joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007d93f
Capabilities:
Authenticate hmac

Disassembly:
add eax, 0x6b08a330
ror edx, 1
xor ecx, 0xc921f298
pop eax
lea edx, [edx + ecx*8 - 0x16be4257]
ror edx, 3
shr byte [esp + ecx - 0x1a1dd32c], 0xc1
jle 0x10088208
push edx
pushfd
mov edx, 0xc226df24
test edx, 0xb326aba1
push ecx
call fcn.100d63a4
mov dx, word [edi]
mov eax, ecx
add cx, 0x58b0
adc edi, 2
dec cx
movzx ecx, byte [esi]
push eax
jno 0x1009092e
mov eax, dword [esp + ecx*4 - 0x68774cb0]
neg edx
pop ecx
inc ecx
jl 0x100c17d0
jmp 0x100a4a9b
xor cl, bl
ror cl, 1
sub dx, 0xd437
neg cl
shr edx, 0xcb
rol cl, 1
shl dl, 5
adc cl, 0xe
mov eax, edx
xor al, ah
call fcn.100c3f62
mov ecx, 0x869c3224
jmp 0x1007f947
rol edx, 1
inc ecx
not ax
bswap edx
xor ebx, edx
sub eax, 0xb510ea91
dec ecx
add esi, edx
jmp esi

Function at 0x1007fb5d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ecx
inc edx
not edx
lea eax, [eax + eax*4 - 0x5aec1ac8]
xor ebx, edx
mov dword [esp + ecx*8 - 0x21a24958], ecx
sar ecx, 0xc2
mov dword [esp + eax - 0x505ce539], ecx
adc ebp, edx
jmp 0x100b40ae
mov ecx, dword [edi + ecx - 0x10d1247]
sub ax, 0x7d23
movzx eax, byte [esi + eax - 0x505c6815]
mov edx, dword [esp]
xor al, bl
dec dword [esp + edx*2 - 0x8689258]
sub al, 0x9d
neg al
sub al, 0x8a
xor al, 0xac
ror edx, 0xe2
xor bl, al
lea eax, [esp + eax + 0x10]
shr dx, 0x83
mov dword [eax + edx - 0x10d0249], ecx
movsx ecx, byte [esp + edx*4 - 0x4340919]
not cx
mov edx, dword [edi + edx*4 - 0x434091c]
lea edi, [edi + ecx*4 - 0x3ffe0]
jne 0x100b4cb2
mov ecx, 0x9b8c08a2
add dl, al
mov word [edi], dx
push ecx
mov eax, dword [esi + 1]
shl word [esp + 0xc], 0xa3
call fcn.10099bff

Function at 0x10080c53
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp + ecx - 0x2100810b], 0x4a23392f
sal byte [esp + ecx*2 - 0x42010213], 0xe2
mov dword [edi + ecx*2 - 0x42010216], edx
mov eax, 0xcd844937
jne 0x100cdc8c
mov ecx, 0x69bfaf86
sar ecx, 0x43
movzx eax, cx
movzx edx, word [esi + ecx*2 - 0x1a6febe0]
xor dx, bx
not dx
shl ecx, 0x37
inc eax
sbb dx, 0x633e
call fcn.100a14c5
sal dl, 0xe3
lea eax, [eax + ecx*4 + 0x60ada76b]
shr dx, 0x26
jnp 0x100a7680
neg eax
or dword [esp + edx - 0x205], edx
sub dl, byte [esp + ecx*2 - 0x4201020e]
dec eax
xor ebx, eax
or dword [esp + edx*4 - 0x8a4], edx
adc ebp, eax
call fcn.1008863f
rol eax, 2
and edx, ecx
adc dword [esp + edx*2], 0xea19c51d
ror edx, 0x4f
xor ebx, eax
add esi, eax
mov dword [esp + edx], esi
ret
dec dl
call fcn.100a0df2
dec ax
mov eax, dword [esi + ecx*2 - 0x42010216]
or cx, cx
not dword [esp + ecx - 0x2100810b]
or dword [esp + ecx - 0x2100810b], ecx
lea esi, [esi + ecx*2 - 0x42010212]
and cl, 0x96
xor eax, ebx
rol cl, cl
lea eax, [eax + ecx*8 - 0x264d3b35]
not eax
movzx edx, cx
jae 0x100a6e74

Function at 0x10081e4a
Capabilities:
Manually build aes constants

Disassembly:
movsx ebx, bx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0xc], 0xff2edb7f
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.100b30a5
Function at 0x10087b9a
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [esp + ecx + 4]
shl eax, 0xad
mov eax, dword [ecx + edx*2 - 0x182824ae]
mov dword [esp + edx*4 - 0x3050495c], edx
add dword [esp + edx*2 - 0x182824ae], edx
dec dx
mov ecx, eax
or dword [esp + edx*2 - 0x182824ac], edx
mov edx, dword [edi + edx - 0xc141256]
pop eax
adc ecx, edx
movsx edx, al
sal dl, 0xa7
sub dx, dx
mov dword [eax + edi - 0x1c3c36fe], ecx
jg 0x100bfcdc
jo 0x1008d2b6
xchg edx, eax
mov ecx, dword [edx + esi - 0x1c3c36fd]
jge 0x100c2313
xchg word [esp + eax - 0x50b6191d], cx
add ebp, edx
movsx edx, cl
mov ecx, dword [edi + eax - 0x50b6192a]
sub byte [esp + eax - 0x50b61923], dh
movzx edx, byte [eax + esi - 0x50b61921]
setns byte [esp + eax - 0x50b6191e]
xor dl, bl
sal ax, 0xe2
sar eax, 0x84
dec eax
sub dl, 0x9d
xor eax, eax
neg dl
sub dl, 0x8a
xor dl, 0xac
jmp 0x10085a00
push esi
push edx
mov dword [esp], ecx
push edx
mov dword [esp], edi
mov ebx, edx
lea edx, [edx*4 + 0x1e0c5b38]
call fcn.100c50b8
sar al, 0x44
xadd dx, ax
xor ecx, ebx
sar eax, 0xfa
sal dx, 0x21
jno 0x100d182f
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov eax, 0x4a0a02aa
not edx
not ecx
push eax
and edx, ecx
mov dword [eax + edi - 0x4a0a02a6], edx
sal dword [esp + eax - 0x4a0a02aa], 0x81
mov edx, dword [eax + ebp - 0x4a0a02aa]
dec eax
sal dword [esp + eax - 0x4a0a02a9], 0x2f
lea ebp, [ebp + eax - 0x4a0a02a5]
xor edx, ebx
lea ecx, [eax + eax*2 - 0x6ae7f7ee]
bswap eax
xor edx, 0x3a246218
inc byte [esp + ecx - 0x7336100d]
rol edx, 2
inc edx
call fcn.100988d5
add esi, 4
movsx eax, cx
xor edx, ebx
shr eax, 0x13
and al, ch
lea edx, [edx + eax + 0x5db46f89]
xor cl, 0x23
neg edx
call fcn.1008bed8
Function at 0x1008ef71
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + edx*2 - 0x4a0c3100]
mov dword [esp + eax - 0x78b08cdc], eax
pop eax
sub al, al
mov ecx, edx
bswap eax
shl ax, 0xeb
movsx edx, ax
mov eax, dword [edi + eax*4 - 0x2330000]
js 0x100ad6f7
mov edx, 0x321f560b
shl dl, 0xc2
movsx ecx, dx
mov eax, dword [ecx + ebp - 0x562c]
not edx
lea ebp, [ebp + ecx*4 - 0x158ac]
and dx, dx
or edx, 0x442cff9e
xor eax, ebx
shr dl, 0x21
adc dx, cx
not eax
adc edx, edx
shr edx, 0xc8
adc ecx, edx
ror eax, 3
not edx
inc ecx
xadd cx, dx
neg eax
sal dl, 0xe5
inc eax
inc cl
sal cl, 0x61
rol eax, 3
dec dl
xor ebx, eax
shr cx, 0xe4
add esi, eax
movzx dx, byte [edi + ecx - 0x9c0565]
dec cx
movsx eax, cl
mov al, byte [edi + ecx - 0x9c0562]
call fcn.100a7d5f
mov edx, 0x7f904488
or dx, dx
shl dl, 0xe1
mov ecx, dword [esi + edx - 0x7f904410]
ror edx, 0xc1
movsx eax, dx
lea esi, [esi + edx*2 - 0x7f90440c]
xor ecx, ebx
call fcn.10080bbd
je 0x1008efb4
jmp dword [esi + 0x23]
mov ebx, 0xcac1806f
ror dword [edi], 0xbf
ret 0xb48d
in al, dx
fistp word [ecx + edi*4]
dec ebp
jo 0x1008f01b
and byte [eax + 0x60], dl
lds ecx, [ebp + 0x70]
loopne 0x1008f087
and byte [eax - 0x5c], cl
movsd dword es:[edi], dword [esi]
mov ebx, dword [edi]
add esp, dword [ebx + 0x70f5178f]
mov ebx, 0x23954f8
std
enter 0xffffffffffff8e07, 0xe
std
les ecx, [ebx + edi + 0x17]
pop ebx
test al, 0x8b
jge 0x1008f09d
push ebx
sbb dword [ebx + 3], ebx
mov ebx, 0x7d7f0671
mov ebx, 0x230d0671
cli
inc esi
lodsd eax, dword [esi]
push ebp
or byte [ecx - 0x5251cf0e], al
xlatb
add eax, eax
invalid
les eax, [edx]
add byte [ebp + 0x66fe077c], cl
lea edi, [edi + eax - 2]
sar cx, 0x28
sets dl
or ecx, eax
mov eax, 0x85a3a288
not ecx
sub al, al
shr edx, 0xf6
mov eax, dword [edi + edx - 0x3fb]
call fcn.10089ac4

Function at 0x1008f111
Capabilities:
Encode data using xor

Disassembly:
xchg byte [esp + 7], dl
xor eax, ebx
xadd byte [esp + 6], dh
call fcn.100b09eb
mov eax, 0x4023993f
push eax
mov eax, dword [esi + eax - 0x4023993f]
pop edx
add edx, 0x15bd9482
lea esi, [esi + edx - 0x55e12dbd]
sub dx, dx

Function at 0x1009abd5
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x4e94c282
mov ecx, dword [esi]
mov eax, 0xbeac5ab2
xchg ah, al
call fcn.100c65ee

Function at 0x1009e6bc
Capabilities:
Manually build aes constants

Disassembly:
add dword [esp], ecx
xor dl, 0xa4
add dl, 0x17
xadd byte [esp], cl
xor bl, dl
jmp 0x10081ebd
dec dl
pop eax
or cx, 0x221e
not dl
adc dword [esp], ecx
jb 0x10091a78

Function at 0x1009e86b
Capabilities:
Authenticate hmac

Disassembly:
ror cl, 0x41
jno 0x100859cd
xor bx, cx
sub edi, 2
mov word [edi], cx
rol al, 5
xchg byte [esp + 2], dl
mov ecx, dword [ebp]
rol dword [esp], 0x31
adc ebp, 4
push eax
bswap eax
neg eax
xor ecx, ebx
pop eax
pop edx
bswap ecx
call fcn.100dd716
Function at 0x1009f4d0
Capabilities:
Encode data using base64

Disassembly:
sub ecx, 0xfffffff9
mov ecx, 0xe983fcd1
mov dword [0x83fce197], eax
jmp 0x134ae05e
adc eax, 0x4254940b
jnp 0x248ec58d
xchg ebx, eax
add byte [ebp - 0x3b], al
inc ebp
lds ebx, [edx - 0x7f]
ret 0x89e9
shr dx, 0x64
bswap ecx
jp 0x1007dffa
lcall 0x4913, 0xbedfed84
jno 0x1009f4c5
jb 0x1009f491
mov byte [0xe0714927], al
xchg dh, ch
salc
sbb ah, byte [ecx - 0x564ee076]
fldln2
popfd
xchg esi, eax
mov ecx, 0x3de90f8
std
add edi, ebp
in al, dx
aas
add bh, ch
mov ebx, 0x141740c5
inc eax
or eax, dword [esi - 0x3d]
or byte [edi], dh
aaa
leave
call 0xfffcb914
inc eax
je 0x1009f4fd
and ebx, dword [esi]
js 0x1009f4b8
xchg esi, eax
mov ch, byte [edx]
stc
xchg al, bl
xchg esp, eax
scasd eax, dword es:[edi]
wait
mov ebx, dword [edi]
push esi
cmp eax, 0x33da4245
jne 0x1009f510
and al, 0x10
inc esp
aas
xchg ecx, edi
sbb al, 0x50
sub al, 0x3f
xchg ecx, edi
dec eax
push esi
adc byte [edi], bh
xchg ecx, edi
dec edx
or al, 0x64
aas
xchg ecx, edi
sbb al, 0x32
dec eax
aas
xchg ecx, edi
sbb al, 0x62
invalid
Function at 0x1009f7de
Capabilities:
Check for time delay via gettickcount

Disassembly:
add edi, 4
shrd ax, dx, cl
mov edx, 0x6601f3b2
shl edx, 0xb3
setp dl
mov word [edi], ax
lea eax, [edx - 0x6655ae5c]
movsx ecx, al
mov edx, dword [ebp + eax*2 - 0x6e74a34a]
lea ebp, [ebp + eax*2 - 0x6e74a346]
adc eax, eax
xor edx, ebx
dec al
call fcn.100a46b6
shl ecx, 0x38
xor eax, 0xc3b4da25
not eax
neg eax
not ecx
and dl, dl
xor dl, cl
sbb eax, 0xa21b60ac
bswap ecx
shl cl, 7
xor ebx, eax
add ebp, eax
call fcn.10090dac
mov ecx, 0xa620e820
movsx edx, cl
shl ecx, 0x9b
mov dx, word [edi + ecx*2]
or cl, byte [edi + ecx + 2]
mov eax, 0xbb0ccb0a
ror ax, 0xc4
xchg ah, al
add edi, 2
rol eax, 0x93
shr dx, cl
call fcn.100bcbff
not edx
bswap edx
sub al, 0x9c
jge 0x1008ebd6
xor edx, 0x9c2f7716
rol edx, 2
and ecx, 0x2485d1aa
mov dword [esp + eax - 0x4403d2e6], ecx
setbe al
xor ebx, edx
xor eax, ecx
adc ebp, edx
movzx eax, byte [esi + eax - 0x648351fc]
lea edx, [ecx + ecx - 0x6beac7f8]
xor al, bl
rol word [esp + ecx - 0x20807ffe], 6
xor al, 0x86
not word [esp + ecx*2 - 0x4100fffe]
shl byte [esp + ecx - 0x20807ffd], 0x82
rol al, 1
sal word [esp + ecx - 0x20807fff], 0xa6
not dl
not al
ror al, 1
xadd edx, ecx
xchg dword [esp], edx
add byte [esp + edx - 0x7cdffffe], dh
inc al
call fcn.100d7931
mov ecx, 0xa922e089
mov eax, dword [edi]
shr cl, 0xc3
inc cl
mov edx, dword [edi + 4]
mov cl, byte [edi + 8]
jge 0x100dde8b
mov eax, 0xacadf10e
lodsd eax, dword [esi]
lodsb al, byte [esi]
mov ecx, dword [ebp]
call fcn.100cda95
and dword [ebx], ebx
neg dword [edi + edi*4]
adc eax, 0x210002e2
sbb esi, edi
sbb al, 0xbf
mov edi, 0x96b773b7
mov bh, 0x73
mov bh, 0x96
lds edx, [ebx]
mov dword [0xc596b727], eax
jecxz 0x1009f889
xor esi, dword [edi - 0x70683a6a]
dec ebx
mov bh, 0x96
lds esp, [edi]
cmpsd dword [esi], dword es:[edi]
xor dword [esi + ecx*4], 0xffffffc5
add ebp, ecx
pop eax
salc
cmc
stosd dword es:[edi], eax
xchg al, al
and dh, byte [ecx]
push ecx
sahf
mov bl, 0xb
xchg dword [ebx + 0x56], esi
cmp eax, 0x32d2d488
jnp 0x1009f8e2
mov dl, ah
or byte [esi + 0x7b], bh
daa
mov byte [esi + 0x277b12bc], ah
mov ah, al
clc
sub bh, byte [ebx + 0x27]
mov al, dh
loop 0x1009f8ef
push ds
sbb byte [eax + 0x62f00afc], cl
sal dword [edi - 0x75], 0xd1
mov edx, ecx
mov eax, dword [ecx + esi - 0x748f5498]
mov dword [esp + ecx - 0x748f5498], ecx
mov ecx, dword [ecx - 0x5497f374]
jo 0x1009f875
shr dword [esp + ecx - 0x748f5498], 0x71
jo 0x1009f87c
jno 0x1009f8f2
dec dword [esp + edx - 0x748f5498]
mov word [eax + ebp*2], ss
stosd dword es:[edi], eax
jo 0x1009f884
xor eax, ebx
pop ecx
dec eax
neg eax
ror dx, cl
and edx, 0xe3ae273a
call fcn.100c71b5
jmp 0x1009816c
adc edi, 6
shrd eax, edx, cl
mov dword [edi], eax
mov ecx, 0x1e0f8487
mov eax, dword [esi + ecx - 0x1e0f8487]
xor cx, 0xf08d
add cl, 0x1c
lea esi, [ecx + esi - 0x1e0f7422]
lea ecx, [ecx + 0x6a8dce0b]
movzx edx, cl
xor eax, ebx
or ecx, edx
xor eax, 0xef841fbb
bswap eax
jmp 0x100ce8bb

Function at 0x100a474e
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
neg ecx
mov dword [esp], 0x6c16670d
add esi, eax
movzx edx, byte [ebp + 5]
jmp 0x1007e198
Function at 0x100acbf5
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edx, dword [ebp + eax*2 - 0x6f]
dec word [esp + eax*8 - 0x1be]
call fcn.10092f07
call fcn.100d17d1
mov ecx, 0xe71d7a34
add ecx, ecx
movzx edx, byte [ebp]
movsx eax, cx
dec cx
xor ax, cx
xor dl, bl
neg eax
sar ecx, cl
adc cl, 0x1b
ror dl, 1
or eax, eax
and ecx, 0x81be66af
neg dl
rol dl, 1
ror ecx, 0xb3
or ax, cx
js 0x100b1a84
adc dl, 0xe
xor ax, 0x9985
xor bl, dl
xor al, cl
adc edx, esp
shl cx, 0xd
or ax, ax
and cl, cl
movzx cx, byte [eax + edx - 0x6645]
push eax
add al, 0x38
sbb ax, word [esp + eax - 0x667d]
mov word [edi + eax*2 - 0x72], cx
jne 0x100a0395

Function at 0x100ae60e
Capabilities:
Authenticate hmac

Disassembly:
xor eax, 0x25124701
bswap eax
dec edx
movsx ecx, dl
xor dl, ch
lea eax, [eax + edx*4 + 0xf153042]
mov dword [esp + edx - 0x23beee3a], 0x613069ba
jae 0x100d55c8
mov ecx, 0xeab5bf29
push ecx
xor dword [esp], 0x7e380187
mov edx, edi
pop ecx
mov dword [edi - 4], edx
ror ecx, 0xd8
sar cx, 0xce
mov edx, dword [esi]
movsx eax, cx
sar cx, 2
xor edx, ebx
neg cx
jge 0x100bc557

Function at 0x100ae9f9
Capabilities:
Manually build aes constants

Disassembly:
not edx
mov ecx, dword [esp]
xor word [esp + ecx - 0x42ca1009], 0x1f91
and eax, edx
sal byte [esp + ecx - 0x42ca100a], 0x86
movzx edx, cl
dec word [esp + edx*4 - 0x2f]
mov dword [edi + edx*8 - 0x60], eax
jae 0x100dc166
bswap ecx
and byte [esp + 5], dl
jns 0x100c8f37
invalid
mov ecx, dword [ebp]
mov dword [esp], eax
add ebp, 4
and dx, word [esp + 3]
xor ecx, ebx
sar dx, 0xad
jb 0x1009da75
not eax
jmp 0x10087253
sal dword [esp + ecx - 0x42ca100a], cl
lea edi, [edi + ecx - 0x42ca1005]
mov dword [esp + ecx - 0x42ca100d], esi
ret 4
jne 0x100cafca

Function at 0x100badc9
Capabilities:
Encode data using xor

Disassembly:
adc al, al
not ax
mov ax, word [eax + edx - 0x7bd54a22]
mov ecx, 0x83a2d50c
setle byte [esp + 8]
mov word [edi - 2], ax
sbb edi, 2
call fcn.100b20af
xor ecx, ecx
neg dl
not ecx
ror eax, cl
inc dl
xadd eax, ecx
ror dl, 1
and eax, 0xb90f1916
sbb dl, 0x20
call fcn.100b1841
xor ebx, eax
sal dl, 5
call fcn.100b1fc7
ror eax, 1
call fcn.100e30fa
mov dword [esp + ecx*2 - 0x468f1216], ecx
not dword [esp + ecx*2 - 0x468f1216]
and dx, ax
not dx
sar cx, 0x4f
mov eax, 0xa925ab35
push eax
mov word [ecx + edi - 0x2347fffd], dx
movzx eax, byte [esi + ecx*2 - 0x468ffffa]
lea edx, [ecx - 0x61e2cece]
lea esi, [esi + ecx*2 - 0x468ffff9]
or edx, 0x39105b28
not word [esp + ecx - 0x2347ffff]
neg edx
xor al, bl
push ecx
shl dx, 0xeb
rol al, 1
neg al
sub al, 0x19
dec edx
setno cl
xor al, 0x12
ror al, cl
xor bl, al
lea eax, [esp + eax + 0xc]
add dl, byte [esp + ecx*2 - 0x468ffdff]
mov cx, word [eax + ecx - 0x2347ff01]
push edx
add word [esp + edx*2 - 0xd146e3f], 0xa3a6
sbb edx, dword [esp + edx - 0x68a3716]
mov word [edi + edx*2 - 0x53a3805c], cx
lea eax, [edx + edx*4 - 0x55430b78]
lea edx, [esp + edx*2 - 0x53a37fd8]
jge 0x100b0444
Function at 0x100cde3f
Capabilities:
Encode data using xor

Disassembly:
sub eax, dword [esp + ecx*2 - 0x40016]
xor ebx, edx
add ebp, edx
movzx ax, byte [ecx + edi - 0x2000f]
and ecx, dword [esp + ecx*8 - 0x10006e]
shr byte [esp + ecx*8 - 0x10002c], cl
xchg byte [esp + ecx - 0x20006], ch
mov cl, byte [edi + ecx*2 - 0x5080c]
adc edi, 2
sal al, cl
mov ecx, 0xe7184f13
jmp 0x1008672a
jle 0x100bc5a1
not edx
sar cl, 0x42
or dword [esp + ecx*4 - 0x5e10fc20], ecx
shr ecx, cl
rol edx, 3
or cx, 0xc5be
dec edx
mov dword [esp + ecx*2 - 0x5eb7e], 0x7b9484bd
shr cx, 0x6c
not edx
jns 0x100a04f8
add cx, 0x23
neg dx
rol cx, 1
xor cx, 0xb5a7
not cx
mov eax, edx
xor bx, cx
inc ax
jne 0x100cd360

Function at 0x100d3931
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp], ecx
not edx
sub edx, 0x5003fa19
not cx
jmp 0x100184b4

Function at 0x100d6ce3
Capabilities:
Create thread

Disassembly:
not ecx
add edi, 2
not ecx
neg dword [esp + ecx - 0x69cf78e6]
mov edx, 0xdfb58623
mov word [ecx + edi - 0x69cf78ea], ax
sar dword [esp + ecx - 0x69cf78e6], cl
call fcn.10080561

Function at 0x100dc015
Capabilities:
Authenticate hmac

Disassembly:
mov word [edi + ecx*8 - 0x480007f2], dx
neg eax
lea eax, [esp + eax*2 + 0x2c]
neg cx
shl dword [esp + ecx - 0x900fefc], cl
jae 0x100b6ccc
mov ecx, 0xac23fa17
push ecx
mov edx, dword [edi]
xadd byte [esp], ch
mov eax, dword [edi + 4]
shl ecx, cl
jbe 0x100978e6
or cx, word [esp + 2]
mov cl, byte [edi + 8]
adc edi, 6
shrd edx, eax, cl
mov dword [edi], edx
call fcn.100e2bf9
ja 0x100c3b97
neg ecx
add dx, 0xec18
bswap ecx
sub dword [esp + 7], 0x724eab7
push ecx
xor dx, 0x32b8
movsx eax, cx
bswap eax
sub byte [esp + 0xc], ah
neg dx
shl al, 0x81
neg ecx
or cl, ah
xor bx, dx
push eax
dec ecx
jg 0x1007b3c4
lea esi, [esi + edx*2 - 0x1fd09f6]
xor al, bl
shr edx, 0xdd
push ecx
js 0x1009964b
xor al, 0x86
add byte [esp + edx + 9], ch
rol al, 1
ror cl, 0x24
and ecx, ecx
not al
call fcn.10083f4b
mov eax, 0x31b92e1d
push eax
movsx ecx, al
mov edx, dword [eax + esi - 0x31b92e1d]
call fcn.100e2f89
xor bl, al
lea eax, [esp + eax + 0x10]
shr dword [esp + 7], 0x51
mov byte [esp + 0xc], 0xbe
mov edx, dword [eax]
pop eax
movzx eax, cl
mov dword [edi + eax*2 - 8], edx
pop edx
xor eax, edx
push ecx
movzx eax, byte [esi + eax*2 - 0x1fd09f7]
jg 0x100b8ffd

Function at 0x100e21ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
bswap edx
inc word [esp + ecx*8 - 0x21a2495a]
xor edx, 0x15b71c3f
bswap edx
call fcn.1007fb5d

Function at 0x100e2203
Capabilities:
Check for time delay via gettickcount

Disassembly:
movzx ax, al
rol cx, 0xe5
lea edx, [ecx - 0x69f8e86c]
xor cl, byte [ecx + edi + 4]
and al, cl
mov dword [esp + 4], edx
not al
call fcn.1007b8ae
call fcn.100a6956
movzx ecx, word [esi]
mov edx, 0x1b95e11d
lea esi, [esi + edx*2 - 0x372bc238]
dec dl
xor cx, bx
and dl, dl
not cx
dec dl
call fcn.10083005

Function at 0x100e2989
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp], 0x6c0a5b0e
pop eax
lea esi, [esi + eax - 0x6c0a5b0a]
mov edx, 0x878d4994
xor dx, dx
xor ecx, ebx
inc al
call fcn.100df939
Function at 0x100e29a9
Capabilities:
Check for time delay via gettickcount

Disassembly:
neg cx
neg cx
movzx edx, byte [ebp + ecx*8 - 0x777]
lea ebp, [eax + ebp - 0x7c993048]
jo 0x100c82e1
mov dword [esp + ecx - 0xf0], 0xcb1c259e
adc eax, ecx
xor dl, bl
sub dl, 0x94
rol dl, 1
neg dword [esp + eax - 0x7c993143]
xor dl, 0xa0
or dword [esp + ecx - 0xf0], ecx
sal byte [esp + ecx*2 - 0x1de], 4
or eax, dword [esp + ecx - 0xf0]
dec dl
ror al, 0x23
call fcn.100cfe18
inc esp
pop edx
ljmp 0xe076
Function at 0x10a9890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x915000]
push edi
or ebp, 0xffffffff
jmp 0x10a98b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10a98b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10a98a8
mov eax, 1
add ebx, ebx
jne 0x10a98cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10a98dc
jne 0x10a98ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10a98ec
dec eax
add ebx, ebx
jne 0x10a98e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10a98c0
xor ecx, ecx
sub eax, 3
jb 0x10a9904
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10a9976
sar eax, 1
mov ebp, eax
jmp 0x10a990f
add ebx, ebx
jne 0x10a990f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10a991c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10a9940
inc ecx
add ebx, ebx
jne 0x10a992c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10a9921
jne 0x10a993d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10a9921
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10a9960
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10a9951
jmp 0x10a98ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10a9960
add edi, ecx
jmp 0x10a98ae
pop esi
mov edi, esi
mov ecx, 0x44965
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10a997e
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x10a9983
lea edi, [esi + 0xca4000]
mov eax, dword [edi]
or eax, eax
je 0x10a99eb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcb60f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcb6294]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10a99a9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcb6298]
or eax, eax
je 0x10a99e5
mov dword [ebx], eax
add ebx, 4
jmp 0x10a99c6
call dword [esi + 0xcb629c]
popal
jmp 0xc9b3f4
Function at 0x10001860
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10366330], 0
je 0x10001879
mov eax, dword [0x10366330]
jmp 0x10001a16
mov dword [0x10366330], 0x10366308
push 0x28
push 0
push 0x10366308
call fcn.101d90c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10366308], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1036630c], eax
cmp dword [0x1036630c], 0
jne 0x100018bf
xor eax, eax
jmp 0x10001a16
push str.ImagehlpApiVersionEx
mov eax, dword [0x1036630c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10366310], eax
push str.SymInitialize
mov ecx, dword [0x1036630c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10366314], eax
push str.SymSetOptions
mov edx, dword [0x1036630c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10366318], eax
push str.SymGetOptions
mov eax, dword [0x1036630c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1036631c], eax
push str.SymLoadModule
mov ecx, dword [0x1036630c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10366320], eax
push str.SymGetModuleInfo
mov edx, dword [0x1036630c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10366324], eax
push str.SymGetSymFromName
mov eax, dword [0x1036630c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10366328], eax
push str.BindImage
mov ecx, dword [0x1036630c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1036632c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.101d90c0
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x10366310], 0
je 0x1000199d
lea eax, [ebp - 8]
push eax
call dword [0x10366310]
cmp dword [0x10366310], 0
je 0x100019af
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x100019ca
mov edx, dword [0x1036630c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1036630c], 0
xor eax, eax
jmp 0x10001a16
cmp dword [0x10366314], 0
je 0x100019e3
push 0
push 0
mov eax, dword [0x10366308]
push eax
call dword [0x10366314]
cmp dword [0x1036631c], 0
je 0x10001a11
cmp dword [0x10366318], 0
je 0x10001a11
call dword [0x1036631c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10366318]
mov eax, dword [0x10366330]
mov esp, ebp
pop ebp
ret