [esp + edx*2 - 0xe0], 0xd
pop ecx
xor ax, bx
shr cl, 0xc2
bts ecx, ecx
or dx, cx
not ax
lea ecx, [ecx*2 + 0x310f7d0b]
neg ecx
inc ax
rol ax, 1
push edx
sar dword [esp + edx - 0x71], cl
xor ax, 0x2a98
neg dword [esp + edx*8 - 0x388]
rol dx, 0xa1
adc ax, 0x9030
ror cx, 0xa1
neg ax
sal edx, cl
push edx
xor bx, ax
xchg dword [esp + ecx*2 - 0x444d82f1], ecx
add ecx, 0x2205d408
jns 0x10181a90

Function at 0x101aade6
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub byte [esp + eax - 0x5f7526e4], 0x99
sbb dl, 0xb9
and cx, ax
neg eax
xor dl, 7
mov dword [esp + ecx*2 - 0x55804100], ecx
imul cx, ax
cbw
adc dl, cl
xor bl, dl
lea edx, [esp + edx + 8]
or cx, cx
sub dword [esp + ecx*2 - 0x558095fd], ecx
movzx cx, byte [edx + ecx*2 - 0x55809600]
lea edx, [eax + eax*4 + 0x45af5496]
lea edi, [edi + edx - 0x68615506]
not al
dec eax
mov word [edi + edx - 0x68615504], cx
xchg edx, eax
jl 0x102424c4
mov eax, 0x1685b585
lea ebp, [ebp + eax*4 - 0x5a16d618]
movzx ecx, ax
mov eax, dword [ebp + eax - 0x1685b585]
xor eax, ebx
and ecx, ecx
ror ecx, 0x4a
shl cx, 0x65
neg eax
lea eax, [eax + ecx + 0x4ecf448e]
lea edx, [ecx + ecx*8 - 0x66cd954e]
xor eax, 0xe584bb8c
bswap edx
sal cx, 0xe1
inc eax
bswap ecx
not dl
shl ecx, 0x2e
xor ebx, eax
shr ecx, 0xeb
inc edx
bt edx, 0xb6
adc esi, eax
push ecx
movsx eax, dl
mov eax, dword [edi + ecx*4 - 0x680c20]
sub cl, 0xa8
shl dword [esp + ecx*4 - 0x680d80], 0xe9
mov edx, dword [ecx + edi - 0x1a035c]
inc cx
lea edi, [edi + ecx - 0x1a0359]
or ecx, ecx
shr cl, 0x22
and cl, ch
mov dword [ecx + eax - 0x1a0300], edx
rol byte [esp + ecx - 0x1a02fe], 0x21
mov dword [esp + ecx*8 - 0xd01800], esi
ret
pop eax
pop eax
jne fcn.101b3e0d
Function at 0x101ab86b
Capabilities:
Terminate process

Disassembly:
xor cl, 0x2b
not ax
shl eax, 0x6a
sbb cl, 0xbf
mov dword [esp + eax*4 - 0xffff000], 0x31aed4ac
neg cl
neg eax
btr eax, eax
sbb cl, 0xb3
shr ax, 0xe5
push eax
xor bl, cl
call fcn.102180fc

Function at 0x101ab902
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
mov dword [esp], eax
adc edi, 2
shl byte [esp + 3], 0xa2
and cl, dl
mov edx, 0xf9afa422
mov dword [esp], edx
call fcn.1025c216

Function at 0x101aca9f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
xor ecx, ebx
or dword [esp + eax - 0xce89], 0x6c218f86
ror ecx, 1
sal eax, 0xca
mov dword [esp + eax - 0x33a3400], eax
imul edx, edx
dec ecx
bts ax, dx
sar eax, 0x94
jbe 0x10188da4
mov edx, 0x112fdbaa
mov eax, dword [edx + ebp - 0x112fdbaa]
lea ecx, [edx*2 + 0x593d1b24]
lea ebp, [edx + ebp - 0x112fdba6]
push edx
btc ecx, 0xa4
xor eax, ebx
inc byte [esp + edx*4 - 0x44bf6ea5]
xchg dword [esp + edx*4 - 0x44bf6ea8], edx
inc eax
shl dl, 0x46
push edx
neg eax
sal cl, 0xe3
jne 0x101e0700
xor eax, 0xe018980b
shr cx, 0xe9
sub edx, ecx
inc eax
neg eax
xor edx, 0xd58ad533
or word [esp + edx - 0x43190e21], 0x5ba9
dec eax
not edx
dec dx
and ecx, 0x8bb6a92b
rol eax, 3
not eax
call fcn.101ff4e6
Function at 0x101ad344
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
jmp 0x101ad3b1
call fcn.100dfb30
mov ecx, dword [ebp + 0xc]
clc
jmp 0x101b14a8
push eax
movzx ax, cl
movzx eax, sp
movsx eax, bp
mov eax, dword [edi + 0x134]
jmp 0x101dba68
mov dword [esp + ecx - 0x6301fe35], edx
lea ebp, [ecx + ebp - 0x6301fe3a]
xor eax, ebx
inc eax
ror eax, 3
mov dword [esp + ecx - 0x6301fe2d], ecx
push edx
sar cx, 0x23
lea eax, [eax + edx + 0x45f90031]
sbb dl, dl
neg dword [esp + ecx - 0x6301ffc1]
push ecx
rol eax, 1
xor ebx, eax
sal edx, cl
sal edx, cl
add edi, eax
movzx ax, byte [esi + edx*2 - 0x601fe002]
and dx, 0x6507
setge dl
mov dl, byte [ecx + esi - 0x6301ffc6]
xchg dword [esp + ecx - 0x6301ffbc], ecx
not al
xor dword [esp + ecx - 0x41ed7dbd], ecx
shl cl, 0xc4
not dl
call fcn.1023554a
push ebx
jmp 0x1018d088
add esp, 0xc
jmp 0x1022739c
call eax
mov ecx, dword [ebp + 0xc]
add esi, 0x10
cmp ebp, eax
lea esp, [esp + 0x1c]
test edi, 0xbaa47a00
cmp esi, ecx
jle 0x10227385
sub ecx, esi
btr ax, 0x3e
bt ax, di
cbw
lea eax, [edi + 4]
cmc
jmp 0x1021934a
push 0x10
push eax
call fcn.100e26c5
lea eax, [edi + 0x40]
push eax
cwde
mov al, 0x18
lea eax, [edi + 4]
jmp 0x101e81cd
push eax
mov ah, 0x83
not al
mov ax, bp
lea eax, [edi + 0x14]
jmp 0x101a069f
add ecx, 0x10
jmp 0x10181f08
movups xmm0, xmmword [edi + 4]
movzx ax, bh
xor ax, 0x1da6
add eax, esp
movups xmmword [ebx], xmm0
sar eax, cl
not ah
ror eax, cl
lea ebx, [ebx + 0x10]
sar al, cl
cbw
movzx ax, dl
lea eax, [edi + 0x14]
test bl, bh
cmp dx, bp
cmc
cmp esi, dword [ebp - 4]
jmp 0x1024d2d7
jmp loc.100a920e
jl 0x10266496
mov eax, dword [ebp + 8]
sub esi, ecx
cmp di, 0x4db4
clc
cmc
mov dword [edi + 0x24], esi
cmp eax, ebp
stc
sub edi, esi
test ecx, ecx
clc
test edi, 0xa900d909
add edi, 0x14
jmp 0x1024ec47
mov dword [eax], edi
jmp 0x1024fcb7
nop
jmp 0x1023924c
push dword [ebp + 0x10]
push 1
jmp 0x101df3a4

Function at 0x101ae0e4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
ror word [esp + 6], 0x66
shrd edx, eax, cl
mov dword [ebp], edx
call fcn.1018151f
call fcn.101dff1e

Function at 0x101ae6bb
Capabilities:
Read file on windows
Terminate process

Disassembly:
push 0x49b67188
add edi, 4
xor eax, ebx
mov ecx, 0xaabc34a7
neg byte [esp + 1]
mov dword [esp + 4], 0x441c133d
xor eax, 0x4096a796
movsx edx, cl
btr edx, 0x85
inc eax
dec cl
xor eax, 0x6418ec2b
xor cx, 0xc92
neg cx
rol word [esp + 1], 7
dec eax
xor word [esp + 5], 0x4d07
jp 0x1023a2c4
movzx edx, byte [edi]
add cx, cx
adc edi, 0
lea eax, [ecx*2 - 0x5378eaf8]
xor dl, bl
ror cl, 0xe3
cbw
pop ecx
ror dl, 1
sub dl, 0x2d
neg dword [esp + ecx - 0x4947db88]
rol dl, 1
rol cx, 0x26
push ecx
neg dl
sub eax, 0x55a3bbbb
lea eax, [eax + ecx + 0x7f1638b3]
imul eax, dword [esp + eax - 0x74ba5f66]
xor bl, dl
btr cx, 0x10
cwde
cbw
lea ebp, [ecx + ebp - 0x4947e238]
sar ecx, 0xa6
mov word [ebp + ecx*8 - 0x928fc40], dx
xadd cx, ax
lea edx, [eax + 0x308b7fbe]
bts ecx, eax
pop edx
pop eax
jb fcn.10190646
xor ebx, eax
add esi, eax
jmp 0x1020974d
Function at 0x101af4a2
Capabilities:
Terminate process

Disassembly:
bswap ecx
and dword [esp + 6], edx
add eax, 0x69160938
push edx
not ecx
lea ecx, [ecx + edx + 0x386d250c]
shl edx, 0xc5
xor ecx, 0xcca7282d
neg al
rol dword [esp + 8], 0x10
jp 0x101e1e5f
mov ecx, 0xac165891
movzx edx, cl
push edx
mov ecx, dword [edi + edx - 0x91]
neg edx
push edx
sbb byte [esp + 3], dh
adc edi, 3
mov eax, 0x10148baa
shl byte [esp + eax*4 - 0x40522ea7], 0xe1
xor ecx, ebx
sal dl, 0xc7
mul al
rol ecx, 1
xadd byte [esp + eax - 0x101470e1], dh
xchg dword [esp + eax*4 - 0x4051c38c], eax
call fcn.101876c2
dec ecx
cwde
rol edx, 0x77
mov edx, dword [esp + 4]
adc edx, 0xffff4789
jmp edx
Function at 0x101b14f7
Capabilities:
Read file on windows
Terminate process

Disassembly:
cwde
ror ecx, 2
sub al, ah
sar eax, 0x5d
cmovnp ax, dx
lea ecx, [edx + ecx - 0x571d1709]
sbb al, al
bswap edx
rol ecx, 2
cdq
xor ebx, ecx
ror edx, 0xb4
sar eax, 0xd1
adc esi, ecx
lea ebp, [edx + ebp - 2]
sal dx, 0x61
inc eax
mov ax, word [ebp + edx*2]
jne 0x1017c461
mov eax, dword [edi]
mov ecx, 0xeb25fa09
lea edx, [ecx + ecx*4 + 0x45b5c194]
push edx
mov edx, dword [edi + 4]
sal ecx, cl
and cx, word [esp + ecx - 0x4bf411ff]
or cl, byte [edi + ecx - 0x4bf411f8]
jmp 0x101a46eb
sar word [esp], 0xea
adc edi, 5
shrd eax, edx, cl
mov dword [edi], eax
mov edx, 0x1809e88b
mov eax, dword [edx + ebp - 0x1809e88b]
lea ebp, [edx + ebp - 0x1809e887]
xor eax, ebx
lea eax, [eax + edx + 0x48aea77d]
not dl
xor dx, dx
seta dl
not eax
lea eax, [eax + edx*4 + 0x585e5e0b]
bswap eax
sub dx, dx
xor ebx, eax
xadd dword [esp + edx - 0x18090000], edx
adc esi, eax
movsx eax, dl
rol al, 1
pop edx
jmp esi
not cx
xor edx, 0x25857c99
lea eax, [ecx + eax*2 + 0x40081b1d]
ror edx, 1
lea edx, [edx + eax - 0x4b3ceab6]
push ecx
bswap ecx
rol cl, 0x83
neg edx
xor ebx, edx
xadd dword [esp + eax - 0x400a5ef6], ecx
je 0x101d2964
adc esi, edx
xadd eax, ecx
xadd cx, ax
mov edx, eax
pop edx
pop eax
pop ecx
pop edx
jne fcn.1017fa23
mov eax, 0x2e080faf
lea esi, [esi + eax*2 - 0x5c101f62]
cwde
lea ecx, [eax*4 - 0x224aaac6]
mov eax, dword [eax + esi - 0xfaf]
movsx edx, cx
add dl, dh
xor eax, ebx
bt dx, cx
jae 0x10234a83
mov ecx, 0x191989c
shr ecx, 0xf2
movzx edx, word [edi + ecx*8 - 0x320]
movsx eax, cl
lea edi, [edi + ecx*2 - 0xc6]
bts ax, cx
xor dx, bx
dec dx
cwde
push eax
neg dx
neg eax
dec dx
ror dx, 1
sub ax, 0x1bbe
xor bx, dx
cwde
lea ebp, [ebp + ecx*8 - 0x322]
mov word [ebp + ecx - 0x64], dx
mov edx, dword [edi + ecx*2 - 0xc8]
lea edi, [edi + ecx - 0x60]
rol dword [esp + ecx - 0x64], cl
sbb eax, 0xd9922295
neg byte [esp + ecx - 0x61]
xor edx, ebx
not cx
xor edx, 0xda904ea7
xadd dword [esp + ecx - 0xff9b], eax
ror word [esp + ecx*2 - 0x1ff34], 0x88
neg dword [esp + ecx*8 - 0x7fcd8]
bswap edx
ror ecx, cl
neg edx
imul eax, ecx
lea eax, [ecx*4 + 0x5b857926]
inc edx
not dword [esp + ecx - 0x1ff360]
sal ecx, 0xd
lea eax, [eax + ecx*4 + 0x7726db24]
rol edx, 1
neg edx
xadd byte [esp + 2], ah
rol ecx, 0x55
sbb edx, 0x91906c80
xor edx, 0xc51483a8
add ecx, ecx
sar ecx, 0x6d
lea edx, [edx + ecx*4 - 0x680e5522]
setp cl
xor edx, 0xda017503
lea ecx, [eax + eax*2 - 0x7bcf406d]
not word [esp]
lea eax, [ecx + ecx + 0x620b2099]
xor ebx, edx
neg byte [esp + eax - 0x3795887a]
add esi, edx
shr eax, 0xa6
ja 0x10198dbf
cdq
pop ecx
jns fcn.10190646