joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ed1ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub al, 0x11
rol al, 1
sub byte [esp + ecx*2 - 0x1fe13], dh
inc ecx
sbb al, 0x11
sar cx, cl
xadd byte [esp + ecx*4 - 0x3fffc], dh
xor al, 0xb3
sar cl, 0xc1
ror al, 1
inc cl
jg 0x1008ec9f
xor bl, al
not dl
neg dl
xchg dword [esp + ecx*2 - 0x1fe00], edx
lea eax, [esp + eax + 4]
seta byte [esp + ecx*2 - 0x1fe00]
and dx, cx
adc word [esp + edx*8 - 0x7f800], dx
movzx dx, byte [ecx + eax - 0xff00]
dec dword [esp + ecx - 0xff00]
call fcn.10103f97
sub ecx, 0xfc2024a5
shl edx, 0x6b
not ecx
xor ebx, ecx
call fcn.10108ee1
mov ax, word [edi]
mov edx, 0x80114e02
movsx ecx, dx
neg dl
movzx edx, byte [ecx + esi - 0x4dfe]
setae cl
xor dl, bl
rol dl, 1
add ecx, 0x229099a3
sar cx, cl
xor dl, 0x3b
sal ecx, cl
neg dl
or cl, 0x8f
sbb dl, 0x30
xor dl, 0x98
ror cl, 0x25
xor cx, cx
inc dl
neg cx
lea ecx, [ecx*2 + 0x4e3631b5]
xor bl, dl
dec ecx
setl cl
add edx, esp
xor cx, cx
setl cl
mov byte [edx], al
movsx edx, cl
sar ecx, 0x79
movzx eax, byte [esi + edx*8 + 5]
not cl
lea esi, [esi + edx*2 + 6]
sub dx, dx
not cx
xor al, bl
sar dl, 0x26
rol dx, 0x65
inc edx
adc al, 0xd
neg ecx
ror al, 1
push ecx
jmp 0x100b1a18

Function at 0x100ed58c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg al
xadd byte [esp + 0xc], dh
xor dl, 0xaf
ror al, 1
call fcn.100ada4f

Function at 0x100f0051
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
neg edx
push eax
lea ecx, [eax + eax + 0xeb0a121]
xadd word [esp + eax*4 - 4], cx
xor ebx, edx
or dword [esp + eax - 1], ecx
adc ebp, edx
sub cx, word [esp + eax*2 - 2]
mov byte [esp + eax + 1], 0x9a
jg 0x1012ff13
dec edx
inc ax
mov dword [esp + eax - 1], eax
bswap edx
rol byte [esp + eax + 1], 0x44
ror edx, 2
jmp 0x100a66da
pop eax
jb fcn.100c3c87

Function at 0x100f1977
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edx, 0xa8f3c0b
pop ecx
dec eax
bswap eax
not eax
call fcn.100b3c94
inc ecx
dec eax
bswap eax
sal dword [esp], 0xa2
ror ecx, 1
shr ax, 0x2e
xor ebx, ecx
or dword [esp], 0xac3cf832
shr byte [esp], 0x42
add ax, ax
adc ebp, ecx
call fcn.100a91bc

Function at 0x100f3caa
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
neg al
ja 0x10101a74
add ebp, edx
sal dword [esp + eax - 0x14af090b], cl
mov dword [esp + eax*4 - 0x52bc2448], ebp
ret 8

Function at 0x100f4c1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [edx*4 - 0x5c437257]
inc eax
jmp 0x100b6e8a
xor bl, al
mov dword [esp], edx
lea eax, [esp + eax + 8]
xor dx, dx
sar byte [esp + 2], 0x63
mov dword [eax], ecx
rol dword [esp + 4], 0xb2
sal dword [esp + 4], 0x33
add word [esp], dx
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
mov dword ss:[edx], eax
mov edx, 0x99f812a
mov eax, dword [edi + edx*2 - 0x133f0253]
xor eax, ebx
or dx, 0x8b05
lea eax, [eax + edx*2 - 0x26d7060b]
xor eax, 0xcf37d005
sal dx, 0x8a
jne 0x100a0529
Function at 0x100f4f03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg cx
sub cx, 0xdb06
shl dword [esp + eax*8 - 0x80516bc], 0x1f
dec al
xor cx, 0x88af
xor edx, 0xca8bf610
dec cx
sar eax, 0x7d
and byte [esp + eax + 5], al
xor bx, cx
call fcn.100fe92b
xor eax, 0xee28d2bd
call fcn.10106370

Function at 0x100f89f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword fs:[ecx + edx - 0x7ba6c05e], eax
js 0x100cd906
mov word [ecx + edx*2 - 0x4fd043fe], ax
not byte [esp + edx - 0x27e821fd]
mov ecx, dword [edx + edi - 0x27e821fe]
shr dword [esp + edx*2 - 0x4fd043fe], 0x81
je 0x100d70a6
mov eax, 0xdd273d1e
xor ecx, ebx
and ax, dx
bswap ecx
call fcn.10114e3b
sub edx, edx
add edx, dword [edx + esi]
add esi, 4
mov ecx, 0x3d9f7dab
mov eax, ecx
inc cl
xor edx, ebx
shr eax, 0xb
bswap edx
sar eax, cl
inc edx
ror edx, 2
dec eax
jne 0x100da4fd
lea edx, [edx + ecx*2 - 0x7496f0a5]
call fcn.100db8bf
sub cl, 0x12
xadd dl, dh
neg edx
xor bl, cl
xor byte [esp + edx - 0x27e821fc], dl
lea ecx, [esp + ecx + 4]
dec dword [esp + edx*2 - 0x4fd043fe]
jno 0x100c56f0
neg byte [esp + eax*2 - 0x494c0124]
mov edx, dword [edi + eax*2 - 0x494c0120]
ror eax, 0x8a
not ecx
ror al, 0x67
pop eax
not edx
sar eax, 0x6f
sal ax, 0xcc
mov dword [esp + eax], eax
and ecx, edx
xor al, al
call fcn.100eb7a6
neg dx
sub esi, 0xfffffffb
movzx ecx, dx
mov dword [esp + ecx*4 - 0x9ffc], edx
dec ecx
xor al, bl
add cl, 0xb8
call fcn.10126f61
mov edx, 0xd582812a
movzx eax, dx
mov ecx, dword [edi + eax*4 - 0x204a8]
not eax
mov eax, dword [edi + 4]
or dx, dx
lea edx, [edx*2 - 0x2f5e41f6]
lea edi, [edi + edx - 0x7ba6c056]
ja 0x10090d81
rol cl, 1
jmp 0x100f7241

Function at 0x100fc79a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, eax
sar edx, 0xa7
call fcn.1011e9b6
mov ecx, dword [esi]
movzx ax, byte ss:[ecx]
mov cx, ax
movzx cx, cl
mov al, byte [esi + 4]
jmp 0x10138e5a

Function at 0x100fdb36
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
call fcn.100b162e
add ebp, edx
mov ax, word [edi + ecx - 0x5023ba90]
shl cx, 8
lea edx, [ecx + ecx*2 + 0x59a76b12]
mov dx, word [ecx + edi - 0x50238ffe]
jp 0x100cbfab
push ecx
jmp 0x1012ace6
call fcn.10029cc6
lea esp, [esp + 8]
stc
jmp 0x1012fade

Function at 0x100fdb5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sar cx, 0x46
sub dword [esp + ecx - 0xfece], ecx
bswap eax
adc cl, 0xbb
lea eax, [eax + edx*2 - 0x5f059482]
jne 0x10097d68

Function at 0x10103036
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg ecx
push edx
xor ebx, ecx
neg ax
sub edx, 0xc51f19ac
add ebp, ecx
rol word [esp + eax + 9], 0x81
pop edx
pop edx
pop edx
jae fcn.100c3c87
push esi
push dword [ebp - 0x4c]
mov dword [ebp - 0x2c], 0
push esi
jmp 0x10103931
xor ecx, ebx
mov dword [esp + edx], 0xc237cbac
jmp 0x1012d43c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
rol dword [esp + edx*4 + 4], 0x54
lea ecx, [eax + ecx - 0x1ba07ea4]
neg ecx
ror byte [esp + edx*4 + 1], 0x87
bswap ecx
setae dl
adc edx, edx
jae 0x100921ce
Function at 0x10104c58
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
xor eax, ebx
mov dword [esp + edx*2], ecx
inc eax
or cx, dx
pop edx
and ecx, 0x7705f815
ror eax, 1
call fcn.1010a9d0
call fcn.100df582
inc edx
neg edx
not eax
xor ebx, edx
add ebp, edx
call fcn.100e9243
mov eax, dword [edi + edx*2]
jge 0x100b596f
mov ecx, 0x7c18bea3
call fcn.1012ff1a
mov eax, 0xea367002
call fcn.10022d7b
lea edx, [edx + edx*4 + 0x89e7983]
xor bx, ax
jmp 0x100dae2a

Function at 0x1010668c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol ecx, 2
shr eax, 0x82
xor ebx, ecx
dec edx
add ebp, ecx
mov cx, word [esi + eax - 0x3fc6]
call fcn.1012a6c0

Function at 0x10107b11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x20]
call fcn.100fbf11
Function at 0x1010954d
Capabilities:
Parse pe header

Disassembly:
xor dl, bl
shr eax, 0x15
mov dword [esp + eax - 0x460], eax
shr byte [esp + eax*2 - 0x8bf], 0xa2
not dl
adc dl, 0x11
neg dl
not ax
jmp 0x1010952e
ja 0x100fd60c
push edx
push ecx
call fcn.10029cc6
add esp, 8
mov dword [ebp - 0x50], 0
clc
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
test edi, edi
test esi, esi
jmp 0x100bd5f5
mov byte [ecx - 4], al
test dl, 0xb2
mov byte [ecx - 3], 1
stc
cmp edx, 0x21
jb 0x1010750c
mov dword [ebp - 0x68], 0x21
mov edx, dword [ebp - 0x64]
mov eax, edi
cmp bl, dh
bsf ax, cx
mov dword [0x1008cb28], edx
xchg ah, al
sar eax, 0x3a
rcl eax, cl
mov byte [ebp - 4], 2
rcl eax, cl
btc ax, 0xa8
rcl al, 0x8a
xor ecx, ecx
sub edi, edi
ror al, 0x16
add eax, ebp
mov dword [ebp - 0x44], 0
cmc
rol ax, 0x84
adc ah, ch
mov eax, 0x5a4d
clc
cmc
mov dword [ebp - 0x40], ecx
clc
test sp, cx
cmc
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x70], 1
test ch, ah
cmp al, 0x99
cmp word [edx], ax
jmp 0x100da705
je 0x10138b28
push 0x42
jmp 0x10136cfa
jne 0x100e0820
mov eax, dword [esi + 0x14]
cmc
movups xmm0, xmmword [esi + 4]
movzx eax, ax
add eax, esi
mov dword [ebp - 0x64], eax
and ax, sp
add eax, ebp
bswap ax
movzx eax, word [esi + 6]
cmp cx, ax
xor esi, esi
test edx, ebp
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x7c], eax
test bx, 0x4a3d
nop dword [eax]
jne 0x100e0820
mov esi, dword [edx + 0x3c]
cmp bx, 0x5e91
stc
cmc
add esi, edx
cmc
cmp dword [esi], 0x4550
jmp 0x100d4866
mov byte [ecx - 7], 1
mov byte [ecx - 6], al
shr ax, cl
movzx eax, byte [ebp + edx - 0x36]
lea edx, [edx + 3]
cmc
mov byte [ecx - 5], 1
jmp 0x100a6ab4
lea ecx, [ecx + 6]
test ah, 0x9c
cmp bx, 0x3307
mov byte [ecx - 8], al
test bx, ax
movzx eax, byte [ebp + edx - 0x37]
jmp 0x100e6d18
call fcn.1003657a
jmp 0x10138b28
call fcn.1002a243
lea esp, [esp + 4]
rcl ecx, cl
neg ch
mov dword [ebp - 0x80], eax
xchg ch, cl
btc cx, 0x3e
not cx
mov dword [ebp - 0x6c], eax
sub edx, edx
lea ecx, [eax + 2]
sar eax, 0x13
sbb al, cl
movzx eax, byte [ebp + edx - 0x38]
jmp 0x100eb25c
call fcn.1011cc62
mov word [esi + edx - 0x10001], cx
pop edx
shr edx, 0x59
and eax, 0x93a97f36
mov ecx, dword [edx + edi - 2]
call fcn.100918b8
call fcn.100942b3
jb 0x100a4af2
mov ecx, dword [ecx - 4]
test edx, 0x493e440b
clc
add edx, 0x23
cmp ecx, eax
clc
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jmp 0x100a4aec
mov dword [ebp - 0x68], 0
jmp 0x101074e5
mov dword [ebp - 0x6c], 0
jmp 0x1011e98c
mov ecx, str.api_call_exception:GetModuleHandleA
jmp 0x1008eca5
Function at 0x1011dda7
Capabilities:
Encode data using xor

Disassembly:
xor bl, dl
sar byte [esp], 0x44
ror dword [esp + 1], 0x4e
lea edx, [esp + edx + 8]
mov byte [edx], al
call fcn.1009f8cd
lea ecx, [ecx + eax*8 - 0x75bf2291]
call fcn.100969ea
mov dword [esp + 8], 0x463659b9
mov ecx, dword [esp + ecx - 0x3bba712]
call 0x1011dda7
sbb edi, 0xfffffffa
sal byte [esp + 8], 0xa1
xor ecx, ebx
shl edx, 0xdf
sub byte [esp + edx - 0x7ffffffc], dl
not dword [esp + edx - 0x7fffffec]
sbb ecx, 0x1397efad
xor ecx, 0xcf37d005
inc ecx
movsx eax, dx
mov dword [esp + eax*2], 0x35bf32b6
or dword [esp + eax*2 + 0x16], 0xd692bf01
xor ecx, 0x14357cae
sal dword [esp + eax + 0xb], 0xef
bswap ecx
jp 0x100d1b89
ja 0x100f3a65
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.100fbf11
jmp 0x100b2cc0
Function at 0x10121b55
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
inc ecx
shl dword [esp + edx + 0x2d6e686d], 0x2d
xor word [esp + edx*2 + 0x5adcd0da], dx
neg ecx
add ecx, 0x88aed81c
sar edx, 0xdc
movsx eax, dl
xor ecx, 0x1e13c38d
xchg word [esp + edx*2 + 8], dx
or edx, 0x6d82010e
setns byte [esp + edx + 0x3c81]
dec ecx
call fcn.100ef3e3
movzx dx, byte [ecx]
lea ecx, [eax + eax + 0x5030a7be]
sal ecx, cl
adc esi, 2
sub cx, 0xaf84
jae 0x100dcf19
mov word [esi], dx
mov dword [esp], eax
mov edx, dword [edi]
inc eax
xadd cl, al
xchg dword [esp + 4], eax
add eax, 0xffff6880
jmp eax

Function at 0x101231ef
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add ebp, eax
inc edx
pop edx
pop edx
pop ecx
pop ecx
pop eax
add edx, ebp
jmp edx
not dl
xchg dword [esp + ecx*2], ecx
xor eax, 0xdc10ab19
lea eax, [ecx + eax*8 - 0x50ebfa]
inc dl
ror dl, 1
or ax, 0x7a0c
or dword [esp + 2], ecx
inc dl
shr dword [esp + 4], cl
jne 0x100b9154
xor dl, 0x1c
ror dl, 1
and ecx, dword [esp]
neg eax
cmovae ecx, eax
xor bl, dl
not eax
lea edx, [esp + edx + 8]
jmp 0x100d75fe
lea edi, [edi + ecx*2 + 4]
lea edx, [ecx + ecx*8 + 0x4624489d]
ror cx, 0xec
shl dl, 0x87
xor eax, ebx
bswap eax
rol byte [esp + ecx*2 + 5], 0xc4
neg edx
xor eax, 0x65937683
push ecx
rol cl, 0x61
push edx
not eax
xor eax, 0xc6afc6bf
inc ecx
add ecx, 0xd42c0e88
xor ebx, eax
xchg edx, ecx
jmp 0x10099e3c
xor ecx, ecx
jo 0x100dd8e1
push ecx
mov dword [edx + ecx], eax
mov eax, dword [ecx + edi]
jle 0x100a5939
mov edx, dword [edi]
mov ecx, 0x15070c10
call fcn.10106635
rol eax, 0x7d
mov eax, dword [edx]
movsx edx, cx
call fcn.10138b19
shr dl, 0x86
mov ecx, edx
mov eax, dword [edi]
sbb dx, cx
adc edx, 0xb000388d
sub dx, 0x3806
adc cl, byte [edi + edx - 0x60360083]
lea edi, [edi + edx - 0x60360085]
shl eax, cl
mov dword [edi + edx - 0x60360087], eax
movzx eax, dx
sar ax, 0x66
jmp ebp
inc edx
ror ax, 0x86
bswap edx
not edx
adc al, 0x3d
dec cl
rol edx, 1
sub cl, ch
sbb eax, 0x2d971818
pop ecx
xor ebx, edx
push eax
rol byte [esp + eax*2 - 0x4b147408], 0xc2
adc ebp, edx
sal word [esp + eax*2 - 0x4b147407], 0xc7
mov edx, dword [eax + esi - 0x258a3a04]
sal cl, 0x45
xor al, byte [esp + ecx - 0x5321b77d]
mov eax, dword [esi + eax*2 - 0x4b14743e]
dec ecx
sbb ecx, 0x65b08c20
push ecx
add esi, 8
mov dword fs:[edx], eax
pop eax
pop ecx
jmp ebp
mov dword [esp + ecx - 2], ecx
bswap eax
add ebp, edx
movzx edx, byte [edi + ecx + 2]
lea edi, [ecx + edi + 3]
xor dl, bl
ror dl, 1
xor al, 0x30
js 0x1009b317
mov byte ss:[eax], dl
pop ecx
movsx eax, cl
mov edx, dword [esi + ecx - 0x1cd5780d]
ror cl, 0xe1
and cl, ah
not cx
lea esi, [esi + eax*2 - 0x16]
sbb al, 0x97
sbb ecx, 0x1825471c
xor edx, ebx
sal ax, cl
or cl, 0x9e
lea edx, [edx + ecx*2 - 0x250100a0]
sbb ecx, eax
inc ecx
neg edx
call fcn.1010b05e
Function at 0x1012388a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
adc ebx, edx
add dword [eax - 0x6d], edx
jecxz 0x1012288f
and byte [ebx], al
xor ch, byte [esi]
cli
ljmp 0xe175
in eax, 0xb3
lds esi, [0x2caf8618]
stosd dword es:[edi], eax
jne 0x10122857
sub al, 0x1e
push esi
call 0xf9062298
push edi
mov byte [0x8a4edff1], al
sub dh, byte [edi + 0x60]
mov al, 0xb4
fnstsw word [ecx - 0x39d3199a]
imul esi, esi, 0xffffffff
mov ebp, 0x259de0ca
out dx, eax
inc ah
out 0x2c, eax
xor eax, 0x63486ed0
dec ecx
pop edi
shr byte [esi + 0x48], 1
arpl word [ecx + 0x5f], cx
nop
or eax, 0xba3b719
dec edx
aaa
ljmp 0x42d1
or dx, dx
not cl
inc edx
jecxz 0x1012287c
invalid
call fcn.100a4e26
bswap ecx
jmp 0x1001f90e
xchg di, ax
stc
invalid
mov ecx, 0x468f86bf
lea eax, [ecx + ecx - 0x31c513ed]
sal eax, cl
mov ecx, dword [esi + eax - 0x80000000]
not ax
bswap eax
mov eax, dword [esi + 4]
call fcn.100bc77b
daa
jge 0x10122901
jo 0x101228c3
xor al, 0xa6
pop eax
sar dword [edi], cl
out 0x40, eax
cmpsb byte [esi], byte es:[edi]
pop eax
shr ebx, cl
inc ebx
xor al, 0xa6
pop eax
sal dword [edi + 0x58a62863], cl
sar dword [ebx + 0x1f], cl
js 0x101228ed
mov ebx, ebx
dec ebx
mov esi, dword [ecx - 0x75]
cbw
add dword [ecx], esp
push cs
dec ebx
std
pushfd
or dword [ebx + 0x3c], ebx
xlatb
stosd dword es:[edi], eax
out dx, al
loopne 0x101228f4
inc esi
adc edx, edi
pop edx
push ss
sbb byte [ecx], al
invalid
mov dword [esi + ecx*2], edx
mov eax, ecx
xadd eax, ecx
inc eax
mov edx, dword [edi + ecx*8]
not cx
lea edi, [edi + ecx*2 - 0x1fffa]
xor edx, ebx
rol eax, cl
lea edx, [edx + ecx - 0x1398efac]
not ecx
jb 0x10122905
xchg dword [esp + 0xc], ecx
adc ecx, 0x6baa7
jmp ecx
Function at 0x10124adb
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea edi, [edx + edi - 0x3808525e]
setl cl
dec cx
sub dl, 0x86
mov word [edi + edx - 0x380852d6], ax
push ecx
shl cl, 5
setp dl
pop ecx
js fcn.100c3c87
je 0x1009ac97
push 0
jmp 0x100ea286
je 0x1009ac97
push str.8061A054_2CC2_4D2C_A3BF_703FF9E4AF0B
jmp 0x100de0a0
push 0
jmp 0x100d670e
mov eax, dword [esi]
lea ecx, [edx*4 - 0x70d58660]
adc esi, 4
neg dl
shl cl, 0x64
xor eax, ebx
neg ecx
sets dl
lea eax, [ecx + eax - 0x5bbeb68e]
or edx, edx
bswap eax
jne 0x10101a42
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1008cf34], eax
cmp esi, 0x239372b8
cmp cl, ch
cmc
test eax, eax
je 0x1012abb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x563
jmp 0x1009a339
sub eax, 0xe7a32e07
xor cl, 0xb3
or eax, 0xa521d798
ror cl, 1
xor bl, cl
lea ecx, [esp + ecx + 4]
inc dl
movzx ax, byte [ecx + edx*2 - 0x7010a4b8]
pop ecx
jne 0x100d8844
push 0
jmp 0x10120c2b
jns 0x10023f56
mov ecx, dword [edi]
movzx dx, byte [ecx]
add edi, 2
mov eax, 0x221f9e06
add eax, 0x661d403f
jo 0x100b0856
seta cl
mov cl, byte [esi + 8]
call fcn.100a9eb7
push 0
jmp 0x10110b4f
push 0
push 0
jmp 0x1013ba17
neg eax
shr ecx, 0x50
not ecx
ror eax, 1
xor edx, 0xae1b73a3
xor ebx, eax
shl ecx, 0xb4
adc ebp, eax
movzx eax, dx
rol eax, 0xd8
movzx ecx, byte [esi + ecx - 0x77700000]
lea esi, [esi + edx*2 - 0x7010a545]
xor cl, bl
not dl
add cl, 0xd
lea eax, [eax + edx*4 + 0x3a1f6d8a]
lea eax, [edx + edx*8 - 0x53cc4ee3]
shl eax, 0x91
ror cl, 1
sub cl, 0x11
dec dl
rol cl, 1
push eax
sub cl, 0x11
shr al, 0x44
jae 0x100d7095
push 1
jmp 0x100d84db
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1008cf30], eax
cmp bh, 0x1e
test eax, eax
jmp 0x1009233b
ror al, 1
inc ecx
sal byte [esp + ecx - 0x741ddfa2], 0xc7
xor bl, al
mov dword [esp + ecx - 0x741ddf99], 0xaf8dc00b
xadd cl, ch
sal cl, 0xc5
lea eax, [esp + eax + 0x1c]
xor ecx, 0x40a5efb4
mov word [eax + ecx - 0x34b846b4], dx
mov dword [esp + ecx*2 - 0x69708d60], ecx
movsx eax, cx
je 0x100c36de
mov edx, dword [esi + ecx*2 - 0x69708d67]
xor edx, ebx
mov dword [esp + ecx - 0x34b846a0], 0xa01b59be
pop ecx
call fcn.10118ef6
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.545A667D_CDC4_4780_94BE_46ACDB864AD8
push 0
jmp 0x100ae6ec
push 0x10025390
push 0
jmp 0x100f0e6c

Function at 0x10126b0f
Capabilities:
Packed with generic packer

Disassembly:
not eax
sar dl, 0xc3
sar edx, 0x93
xor ebx, eax
add ebp, eax
add edx, 0x8d92ee3a
push ecx
mov eax, dword [edi + ecx - 0xfb]
call fcn.100ce62f
add edi, 4
mov eax, 0x97955d02
sub eax, 0xc81fa63c
xor edx, ebx
lea ecx, [eax - 0x567e77cc]
rol ax, 0x85
sub cl, 0x18
xor edx, 0x94a2a1b4
call fcn.10115a89
mov ecx, 0xeb82e235
push ecx
lea eax, [ecx + ecx*2 + 0x2fa67238]
mov dx, word [edi]
call fcn.10103141
neg ecx
xor eax, 0xc93c572a
neg edx
shr edx, 0xd0
dec eax
bswap eax
shr ecx, cl
add eax, 0xefb91d28
ror dl, 0x46
jae 0x100c77c9
dec al
sal cx, 0xaa
neg cx
and dx, cx
xor al, 0xf
lea ecx, [ecx*8 + 0xa907bba]
sar edx, cl
neg al
not cx
call fcn.1011a901
Function at 0x10126bd8
Capabilities:
Packed with generic packer

Disassembly:
movzx edx, cl
neg eax
or dx, 0x453c
ror eax, 1
lea eax, [eax + edx - 0x5d400e2e]
xor dl, 0x27
inc cl
xor ebx, eax
add ebp, eax
mov eax, dword [esi + edx*2 - 0x8bb4]
sub cl, 0x83
xadd ecx, edx
setnp cl
mov edx, dword [esi + ecx*2 - 0x89fc]
lea esi, [esi + ecx*2 - 0x89fc]
dec cx
or eax, edx
mov edx, ecx
not eax
or dl, dl
mov dword [esp + ecx - 0x44ff], edx
mov dword [esi + ecx - 0x44ff], eax
movzx eax, cl
mov dword [esp + ecx*8 - 0x227f8], ebp
ret
lea edi, [edi + ecx*2 - 0x725a6922]
neg ecx
sbb ecx, ecx
xor eax, ebx
ror eax, 2
dec eax
xor cl, 0xa
js 0x100dc738
aas
xlatb
jo 0x10126bf9
shl esp, 0x58
pop eax
ror edx, cl
adc dh, byte [ebp + 0x36d358e4]
dec edx
test esp, esp
pop eax
rcr esi, cl
xchg esi, eax
in eax, 0xe4
pop eax
rcl esi, cl
xchg edx, eax
add bl, byte [esi]
sbb al, ah
mov dword [ebp + 0x5b0cee8c], eax
invalid

Function at 0x10128804
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
pop edx
pop eax
pop ecx
jne fcn.100c3c87
lea eax, [edx*4 - 0x2b4e2dd7]
inc eax
mov word [edx + edi - 0xbd160], cx
lea edi, [edi + edx - 0xbd160]
jnp 0x100fc3ed

Function at 0x1012e6a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec al
neg al
call fcn.1008f2fd
mov ax, word [edx + ecx - 0x63990000]
mov dword [esp + ecx - 0x63990000], ecx
mov word [esi + ecx - 0x63990002], ax
mov eax, dword [edi + ecx - 0x6398ffff]
xor eax, ebx
and cl, 0x1b
dec word [esp + ecx - 0x63990000]
sbb eax, 0xab12c029
lea edx, [ecx*8 + 0x233dfb31]
pop edx
sar cx, 0xc6
neg eax
rol dx, 0x4a
adc dx, cx
push edx
inc eax
inc ecx
bswap eax
xadd dword [esp + ecx - 0x63990001], ecx
xor ebx, eax
sar edx, 0x81
inc cx
push ecx
adc ebp, eax
mov eax, 0x8cbe8f16
mov dx, word [esi + edx*2 - 0x63990002]
mov cl, byte [esi + ecx - 0x63990001]
xchg dword [esp], eax
lea eax, [eax + eax - 0x43d981e2]
shr dx, cl
mov word [esi], dx
ror byte [esp + 5], 0x24
mov dx, word [esi]
sbb esi, 0xfffffffe
rol al, 0x66
movzx eax, byte [edi + 5]
adc edi, 6
xor al, bl
neg al
jmp 0x1010c4c8

Function at 0x1012ee47
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.100a5adc
movsx eax, cl
add ebp, edx
neg eax
call fcn.100b5c6f
cmovle eax, eax
Function at 0x10130786
Capabilities:
Packed with generic packer

Disassembly:
add al, cl
pop ecx
add byte [esp + edx - 0x137ffff3], ch
ror al, 1
inc al
jmp 0x10126b8e
call fcn.100f139b
push eax
ror dl, 1
shr eax, 0xf8
xor dl, al
sub dl, 1
or ecx, 0x2cb1c989
ror dl, 1
mov dword [esp + eax - 0xfb], 0xbc85452d
dec dword [esp + eax*8 - 0x7f4]
inc word [esp + eax - 0xfa]
xor bl, dl
not cl
mov dword [esp + eax*8 - 0x7f7], 0xf39d723
lea edx, [esp + edx + 8]
add dword [esp + eax*4 - 0x3fc], 0x1a093192
movzx cx, byte [edx + eax - 0xff]
mov word [esi + eax - 0x101], cx
setns byte [esp + eax*8 - 0x7f5]
mov eax, dword [eax + edi - 0xfe]
shl word [esp + 6], 0x8f
sbb edi, 0xfffffffb
call fcn.1010b20d
sub edi, 2
sub al, 0
mov word [edi], dx
push eax
mov ecx, dword [esi]
je 0x1009cd65
movzx edx, al
sub word [esp + edx - 0x14], 0xfaac
lea esi, [edx + esi - 0x15]
xor ecx, ebx
sal dword [esp + edx - 0x15], 0x21
xchg dword [esp + edx*2 - 0x32], eax
and dl, ah
ror ecx, 1
dec dword [esp + edx*4 - 0x34]
lea eax, [eax*4 + 0x203be9e]
lea ecx, [ecx + edx*4 - 0x77ab8357]
ror ecx, 3
dec ecx
ror ecx, 1
xor ebx, ecx
add ebp, ecx
sal dx, 0xee
push edx
pop eax
pop edx
pop edx
pop edx
pop eax
jae fcn.100c3c87
not dx
add ebp, ecx
push edx
mov byte [esp + edx*2 - 0x2701fffb], dh
mov eax, 0x58a3c802
movzx eax, byte [edi + edx*4 - 0x4e03fff6]
lea edi, [edx + edi - 0x1380fff8]
lea ecx, [edx*4 + 0x509edf92]
shl ecx, 0xbb
xor al, bl
not dx
and dx, cx
ror al, 1
push ecx
not al
inc cl
jns 0x100c65bc
call fcn.1011b4cf
inc dx
sub edi, 4
not cx
mov dword [edi], eax
movsx eax, cl
or word [esp + eax - 0x31], 0xbfbe
pop edx
jp fcn.100c3c87

Function at 0x10131d4a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr eax, 2
lea ecx, [esp + ecx + 0x10]
lea edx, [eax + eax*8 + 0x7d9742ab]
call fcn.10027e3e

Function at 0x10138e41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg al
not word [esp + 9]
neg dx
dec dword [esp + 8]
sub al, 0x1d
shr dword [esp + 5], cl
call fcn.100d6133
mov edx, 0x179e7c90
xor dx, 0x3593
and cl, al
not cl
lea eax, [edx*8 - 0x217a90c6]
mov word [esi + edx*2 - 0x2f3c9202], cx
add edx, eax
mov ecx, dword [edi]
xor ecx, ebx
sub eax, edx
and edx, edx
adc dx, ax
neg ecx
call fcn.10115271
Function at 0x1013a6b7
Capabilities:
Create thread

Disassembly:
lea edi, [edx*4 + 0x5c86280e]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0xc]
bswap edi
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.100cfce7

Function at 0x1013b773
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edi, [edi + ecx - 0x67844d38]
lea edx, [ecx + 0x4698a18f]
mov dword [esp + ecx - 0x67844d3c], 0x34bbaabb
movzx edx, byte [esi + ecx - 0x67844d3c]
neg byte [esp + ecx - 0x67844d37]
jb 0x1012b79d

Function at 0x1013b9af
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov cx, word ss:[edx]
mov edx, 0xf1075098
call fcn.10128e4c