joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d7f4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
add eax, 8
shr edx, 4
mov ebx, dword [ebp - 4]
xor dword [eax], ebx
mov ebx, dword [ebp - 8]
xor dword [eax + 4], ebx
mov ebx, dword [ebp - 4]
xor dword [eax + 0x20], ebx
mov ebx, dword [ebp - 8]
xor dword [eax - 8], esi
xor dword [eax - 4], edi
xor dword [eax + 0x18], esi
xor dword [eax + 0x1c], edi
xor dword [eax + 0x24], ebx
add eax, 0x40
dec edx
jne 0x101d81b
mov ebx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
add ebx, 0xfffffff4
cmp ebx, 4
jb 0x101d884
mov eax, dword [ebp + 8]
add ebx, 0xc
add eax, 0x18
shr ebx, 4
xor dword [eax - 8], edx
xor dword [eax - 4], esi
xor dword [eax], edi
xor dword [eax + 4], ecx
xor dword [eax + 0x18], edx
xor dword [eax + 0x1c], esi
xor dword [eax + 0x20], edi
xor dword [eax + 0x24], ecx
add eax, 0x40
dec ebx
jne 0x101d867
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101ddee
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x101de0c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x101de03
pop esi
pop ebp
ret 0xc
Function at 0x101de60
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x28]
sub al, 2
push ebx
mov ebx, dword [ebp + 0x10]
and al, 0xfe
mov cl, 0xe
shl al, 2
sub cl, bl
push esi
mov esi, dword [ebp + 0xc]
or al, cl
cmp dword [ebp + 0x18], 0
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0x14], al
jbe 0x101dea2
or al, 0x40
mov byte [ebp - 0x14], al
push ebx
lea eax, [ebp - 0x13]
push esi
push eax
call sub.msvcrt.dll_memmove
mov ecx, dword [ebp + 0x20]
add esp, 0xc
push 0xf
pop eax
cmp ebx, eax
jae 0x101dec6
mov byte [ebp + eax - 0x14], cl
shr ecx, 8
dec eax
cmp eax, ebx
ja 0x101deba
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.01022d90
mov edx, dword [ebp + 0x18]
test edx, edx
jbe 0x101df3a
xor ecx, ecx
push 2
pop esi
cmp edx, 0xff00
jb 0x101def3
not byte [ebp - 0x14]
xor byte [ebp - 0x13], 0xfe
push 4
mov ecx, esi
pop esi
lea eax, [esi - 1]
test eax, eax
jl 0x101df07
lea ebx, [ebp + ecx - 0x14]
xor byte [ebx + eax], dl
shr edx, 8
dec eax
jns 0x101defe
add ecx, esi
mov esi, dword [ebp + 0x14]
cmp ecx, 0x10
jne 0x101df20
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.01022d90
xor ecx, ecx
mov al, byte [esi]
xor byte [ebp + ecx - 0x14], al
inc ecx
inc esi
dec dword [ebp + 0x18]
jne 0x101df0c
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.01022d90
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
cmp ebx, 0x10
jb 0x101df76
shr ebx, 4
mov eax, dword [esi]
xor dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
xor dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
xor dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
xor dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.01022d90
sub dword [ebp + 0x20], 0x10
add esi, 0x10
dec ebx
jne 0x101df48
cmp dword [ebp + 0x20], 0
jbe 0x101df96
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0101ddee
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.01022d90
push dword [ebp + 0x28]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.msvcrt.dll_memmove
add esp, 0xc
push 0x10
pop ecx
pop edi
pop esi
lea eax, [ebp - 0x14]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x101dfb1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01010238
leave
ret 0x24
Function at 0x101e7bb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20
pop edi
push edi
call fcn.0101b62c
mov esi, eax
test esi, esi
jl 0x101e87d
push 1
push dword [ebp + 8]
call fcn.0101c113
mov esi, eax
test esi, esi
jl 0x101e87d
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0101c09f
mov esi, eax
test esi, esi
jl 0x101e87d
cmp word [ebp + 0x10], di
je 0x101e81d
mov esi, 0xc000000d
jmp 0x101e87d
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.msvcrt.dll_memmove
add esp, 0xc
push 1
push dword [ebp + 0xc]
call fcn.0101c113
mov esi, eax
test esi, esi
jl 0x101e87d
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0101c09f
mov esi, eax
test esi, esi
jl 0x101e87d
cmp word [ebp + 0x10], di
jne 0x101e816
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, edi
jb 0x101e85a
push ebx
push edi
push dword [ebp - 4]
push 0x2000
call fcn.0101cc10
mov esi, eax
cmp dword [ebp - 4], 0
je 0x101e88c
push edi
push dword [ebp - 4]
call fcn.0101b738
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x101f123
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
not eax
cmp dword [ebp + 0x10], ecx
jbe 0x101f153
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x1004b38]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x101f134
not eax
pop ebp
ret 0xc
Function at 0x101f15e
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb4]
push eax
call fcn.01023880
push 0x40
lea eax, [ebp - 0x58]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0x14], 0x40
push dword [ebp + 0x14]
push esi
jbe 0x101f1d1
lea eax, [ebp - 0xb4]
push eax
call fcn.01023940
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.01023a50
jmp 0x101f1dd
lea eax, [ebp - 0x58]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
xor byte [ebp + eax - 0x58], 0x36
inc eax
cmp eax, 0x40
jb 0x101f1df
push 0x40
pop esi
push esi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.01023940
push dword [ebp + 0xc]
lea eax, [ebp - 0xb4]
push edi
push eax
call fcn.01023940
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.01023a50
xor eax, eax
xor byte [ebp + eax - 0x58], 0x6a
inc eax
cmp eax, esi
jb 0x101f220
push esi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.01023940
push 0x14
pop edi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.01023940
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.01023a50
mov eax, dword [ebp + 0x1c]
cmp eax, edi
jbe 0x101f268
mov eax, edi
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x5c
pop ecx
lea eax, [ebp - 0xb4]
mov byte [eax], 0
inc eax
dec ecx
jne 0x101f27f
mov ecx, edi
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
dec ecx
jne 0x101f28b
pop edi
mov ecx, esi
pop esi
lea eax, [ebp - 0x58]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x101f29a
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.01010238
leave
ret 0x18
Function at 0x1022010
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x1022c50
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
mov dword [ebp - 0x50], eax
cmp edi, 8
ja 0x1022c85
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.01023b00
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.01022b40
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.01023b00
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, 0x40
add esi, 0x28
mov byte [esi], 0
inc esi
sub eax, 1
jne 0x1022d26
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
mov esp, ebp
pop ebp
ret 8
Function at 0x1023880
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10269ec], 0
push ebx
jne 0x10238fd
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x10238f1
cmp dword [ebp - 8], 0x660
jae 0x10238f1
xor eax, eax
mov eax, dword [eax*4 + 0x10265d0]
mov dword [0x10269ec], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x180884a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x18018c0
call fcn.01808a24
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1808885
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1808885
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x180889d
cmp eax, 0x20b
je 0x180888a
mov dword [ebp - 0x1c], edi
jmp 0x18088b1
cmp dword [ecx + 0x84], 0xe
jbe 0x1808885
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x18088ab
cmp dword [ecx + 0x74], 0xe
jbe 0x1808885
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1817a10], 0xffffffff
or dword [0x1817a14], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1812b70]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1812b6c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1817a18], eax
call fcn.01808aa4
cmp dword [0x18122f0], edi
jne 0x180890c
push fcn.01808aa4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01808a8d
push 0x180a010
push 0x180a00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1812b68]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1812b64]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x180a008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.018063b5
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1808983
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x18089b8
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01808a5f
ret

Function at 0x566d20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa2000]
push edi
or ebp, 0xffffffff
jmp 0x566d42
Function at 0x10164145
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x101640a5
pushfd
jmp 0x101600fe
mov dword [esp], ecx
mov byte [esp], ch
mov dword [esp + 0x74], edi
lea esp, [esp + 0x74]
jmp 0x10164065
shr esi, 0xd
xchg esi, eax
push dword [esp + 0xc]
bsr cx, ax
call fcn.101640c5
cmp eax, 0x83e69f0c
in al, dx
sbb eax, 0xeec1e57f
or eax, 0x648d30eb
and al, 1
sub esp, 0x1d
jg 0x1016408f
shr esi, 0xd
jmp 0x101640df
jmp 0x101640c8
mov edi, dword [esp + 0x50]
call 0x101640eb
ror dword [ebx - 0x25], 0xbe
dec ebp
stc
imul ebp, esp, 0x73f40562
jns 0x10164137
xchg esi, eax
push dword [esp + 0xc]
bsr cx, ax
jmp 0x1016409c
dec ecx
call 0x76f3e348
not ebx
call 0x10164145
sub al, 0xf
mov dword [reloc.MSVCRT.dll___dllonexit], eax
in al, dx
jmp 0x10164176
Function at 0x1016fed7
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x101bfafc
push 0x1017b49c
push edi
call fcn.1018679d
in al, 0xeb
xor ch, byte [esi + 0x29dabf2f]
add esp, 0x40b1d640
bnd jge 0x101bfb64
fbld tbyte [esi]
push ecx
ror byte [ebp + 0x21012464], 1
lea esp, [esp + 1]
and edx, ecx
clc
stc
and al, 0x44

Function at 0x101806fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x88
mov ebp, esp
mov edx, 0x8f209398
mov al, byte [esp]
mov al, byte [esp + 3]
lea edx, [eax + ebp]
jmp 0x101806ca

Function at 0x101beb78
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp + 0xc], eax
jmp 0x101beba9
lea ebp, [ebp + 0xe]
movzx esi, byte [ebp]
pop ebp
jmp 0x101bebc8
lea esp, [esp + 4]
popal
jmp 0x101beb7e

Function at 0x101bee00
Capabilities:
Encrypt data using aes

Disassembly:
not bh
xor edx, eax
jmp 0x101bee0a
sub esp, 0x12
setbe ah
lea esp, [esp + 2]
jmp 0x101bee2e

Function at 0x101bef5f
Capabilities:
Encrypt data using aes

Disassembly:
and edi, esi
sub esp, 0x19
push eax
jmp 0x101bef79
stc
clc
call 0x101bef5f
dec eax
lea esp, [esp + 4]
and edi, 0xff000000
jmp 0x101befbb
lea esp, [esp + 1]
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
lea esp, [esp + 0x30]
and ecx, 0xff0000
jmp 0x101bef57
mov esi, 0x12b2ee24
mov dword [esp], edx
popal
and edx, esi
jmp 0x101befea
movzx edi, byte [edi*4 + 0x10179c64]
xor ecx, edi
mov edi, dword [esp]
jmp 0x101befc6
xor ecx, edi
btr di, dx
pushal
mov cl, 0xb6
jmp 0x101bef90
and edx, ebp
lea edi, [esi*4]
xor ecx, edx
lea edi, [eax - 0x80]
jmp 0x101beffe
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
sub esp, 0xa
pop word [esp + 1]
shr edi, 0x18
jmp 0x101bef9d
lahf
dec dl
not dx
lea esp, [esp + 8]
xor ecx, dword [ebx]
mov edx, dword [esp]
call fcn.101bf15c
clc
jns 0x101beffd
mov byte [ebx - 0x66], bh
fdivr dword [ebx]
adc cl, byte [ebp + 0x35442464]
add byte [eax], al
add byte [ecx], al

Function at 0x101bf044
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
not dx
jmp 0x101bf05c
jmp 0x101bf02e
add ebx, 4
rcl dl, cl
jmp 0x101bf068
lea esp, [esp + 4]
xor ecx, dword [eax]
mov edx, dword [esp]
cmc
jmp 0x101bf046
mov dword [edi], ecx
not dx
jmp 0x101bf115
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
stc
sub esp, 0x14
jmp 0x101bf096
mov edx, dword [eax + 4]
xor edx, ecx
mov cl, 0xc3
jmp 0x101bf0ba
Function at 0x101bf15c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xd
lea esp, [esp + 1]
lea esp, [esp + 0x10]
lea edi, [eax + 0x10]
not edx
call fcn.101bf044
xor ecx, edx
mov dl, byte [esp]
mov edx, 0xcbd43d7
mov dl, 0x37
mov dword [eax + 0x18], ecx
jmp 0x101bf0df
mov dl, bh
mov edx, dword [eax + 0xc]
cmc
call fcn.101bf0c6
pushfd
mov dword [eax + 0x1c], edx
cmc
pushal
sub esp, 4
jmp 0x101bf0f9
lea esp, [esp + 0x40]
cmp ebx, 0x1017b48c
pushfd
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x101bf134
lea esp, [esp + 4]
push 0xa
lea esi, [esp + ecx]
mov bp, word [esp]
jmp 0x101bf186
lea esp, [esp + 4]
jne 0x101be89e
lea edi, reloc.MSVCRT.dll___dllonexit
mov si, 0xeb9c
pushfd
jmp 0x101bf11e
jmp 0x101bf081
lea eax, [esp - 0x3c]
mov eax, dword [esp]
call fcn.101bf161
pop esi
mov bx, word [esp]
lea ebx, [esi*4]
mov bx, 0x8826
lea ebx, [esi + edi]
jmp 0x101bf33b
pop ebp
call 0x101bf259
mov al, 0x5f
bts eax, esi
jmp 0x101bf8e7
mov ebp, edx
mov eax, dword [ebp]
pop ebp
jmp 0x101bf406
sub esp, 0
mov dword [ecx - 4], eax
push ebp
jmp 0x101bf387
push eax
jmp 0x101bf3dd
clc
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x101bf3a6
mov edi, dword [ecx]
pushal
mov dword [ecx], eax
mov eax, dword [edx + 4]
jmp 0x101bf3bc
mov eax, edx
mov dword [eax], edi
pop eax
mov edi, dword [ecx + 4]
jmp 0x101bf3eb
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
jmp 0x101bf415
mov dword [edx - 4], edi
bsr edi, esp
mov di, cx
mov di, 0x6a14
jmp 0x101bf3d3
lea esp, [esp + 0x2c]
sub ebx, 4
pushal
lea esp, [esp + 0x20]
jmp 0x101bf427
add ecx, 0x10
jmp 0x101bf5bd
add eax, 0xfffffff8
mov dword [eax], edi
pop eax
neg edi
mov edi, dword [ecx - 4]
jmp 0x101bf39d
mov eax, dword [ebp - 8]
jmp 0x1016fc15
sub edx, 0x10
cmp dword [ebp - 4], ebx
jl 0x1016fbff
jge 0x101bf467
pushal
mov bp, 0xc2db
not ah
mov dword [esp + 0x1c], edx
popal
jmp 0x101bf43f
mov eax, dword [edx - 4]
pushfd
push eax
jmp 0x101bf789

Function at 0x101bf161
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 8]
pop edi
jmp 0x101bf16c
lea ebx, reloc.MSVCRT.dll___dllonexit
mov si, word [esp]
lea esi, [eax + 0xb7]
jmp 0x101bf192
Function at 0x101bf2eb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
setnp al
mov ax, word [esp]
jmp 0x101bf2bc
pushal
lea esp, [esp + 0x20]
cmp eax, 1
jmp 0x1016fc23
jle 0x1016fc81
lea ebx, [edx + ebp]
mov edx, 0xf51d4e94
setp bl
btc ebx, eax
jmp 0x101bf451
pop edi
jmp 0x1016fc88
pop esi
push edx
xchg dword [esp], ebx
xchg byte [esp], bh
jmp 0x101bfaf5
mov bx, 0xffe3
mov bl, al
pushal
jmp 0x101bf4cb
lea esp, [esp + 4]
jmp 0x101bf211
push edi
mov si, dx
mov esi, dword [esp]
pushal
jmp 0x101bf235
mov esi, ecx
lea esp, [esp + 0x20]
call fcn.101904d7
mov ebx, 0xe34e90
jmp 0x101bf2a7
shl ebx, 2
jmp 0x101bf284
mov ebx, eax
sub esp, 0xe
push dword [esp + 3]
lea esp, [esp + 2]
jmp 0x101bf25f
mov dword [ebp - 8], eax
lea esp, [esp + 0x10]
test ebx, ebx
jmp 0x101bf305
lea edx, [esi + ebx*4 + 8]
jmp 0x101bf2d6
lea ebx, reloc.MSVCRT.dll___dllonexit
and dword [ebp - 4], 0
lea ebx, [ebx + edi]
not bx
mov ebx, dword [esp]
jmp 0x101bf275
push ebx
mov ebx, edx
add ebx, 0xfffffff8
jmp 0x101bf2de
lea ecx, [esi + 8]
jmp 0x1016fbff
mov eax, dword [ebx]
pop ebx
mov edi, dword [ecx - 8]
push esi
call 0x101bf2eb
les ecx, [ecx + 0x2aeb2424]
jae 0x101bf2ed
and al, 0xeb
sub dh, byte [ebx - 5]
imul ecx, dword [esi], reloc.MSVCRT.dll___dllonexit
dec esp
pop ebx
fdiv qword [edx + 0x15]
in al, 0x52
scasd eax, dword es:[edi]
sub dword [ecx - reloc.MSVCRT.dll___dllonexit], edi
imul eax, dword [edx + reloc.MSVCRT.dll___dllonexit], 0xfffffffb
jmp dword [esi - 0x79]
jle 0x1016fc15
xchg di, dx
mov dl, 0xda
not edx
setnp al
jmp 0x101bf28f
lea ecx, [eax - 1]
setl bl
lea edi, reloc.MSVCRT.dll___dllonexit
jmp 0x101bf4a2
mov ecx, 0xe6b4d79c
jmp 0x101bf533
lea ebx, [edi*4]
not edx
jmp 0x101bf46f
lea edi, [ebp*4]
mov bx, word [esp]
mov dword [ebp - 4], ecx
cmc
xchg ecx, edi
jmp 0x101bf485
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
bswap edx
jmp 0x101bf4f7
movzx ebx, byte [esi + 0x11]
push di
mov di, 0x4fe6
mov di, 0x8088
not edx
lea esp, [esp + 2]
jmp 0x101bf4b5
mov ebp, esi
mov edx, dword [ebp]
pop ebp
call fcn.101bf517
int 0x48
fidivr word [ecx - 0x6b9a30b8]
pop es
scasb al, byte es:[edi]
mov ecx, 0x2024648d
lea esp, [esp + 0x20]
add esi, 0x10
push ebp
jmp 0x101bf4e1
add ecx, 0x194b2963
jmp 0x1016fcb8
lea esp, [esp + 4]
pop ebx
leave
ret

Function at 0x101bf702
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
jmp 0x101bf74e
add esp, 3
lea esp, [esp + 1]
jmp 0x101bf6ec

Function at 0x101bf737
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], esi
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
sub esp, 0x14
call fcn.101bf6aa
movzx ebx, byte [esi + 6]
call 0x101bf737
sub eax, 0x649d1c8b
pushfd
pop ss
adc byte [esi - 0x14dbf377], bl
pop ds
cmp dword [esi + reloc.MSVCRT.dll___dllonexit], edi
setbe byte [ecx]
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
bsf ebx, esp
mov ebx, dword [esp]
bsr ebx, esp
jmp 0x101bf72d
Function at 0x101bf8c8
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x101bf8f1
sub esp, 0x19
stc
lea esp, [esp + 1]
jmp 0x101bf940
mov word [esp + 1], dx
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
pushfd
and ebx, ecx
jmp 0x101bf8ca
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
movzx ebx, byte [esi + 0xd]
jmp 0x101bf92a

Function at 0x101bf9d8
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 2
lea esp, [esp + 2]
jmp 0x101bfa11
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
stc
cmc
and edi, ecx
call fcn.101bf9fb
loope 0x101bfa89
hlt
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
stc
sub esp, 0x10
pushfd
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x101bfaa3
and edx, ecx
jmp 0x101bfa62
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
clc
sub esp, 0x17
lea esp, [esp + 0x16]
jmp fcn.101bfb1c
and ebx, ecx
clc
clc
lea esp, [esp + 0x34]
jmp 0x101bfa8d

Function at 0x101bf9fb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x101bfa51
pushal
jmp 0x101bfb62
mov dword [esp], esi
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
sub esp, 0x1c
jmp 0x101bfa3b
movzx ebx, byte [esi + 0xe]
call fcn.101bfa82
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
xchg bh, bl
ror bx, cl
jmp 0x101bfac2

Function at 0x10506230
Capabilities:
Parse pe header

Disassembly:
call fcn.10506010
mov dword [esp + 2], ebx
mov dword [esp + 0x10], edi
jmp 0x10506253
lea esp, [esp + 0x10]
jmp 0x10506284
push ebp
jmp 0x105062c8
mov eax, dword fs:[0x30]
jmp 0x1050626e
push ebx
jmp 0x10506319
mov ebp, eax
lea ebp, [ebp + 0xc]
mov eax, dword [ebp]
pop ebp
jmp 0x105062b2
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1050600b
mov ebx, eax
lea ebx, [ebx + 0x1c]
mov eax, dword [ebx]
pop ebx
jmp 0x105062e9