joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b49c6
Capabilities:
Read file on windows
Terminate process

Disassembly:
add esi, edx
btr eax, ecx
or ecx, eax
pop ecx
pop edx
jns fcn.10190646
not edx
neg eax
shr edx, 0xb
ror eax, 3
push ecx
lea eax, [edx + eax + 0x40241360]
btc dx, cx
bswap eax
adc dl, ch
xor ebx, eax
ror edx, cl
call fcn.1024d05d
mov dx, word [ebp]
mov ecx, 0x1385fa7
mov ax, word [ebp + ecx - 0x1385fa5]
mov cl, byte [ecx + ebp - 0x1385fa3]
add ebp, 4
push 0x76297e3e
rol dword [esp], 0xe5
jae 0x10236287
mov ecx, 0xf528f52e
mov eax, 0xb02fdbbb
lea edx, [ecx*8 - 0x16777a57]
mov ecx, dword [ebp]
btc eax, 0xa6
xor edx, eax
mov edx, dword [ebp + edx*2 - 0x45ffe9c0]
setb al
dec ax
sbb al, ah
adc ebp, 4
bswap eax
rol eax, 0xd4
adc ecx, edx
movsx edx, al
call fcn.101d9a89
shrd dx, ax, cl
mov word [ebp], dx
push 0x94304d15
mov eax, dword [esp]
mov edx, dword [edi]
rol dword [esp + 4], 9
adc word [esp + 5], ax
adc edi, 4
inc eax
xor edx, ebx
jmp 0x101e8d46

Function at 0x101b63af
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, ecx
xor edx, dword [esi + edx*4]
mov dword [esp], eax
mov dword [esp + 4], ecx
shl ax, 0x84
mov eax, dword [esi + 4]
jb 0x101cf4fb
call fcn.101e8bc8
mov ecx, dword [esi]
mov edx, 0xafbc6615
movzx eax, dl
cwd
mov edx, dword [esi + eax - 0x11]
call fcn.10245e25
Function at 0x101b740d
Capabilities:
Terminate process

Disassembly:
pop esi
mov ebx, esp
pop ebx
jmp 0x102235a4
push eax
jmp 0x102329ba
push ecx
jmp 0x1022062b
add ebp, edx
mov dword [esp + eax], eax
rol dword [esp + eax + 4], 0xd7
mov edx, dword [esp + eax + 4]
pop edx
pop ecx
jb fcn.1022ca3e
sub dl, 0xbb
btc cx, ax
jb 0x102160e4
mov eax, 0x9b28c52b
movsx ecx, al
movzx edx, cx
mov eax, dword [edi + ecx*2 - 0x56]
lea edi, [edi + ecx*2 - 0x52]
sal edx, 0xd3
xor eax, ebx
neg eax
or edx, ecx
not eax
shr dl, 0xa5
shl cl, 0x87
inc eax
ror eax, 1
call fcn.101e83c3
mov edx, 0xb52ac304
mov edx, dword [edi]
mov ecx, 0x351d8201
lea edi, [edi + ecx*2 - 0x6a3b03fe]
sal ecx, 0x39
xor edx, ebx
lea eax, [ecx + ecx*2 + 0x4cb2292c]
not cx
neg edx
btc eax, 0x2f
sar cl, 0x64
rol eax, cl
dec edx
bswap edx
xor cx, cx
add eax, 0x628f803e
neg edx
call fcn.101d1a6f
mov edx, 0x60a81c8c
mov eax, edx
mov edx, dword [edi + edx - 0x60a81c8c]
jmp 0x1024e22f
call fcn.101abf4e
mov ax, word [esi]
mov ecx, 0x25abe9ad
lea edx, [ecx + ecx*2 + 0x6b90e4a5]
push ecx
mov cl, byte [esi + ecx*2 - 0x4b57d358]
dec dx
add dl, dh
adc esi, 1
not dl
shr ax, cl
mov ecx, edx
mov word [esi], ax
mov eax, ecx
sub ebp, 4
inc word [esp + 1]
push eax
mov edx, dword [ebp]
call fcn.10198a07
jle 0x101b33ea
push edi
jmp 0x1018b548
add esp, 0xc
add dword [eax], edi
sub dword [esi + 0x24], edi
xchg ebx, edi
bswap di
pop edi
jmp 0x101894d9
cmovae ax, cx
ror dl, 1
not eax
add ax, ax
sub ecx, eax
sbb dl, 0x9d
or ax, ax
sal ecx, cl
dec ax
xor bl, dl
push ecx
sal cx, 0x4a
lea esi, [esi + eax - 0x77502773]
xadd dword [esp + eax - 0x77502771], eax
or eax, eax
mov word [esi], dx
ja 0x101c4eb5
add esi, ecx
imul edx
pop edx
btr eax, 0x80
mov ax, word [eax + ebp - 0x79c219e4]
dec edx
movsx ecx, dl
mov cl, byte [ecx + ebp - 0x6d]
adc ebp, 2
sar dx, 0x4c
call fcn.1024ee55
push eax
jmp 0x10243efc
mov esp, ebp
pop ebp
jmp 0x100a948a
push ebx
call fcn.100dfb30
mov eax, dword [ebp + 8]
sar bh, cl
jmp 0x10203633
lea edi, [edi + eax - 0x60a81c88]
mov ecx, eax
inc ecx
xadd cx, ax
xor edx, ebx
xor ecx, 0x671476a5
sbb eax, ecx
btc eax, eax
lea edx, [eax + edx - 0x796cf0d2]
neg eax
and ax, ax
not edx
sar eax, cl
ror edx, 1
shl eax, cl
xor edx, 0x2ea01e3c
neg edx
sal cl, 0xa4
btr ecx, eax
xor ebx, edx
ror eax, 0x75
sar cl, 0xc4
neg ecx
add esi, edx
lea edx, [ecx + eax*2 + 0x7d858d8f]
movzx ecx, word [edi + eax - 0x500]
lea edi, [edi + eax - 0x4fe]
xor cx, bx
push edx
btr ax, dx
shr ax, 0x4f
dec cx
rol dx, 0x43
neg cx
call fcn.101e2fa3

Function at 0x101b75ee
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
ror dl, 1
mov dword [esp], 0x89c73af
dec dl
idiv al
call fcn.1019b52d
Function at 0x101b836d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
not ecx
mov dword [esp], edx
and dword [esp], eax
sar edx, 0x73
ror ecx, 2
and dl, 0xaa
jne 0x101f0a0f
not eax
dec eax
pop ecx
rol dl, 0x82
bswap eax
dec eax
not eax
xor eax, 0xba1828b8
and dx, 0x4028
setnp dl
push ecx
not eax
setns cl
sbb eax, 0x683883af
bswap edx
xor ebx, eax
add edi, eax
push ecx
ror word [esp + edx*8 - 0xa07fff6], cl
mov dword [esp + edx*2 - 0x281fffe], edi
ret 4
xor ebx, ecx
xor edx, 0x47a6608b
adc esi, ecx
xchg al, dl
movzx ecx, byte [esp]
movzx eax, byte [edi + ecx*2 - 0x12]
neg dword [esp + ecx - 9]
lea edx, [ecx + ecx - 0x547aa95e]
lea edi, [ecx + edi - 8]
lea ecx, [ecx - 0x527061da]
xor al, bl
bswap edx
inc al
and ecx, dword [esp]
neg al
xor al, 0x97
push ecx
inc al
neg al
xor bl, al
shl dl, cl
shl ecx, 0x50
shl dword [esp + 1], 0xc5
lea eax, [esp + eax + 8]
sbb ecx, edx
jo 0x10213bdf
shr dx, 8
mov dx, word [eax]
mov eax, ecx
sbb ebp, 1
bt ecx, 0x28
mov word [ebp], dx
pop ecx
pop ecx
jae fcn.1024af8a
mov esi, 0x4929950b
mov esp, edi
pop esi
mov eax, 0x45255d1b
call fcn.101c9aa3

Function at 0x101bad93
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.1020108f
ror ecx, 7
mov eax, dword [esi]
setae byte [esp + 3]
mov dword [esp], 0x33a28439
xor ecx, dword [esp]
xor eax, ebx
sar ecx, 0xc8
add ecx, 0xa50f9613
dec eax
ror eax, 3
shr ecx, cl
and ecx, ecx
lea edx, [ecx + ecx - 0x1fef40fa]
not eax
dec eax
xor ebx, eax
pop edx
add ebp, eax
lea esi, [ecx + esi - 0xa4c20]
movzx ecx, byte [esi + ecx*2 - 0x14983e]
call fcn.1025f1c6
mov ecx, dword [edi]
mov eax, 0x3e964218
mul eax
lea edi, [eax + edi - 0x2530623c]
rol dx, 0xb
neg ax
xor ecx, ebx
inc ecx
ror ax, 0x88
neg ecx
lea ecx, [ecx + edx*8 + 0x66ac65ad]
ror al, 4
neg ecx
xor eax, eax
btr eax, eax
sbb ecx, 0xf3b78c05
shl ax, 0x2c
not eax
bswap edx
xor ebx, ecx
add esi, ecx
sub edx, eax
cdq
bswap edx
mov bp, word [ebp]
movsx ecx, ax
jne fcn.1024af8a
Function at 0x101bff88
Capabilities:
Read file on windows
Terminate process

Disassembly:
ror dx, 0x85
xor ebx, eax
and cl, byte [esp + edx - 0x58867bc5]
mov dword [esp + ecx - 0x62f17770], 0x8a135b95
adc esi, eax
or cl, 0x87
shr edx, cl
pop ecx
pop eax
pop edx
jns fcn.1017fa23

Function at 0x101c1420
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea ebp, [ecx + ebp - 0x68f10032]
mov dword [ebp + ecx - 0x68f1002e], edx
sar ax, cl
mov edx, dword [edi + ecx - 0x68f1002e]
mov dword [esp + ecx - 0x68f1002e], eax
lea edi, [ecx + edi - 0x68f1002a]
xor edx, ebx
cwde
ror edx, 2
push ecx
xor edx, 0x43954139
sal ax, 0xae
push eax
jae 0x10179c6f
sbb edx, 0x32985fb4
inc ecx
xor edx, 0xf38c731d
rol dword [esp + ecx - 0x68f10029], 4
ror word [esp + ecx - 0x68f1002a], cl
xor ebx, edx
add esi, edx
bt eax, ecx
cwde
shr byte [esp + ecx - 0x68f1002f], 0xa5
pop ecx
pop eax
pop ecx
jns fcn.10190646
push 0x22b651e
mov eax, dword [esp]
sub dword [esp + eax*2 - 0x456ca3c], eax
mov ecx, dword [edi + eax - 0x22b651e]
sub al, ah
lea edi, [edi + eax*4 - 0x8ad96e0]
push eax
div al
xor ecx, ebx
rol dword [esp + eax*8 - 0x115c6c5c], 0x8b
not ecx
lea edx, [eax*2 + 0x759db0a9]
cdq
rol dword [esp + eax*4 - 0x8ae3630], 0x62
dec ecx
push edx
not ecx
and dword [esp + eax - 0x22b8d85], eax
adc dl, 0xb8
dec ecx
lea eax, [eax + eax*8 - 0x2ad4a353]
xor dword [esp + edx*2 - 0x168], eax
setb al
xor ebx, ecx
shr word [esp + edx*2 - 0x168], 0xa7
pop eax
adc esi, ecx
and edx, eax
mul ax
or eax, dword [ebp + eax*2]
movzx ecx, dl
or ecx, 0xa32abb09
push edx
add edx, dword [ebp + edx + 4]
add ebp, 4
not dword [esp + 8]
inc byte [esp + 3]
neg ecx
add eax, edx
mov dword [ebp + ecx - 0x5cd544f7], eax
mov dword [esp + ecx - 0x5cd544f7], esi
ret 8

Function at 0x101c3207
Capabilities:
Encode data using base64
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [esp + ebp - 0x41]
shl ebx, 0xce
mov eax, dword [esp + ebp*2 - 0x82]
push dword [esp + 0xc]
popfd
mov ebx, dword [esp + ebp*8 - 0x218]
mov ecx, dword [esp + ebp*2 - 0x76]
push ebp
mov ebp, dword [esp + ebp*2 - 0x6e]
call fcn.101ab98c

Function at 0x101c7e82
Capabilities:
Read file on windows
Terminate process

Disassembly:
movsx eax, word [esp + edx - 0x6f9d887c]
ror cl, 1
mov dword [esp + eax*2], 0x169e900e
dec cl
xchg word [esp + eax*8 + 2], dx
xor bl, cl
div dword [esp + edx - 0x6f9d169e]
lea ecx, [esp + ecx + 8]
add ax, ax
ror eax, 0x9e
movzx dx, byte [edx + ecx - 0x5b7149e2]
neg eax
movzx ecx, byte [esp + 4]
dec ax
lea edi, [ecx + edi - 2]
lea ecx, [ecx + ecx*2 + 0x528cd70d]
cbw
Function at 0x101c7edf
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea ebp, [ebp + edx - 0x46aedfa0]
not byte [esp + edx - 0x46aedf97]
shr byte [esp + edx - 0x46aedf99], 0x23
xor al, bl
shl dword [esp + edx - 0x46aedf9a], 0xcb
btr edx, edx
xor edx, dword [esp + edx - 0x42aedf9a]
xor al, 0xb3
ror al, 1
bt edx, edx
lea edx, [edx + edx*8 - 0x46418657]
bswap edx
adc al, 0x28
rol dword [esp + edx - 0x1356e411], 0x9d
sar edx, 0xe1
neg al
push edx
and dl, 0xb6
xor bl, al
lea eax, [esp + eax + 8]
sub word [esp + edx - 0x9ab71fc], dx
or edx, edx
add dx, dx
mov dword [eax + edx*8 - 0x4d5f2000], ecx
shl dword [esp + edx*2 - 0x1357c7fc], 0xe3
mov dword [esp + edx*2 - 0x1357c800], edi
ret 4
mov ebp, dword [ebp + ecx - 0x40]
pop edx
pop eax
pop eax
jl fcn.10190646
jns 0x10218ed0
lea esi, [esi + edx - 0x46aedf92]
movzx eax, byte [ebp + edx - 0x46aedfa0]
and word [esp + edx - 0x46aedf9a], 0x1e28
jp 0x101be109
xor bl, dl
pop ecx
movsx ecx, word [esp + 4]
sub edi, 2
push eax
neg ecx
mov word [edi + ecx*8 - 0x22ea8], dx
lea ebp, [ecx + ebp - 0x45d9]
mov eax, dword [ebp + ecx - 0x45d5]
movsx edx, cx
and dl, ch
mov dword [esp + ecx - 0x45d1], ecx
xor eax, ebx
and edx, ecx
not eax
ror eax, 3
dec eax
bswap eax
sal ecx, cl
xor eax, 0x70062a94
imul edx, dword [esp + edx - 0x453d]
adc byte [esp + edx*2 - 0x50bf8929], ch
xor ebx, eax
add esi, eax
pop eax
pop edx
pop edx
jmp fcn.1017fa23

Function at 0x101c8f1f
Capabilities:
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
lea edx, [eax + eax - 0x7d4bf3cc]
dec cl
xadd eax, edx
xadd edx, eax
pop edx
ror cl, 1
inc cl
mov dword [esp + eax*4 - 0x4a808a2], 0x9f34bd01
jmp 0x10196a35

Function at 0x101c9aa3
Capabilities:
Read file on windows
Terminate process

Disassembly:
push dword [esp + 4]
popfd
mov ecx, dword [esp + eax - 0x45255d13]
call fcn.101bd35d
Function at 0x101cbb85
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
dec word [esp + ecx*2 + 1]
dec ecx
rol al, 1
sal ecx, 0xb6
xor bl, al
xor dx, word [esp + ecx*8 + 2]
lea edi, [edi + ecx - 2]
inc dl
sub ecx, 0x3b0bc68b
jb 0x102526bd
lea edx, [eax + edx - 0x651c8800]
cmovo eax, dword [esp]
and byte [esp + 1], ch
shr word [esp + 2], 0x25
rol edx, 1
sal word [esp], cl
bswap edx
lea edx, [edx + ecx - 0x11559ee6]
lea ecx, [ecx*4 + 0x7ea29b87]
ror edx, 2
xor cl, 0x39
rol eax, 0xb4
call fcn.1019572c
neg al
neg word [esp + ecx*2 + 1]
lea edx, [ecx*4 + 0x42ad643b]
xchg byte [esp + ecx*8 + 4], cl
xor al, 1
bts cx, cx
sub cx, word [esp + ecx + 1]
ror dword [esp + ecx + 3], cl
adc al, 0x25
jmp 0x1017fe6a
inc eax
dec dl
sal ecx, 0x86
ror eax, 3
and edx, 0xf7271583
jae 0x1024d020
mov edx, 0xc08a502c
mov ecx, dword [ebp]
mov ax, word [ebp + 4]
bswap edx
rol edx, 0xe4
rol edx, 0x88
lea ebp, [ebp + edx*2 - 0x11580584]
neg edx
mov word ss:[ecx], ax
sbb esi, 3
movzx ecx, dx
mov eax, dword [esi + ecx*2 - 0x1fa76]
bts ecx, edx
xor eax, ebx
inc eax
add edx, 0xd3046611
neg eax
rol eax, 1
lea edx, [ecx*8 - 0x4be0b042]
btc dx, dx
call fcn.1026ceb5
push 0x4f187d18
sub ebp, 4
mov ecx, dword [esp]
jmp 0x10242363
xchg word [esp + 2], si
mov esi, dword [esp + 8]
call fcn.101cc077
xor al, bl
and dl, dh
mov dword [esp + edx*8], ecx
jbe 0x101a7d30
mov ecx, 0x390f689
lea ebp, [ebp + ecx*8 - 0x1c87b44c]
movsx eax, cl
btr ecx, eax
cdq
mov eax, dword [ebp + ecx*4 - 0xe43d224]
sbb edx, edx
shr ecx, cl
lea edx, [ecx*8 - 0x20f430da]
xor eax, ebx
not edx
sub cx, cx
not eax
xchg dl, cl
inc ecx
rol eax, 1
dec eax
xchg ecx, edx
neg eax
jmp 0x1022f408
bswap eax
jmp 0x101a8180
btc cx, 0x36
mov edx, dword [ebp + ecx - 0x4f187d58]
lea ecx, [ecx*8 - 0x5ee6d57b]
mov eax, ecx
imul ecx, eax
xor edx, ebx
shl cl, 0xe4
ror edx, 3
shr ecx, 0x73
dec edx
xor edx, 0xbf260e91
push ecx
ror al, 0x66
lea edx, [edx + eax*2 + 0x74012874]
sub byte [esp + eax - 0x19dd1513], ah
not edx
xor ebx, edx
imul ecx, dword [esp + ecx - 0x698]
call fcn.1026ebd0
inc cl
neg edx
sbb eax, 0xd28b5836
bswap eax
dec edx
add edx, ecx
shl cx, cl
rol eax, 1
imul ecx, ecx
shr dl, 0x85
rol cl, 0xa5
xor ebx, eax
sub cl, dh
neg cl
xadd cl, dh
adc esi, eax
btc cx, dx
mov ecx, dword [edi + edx*8 - 0x40000]
push edx
mov eax, dword [esp + edx*2 - 0x10000]
mov word [esp + edx - 0x7fff], dx
add dl, byte [edi + edx - 0x7ffc]
dec word [esp + eax*4 - 0x1ffff]
shl dword [esp + eax - 0x8000], 0x35
lea edi, [edi + eax*8 - 0x3fffa]
mov byte [eax + ecx - 0x8000], dl
mov dword [esp + eax - 0x8000], esi
ret
mov word [edi + edx - 0x42ad9b3c], ax
setno dl
pop edx
pop ecx
jle fcn.1017fa23
mul edx
jo 0x1023cee0
mov ebx, 0x8c1c2421
mov esp, esi
pop ebx
pop ecx
mov edx, 0xbfbfd63d
pop eax
mov edi, edx
mov esi, 0xf334450f
add edi, esi
popfd
jmp 0x102569bc
pop ebp
xchg edi, edx
not dl
push esi
mov edi, dword [esp + 4]
xchg dword [esp], edx
jmp 0x101ba0e1
Function at 0x101cbf2d
Capabilities:
Read file on windows
Terminate process

Disassembly:
xor eax, eax
jge 0x10235b8e
mov ecx, dword [ebp]
mov ax, word [ebp + 4]
mov edx, 0xb38eec3f
add ebp, 6
sal dl, 1
sub edx, edx
mov word [ecx + edx*4], ax
movsx eax, dl
call fcn.101bfc6f
mov eax, 0xed3ad983
ror al, 0x81
mov edx, dword [ebp]
xor al, al
mov ecx, eax
mov ax, word ss:[edx]
call fcn.1022ee0a
lea eax, [edx + eax - 0xfe7c0c7]
mov word [edi + edx - 0x702c4504], cx
jb 0x101969d9
inc edx
mov edx, dword [ebp + edx - 0x702c4505]
adc ebp, 4
mov dword [esp], eax
mov ecx, 0x492013b8
xor edx, ebx
jmp 0x101dd47b
rol edx, 2
sub edx, 0xf8a963a3
pop eax
shl cx, 0xca
inc ecx
neg edx
xor ecx, 0x722d0988
setge al
ror edx, 1
bt eax, ecx
neg eax
xor ebx, edx
not ecx
add esi, edx
sub al, ch
jne 0x101c69d2

Function at 0x101cc3e6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
not edx
inc eax
shr ecx, 0x94
mov dword [ecx + esi - 0xb5b], edx
lea ebp, [ebp + ecx - 0xb5f]
mov ecx, dword [ecx + ebp - 0xb5b]
mov dword [esp + eax*2 - 0x1cab0], eax

Function at 0x101cd5c1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
shr byte [esp + eax - 0x1b4bb36c], 0x23
pop eax
pop eax
ja fcn.10242672
mov dword [ebp - 0x10], edi
jmp 0x101da86f
mov dword [ebp - 8], esi
jmp 0x10203167
mov dword [ebp - 0xc], eax
jmp 0x1024a0f0
jmp 0x1026a8b8
Function at 0x101cf511
Capabilities:
Read file on windows
Terminate process

Disassembly:
add eax, eax
jl 0x1021b2ca
shr edx, cl
mov dword [edi], edx
movsx edx, al
ror edx, 0xf8
pop edx
pop edx
jmp esi

Function at 0x101cf6ba
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp + ecx - 0x42fef2dc], edx
add byte [esp + edx - 0x7f91b190], 0x2b
mov dx, word [ebp + edx - 0x7f91b18f]
mov cl, byte [ebp + ecx - 0x42fef2d8]
adc ebp, 4
shrd ax, dx, cl
mov word [ebp], ax
xor byte [esp + 2], 0x9a
call fcn.10231fd0
lea eax, [eax*8 - 0x4f67d0d0]
mov ecx, dword [edi + 4]
bt ax, 0x3e
ror ax, 0xa3
sub ax, 0x4616
adc edi, 7
sub eax, 0xfba6d633
lea eax, [eax + eax*4 + 0x4a116a10]
mov dword [edx], ecx
movzx edx, al
lea ebp, [edx + ebp - 0xca]
add eax, eax
lea ecx, [edx*8 - 0x4ffc2d4]
adc ecx, 0x86bf2128
mov eax, dword [ebp + edx*4 - 0x318]
lea ecx, [edx + 0xbb48f24]
call fcn.1018aebf
mov edi, 0x9d0b672e
mov esp, ebp
btr edi, edi
jae 0x10240cb1
movsx ebx, di
pop esi
movzx ebp, bx
pop edi
rol ebp, 0x62
pop edx
pop eax
popfd
pop ebx
bswap ebp
pop ecx
jmp 0x101dd3b2
call fcn.101b1cba
mov eax, 0xb514259d
movzx edx, ax
lea edi, [edx + edi - 0x25a1]
shl edx, 0xb5
mov edx, dword [edi]
movzx ecx, ax
sal eax, cl
xor edx, ebx
and ax, cx
btc ecx, eax
sal eax, cl
ror edx, 1
and ecx, ecx
sbb cx, 0x6924
neg edx
xor ax, 0xab2c
inc edx
rol edx, 2
sub eax, 0xd48e1a27
xor ebx, edx
bt cx, 0x85
neg ecx
add ebp, edx
call fcn.10269ea3
jmp 0x1022976e
mov ecx, 0x22055b21
mov edx, ecx
mov eax, dword [edi + edx - 0x22055b21]
dec edx
lea edi, [edi + ecx*2 - 0x440ab63e]
dec dx
push ecx
xor eax, ebx
sar dx, cl
not eax
bswap eax
not word [esp + edx - 0x22052d8e]
neg eax
ror eax, 3
push ecx
xor ebx, eax
shl cx, cl
mov byte [esp + edx - 0x22052d8d], cl
jo 0x1017db49

Function at 0x101cfb47
Capabilities:
Read file on windows
Terminate process

Disassembly:
neg edx
shr edx, 0xa3
lea ebp, [edx + ebp - 0x1ffffff0]
adc ax, word [esp + edx - 0x1fffffe9]
xor dword [esp + edx - 0x1fffffea], 0x2823381f
mov word [ebp + edx*4 - 0x7fffffb8], cx
jns 0x1017b7cb
rol eax, 1
btr edx, edx
or cx, dx
sar cl, 6
adc eax, 0xe801f681
rol cl, 3
rol dl, 6
bswap eax
dec dl
and dl, dh
xchg ecx, edx
inc eax
btr cx, cx
xor ebx, eax
lea ecx, [ecx*8 + 0x808d513]
shl cx, 0xa1
sbb cx, dx
adc esi, eax
ror ecx, 0x64
xor cx, dx
mov eax, dword [ebp + edx*4 - 0xbdc]
mov edx, dword [ebp + edx*2 - 0x5ea]
shl cx, cl
mov cl, byte [ebp + 8]
push 0xadb6582e
dec byte [esp + 2]
push 0xaa90890d
adc ebp, 5
shld eax, edx, cl
call fcn.101fbe2f
Function at 0x101d0674
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea edi, [edx + edi - 0x1b26b2bf]
cdq
not cx
movzx ecx, word [edi + edx]
xor cx, bx
mov dword [esp + edx], edx
mul dx
and dword [esp + edx*2], 0x72072eb5
ror cx, 1
shl dword [esp + edx*2], 0x3a
dec cx
add ax, word [esp + edx*2 + 2]
setle al
neg cx
add word [esp + edx + 1], ax
xchg dx, ax
xchg dword [esp + eax], eax
xor cx, 0x2838
xor bx, cx
dec edx
ror dl, 0x61
bts dx, dx
lea esi, [esi + edx - 3]
xchg dword [esp + edx*2 - 2], edx
setae al
mov word [esi + edx], cx
or edx, edx
lea ecx, [edx + edx*4 + 0x2a814231]
and ax, word [esp + edx*4 + 2]
pop ecx
je fcn.1022ca3e
shl ecx, 0x2f
xor al, bl
shl ecx, 0x89
dec cx
adc al, cl
xor al, 0xab
rol al, 1
shl ecx, cl
bswap ecx
not edx
dec al
neg al
imul edx, edx
xor bl, al
btc ecx, 0x21
rol edx, cl
adc eax, esp
shr cx, 0xe6
movzx dx, byte [eax + ecx - 2]
sbb ebp, ecx
mov eax, ecx
btc cx, ax
cwde
mov word [ebp + ecx - 6], dx
and al, ah
jge 0x10247d8d
mov eax, dword [edi]
mov edx, ecx
xchg ecx, edx
mov cx, word [eax]
add edi, 2
and edx, edx
neg edx
mov word [edi + edx*2 - 0x5af44290], cx
movsx ecx, dl
shl edx, 0x9f
sar dl, 0x86
mov eax, dword [edx + ebp]
rol edx, cl
neg cl
lea ebp, [ebp + edx + 4]
sal ecx, cl
inc ecx
neg dx
xor eax, ebx
rol eax, cl
not cl
rol cx, 0xe3
rol cx, 0xf
neg eax
btc dx, dx
inc cx
xor eax, 0xdca71abc
add cl, dl
and cl, cl
bswap eax
sar cx, 0x49
shl ecx, 0x14
xor ebx, eax
and edx, edx
or edx, 0x1fa9bb35
adc esi, eax
movzx eax, cl
not cl
cbw
or eax, esi
jmp eax
bswap edx
xadd ecx, eax
xor ebx, edx
shr ecx, 0x4a
sbb word [esp + eax - 0x791b1c26], 0xcf32
call fcn.101e8f3c
mov ecx, 0x5e14e38a
mov ecx, dword [ebp + ecx - 0x5e14e38a]
mov eax, 0x850abca4
imul eax
sbb dx, ax
lea ebp, [ebp + edx*2 - 0x761ccc34]
bswap eax
cwde
mov edi, ecx
movzx ecx, ax
jns 0x101b0fb8
mov edx, eax
adc eax, dword [ecx + edi - 6]
not edx
shl dl, cl
lea edi, [ecx + edi - 2]
xor eax, ebx
lea edx, [edx*2 + 0x30a15cad]
neg eax
bswap edx
not eax
shr ecx, 0x34
sub cx, cx
xor edx, ecx
inc eax
or ecx, 0x4b326093
neg edx
bt ecx, edx
ror eax, 1
shl ecx, 0x53
not eax
xor ebx, eax
add esi, eax
rol edx, 0x15
jb fcn.10190646
mov edx, 0xec86610a
mov edx, dword [edi]
mov ecx, 0x791b1c29
lea edi, [edi + ecx - 0x791b1c25]
xor edx, ebx
dec cl
inc edx
movsx eax, cl
rol ax, 0xc1
ror edx, 1
push eax
neg edx
jmp 0x101f7a56

Function at 0x101d39fa
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add ax, 0xf8a1
mov eax, dword [esi]
mov dword [esp], edx
mov ecx, 0x9d93299b
sal dword [esp], 0x83
xor eax, ebx
rol cl, 0x22
and ecx, edx
sbb eax, 0x3e96182c
inc edx
rol cx, cl
bswap eax
xor eax, 0xc923c213
xchg dword [esp], edx
and dx, cx
lea eax, [ecx + eax - 0x4a047cf7]
adc dword [esp], edx
or byte [esp], 0x29
xor ebx, eax
sub dword [esp], edx
push ecx
add edi, eax
and byte [esp + 4], 0xa8
bts ecx, ecx
sbb esi, 1
movzx eax, cl
xor al, dh
movzx edx, byte [esi + eax*2 - 0x10]
not al
xor dl, bl
sub cl, 8
add ecx, eax
push eax
neg dl
call fcn.1026afa3
Function at 0x101d4f77
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov word [eax + edi - 0xfffffd], dx
jae 0x101f57ba
lea eax, [eax + ecx*2 + 0x1fc2a8ce]
xor eax, 0xe584bb8c
mov dword [esp + ecx - 0x482650b0], ecx
inc eax
call fcn.101dcaf5
neg edx
dec edx
bt eax, ecx
ror edx, 1
xor edx, 0xe9029637
dec ecx
and ecx, ecx
ror edx, 2
bt ax, ax
inc edx
not edx
add eax, 0x71a7dc9a
xor ebx, edx
add esi, edx
shl cx, 0xd
lea edx, [ecx + eax*2 + 0x2ab2bb1]
je 0x101e3cbb
movzx ax, byte [edi + ecx*2 - 0x1c6ec000]
sub cl, 0x96
mov cl, byte [edi + ecx*2 - 0x1c6ec0d2]
push edx
shr al, cl
inc dx
mov word [edi + 2], ax
jnp 0x102569cf
lea edi, [ecx + edi - 0x3fffd]
bswap eax
imul ecx
mov dword [esp + ecx - 0x3ffff], esi
ret 4
lea ecx, [edx + edx - 0x4f77f3f8]
pop ecx
mov dx, word [edi + 2]
mov eax, ecx
jle 0x102649fa
mov eax, ecx
dec edx
bswap edx
lea eax, [ecx + ecx + 0x791c849e]
cwde
not cl
lea edx, [edx + eax - 0x34e17d6e]
inc cl
xor edx, 0x17156706
push ecx
rol ecx, 0x1c
neg ax
xor ebx, edx
rol al, 0x23
adc esi, edx
mov eax, dword [edi + ecx - 0x647221fd]
push ecx
dec word [esp + ecx - 0x647221fa]
mov cl, byte [edi + ecx - 0x647221f9]
mov edx, 0xde827813
add edi, 2
sar dl, 0xa4
adc byte [esp + 5], dl
shr eax, cl
jmp 0x1025901a
mov dword [edi], eax
mov ecx, 0xd48590a1
or dx, 0xa292
pop ecx
pop eax
jmp esi
bt eax, eax
movzx ecx, byte [ebp + 4]
dec al
sar al, 0x81
xor cl, bl
sub eax, 0xf0b81d8a
not cl
inc cl
ror ax, 0x61
jae 0x10209506
sal al, 0xe2
neg cl
sal eax, 0x75
xor cl, 0x89
shr ax, 0x87
xor bl, cl
rol eax, 0x52
inc al
shl eax, 0xd8
adc ecx, esp
dec eax
mov byte [ecx + eax*2 - 0x1fffffe], dl
movsx edx, al
movzx edx, byte [ebp + eax*4 - 0x3fffff7]
movzx ecx, al
lea ebp, [ebp + eax*2 - 0x1fffff8]
xor dl, bl
ror dl, 1
or ecx, eax
adc cl, al
add dl, al
rol dl, 1
sub dl, al
push ecx
sal cl, 0xc5
xor bl, dl
ror ecx, 6
push eax
jae 0x10190738

Function at 0x101d5c3c
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp], 0xa433ff8e
add edi, 1
xor al, bl
mov dword [esp + 4], 0x358e611e
mov edx, 0x33b21106
dec al
mov ecx, dword [esp + edx - 0x33b21102]
xor al, 0x24
sar dx, 0x4c
xchg byte [esp + ecx - 0x358e611d], cl
sbb al, 0xab
lea ecx, [ecx + edx*8 + 0x6023839e]
add dword [esp + edx - 0x33b20000], edx
rol al, 1
xor bl, al
dec edx
sal ecx, 0x94
neg cx
lea eax, [esp + eax + 8]
adc cl, ch
shl cl, 0xc3
seta dl
mov ecx, dword [eax + ecx - 0x5a500000]
sal dx, 0xca
sal dword [esp + edx*2 - 0x6763fffd], 0xe9
movzx eax, byte [esp + edx*2 - 0x6763fffc]
lea ebp, [eax + ebp - 0xb0]
push eax
sar eax, 0xb2
rol byte [esp + eax*2 + 2], 0x81
mov dword [ebp + edx - 0x33b20000], ecx
dec byte [esp + edx - 0x33b20000]
add eax, dword [edi + eax*2]
pop ecx
call fcn.1023cafd

Function at 0x101d5cd8
Capabilities:
Read file on windows
Terminate process

Disassembly:
and cl, ah
mov dword [esp + eax - 0x3edf], eax
ror edx, 1
or ecx, eax
call fcn.1025a40c