joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1023f731
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
btr dx, 0xbb
shr edx, cl
ror al, 1
xor bl, al
dec byte [esp + ecx*2 - 0x39]
lea eax, [esp + eax + 8]
shr cx, 0xe9
rol cl, 0x46
mov dl, byte [edx + eax - 1]
mov eax, ecx
neg dword [esp + ecx + 3]
not word [esp + ecx*8 + 1]
mov word [ecx + edi - 2], dx
lea edi, [edi + ecx*2 - 2]
pop ecx
pop edx
jb fcn.10187551
dec cl
ror edx, 0x21
ror eax, 0xac
xadd ax, dx
rol cl, 1
xor bl, cl
lea eax, [edx + edx*4 + 0x1a10a51a]
lea ecx, [esp + ecx + 4]
movzx ax, byte [ecx + eax*2 - 0x34214a48]
mov dword [esp + edx*8 - 0x10], edx
movzx ecx, dl
mov dx, ax
neg dword [esp + ecx*2 - 4]
movzx dx, dl
lea eax, [ecx*8 + 0x4102140a]
rol ecx, cl
shl eax, 0x4c
mov cl, byte [edi + ecx*2 - 0x10]
adc dl, cl
neg word [esp + eax*2 - 0x42833ffe]
sar byte [esp + eax*2 - 0x42833ffe], 0x44
xadd byte [esp + eax - 0x21419ffd], al
mov word [edi + eax - 0x2141a000], dx
bt eax, 0x98
mov ecx, dword [eax + esi - 0x2141a005]
xor ecx, ebx
ror ecx, 3
sar al, 4
bswap ecx
lea edx, [eax*4 - 0x33ccb4d7]
shr eax, 3
lea ecx, [ecx + eax*8 + 0x4690b21]
bswap ecx
shl dl, 0x62
not dword [esp + eax - 0x4283400]
xor ebx, ecx
sal dword [esp + eax*2 - 0x8506800], 0x4d
lea edx, [edx + eax + 0x583fd4ae]
sal edx, 0x9a
add ebp, ecx
neg edx
movzx eax, byte [esi + eax*8 - 0x2141a006]
movzx ecx, word [esp]
ror cl, 0x21
sbb byte [esp + ecx*8 - 0xfffd], cl
lea esi, [esi + ecx - 0x2006]
push ecx
not dword [esp + ecx - 0x1ffc]
xchg ch, cl
xor al, bl
add al, 0x84
rol al, 1
dec ecx
dec al
btc dx, 0x31
not al
jae 0x1017ad60

Function at 0x10241056
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub eax, 0xc137d83b
mov dword [esp], 0xbf0e95a0
xor ebx, eax
bt edx, edx
Function at 0x102443da
Capabilities:
Terminate process

Disassembly:
adc edi, 1
shl eax, 4
idiv al
or eax, eax
and dx, cx
sal eax, 0x49
not dx
mov word [edi + eax - 0x5e006200], dx
movzx ecx, ax
sar eax, 0xb
ja 0x102550d6
ror eax, 0x29
neg ecx
not ecx
push eax
xchg dword [esp + eax*8], edx
not ax
xor ebx, ecx
xchg byte [esp + edx*2 + 2], ah
add edi, ecx
sub dword [esp + edx*2], eax
sal byte [esp + edx + 2], 0x81
push edx
lea esi, [esi + eax - 0x2e03]
lea ecx, [edx*2 - 0x6ae569f2]
add edx, dword [esi + edx*2]
sar word [esp + eax*2 - 0x5bfc], 0xe4
shr dword [esp + eax*2 - 0x5bfa], 0x1a
xor edx, ebx
rol al, 0x27
lea eax, [eax*2 - 0x29743de9]
sal al, 0xc6
inc edx
imul ax, ax
neg edx
and ax, word [esp + 4]
lea edx, [edx + eax - 0x2c5762cb]
ror edx, 3
sar eax, cl
push ecx
xor ebx, edx
rol eax, cl
neg byte [esp + 7]
sbb ebp, 4
sar al, 0x87
mov dword [ebp], edx
sal dword [esp + 8], cl
sar al, 7
pop edx
pop eax
pop ecx
js fcn.1018699d
xor edx, 0x3d307323
mov eax, 0x12984c8c
cbw
dec al
rol edx, 1
movzx ecx, ax
not edx
xor ecx, 0x323ef893
xor ebx, edx
call fcn.101e859f
mov ecx, 0x651210a0
not cl
mov eax, ecx
lea esi, [esi + eax - 0x65121063]
mov ecx, dword [eax + esi - 0x6512105f]
xor ecx, ebx
rol al, 0x65
lea edx, [eax*4 - 0x75eebe67]
ror ecx, 1
call fcn.102007f6
movzx eax, cl
xor dl, bl
sub eax, ecx
sbb dl, al
neg dl
ror dl, 1
not dl
rol dl, 1
jmp 0x1025735d
mov ecx, dword [ebp]
pop edx
pop edx
xor dword [esp], 0x9414072c
xor ecx, ebx
call fcn.10223b84
mov edx, 0xee378bab
movzx ecx, dl
btr dx, 0xa9
lea ebp, [ebp + ecx*4 - 0x2b0]
bts cx, dx
mov edx, dword [ebp + ecx*4 - 0x22ac]
movzx eax, cl
ror ax, 0x61
xor eax, 0x8ca156ab
xor edx, ebx
xor edx, 0x161fd100
bswap eax
neg eax
sal eax, 4
lea edx, [edx + ecx*2 + 0x51bd4cc9]
bswap edx
shr cl, 6
cwde
neg edx
btc ecx, ecx
cwde
sbb edx, 0xea15022c
xor edx, 0xbd87678e
neg cl
xor ebx, edx
sub eax, 0xa992fd97
adc esi, edx
add al, 0x95
mov edx, 0x948c5387
not dx
mov dx, word [edi + ecx - 0x8fa]
lea eax, [ecx + eax*2 + 0xb9868bb]
mov cx, word [edi + ecx - 0x8f8]
neg al
cbw
jl 0x101897dc
jmp esi
sar cl, cl
cwde
inc dl
ror eax, 0xc7
xor bl, dl
lea edx, [esp + edx + 8]
call fcn.101a2a20
inc cl
cwde
lea eax, [edx + edx*4 - 0xcf996ea]
idiv eax
ror cl, 1
dec cl
sar al, 0x67
cdq
call fcn.101b492d
Function at 0x102447f1
Capabilities:
Read file on windows
Terminate process

Disassembly:
movsx eax, dx
jmp ebp
add ebp, eax
mov ecx, dword [esi + ecx*2 - 0x4bd0ad98]
movsx eax, dl
shr al, 0x83
bswap edx
mov eax, dword [ecx + edx - 0x14abfdff]
imul edx, edx
mov ecx, edx
mov dword [edx + esi - 0x26ac0401], eax
jo 0x10189f09
mov edx, dword [esi - 5]
mov dword [esp], 0xcb814108
pop eax
ror ax, 0xc4
xor edx, ebx
inc edx
lea ecx, [eax + eax + 0x7ebfd3b2]
not edx
xchg cx, ax
lea edx, [edx + eax - 0x47d1ee51]
rol edx, 3
xor ebx, edx
xadd ax, cx
bts ax, 0x1f
adc edi, edx
xor ax, 0x96af
movzx edx, byte [esi + ecx*2 - 0x2b85b7aa]
btc eax, eax
ror cx, 0xec
xor dl, bl
btc ax, 0x35
add ecx, ecx
adc dl, 0x25
shr ecx, 0xce
cmove ax, cx
bswap ecx
not dl
jnp 0x101a85cb
mov ecx, 0x2e96e522
lea eax, [ecx - 0xbcba750]
lea edi, [edi + ecx - 0x2e96e526]
mov eax, dword [ecx + edi - 0x2e96e522]
mov edx, 0xdab17bba
xor eax, ebx
bts cx, cx
sbb ecx, edx
inc eax
bt ecx, edx
bswap eax
sar edx, cl
lea eax, [eax + edx - 0x64e80a65]
ror eax, 3
lea ecx, [edx + edx + 0x1a61933]
bswap ecx
not eax
btr edx, ecx
imul cx, cx
sbb eax, 0x681d2d1a
or ecx, 0x74b71d84
xor ecx, 0x5017091c
rol eax, 1
not eax
ror eax, 3
dec dl
xor ebx, eax
ror cl, 1
jno 0x101df82e
mov ecx, dword [edi]
mov al, byte [edi + 4]
mov edx, 0xfbacc58a
add edi, 6
not edx
sar dl, 0x26
dec edx
mov byte ss:[ecx + edx - 0x4533a00], al
lea ebp, [edx + ebp - 0x4533a04]
movzx ecx, dl
or ecx, dword [ebp + edx*2 - 0x8a67400]
neg dx
xor ecx, ebx
movsx eax, dx
inc ecx
cwde
bts edx, eax
not ecx
rol ecx, 1
call fcn.1021db3a
mov eax, edx
add edx, esi
jmp edx

Function at 0x102473b9
Capabilities:
Read file on windows
Terminate process

Disassembly:
xor cl, bl
dec cl
xor cl, 0xab
shr eax, 0x74
cdq
rol cl, 1
mov dword [esp + edx*2], edx
dec cl
or dword [esp + edx + 2], 0x4a9d9b88
neg cl
cwd
bts edx, eax
xor bl, cl
lea ecx, [esp + ecx + 0xc]
inc dword [esp + edx*8 - 0x7f8]
movzx dx, byte [edx + ecx - 0x100]
setl byte [esp + eax - 0xd86]
movzx ecx, ax
lea ebp, [ebp + eax - 0xd8a]
bts cx, 0x23
mov word [eax + ebp - 0xd88], dx
inc byte [esp + eax - 0xd81]
pop eax
pop eax
pop eax
jne fcn.10190646

Function at 0x1024862e
Capabilities:
Terminate process

Disassembly:
xor ecx, ebx
push eax
mov dword [esp + 4], eax
rol ecx, 1
movsx edx, word [esp + 8]
sub ecx, 0x41194ae
idiv eax
call fcn.1019f092
call fcn.1020fc53
Function at 0x10251494
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
adc edi, 2
rol edx, 0xc2
shr eax, cl
dec dword [esp]
jno 0x101b6bb0
lea edx, [edx + 0x20]
jmp 0x102336f2
mov dword [edi], eax
sub ebp, 4
mov ecx, dword [ebp]
bts edx, 0x29
movsx eax, dx
sub al, byte [esp + eax - 0x2bcc]
xor ecx, ebx
cwde
ror ecx, 2
dec dl
dec ecx
shl edx, 0x4f
rol ecx, 1
dec ecx
neg ecx
sub ecx, 0xf3835739
neg ecx
inc al
imul eax, eax
shl ax, 5
xor ebx, ecx
add esi, ecx
mov dword [esp + edx - 0x15e70000], esi
ret
movups xmm0, xmmword [edx]
jmp 0x10252c45
mov dword [esp], ecx
mov cl, byte [edi + 4]
xadd word [esp + 1], dx
je 0x1018c5da
ja 0x1019b45b
mov word [eax + edi - 0x51f6941], cx
lea ebp, [eax + ebp - 0x51f6945]
lea edx, [eax + eax + 0x32a34aa3]
movsx ecx, word [esp + eax - 0x51f6941]
mov eax, dword [ebp + eax - 0x51f6941]
xchg dword [esp + edx*2 - 0x79c43a4a], edx
call fcn.101b1ace
bswap cx
mov ecx, dword [edx + 0xf0]
movups xmm2, xmmword [esi]
jmp 0x10246bb6
movups xmm1, xmmword [edx + 0x10]
jmp 0x101b31d6

Function at 0x10251c14
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add edi, 4
xchg dword [esp], eax
bts ax, ax
shl eax, 0x2b
lea ebp, [ebp + eax - 0x70a92801]
shl word [esp + eax - 0x70a927ff], 0xe
je 0x10188742
inc byte [esp + eax - 0x70a927fd]
movzx eax, byte [ebp + eax - 0x70a92800]
mov edx, 0x280d3b35
xor al, bl
imul edx, dword [esp + edx - 0x280d3b35]
btc dx, 0x91
adc al, 0xbb
ror dx, 0x43
rol al, 1
rol dword [esp], 0x8f
setae byte [esp]
not al
shl dx, 0x66
rol al, 1
add al, 0x8f
neg al
and edx, edx
sal edx, 0x8e
call fcn.10218791
mov edx, 0x348d8825
movsx ecx, dx
btr dx, cx
mov ecx, ebp
lea eax, [edx*8 - 0x105dc1f5]
xor dx, 0x5ab7
div eax
lea ebp, [ebp + edx*2 - 0x115d0eee]
btc edx, 0x3c
lea edx, [edx*4 - 0x28cc0bc9]
mov dword [ebp + edx - 0x39ee120b], ecx
inc edx
mov ecx, dword [edx + edi - 0x39ee120c]
lea edi, [edi + edx*2 - 0x73dc2414]
xor ecx, ebx
ror edx, 0x87
ror eax, 0x64
inc ecx
rol eax, 0xfd
mul eax
call fcn.102280e0
push eax
shl dl, 0xc3
sub al, dh
lea ecx, [esp + ecx + 4]
sal al, 0x21
sar edx, 0xc8
sal edx, 0xd5
add dx, word [ecx + edx*2]
movsx ecx, al
sar cl, 0xe3
jae 0x1021bc2b
sub ebp, 4
mov eax, 0x4e981528
mov edx, eax
mov edx, dword [eax + ebp - 0x4e981528]
btc eax, 0x3f
xor edx, ebx
jmp 0x101a2bfa
shld dx, ax, cl
mov word [esi], dx
call fcn.101ce671
jb 0x1021112b
adc esi, 4
jmp 0x1024bf51
mov ecx, 0xc28e62a4
adc edi, 1
mov eax, ecx
add cx, 0x3816
mov word [edi], dx
not ax
cdq
ja 0x10267085
lea edi, [ecx + edi - 2]
xadd cx, ax
sal al, 0x65
jne 0x102517a3
mov word [edi + eax*2], dx
sal dword [esp + eax*2], 0xcc
lea ebp, [ebp + eax - 4]
imul eax, ecx
adc eax, dword [ebp + eax]
lea edx, [ecx*4 - 0x46da3a65]
sub dword [esp + ecx], edx
sub cl, dl
xor eax, ebx
xor eax, 0x4d8f858c
jmp 0x10180b70
jmp 0x101c7e2e
jnp 0x1020cc3f
not ecx
push edx
mov eax, edx
bswap ecx
inc eax
xor ebx, ecx
div eax
dec dx
add ebp, ecx
mov eax, dword [edi]
rol byte [esp + 7], 0x61
mov dx, word [eax]
jno 0x10202819
mov eax, 0x910e1525
push eax
mov ecx, dword [edi]
jmp 0x10183565
pop eax
pop eax
pop edx
jmp ebp
Function at 0x102539cc
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
pop ecx
dec al
sal cl, 0xc6
not ecx
bt dx, dx
rol al, 1
push edx
push ecx
not al
shl dx, 0xee
xor byte [esp + edx*4 - 0x445bfffb], dh
setne cl
sbb al, cl
shr dword [esp + edx*4 - 0x445bfffc], cl
adc ecx, 0xe21b990a
xor bl, al
imul ecx, dword [esp + edx*4 - 0x445c0000]
mov word [edx + edi - 0x1116fffc], ax
bts edx, 0x39
add ecx, 0x3b3ffe17
movsx eax, cl
lea edi, [edi + edx*4 - 0x4c5bfffc]
jo 0x101d8cc4
push eax
inc word [esp + edx - 0x1316fff6]
mov dword [esp + edx*2 - 0x262e0000], ebp
ret 8
xor ebx, ecx
btc edx, edx
sbb edx, edx
adc ebp, ecx
call fcn.10219777
sub esi, 1
mov ecx, 0xf48df03b
movzx ecx, byte [esi]
mov edx, 0xd31ab21d
rol dl, 0xa1
bts edx, edx
xor cl, bl
lea eax, [edx + edx + 0x48a66bb5]
and edx, 0xa806b21
rol cl, 1
btc ax, ax
btr edx, eax
xor cl, 0x2f
push eax
cwd
bt dx, ax
ror cl, 1
ror dword [esp + edx - 0x200ffff], 0xa4
shr dx, 0xc9
sar dword [esp + edx - 0x200007f], 0x88
dec cl
sar edx, 0xee
xor bl, cl
imul dx, dx
lea ecx, [esp + ecx + 4]
add edx, dword [ecx + edx]
push eax
call fcn.101b06b6
mov cl, byte [ebp + edx*4 - 0xd8]
lea ebp, [ebp + edx*2 - 0x6c]
shr eax, cl
mov dword [esp + edx - 0x37], edx
inc edx
neg dx
mov dword [ebp + edx - 0xffc8], eax
movsx eax, word [esp + edx - 0xffc4]
movsx ecx, ax
mov ecx, dword [edi + edx*8 - 0x7fe40]
sub al, ah
xor dword [esp + edx - 0xffc4], eax
lea edi, [edi + edx - 0xffc4]
cwde
sub edx, edx
xor ecx, ebx
not ecx
sub ecx, 0xb812e420
call fcn.101d1764
dec dl
dec dx
lea esi, [esi + edx - 0x11177c61]
shr ecx, 0x89
not ecx
xor al, bl
push ecx
dec al
neg dword [esp + edx - 0x11177c5c]
sar byte [esp + edx - 0x11177c5c], 0x42
sal dl, 0xe3
xor al, 0x89
jmp 0x101a3950

Function at 0x10255623
Capabilities:
Read file on windows
Terminate process

Disassembly:
shld dx, ax, cl
mov word [ebp], dx
mov ecx, 0xfdae4f31
mov dword [esp], 0xd3aef72f
mov ecx, dword [edi]
jmp 0x1024b376
mov eax, 0x7f37fb29
lea edi, [edi + eax - 0x7f37fb25]
movzx edx, ax
xor ecx, ebx
imul dl
neg eax
neg ecx
jmp 0x10190a89
mov dword [esp + 4], 0xa850209
jmp 0x101b8a61

Function at 0x1025e95a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
push edx
call fcn.101dfa86
xor dx, 0xda1d
inc dx
neg cl
xor bx, dx
sub edi, 2
mov word [edi], dx
pop ecx
jmp 0x10235b8e

Function at 0x1025f577
Capabilities:
Encode data using base64

Disassembly:
neg edx
lea ecx, [ecx*2 + 0x22364d34]
xor cx, ax
inc edx
xchg cl, al
xor ebx, edx
add esi, edx
push ecx
mov dword [esp + ecx - 0x22368cfc], eax
movzx edx, ax
mov dword [esp + edx*2 - 0x1806c], esi
ret 8
rol edx, cl
dec ax
sub ecx, dword [esp + ecx*2 + 2]
jg 0x10236f49
Function at 0x102605da
Capabilities:
Encode data using base64

Disassembly:
and edx, eax
bswap ecx
call fcn.10212116
mov ecx, 0x13371f10
movsx eax, cl
mov dx, word [edi + ecx - 0x13371f10]
and ecx, ecx
ror ecx, 0x4e
mov cl, byte [edi + eax - 0xe]
lea edi, [eax + edi - 0xe]
shr dx, cl
sar ax, 0x69
cwde
mov word [edi + eax*4], dx
lea esi, [eax + esi - 4]
mul eax
lea ecx, [edx - 0x7f49b5ed]
add edx, dword [esi + eax*2]
xor ecx, 0xfb25649d
not ecx
sub ecx, eax
xor edx, ebx
lea edx, [edx + eax*2 - 0x49281eaf]
dec cx
jl 0x10266774
not edx
btc ecx, 0x93
ror ecx, 0x25
lea edx, [edx + ecx + 0x579a2930]
bt cx, 0x87
sub cl, al
sal ecx, cl
neg edx
inc ecx
dec ecx
xor ebx, edx
add ebp, edx
push eax
rol ecx, 0x3f
and dword [esp + eax*2], eax
add dword [esp + eax], ebp
ret

Function at 0x10260819
Capabilities:
Read file on windows
Terminate process

Disassembly:
jb 0x1021fc1b
lea eax, [eax + ecx*2 - 0xf9e1f50]
xor ebx, eax
call fcn.101cecd3

Function at 0x102614a2
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea edi, [edx + edi - 0x8a]
xor cx, bx
movzx eax, dx
dec cx
xadd edx, eax
cbw
neg cx
push edx
dec cx
call fcn.1022476c

Function at 0x102614f9
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea edi, [edx + edi - 0x105]
imul edx, eax
pop ecx
pop eax
jo fcn.10187551
mov ecx, 0x51089d31
lea edx, [ecx + 0x5baa5f1a]
mov edx, dword [edi + ecx - 0x51089d31]
movzx eax, cx
lea edi, [edi + ecx - 0x51089d2d]
btr cx, 4
sar ax, 0x8f
idiv cl
xor edx, ebx
xor edx, 0x4b310205
xor ecx, 0xff8a8ab1
bts ecx, ecx
inc edx
ror edx, 1
bts eax, ecx
shl cl, 0x27
inc edx
sal cl, 0xa1
xor ebx, edx
xchg ah, al
add cx, ax
adc esi, edx
mov edx, ecx
push edx
mov ebp, dword [ebp + eax - 0x100ff]
pop edx
jmp fcn.10190646

Function at 0x10264028
Capabilities:
Encrypt data using aes
Reference aes constants
Terminate process

Disassembly:
mov dword [esp + ecx], ecx
xor edx, ebx
sal dword [esp + ecx], 0xbe
js 0x1025df47
inc edx
not edx
mov word [esp + ecx], ax
ror edx, 3
lea edx, [edx + ecx*8 - 0x7b0d1aaf]
sar ax, 0xb
sar ecx, 0xc2
bswap eax
ror edx, 1
and cx, ax
cmovne cx, word [esp + ecx*4 + 2]
lea ecx, [ecx + eax - 0x5d99ad4]
xor ebx, edx
add ebp, edx
btc eax, 0x17
sbb dword [esp], ecx
pop eax
jge fcn.1022ca3e
Function at 0x10264561
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov edx, ecx
push ecx
xor eax, ebx
or dx, 0x685
bswap eax
neg eax
and byte [esp + 2], 0x99
sub ecx, edx
shl word [esp + 2], 0x86
ror eax, 3
inc eax
xor ebx, eax
and byte [esp + 1], 0xa2
adc ebp, eax
rol dx, 0xad
pop ecx
add ecx, ebp
jmp ecx
lea ecx, [edx + edx - 0x17f2d9f7]
call fcn.101b66f6
lea ecx, [eax + ecx - 0x3cce1e83]
push eax
not dword [esp + edx + 0xc]
adc dl, byte [esp + eax - 0xc94d0c8]
xor ebx, ecx
div eax
add esi, ecx
mov ecx, 0xb9399691
mov dword [esp + eax*2 - 0x5e2], esi
ret 0x10
mov dword [edx + eax*8], ecx
lea edx, [eax + eax*4 - 0x5b478d43]
btc edx, edx
mov ecx, dword [eax + edi]
lea edi, [eax + edi + 4]
add dword [esp + eax + 0xc], eax
adc dword [esp + eax + 0xb], 0x5b0a6001
xor ecx, ebx
shr dword [esp + eax*2 + 9], 0xc2
lea eax, [edx*4 - 0x64d875a]
not ecx
neg ecx
sub ax, dx
shr edx, 0x9e
rol ecx, 1
btc ax, dx
bswap ecx
jb 0x10263f75
xor ecx, ebx
lea edx, [eax*8 + 0x7b971b83]
bts eax, eax
bswap ecx
mul dx
rol ecx, 3
lea eax, [eax*2 + 0x660d0cb1]
sub ecx, 0x9130371a
xor eax, edx
rol ecx, 1
rol eax, 0x86
neg ecx
inc ecx
add al, ah
neg ecx
shr edx, 0x86
shr ax, 0x88
push eax
xor ebx, ecx
add esi, ecx
mul dword [esp + eax*8 - 0x78f804a8]
movzx ax, byte [edi + edx*8 - 0x7252e90]
jo 0x1024bc29
mov eax, 0xac89de36
mov edx, dword [edi]
mov ecx, 0xfd87e5b6
sal cx, 0x4e
neg ecx
mov ax, word [edi + ecx*2 - 0x4f0fffc]
and cx, 0x8bbd
lea edi, [edi + ecx*2 - 0x4f0fffa]
imul ecx, ecx
mov word [edx + ecx - 0x40000000], ax
neg ecx
lea eax, [ecx + ecx*4 + 0xf15a004]
sbb esi, 3
shl al, 0x86
mov eax, dword [esi]
jb 0x102327df
Function at 0x10264689
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov eax, dword [edx + eax*2 - 0x20000]
lea ecx, [ecx*8 - 0x62496a76]
sbb ebp, 4
push ecx
sub ecx, 0x92803332
pop edx
mov dword [ecx + ebp - 0xb353920], eax
mov eax, 0x49b3e30e
pop ecx
adc dword [esp + ecx - 0x3f0fdbbc], ecx
pop ecx
js fcn.10190646
xadd edx, ecx
ror byte [esp + ecx - 0x6600b33c], cl
not eax
dec word [esp + ecx - 0x6600b336]
inc eax
call fcn.101e6333
mov ecx, dword [esi]
mov edx, 0x808f8a1b
neg edx
mov eax, edx
mov eax, dword [esi + edx - 0x7f7075e1]
lea esi, [esi + edx - 0x7f7075e1]
bts edx, edx
not dx
add ecx, eax
mov dword [esi + edx - 0x7f708a1a], ecx
lea ecx, [edx + edx + 0x7682618e]
lea edi, [edi + ecx - 0x756375c6]
xadd cx, dx
push ecx
mov edx, dword [ecx + edi - 0x7563ffdc]
xor edx, ebx
movsx eax, cx
neg ecx
sete cl
inc edx
sar al, 0xa3
lea ecx, [eax*2 + 0x6511ea9c]
or al, 0xb9
xor edx, 0xefbee389
shr ecx, cl
push eax
not edx
sub eax, 0xf025d511
sbb eax, eax
dec edx
not edx
shl word [esp + ecx*2 - 0x3284], 0xab
inc edx
or al, byte [esp + ecx*4 - 0x650d]
xor ebx, edx
xor ecx, dword [esp + ecx - 0x1943]
cwde
adc ebp, edx
mov dword [esp + ecx*2 - 0x1ffcd76], ebp
ret 4
mov dword [esp + ecx*4 - 0x90], 0x3f0fdbbc
sub dl, 0x94
mov dword [esp + ecx*4 - 0x94], ecx
not ecx
neg dl
sub dl, 0xbe
pop eax
shl dword [esp + eax*4 - 0x90], cl
xor bl, dl
sub ax, ax
xadd cl, ch
idiv byte [esp + eax*4 + 2]
lea edx, [esp + edx + 8]
btc eax, 0x10
jae 0x101e0d16
sub eax, 0xbeb011ae
mov edx, dword [esp + ecx*8 + 2]
xadd dl, dh
not eax
push ecx
push edx
xor eax, 0x6f391012
jmp 0x1022f40f

Function at 0x10265df5
Capabilities:
Encrypt data using aes
Reference aes constants
Terminate process

Disassembly:
and cx, cx
rol ecx, cl
not edx
sal cl, 0x42
bts cx, cx
sbb cx, cx
not eax
and edx, eax
bswap ecx
movsx eax, cl
mov dword [esi], edx
cwde
rol cx, cl
sbb edi, 4
sal cl, 0x41
btc ax, cx
bt ecx, 0x2a
mov ecx, dword [edi]
movsx edx, ax
shr edx, 0x1f
xor ecx, ebx
call fcn.101e1bb9
ror edx, 3
bswap edx
not ecx
pop ecx
movsx ecx, word [esp + eax - 0x120a]
lea edx, [edx + eax*2 + 0x25aa86fd]
shr cl, 0x46
sar word [esp + eax*8 - 0x908f], 7
not cl
bswap edx
xor ebx, edx
neg cx
add ebp, edx
lea ecx, [esp + eax - 0x11da]
lea eax, [eax*8 + 0x138c81b2]
mov edx, eax
movzx dx, byte [ecx + eax*2 - 0x271a2484]
xchg word [esp + eax*4 - 0x4e344903], ax
not eax
neg byte [esp + 6]
mov word [edi - 4], dx
pop ecx
lea edi, [edi + ecx - 0x5effdb56]
movzx edx, word [esp + ecx - 0x5effdb4e]
pop edx
pop edx
jle fcn.10187551
movsx eax, dl
mov ecx, edx
mov ecx, dword [eax + ebp - 0x3a]
or eax, edx
xor edx, 0x2a800098
xor ecx, ebx
div eax
and edx, eax
lea ecx, [ecx + edx*2 + 0xe0db2b0]
rol edx, 8
jp 0x10259106
call fcn.102156f9
Function at 0x1026821a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
neg edx
xor eax, ebx
bts ecx, 0xa2
and ecx, 0xeeba1994
not eax
dec edx
xor edx, edx
call fcn.1021e92f
shr eax, 8
clc
movzx eax, al
clc
cmp bl, 9
shl edx, 8
test cx, dx
movzx eax, byte [eax + 0x100fdc48]
xor edx, eax
movzx eax, cl
mov ecx, dword [edi - 0x38]
shl edx, 8
clc
movzx eax, byte [eax + 0x100fdc48]
jmp loc.100a97b3
lea edx, [ecx + ecx*4 + 0x4304cc8f]
ja 0x1018817a
lea edi, [edi + ecx*2 - 0x15013e]
xor edx, 0x363950be
mov dword [esp + ecx*2 - 0x150140], 0xcd009e11
btc edx, edx
xor ax, bx
bts ecx, 0xb5
jb 0x1024d4c9
call fcn.101908fc
mov eax, 0x62a00815
mov edx, dword [eax + esi - 0x62a00815]
movsx ecx, al
shl cx, 0xea
sets cl
mov ax, word [esi + eax - 0x62a00811]
lea esi, [esi + ecx*8 - 0x29ffa]
shr cx, 0x2c
or ecx, 0x2f7896
mov word [edx + ecx*4 - 0xbde25c], ax
sal cl, 0xa1
lea ebp, [ecx + ebp - 0x2f7832]
movsx edx, cx
call fcn.101acb08
xor ebx, ecx
mul edx
btr dx, 0x99
cdq
adc esi, ecx
btr edx, 0x3f
add eax, esi
jmp eax

Function at 0x10269e29
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esi + ecx*8 - 0x40808], eax
xchg dword [esp + ecx*2 - 0x101fe], edx
mov dword [esp + edx - 0x1a0bbb81], ebp
ret 4
inc edx
mov dword [esp + edx*8 - 0xcf7ff40], edx
add eax, ecx
rol edx, 0xe7
movzx ecx, word [esp + 3]
jae 0x101b3194
sub edi, 4
mov eax, 0x49091802
lea edx, [eax - 0x67d02548]
mov ecx, 0x18198b9d
mov ecx, dword [eax + edi - 0x49091802]
xor ecx, ebx
shr ax, 0x27
not ecx
xadd dl, dh
sbb ecx, 0xbe8d409f
push edx
shl al, 0x23
xor ecx, 0x4b262b2e
cwd
add eax, edx
jl 0x102675cb
dec ecx
cwd
cwde
neg dx
neg ecx
ror edx, 0x7a
xadd edx, eax
dec ecx
xor ebx, ecx
bt edx, eax
bt dx, ax
adc ebp, ecx
mov esi, dword [edx + esi - 0x4e0000b8]
movzx ecx, ax
sub ecx, ecx
pop eax
jbe fcn.1022ca3e
mov ecx, 0x4e9795a3
shr ecx, 0xce
lea edi, [edi + ecx - 0x13a62]
mov edx, dword [edi + ecx*8 - 0x9d2f0]
xor edx, ebx
rol ecx, cl
rol edx, 1
sub edx, 0x41194ae
xor cx, cx
movsx eax, cx
bswap edx
ror eax, 0xc4
rol edx, 3
dec edx
shl cx, 0xe4
xor ebx, edx
add ebp, edx
mov dx, word [esi + ecx - 0x80000000]
or eax, ecx
lea esi, [esi + eax - 0x7ffffffe]
sar eax, 0x13
sbb edi, 1
ror eax, 0x1a
xchg ecx, eax
inc cl
movzx eax, byte [edi + eax - 0x80000000]
neg cx
xchg ch, cl
xor al, bl
xor al, cl
neg ecx
shl cl, 0xe2
dec al
neg al
sub al, 0x93
or ecx, ecx
sar cx, 0xcb
jnp 0x1023eb8e
movzx edx, byte [ebp + ecx - 0xc003]
xor eax, ecx
shl ax, cl
call fcn.10257a31
rol al, 1
sub al, 0xbe
btc cx, 3
xor bl, al
not ecx
sar cl, 6
not cl
add eax, esp
mov word [eax], dx
mov edx, ecx
rol dx, 0xa5
jmp ebp
add ebp, ecx
cwde
xor eax, dword [esi + edx - 0x67b9fff]
mov ecx, dword [esi + edx - 0x67b9ffb]
xadd dl, dh
shr edx, 0x62
lea esi, [esi + edx - 0x19effe3]
jbe 0x101b3be5
Function at 0x1026ad95
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor dl, bl
add dl, 0x12
push eax
pop eax
rol dl, 1
mov ecx, dword [esp + eax*8 - 0x330]
sub eax, dword [esp + eax*2 - 0xc6]
not dl
neg dl
or ecx, 0x3792b32f
imul eax, eax
dec dword [esp + ecx - 0x37fab7fe]
xor dl, cl
pop ecx
sar eax, cl
xor bl, dl
neg eax
lea edx, [esp + edx + 8]
mov ecx, dword [edx + eax - 0x2d3bde]
lea esi, [esi + eax*4 - 0xb4ef7c]
mov dword [esi + eax*2 - 0x5a77bc], ecx
pop edx
pop edx
jne fcn.1022ca3e
mov dword [esp + 4], 0xd12a6829
add byte [esp + 6], dh
xor ecx, ebx
sub edx, edx
shr word [esp + edx*4 + 6], 1
mov dword [esp + edx], 0x4bb42c17
not ecx
dec ecx
neg ecx
xchg byte [esp + edx + 7], dl
mov eax, edx
xor ecx, 0x3e94dc89
push eax
xor ebx, ecx
dec ax
add ebp, ecx
shr byte [esp + edx*2 - 0xcf], 1
neg dword [esp + edx*2 - 0xca]
btc edx, edx
lea edi, [edx + edi - 0x169]
movzx edx, byte [edi + edx*4 - 0x5a0]
jae 0x1022542a

Function at 0x1026afa3
Capabilities:
Read file on windows
Terminate process

Disassembly:
shr ecx, 0x7a
adc dl, 0x91
sar eax, 0x78
ror dl, 1
xadd al, ch
xchg dword [esp + ecx*4 - 0x8f], eax
not dl
mov dword [esp + ecx - 0x26], eax
dec dl
shl eax, 0x91
xor bl, dl
and ecx, dword [esp + ecx - 0x1a]
inc al
lea ebp, [ecx + ebp - 2]
shl eax, 0xcb
sar eax, 0xe1
mov word [ebp + ecx*2], dx
js 0x1022be0b
pop eax
pop ecx
pop ecx
pop ecx
jno fcn.1018699d

Function at 0x1026ba05
Capabilities:
Read file on windows
Terminate process

Disassembly:
rol edx, 1
add dword [esp + eax - 0x203ffff3], 0x3d0132b4
sbb cx, ax
lea edx, [edx + eax*8 - 0xc72f9ee]
xor ax, cx
shl eax, cl
ror dword [esp + ecx - 0x2535810], cl
not edx
xor ebx, edx
lea ebp, [ecx + ebp - 0x2535821]
add eax, 0xae0e5c11
shl cx, 0x2c
mov dword [ebp + eax - 0x4e0e5c11], edx
pop ecx
pop edx
pop edx
pop eax
pop ecx
js fcn.10190646