joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d5cea
Capabilities:
Read file on windows
Terminate process

Disassembly:
adc edi, 4
mov eax, 0x4e030b29
neg dword [esp + eax - 0x4e030b28]
sub byte [esp + eax - 0x4e030b28], ah
xor edx, ebx
push eax
xchg dword [esp + eax - 0x4e030b21], eax
xor byte [esp + 1], 0xab
neg edx
mov ecx, 0xffa0f092
rol cl, 0x42
dec edx
bswap edx
neg edx
sar eax, cl
sbb eax, 0x7eb71b1b
dec edx
or al, byte [esp + 2]
lea eax, [eax + eax*2 - 0x2ac4e957]
inc al
xor ebx, edx
xor cl, cl
adc esi, edx
mov dword [esp + eax - 0x5912e56f], esi
ret 8
adc ebp, 8
mov dword [esp + 4], 0xfc2a06a6
ror edx, 0x1b
mov dword ss:[ecx], eax
add word [esp + 4], dx
mov dword [esp], edx
mov edx, dword [edi]
jnp 0x1018e8b1

Function at 0x101d5d28
Capabilities:
Read file on windows
Terminate process

Disassembly:
bt ax, ax
adc dx, 0xd3bb
call fcn.1026f5a8
mov edx, dword [esp + 0x10]
xor eax, ebx
and dword [esp + edx*2 - 0x5603e830], edx
mov dword [esp + edx - 0x2b01f41c], edx
rol eax, 3
bswap eax
movzx ecx, byte [esp + edx - 0x2b01f414]
push ecx
dec cx
not eax
ror eax, 3
sal ecx, cl
bswap eax
sal ecx, 7
xor ebx, eax
push edx
sar word [esp + edx - 0x2b01f40a], 0xc1
adc esi, eax
add cl, ch
pop eax
pop edx
pop eax
pop edx
pop ecx
pop eax
pop eax
jge fcn.10190646
mov edx, 0x912cdc35
sub ebp, 4
mov ecx, edx
mov eax, dword [ebp]
sub edx, edx
xor eax, ebx
jmp 0x1024564e
xor eax, 0xf028ce84
ror eax, 3
shl edx, cl
neg eax
dec eax
xor ebx, eax
add edi, eax
lea edx, [edx - 0x4cd5024c]
dec cx
sal ecx, 0xf8
lea ebp, [ebp + ecx - 0x34000002]
movzx edx, word [ebp + ecx - 0x34000000]
adc ecx, 0x1b249c16
xor dx, bx
and ecx, ecx
lea eax, [ecx + ecx*4 + 0x7e9735a2]
neg ecx
not dx
setl al
seta cl
dec dx
not dx
jmp 0x1017e2ed

Function at 0x101d68d1
Capabilities:
Read file on windows
Terminate process

Disassembly:
setbe cl
xor ebx, edx
shr eax, 0x6f
bts ecx, 0xb4
lea ebp, [eax + ebp - 0x6d84]
shr word [esp + eax*4 - 0x1b5fb], 0x87
rol al, 0x62
mov dword [ebp + eax*8 - 0x36810], edx
push ecx
mov edx, 0x77910428
bts edx, 0x2d
pop eax
pop ecx
pop ecx
jae fcn.10190646
rol ecx, 1
mov dword [esp + edx - 0x1af6c07e], edx
sub dword [esp + edx*2 - 0x35ed8105], edx
dec ecx
neg ecx
mov dword [esp + edx*4 - 0x6bdb0218], edx
bswap ecx
movzx eax, dx
inc dx
lea ecx, [edx + ecx + 0x719e64aa]
xor ebx, ecx
inc byte [esp + edx - 0x1af6c07b]
inc eax
add esi, ecx
mov dword [esp + edx*2 - 0x35ed810e], esi
ret 0xc
Function at 0x101d9bcf
Capabilities:
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
lea eax, [edx*8 - 0x514c52d8]
ror cl, 1
add dx, ax
imul ax
mov dword [esp + edx - 0x1acf], eax
dec cl
xor bl, cl
lea edx, [edx*4 + 0x7b3b3b5]
imul word [esp + edx*2 - 0xf683de0]
lea ecx, [esp + ecx + 4]
mov eax, dword [edx + ecx - 0x7b4f8ef]
mov ecx, edx
mov dword [ebp + edx*2 - 0xf69f1e2], eax
jno 0x10184c9e
mov eax, ecx
setno cl
lea ebp, [edx + ebp - 0x7b4f8f3]
pop ecx
mov edx, dword [esi + edx - 0x7b4f8f4]
bts ecx, eax
setb al
rol eax, 0xe8
sbb esi, 4
ror ecx, 0x8d
shl cx, 0x8e
shl ecx, 0xe
xor edx, ebx
bswap edx
dec edx
sub cx, ax
not edx
push eax
lea ecx, [ecx + 0x5187d13f]
pop eax
ror edx, 2
cwde
jmp 0x10211f7b
shr al, 0x64
xor ebx, edx
add edi, edx
or cl, 0xd
jno fcn.1018699d
mov ecx, 0xd5a3da25
lea eax, [ecx*2 + 0x5bba8d8c]
mov eax, dword [eax + edi - 0x70241d6]
movzx edx, cl
mov edx, dword [edi + edx*2 - 0x46]
add ecx, ecx
call fcn.101d2e41
mov edx, 0xba8a171b
mov cx, word [edi]
movsx eax, dl
bts dx, dx
mul eax
lea edi, [edi + edx + 2]
lea ebp, [ebp + edx - 1]
Function at 0x101da050
Capabilities:
Terminate process

Disassembly:
push 0x6fb1f213
call fcn.101af777
mov ecx, 0x289262b0
movsx edx, cl
mov edx, dword [edi + ecx*2 - 0x5124c560]
lea edi, [edi + ecx*2 - 0x5124c55c]
not cx
lea eax, [ecx + ecx*8 + 0x72b7459f]
xor edx, ebx
ror edx, 2
inc ecx
inc edx
push eax
shl ecx, cl
sar dword [esp], 0xab
ror edx, 2
sub cx, ax
xadd eax, ecx
lea edx, [edx + eax - 0x1ba956d5]
bswap eax
xchg word [esp + eax - 0x2f7d], ax
xor ebx, edx
add esi, edx
lea edx, [eax*4 - 0x7fe6bae2]
bts ecx, eax
mov edx, dword [ebp + eax*2 - 0x1f7b2]
movzx cx, byte [edx + eax - 0xfbd9]
dec al
pop eax
adc ebp, 1
mov edx, 0x661fa9a4
rol eax, 0x2b
call fcn.10213e89
push edx
jmp 0x101ab7e4
Function at 0x101db647
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [ebp]
add ebp, 4
mov dword [esp], 0xba895b29
sar word [esp + 2], cl
movsx edx, cx
xor eax, ebx
rol eax, 1
xor eax, 0x1ebf9f00
xor byte [esp + 1], ch
jne 0x10253c80
add esi, eax
sar byte [esp + 2], 0x47
mov eax, 0x62a82a03
mov ecx, dword [eax + edi - 0x62a82a03]
neg dx
mov dx, word [edi + eax - 0x62a829ff]
shr eax, 0x81
sal ax, 0x83
bswap eax
lea edi, [edi + eax*8 - 0x4542a182]
mov word ss:[ecx + eax - 0x8a85431], dx
mul dword [esp + eax*2 - 0x1150a862]
call fcn.1025b18d
cmp cl, bh
adc eax, 0x1b808e1e
xchg cx, dx
xadd word [esp + 1], dx
rol eax, 1
xor ebx, eax
jmp 0x101e68df

Function at 0x101db80e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp + ebx - 0x4edabeb5], edx
and di, 0x2db2
mov edx, 0
mov dword [esp + ebx - 0x4edabea5], edx
call fcn.101854bc

Function at 0x101dcb20
Capabilities:
Read file on windows
Terminate process

Disassembly:
sar ecx, cl
sete byte [esp + ecx - 0x1ffffd]
lea eax, [eax + edx*2 - 0x75da3bc6]
add dword [esp + edx - 0x4a8b0000], 0xfd9d3084
neg eax
ror cl, 0xe7
btc dx, cx
sar byte [esp + ecx*8 - 0xfffff7], 0xc3
bswap eax
imul edx, dword [esp + ecx - 0x1fffff]
sal byte [esp + edx - 0x6a627fff], 0xa7
xor ebx, eax
imul edx, dword [esp + edx - 0x6a628000]
add esi, eax
rol dword [esp + ecx - 0x1fffff], 0x70
ror dword [esp + edx - 0x70678000], cl
pop edx
jae fcn.10190646
xor ebx, eax
mov dword [esp + edx - 0x5ad0ffff], ecx
sar ecx, cl
sal dl, 0x85
lea ebp, [ebp + edx - 0x5ad0ffe4]
add dword [esp + edx - 0x5ad0ffe0], edx
pop edx
mov dword [edx + ebp - 0x4a8bffde], eax
shl ecx, cl
movzx eax, dx
mov eax, dword [edi + ecx - 0x80000000]
shl dx, 0x87
lea edi, [edi + ecx - 0x7ffffffc]
not ecx
xor eax, ebx
push ecx
add cl, 0x2b
shl dx, 0xa9
rol eax, 2
jmp 0x1019a06b

Function at 0x101dcf8d
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [edi]
jnp 0x1017ce70
add edi, 4
lea ecx, [edx + edx*2 - 0x504f037b]
sar dword [esp + ecx - 0x69d463ce], 0x61
xor eax, ebx
neg eax
rol eax, 2
bts edx, edx
btc ecx, 7
neg cl
lea eax, [ecx + eax + 0xd55506b]
pop ecx
lea edx, [edx + edx*4 + 0x210dab90]
bswap eax
movsx ecx, byte [esp + edx - 0x1fd57c4]
je 0x1022bdde
sbb edx, edx
add eax, edx
push edx
rol eax, 3
xor eax, edx
xor ebx, eax
push ecx
xor edx, ecx
push edx
adc esi, eax
neg byte [esp + edx*8 + 0x15]
btc dx, cx
sub edx, 0x49a44e35
pop eax
pop eax
pop ecx
pop eax
pop eax
pop eax
pop eax
jl fcn.10190646
jmp 0x1025a6d1
Function at 0x101df56c
Capabilities:
Read file on windows
Terminate process

Disassembly:
cmovno dx, cx
add ebp, eax
movzx edx, byte [edi - 7]
mov eax, 0xccb71d85
sar word [esp + 8], cl
pop ecx
adc edi, 0xfffffff8
push eax
xor eax, eax
xor dl, bl
shl byte [esp + eax + 1], 7
adc dl, 0x12
mov ecx, 0x453efda1
rol dl, cl
dec ax
and cx, 0xa79f
or eax, dword [esp + ecx - 0x453ea56d]
xor dl, al
push eax
neg dl
idiv byte [esp + ecx - 0x453ea570]
or eax, ecx
not dl
jno 0x10233aa7
dec dword [esp + ecx - 0x453ea569]
shl ax, 0x46
xor bl, dl
sal cl, 0x41
idiv al
call fcn.101e3afb
not edx
sal edx, 0x6e
neg eax
rol ecx, 0x7a
bswap eax
cmovb ecx, edx
bts dx, cx
sal dx, 0xa2
xor ebx, eax
sal ecx, 0x54
xor edx, 0xada2bb05
xchg cx, dx
adc esi, eax
and edx, 0x9c0a6408
ja fcn.10190646
mov edx, 0xd784f9b6
sub dx, dx
mov eax, dword [edi]
btc edx, 0xa4
mov ecx, dword ss:[eax]
call fcn.10232017
mov ecx, 0x201ab701
movsx edx, cx
mov eax, dword [ecx + edi - 0x201ab701]
lea edi, [edi + ecx - 0x201ab6fd]
xor eax, ebx
add ecx, 0x9ab31a8
add edx, edx
setno cl
dec eax
xor ecx, ecx
add cx, dx
and dl, 0xb6
rol eax, 1
not eax
sal ecx, 0xee
rol eax, 1
lea edx, [edx*2 - 0x4eff80ce]
xor ebx, eax
add esi, eax
call fcn.1026d15c

Function at 0x101dfa86
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov edx, dword [edi + edx - 0x48c007f]
mov cl, byte [edi + ecx - 0x51dd4c9]
add edi, 6
mov dword [esp + 8], 0xb611f224
shl dword [esp + 8], 0xe
jnp 0x102651c6
shrd eax, edx, cl
mov edx, dword [esp + 8]
or dx, dx
mov ecx, 0xc63d7b35
mov dword [edx + edi - 0x7c890000], eax
mov dword [esp + edx - 0x7c890000], ebp
ret 8
dec eax
cwd
lea ecx, [edx + ecx - 0x29ae2b3b]
ror dl, 0xc2
bswap ecx
or eax, 0x250b099e
or edx, eax
xor edx, edx
neg ecx
call fcn.101bcb45

Function at 0x101e050a
Capabilities:
Terminate process

Disassembly:
add ebp, 4
call fcn.10246f75

Function at 0x101e5693
Capabilities:
Read file on windows
Terminate process

Disassembly:
push eax
dec dl
rol cl, 4
shl cl, cl
mov dword [esp + ecx*8 - 0x20b4fc], ecx
rol dl, 1
dec ax
inc dword [esp + ecx - 0x4169a]
add al, byte [esp + ecx - 0x4169d]
xor bl, dl
lea ebp, [ebp + ecx*2 - 0x82d44]
mov dword [ebp + ecx*8 - 0x20b500], edx
cwde
btc cx, cx
sal eax, 0x75
pop eax
pop ecx
pop ecx
jb fcn.10190646
mov eax, 0xf5af26a1
lea edx, [eax*4 + 0xc3daa83]
movzx ecx, al
mov ecx, dword [ebp + ecx - 0xa1]
add ebp, 4
xor ecx, ebx
dec ecx
shr dx, 0x44
dec dl
ror ecx, 1
sub edx, 0x4fa864bc
cwde
not ecx
shl dl, 0x41
bts eax, edx
xor eax, 0x5603dc95
rol ecx, 2
shl eax, 0x32
xadd dx, ax
dec ecx
bts eax, 0x97
shl al, 0x61
rol dx, 0xa9
xor ebx, ecx
add esi, ecx
add edx, edx
mov ecx, edx
mul cl
mov ecx, dword [edx + edi - 0x26a29a7c]
lea edi, [edi + edx*2 - 0x4d4534f4]
and eax, 0xee0a161b
push ecx
mov ecx, edx
popfd
bswap edx
inc ax
jmp esi
Function at 0x101ef638
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
mov ebp, edi
mov dword [esp + edx*2 - 0x6d82], edx
shr word [esp + edx*8 - 0x1b606], 0xca
sbb dword [esp + edx*4 - 0xdb00], edx
pop edx
pop eax
jno 0x101854da

Function at 0x101f06c0
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
pop ecx
sbb edi, 1
mov ecx, eax
mov word [edi], dx
mov edx, ecx
cdq
add eax, eax
jnp 0x10235b8e

Function at 0x101f0f05
Capabilities:
Read file on windows
Terminate process

Disassembly:
pop eax
mov word [esi + edx - 0x60b9e3e2], cx
lea ebp, [edx + ebp - 0x60b9e3e6]
movzx eax, dl
bts edx, 0xaa
mov ecx, dword [ebp + edx - 0x60b9e7e2]
not edx
add dword [esp + eax - 0xe2], 0xee16ae0a
xor ecx, ebx
sal al, 0x44
shr dword [esp + eax - 0x20], 0xd4
ror ecx, 2
dec ecx
call fcn.1025ad3c

Function at 0x101f1550
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp + edx - 0x2fff0091], eax
pop eax
xor ebx, ecx
cdq
neg dword [esp + edx]
adc esi, ecx
mov ecx, eax
bt ecx, 0xb5
bswap ecx
mov ebp, dword [edx + ebp]
sar cl, 0x66
and dword [esp + edx*2], 0xe3ad5480
pop ecx
jae fcn.1024af8a

Function at 0x101f4361
Capabilities:
Read file on windows
Terminate process

Disassembly:
shr ecx, 0xec
lea edi, [edi + ecx - 0xfff83]
mov dword [ecx + edi - 0xfff7f], eax
lea ebp, [ecx + ebp - 0xfff83]
mov eax, dword [ebp + ecx*8 - 0x7ffbf8]
dec dl
neg dword [esp + ecx - 0xfff72]
xor eax, ebx
shl byte [esp + ecx*8 - 0x7ffbec], 0xe2
rol eax, 1
neg eax
dec dword [esp + ecx*8 - 0x7ffbf0]
push ecx
xor eax, 0x94053ca1
push edx
not ecx
dec eax
btc cx, 0xb3
xor ebx, eax
add byte [esp + 6], 0x33
sar edx, 0xc1
rol ecx, cl
add esi, eax
pop eax
shr edx, cl
sbb dword [esp + edx*8 + 0xa], edx
pop edx
pop ecx
pop ecx
pop eax
pop eax
pop edx
jae fcn.101b3e0d

Function at 0x101f6d3f
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea eax, [esp + eax + 0xc]
btr dx, 0x2a
mov edx, dword [eax + ecx*2 - 0x9cbc4d2]
movzx eax, cx
lea ebp, [ebp + ecx*2 - 0x9cbc4d6]
rol al, 1
cwde
mov dword [ebp + ecx - 0x4e5e269], edx
movzx edx, al
sub word [esp + ecx*2 - 0x9cbc4cf], dx
inc eax
pop eax
pop eax
pop ecx
jnp fcn.10190646
xor ebx, eax
inc ecx
btr edx, ecx
xadd byte [esp + ecx*4 - 0x74], ch
adc esi, eax
movzx eax, dx
and dword [esp + ecx - 0x9018], ecx
lea ecx, [edx + edx*2 + 0x133a21ae]
movzx eax, byte [ecx + edi - 0x133a2730]
dec ecx
neg dword [esp + ecx*2 - 0x26744e5a]
lea edi, [edi + ecx - 0x133a272e]
xor al, bl
mov dword [esp + ecx - 0x133a272f], 0x59938d80
ror ecx, cl
rol al, 1
sar dx, 0xe1
neg edx
sbb al, 0x93
not cl
sar ecx, 0x84
inc ecx
neg al
neg edx
jnp 0x101e3fed
inc byte [esp + ecx - 0x4e5e263]
sbb al, 0xbd
rol dx, cl
xor bl, al
jmp 0x1017ed86
Function at 0x101fba9d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea eax, [eax + eax*4 + 0x313f2ab9]
or al, ah
lea esi, [esi + eax*2 - 0x62845150]
sar al, 4
or dl, cl
movsx ecx, al
not dl
bt eax, ecx
mov word [esi + eax - 0x314228fa], dx
cmovae eax, ecx
sbb edi, 4
movsx edx, ax
mov ecx, dword [edi]
not eax
bts edx, edx
lea edx, [edx*4 - 0x65ce8dd6]
xor ecx, ebx
call fcn.101e5b63
xor ecx, 0x70062a94
rol al, 0x83
or edx, edx
mov dword [esp + eax - 0x25154491], eax
xor ebx, ecx
not dword [esp + eax - 0x25154491]
or al, 0xb2
adc esi, ecx
lea eax, [edx + edx*2 + 0x7bb0e40f]
sub byte [esp + eax - 0x7bb0e23e], 0x98
pop ecx
js fcn.1017fa23
mov edx, 0xd2a07214
lea eax, [edx*8 + 0x3390fba2]
movzx dx, byte [esi]
imul eax, eax
shr eax, 0x90
bts eax, eax
mov cl, byte [esi + eax*2 - 0x1324e]
jb 0x1017f561
mov ebp, 0x511a281e
mov eax, dword [edi + ebp - 0x511a281e]
lea edi, [edi + ebp - 0x511a281a]
mov ecx, ebp
rol ecx, cl
xchg edi, eax
jb 0x101edcc4
mov edx, 0xbc8d5f23
movsx eax, dx
xor edx, edx
lea ebp, [edx + ebp - 2]
and edx, 0xa3905d95
movzx ecx, al
sal edx, 0xe4
mov cx, word [edx + ebp]
xor dx, ax
sub edx, 0xcf0873aa
xor cx, bx
not cx
lea edx, [eax + edx*8 - 0x3f56d557]
dec cx
not cx
btc dx, 0x30
cbw
adc cx, 0xd3bb
mul dl
shr dl, 0x25
neg cx
xor bx, cx
xchg dh, al
cbw
rol eax, 0x3f
lea esi, [esi + edx - 0x48685f08]
xadd dl, ah
shr eax, 0x6f
rol dx, 0xc6
mov dword [esi + edx - 0x4868e0d7], ecx
lea ebp, [ebp + edx - 0x4868e0db]
xor dx, ax
sar al, 5
mov edx, dword [edx + ebp - 0x4868e0d7]
push eax
mov ecx, dword [esp + eax - 0x10000]
xor edx, ebx
xor edx, 0xf028ce84
pop ecx
ror edx, 3
sar cx, 0x69
neg edx
or eax, ecx
xor ax, 0xa21f
sal ecx, 0x4a
dec edx
jmp 0x1021d5d4
xor ebx, edx
bt eax, eax
sbb ecx, ecx
adc edi, edx
jmp fcn.10242672

Function at 0x101fdeed
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp + edx - 0x56faa304], edx
add esi, eax
mov dword [esp + edx - 0x56faa308], ecx
neg dx
pop eax
pop edx
pop eax
jbe fcn.10190646

Function at 0x101fed94
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp], ecx
xor dl, bl
call fcn.101ef872
mov ecx, 0x8e09fe22
movzx ecx, byte [ebp - 1]
mov eax, 0xd1a0d01e
cbw
xor cl, bl
sub ax, ax
cwde
lea edx, [eax - 0x7fe26758]
rol cl, 1
and dx, dx
not ax
neg cl
btc edx, eax
xor cl, 0x21
call fcn.101e6186

Function at 0x101fef43
Capabilities:
Encrypt data using aes
Reference aes constants
Terminate process

Disassembly:
xor edx, ebx
sub cx, ax
bswap edx
bt ecx, eax
or eax, 0xd7bc8fa1
ror edx, 1
shr eax, 0x38
call fcn.101b943c
Function at 0x101ff4e6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
xor ebx, eax
add esi, eax
add dword [esp + ecx - 0xb940021], edx
sbb edx, 0x8836bf2a
add dl, ch
movzx ecx, byte [ebp + edx*2 - 0x69606560]
lea ebp, [ebp + edx - 0x34b032af]
xor cl, bl
movsx eax, dl
neg cl
sub cl, 0x22
sar eax, 0x27
mov dword [esp + edx - 0x34b032b0], eax
pop edx
neg cl
ror word [esp], 0xe7
cwd
adc cl, 0x9e
cwde
lea eax, [eax + eax + 0x5485c50a]
neg cl
add eax, edx
cdq
xor bl, cl
dec edx
dec dx
bt edx, eax
lea edi, [edi + eax - 0x5485c509]
rol dx, 0xeb
sbb byte [esp + eax - 0x5485c505], 0x9e
idiv dword [esp + eax - 0x5485c503]
mov word [eax + edi - 0x290b], cx
pop edx
pop edx
jmp 0x10235b8e

Function at 0x1020498a
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp], 0x93001233
shld dx, ax, cl
mov eax, 0x113d6b97
call fcn.102564c1
mov eax, 0xf9268018
push eax
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
push eax
bswap ecx
call fcn.101cc031

Function at 0x10204d42
Capabilities:
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
mov dword [esp], 0xc089263e
movzx ax, byte [ebp]
mov ecx, 0xf110db3c
mov dl, byte [ebp + 2]
bt ecx, ecx
shl cx, 0x64
and al, dl
and byte [esp + 1], ch
lea edx, [ecx*8 - 0x1e708af9]
not al
mov dword [esp + edx - 0x6a151307], edx
dec ecx
mov word [ebp + edx - 0x6a151305], ax
mov edx, dword [edx + esi - 0x6a15130b]
jb 0x1020a8ef
sbb esi, 4
shr ecx, 0x6b
mov eax, ecx
or cl, 0x99
xor edx, ebx
xadd byte [esp + ecx - 0x1e229c], ch
jnp 0x10224adf
call fcn.101f1369
mov eax, 0x96a6feba
cdq
mov ecx, dword [ebp]
call fcn.10211762
neg cl
xor ax, 0x122c
not cl
sbb edx, dword [esp + eax - 0x30085a3c]
jae 0x102183b1

Function at 0x10206e66
Capabilities:
Read file on windows
Terminate process

Disassembly:
adc edi, 5
or byte [esp + 2], 0xbf
call fcn.102254aa
mov ecx, 0xc3f19a9
mov eax, dword [ebp + ecx - 0xc3f19a9]
lea edx, [ecx*4 + 0x125223f]
imul cx, cx
cmovae cx, dx
mov edx, dword [ebp + ecx*4 - 0x30fdc640]
shl ecx, 0xc9
bt ecx, ecx
shl cl, 0x21
lea ebp, [ebp + ecx - 0x7ee321fc]
xchg ch, cl
call fcn.101da104
xor eax, 0x6a0ff63c
ror eax, 2
xor ecx, 0x11bd193f
sub ecx, 0x2f0c4635
pop ecx
bswap eax
lea ecx, [edx + edx*2 - 0x2444346c]
inc eax
and ecx, 0x8eb3b12e
add ecx, 0x9d973131
sal cx, 0xe7
xor ebx, eax
push edx
sal dword [esp + edx - 0x79a7bbb1], 1
adc esi, eax
push ecx
mov dx, word [edi + edx - 0x79a7bbb1]
movsx eax, cx
cwde
mov ax, word [edi + 2]
mov cl, byte [edi + 4]
jmp 0x10251691
rol dword [esp], 0xce
adc edi, 4
rol word [esp + 3], 0x6b
inc byte [esp + 1]
call fcn.1024c614
mov eax, 0x8b883c19
mov ecx, eax
mov edx, dword [edi]
btc eax, ecx
ror cl, 0x25
mov eax, dword [edi + 4]
mov cl, byte [edi + 8]
push 0xfc03c297
jb 0x101a3eea
Function at 0x1020abc1
Capabilities:
Read file on windows
Terminate process

Disassembly:
or eax, dword [ebp + eax + 6]
imul ecx, ecx
movsx edx, word [esp + ecx]
pop ecx
lea ebp, [ebp + ecx*2 - 0x8f62840]
xor eax, ebx
sub eax, 0x9c989d2e
lea edx, [edx + ecx*4 + 0x36b3d51b]
ror eax, 1
add cl, dh
neg eax
jmp 0x10266c23
xor cl, bl
xadd word [esp + edx*2 - 0x1ac12e6], dx
xor cl, 0x18
neg edx
not dword [esp + eax*2 - 0x5a78da5c]
not cl
shl byte [esp + eax - 0x2d3c6d2c], 0x65
sbb cl, 0x1c
rol dl, 0x84
idiv eax
sal edx, 0x97
rol cl, 1
rol word [esp + 4], 0xc9
sub al, dl
mov dword [esp], edx
adc cl, 0x2a
sub dword [esp + 4], eax
not cl
xor eax, eax
idiv word [esp + eax + 2]
xor bl, cl
lea ecx, [esp + ecx + 8]
lea edx, [edx*8 + 0x1334eca4]
pop eax
mov edx, dword [ecx]
cwde
or dword [esp + eax*4], eax
mov dword [edi + eax*2 - 8], edx
mov edx, dword [eax + ebp + 2]
inc word [esp + eax*4]
xor edx, ebx
movzx ecx, word [esp + eax*4]
not edx
ror edx, 3
ror cl, cl
push eax
neg edx
sal cl, 0xe6
rol ecx, 0xe
ror edx, 1
lea edx, [edx + ecx*8 + 0x742dbd02]
and ecx, 0x389f3835
add eax, 0xa48418b4
xor ebx, edx
pop eax
imul eax, ecx
rol eax, 0x37
adc esi, edx
idiv byte [esp + eax + 1]
jmp 0x1018d11c
sub cl, cl
inc eax
dec edx
sal cx, 0x81
add dx, 0x1713
xor ebx, eax
dec cl
mov dword [edi + ecx*2 - 0x8f6520a], eax
shr dx, 0xed
sub cl, dl
lea edi, [edi + ecx*8 - 0x23d947f4]
setns dl
bswap ecx
jae 0x10235b8e

Function at 0x1020ba96
Capabilities:
Read file on windows
Terminate process

Disassembly:
bswap edx
lea edi, [edi + edx*4 - 2]
mov word [edi + edx], ax
lea ebp, [ebp + edx*2 - 4]
mov dword [esp + edx*4], 0x4804fe0e
push ecx
xor ecx, dword [ecx + ebp]
movzx eax, dx
xor ecx, ebx
not ecx
xadd byte [esp + edx + 7], dh
or ax, 0xa9a8
sar eax, 0xd5

Function at 0x1020c3ca
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub ebp, 4
mov dword [esp + 4], 0x7c94f124
mov dword [ebp], ecx
mov eax, dword [edi]
movsx ecx, byte [esp + 4]
sar dword [esp + ecx*2 - 0x44], 0xcb
shr word [esp + ecx - 0x1f], 0x23
lea edi, [edi + ecx - 0x20]
pop edx
mov edx, ecx
xor eax, ebx
rol eax, 2
push ecx
shl dl, cl
add cx, word [esp + ecx - 0x1e]
lea eax, [ecx + eax + 0x1f3bc415]
shl cl, 0xe1
shr ecx, 0xa5
neg eax
inc dword [esp + ecx*2]
or dword [esp + ecx + 2], edx
lea ecx, [ecx*4 + 0x63b95693]
bswap eax
xor ebx, eax
add esi, eax
movzx eax, byte [esp + ecx - 0x63b95697]
pop edx
pop ecx
jmp fcn.10190646
Function at 0x1020d600
Capabilities:
Read file on windows
Terminate process

Disassembly:
shld eax, edx, cl
mov dword [ebp], eax
pop edx
pop eax
jmp esi
or word [esp + eax - 0x1f6bfffb], ax
sbb ecx, edx
neg ecx
shl dl, 0x47
dec dx
adc dl, 0xaf
not ecx
sbb dword [esp + eax*2 - 0x3ed7fffc], eax
sets al
jns 0x10269ac7
sbb ecx, 0xc7174c0d
btc eax, 0x81
shl ax, 0xce
call fcn.101e0efe
lea edi, [edi + ecx - 0x92b4857]
call fcn.1024df32
mov eax, dword [edi]
mov ecx, 0x70bd6436
lea edx, [ecx + ecx*4 - 0x61c2f3dc]
lea edi, [edi + ecx - 0x70bd6432]
shl cl, 1
bts cx, 0x96
xor cx, dx
xor eax, ebx
shr dl, 0x61
add dl, 0xb
dec edx
neg eax
add cx, 0xc8b8
push edx
push ecx
ror eax, 3
neg cx
mov byte [esp + ecx - 0x70bdd1ea], dh
lea eax, [eax + ecx - 0x20880e48]
neg eax
dec ecx
pop ecx
rol dword [esp + ecx - 0x70bd2e01], cl
rol eax, 2
xor ebx, eax
or dword [esp + ecx - 0x70bd2e01], edx
adc esi, eax
bts ecx, 0xac
neg dword [esp + ecx - 0x70bd3e01]
movzx eax, cl
mov eax, dword [ebp + ecx - 0x70bd3e01]
adc edx, 0x5d37500f
adc ecx, edx
mov edx, dword [ebp + edx*2 - 0x5e4ea262]
mov cl, byte [ebp + 8]
inc dword [esp]
sar byte [esp], 0x66
mov dword [esp], 0x6813d393
adc ebp, 6
push 0xc71f9a04
rol byte [esp + 4], 0xc1
jb 0x10195d6a
mov ecx, 0xef980433
sub esi, 4
shr cx, 0xca
not cx
lea eax, [ecx*8 + 0x373d5a09]
mov edx, dword [esi]
call fcn.101a3f3d

Function at 0x1020d63a
Capabilities:
Read file on windows
Terminate process

Disassembly:
shld edx, eax, cl
mov eax, 0x583511b3
lea ecx, [eax*2 + 0x49b2c822]
mov dword [esp + eax - 0x583511af], 0x34a0221f
mov dword [ebp + eax - 0x583511b3], edx
mov dword [esp + eax - 0x583511b3], 0x7692762b
cwde
lea esi, [eax + esi - 0x11b7]
xchg dword [esp + eax - 0x11b3], eax
lea edx, [eax*8 + 0x592e523b]
mov eax, dword [esi + edx - 0xdc20393]
xadd edx, ecx
xor eax, ebx
shr ecx, 0x7d
lea eax, [eax + edx*8 + 0x663ef630]
xor eax, 0xef24252a
dec eax
call fcn.10186b9b
mov eax, dword [esi - 4]
xor eax, ebx
inc eax
not eax
mov ecx, 0xdf8e8088
lea eax, [eax + ecx - 0x5bde9307]
rol eax, 3
mov edx, ecx
xor ebx, eax
shl cx, 0x44
adc edi, eax
ror cx, 0xe7
mov ecx, dword [ebp]
movzx eax, byte [esi - 5]
xor al, bl
lea edx, [edx + edx + 0x6c8d152a]
not al
bswap edx
ror edx, 0xf9
sbb al, 0x21
and edx, edx
neg al
push edx
bt edx, 0x86
pop edx
adc al, 0x15
imul dx, dx
neg dx
xor al, 0xaa
sar edx, 0x2c
sal edx, 6
adc edx, 0xc2aecc24
sbb al, 0x1b
xor bl, al
call fcn.101cb680

Function at 0x1020dcbd
Capabilities:
Read file on windows
Terminate process

Disassembly:
sbb dx, dx
bswap ecx
mov dword [esp + 4], edx
rol edx, 0x5a
shl edx, 0x12
dec ecx
not dl
not al
bswap ecx
ror ecx, 1
sub edx, 0x2701f72f
xor ecx, 0x48b1e91f
mul eax
xor ebx, ecx
mov dword [esp + eax - 0xf42bd01], eax
add esi, ecx
mov bp, word [ebp + eax - 0xf42bd01]
cbw
shr dword [esp + eax*8 - 0x7a100006], 0x95
dec eax
pop eax
pop ecx
ja fcn.10190646
lea eax, [edx*4 + 0x389679b9]
lea ebp, [ebp + edx - 0x3e]
imul dx, ax
xor ecx, ebx
lea ecx, [edx + ecx + 0x60b7ea46]
dec edx
sub eax, 0x2310ce25
neg edx
not ecx
lea ecx, [ecx + eax*4 + 0x626bab9b]
setle dl
bswap ecx
xor ebx, ecx
and edx, 0x8d07d1b9
adc esi, ecx
jmp esi