joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100450fb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1003b9bf
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1003b9bf
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10045172
cmp word [ecx], dx
je 0x10045172
mov eax, dword [0x1005318c]
push edi
dec eax
push eax
push 0x10053078
call fcn.1004509a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100451e5
cmp word [eax], dx
je 0x100451e5
mov eax, dword [edi]
test eax, eax
je 0x10045196
cmp word [eax], dx
je 0x10045196
lea eax, [ebp - 0x10]
push eax
call fcn.10044a7d
jmp 0x1004519f
lea eax, [ebp - 0x10]
push eax
call fcn.10044b18
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1004520f
mov eax, dword [0x10053074]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10052d68
call fcn.1004509a
add esp, 0xc
test al, al
je 0x1004520f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100451da
cmp word [eax], di
je 0x100451da
lea eax, [ebp - 0x10]
push eax
call fcn.10044a7d
pop ecx
jmp 0x10045211
lea eax, [ebp - 0x10]
push eax
call fcn.10044b18
jmp 0x100451d7
mov eax, dword [edi]
test eax, eax
je 0x100451fc
cmp word [eax], dx
je 0x100451fc
lea eax, [ebp - 0x10]
push eax
call fcn.10044a32
pop ecx
jmp 0x1004520f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100452da
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10044f1f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100452da
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100452da
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100452da
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10045267
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1003a4a9
test ebx, ebx
je 0x100452d5
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1003a4a9
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100452da
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100452da
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10039536
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100452dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029cb8
leave
ret
Function at 0x10097603
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap edx
not ax
push edx
and cx, ax
mov dword [esp + 4], edx
mov word [edi + 2], cx
jmp 0x100d0957
shl word [esp + 2], 6
ror dword [esp + 4], 0xb0
movzx eax, byte [esi + 4]
jb 0x100e69bf
xor bl, dl
movzx eax, cx
lea edx, [esp + edx + 8]
call fcn.100b7eb5
movsx ecx, dx
add esi, 5
ror edx, cl
sbb cx, word [esp + edx - 0x3f36ef05]
or edx, 0xef89e638
xor al, bl
jmp 0x100fd182

Function at 0x1009eee9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edx
ror edx, 1
xor ebx, edx
shr ax, 0xe9
adc ebp, edx
movsx edx, al
shr dl, 0xc1
pop ecx
pop eax
jns fcn.100c3c87
cmp eax, 0x1f
jmp 0x100bcaf1
mov dword [ebp - 0x108], 0x3c003b
mov dword [ebp - 0x104], 0x30004
jmp 0x100b2e5f
ja 0x101123b8
push edx
jmp 0x1012aa68
mov dword [ebp - 0x10c], 0xb002a
jmp 0x100abc80
push ecx
call fcn.10029cc6
add esp, 8
cbw
lea eax, [ebp - 0xc4]
bswap ecx
mov ecx, edx
not cx
mov dword [ebp - 0x110], 0x12
cmovp ecx, ebx
seta cl
xchg ecx, ecx
push eax
movsx ecx, bx
lea ecx, [ebp - 0x110]
jmp 0x100d3e46

Function at 0x1009fd36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edx, 0x9d994b86
inc eax
xor eax, 0x14357cae
bswap eax
or cx, 0xba8b
and cl, 0x8d
sbb eax, 0x75bf2291
and edx, 0xf3bf4b36
dec cl
ror eax, 1
xor ebx, eax
add ebp, eax
sar ecx, 0xa3
lea edx, [esp + edx - 0x117fffb4]
movzx eax, cl
mov ecx, dword [edx + eax - 0xd1]
add ax, 0x2a34
jge 0x10124545
add eax, ecx
mov edx, eax
mov ecx, 0x2a88d4b0
mov eax, dword [edx + ecx*2 - 0x5511a960]
mov dword [esp + ecx*2 - 0x5511a960], ecx
mov dword [esi + ecx*2 - 0x5511a95c], eax
movzx eax, word [esp + ecx - 0x2a88d4b0]
jmp 0x101006bc
dec ax
mov eax, dword [eax + edi - 0xd4af]
lea edx, [ecx*4 - 0x4a69d344]
and word [esp + ecx - 0x2a88d4b0], cx
lea edi, [edi + ecx - 0x2a88d4ac]
rol edx, 0xa6
xor eax, ebx
or word [esp + ecx - 0x2a88d4ae], dx
js 0x10104152
and ecx, edx
lea eax, [eax + ecx*2 - 0x67a997cd]
pop ecx
jb 0x1012b79d
sub cl, ch
xor eax, 0xcf37d005
not edx
jmp 0x1008e89b
sub dl, 0x39
and ecx, dword [esp + ecx - 0xbfffff8]
ja 0x100e2eec
jae 0x1011af6a
out dx, eax
out dx, eax
pop ebx
sbb dword [ebx + ebp*2 + 0x21cbf139], ebx
add esp, esp
imul edi, dword [ecx], 0xfffffff1
lodsd eax, dword [esi]
pop ebp
int1
lodsb al, byte [esi]
adc ah, byte [ebx + 0x64]
cwde
ljmp 0x4108
invalid
lea esi, [esi + ecx - 0x67844d3b]
push ecx
xor dl, bl
not cl
sal ecx, 0x9a
jne 0x1011aee4
movsx eax, cl
sub eax, ecx
ror dl, 1
sub eax, ecx
not dl
lea eax, [ecx + eax*4 - 0x4275caf7]
sub dl, 1
ror dl, 1
rol eax, 0xa6
rol ecx, 0x13
rol ecx, cl
xor bl, dl
add edx, esp
bswap eax
dec eax
movzx cx, byte [edx + ecx*2 - 0x4d97c7ae]
lea edx, [eax + eax - 0x8fa43fa]
dec dl
ror ax, 0x4b
mov word [esi + 2], cx
jns fcn.100ca302
shl edx, 0x82
call fcn.1009e4b6
Function at 0x100a1ae8
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jae 0x10100c8d
mov edx, 0x65a7a42e
mov ecx, 0xdc87c63f
lea edx, [edx + edx + 0x738a9d3f]
mov eax, dword [esi + edx*2 - 0x7db3cb36]
lea esi, [esi + edx - 0x3ed9e597]
add dx, cx
xor eax, ebx
dec ecx
lea ecx, [ecx + ecx*4 + 0x631e0f89]
rol eax, 3
xadd cl, dl
xor eax, 0x94806f92
jmp 0x10127ace
mov edx, dword [esi + ecx*2 - 0x5023450e]
mov dword [esp + ecx - 0x2811a287], ecx
xor dword [esp + ecx - 0x2811a287], 0xea8b0104
push ecx
lea esi, [esi + ecx*2 - 0x5023450a]
jp 0x1008e33f
and dword [esp + ecx - 0x2811a286], eax
xor edx, ebx
call fcn.100a8c77
adc ebp, eax
mov eax, edx
movzx eax, byte [esi + edx - 0x58eb01]
lea esi, [esi + edx*8 - 0x2c75807]
rol dl, 0x43
xor al, bl
jmp 0x10126b6d
mov byte [esp + eax - 0x88], al
lea edi, [edi + eax - 0x8f]
sar eax, 0x27
jb 0x1012ff52
xor word [esp + eax + 7], 0xb012
xor cl, bl
lea eax, [eax + eax*2 + 0x400c7394]
sub cl, 0x18
neg eax
ror cl, 1
or al, ah
ror word [esp + 8], 0x85
neg cl
sar byte [esp + 7], 0x22
dec cl
and word [esp + 8], ax
lea eax, [eax*2 + 0x680bd01f]
xor bl, cl
lea ecx, [esp + ecx + 0xc]
rol dword [esp], 0x6b
dec ax
mov dword [ecx], edx
pop ecx
pop ecx
pop eax
jmp ebp
shr cl, 0x24
rol eax, 1
shr dl, 0x62
bswap eax
shr ecx, cl
inc eax
or dx, cx
xchg ecx, edx
xadd cx, dx
rol eax, 3
rol ecx, 0x31
setb dl
xor ebx, eax
or cl, dl
jne 0x100c8ba9

Function at 0x100a42cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, 0x34
pop eax
and eax, 0x43a2992
dec eax
xor cl, 0x1a
inc cl
and eax, 0x7db11311
or eax, eax
xor cl, 0x93
sal ax, 0x23
add al, 0x35
xor bl, cl
add ecx, esp
mov byte [ecx + eax*8 - 0x8001e8], dl
sbb dh, bh
jg 0x100a4245
dec dword [edi]
mov dh, 0xc8
movzx ecx, al
mov eax, dword [edi + eax*2 - 0x200079]
movsx edx, cl
and ecx, 0x869eca96
add ecx, edx
xor eax, ebx
neg eax
dec dx
dec eax
call fcn.100a1b96
push 0xb070cf16
daa
int 0x40
rol dword [eax + ebp*8], cl
ja 0x100a4242
inc eax
rcr dword [esp + ebp*2 - 0x2cbf32e9], cl
movsb byte es:[edi], byte [esi]
sar byte [edi], 0xcd
inc eax
ror esp, cl
call 0x55307561
sub byte [esi - 0x30aa1bcc], 0xe9
jecxz 0x100a42cb
xor al, 1
imul edx, dword [edx + 0x602135f], 0x52
fsubr qword [edi + 0x5b0f9235]
xlatb
xor dword [ebp + eax - 0x5f], esp
or eax, 0x795b7a20
clc
invalid
push ds
pop esp
dec dword [ebp + 0x244c8b59]
pop ecx
mov ecx, dword [esp + 8]
or dx, ax
lea eax, [ecx + ecx*2 + 0x20269e35]
call 0x101117f3
jb 0x100c377d
invalid
invalid
push esp
invalid
rol ecx, 2
inc ecx
mov dword [esp + eax*2 - 0x156474de], 0xb5a94f1f
push edx
not eax
xor ebx, ecx
add ebp, ecx
call fcn.1011cbca
xor cl, 0x38
mov eax, 0x441b7215
pop eax
jmp 0x100a421c
Function at 0x100a8723
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esi + eax - 0xd960200], dx
mov ecx, dword [edi + eax - 0xd960200]
mov dword [esp + eax*2 - 0x1b2c03fc], eax
movzx edx, byte [esp + eax - 0xd9601fc]
lea edi, [edi + eax - 0xd9601fc]
xor ecx, ebx
lea ecx, [eax + ecx - 0xe089cc]
not byte [esp + eax - 0xd9601fa]
bswap eax
xchg dx, ax
neg ecx
call fcn.100f5e4b
lea edi, [edx + edi - 0x76b32ea5]
movsx ecx, dx
ror dx, 0x2e
jb 0x1010a59e
jmp 0x1011263a
dec edx
sbb ecx, 0x37a62383
jmp 0x10028826
neg eax
call fcn.100b3e03
mov edx, 0x6f02fd9b
shl dx, 0x25
lea ecx, [edx + edx*2 - 0x7469cfde]
mov eax, dword [edi + edx - 0x6f02b360]
add ecx, edx
mov edx, dword ss:[eax + edx - 0x6f02b360]
jge 0x101220f1
mov dword [ecx], eax
call fcn.1011c509
mov edx, 0xcc914ab3
add edx, edx
sar edx, 0x2b
mov ecx, dword [edi]
lea eax, [edx*2 + 0x55060a3f]
or edx, 0x6b90e11b
sub dl, ah
lea edi, [edi + eax - 0x54ec52df]
xor ecx, ebx
xadd edx, eax
xor ecx, 0x6214730a
xchg edx, eax
inc edx
neg ecx
ror edx, 0x61
xchg edx, eax
not ecx
jo 0x100f3e5e
xor eax, ebx
sal dl, 0x65
neg ecx
not eax
jno 0x100fce74
lea eax, [eax + edx + 0x44cd8385]
bswap ecx
not eax
lea edx, [ecx + edx*8 - 0x13cc12e9]
rol cl, 0x85
rol cx, 0xe9
rol eax, 1
jmp 0x100d68d2
movsx eax, cx
mov dword [edi + ecx - 0x47a0fda2], edx
mov eax, dword [esi + ecx - 0x47a0fda2]
lea edx, [ecx*4 - 0x6aca2a7d]
lea esi, [ecx + esi - 0x47a0fd9e]
rol ecx, 0x28
sal ecx, 0x17
xor eax, ebx
xor dx, cx
sar ecx, 0xc5
neg eax
jmp 0x100e216d

Function at 0x100b0a39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ecx
rol edx, 3
push ecx
mov dword [esp + ecx - 0x77fd], eax
shl ecx, 0xbb
xor edx, 0x94806f92
inc al
rol edx, 1
xchg word [esp + ecx - 0x8000000], ax
jmp 0x1012ca0c
add ebp, edx
movzx ecx, byte [esi + eax*2 - 0x10004a69]
xor cl, bl
sub ax, ax
movzx edx, al
rol edx, 0xd6
dec cl
not eax
sar dl, 6
sar al, 0x22
xor cl, 0xf
sal edx, 0x7f
neg cl
and dl, ah
xadd al, ah
xor cl, 0x3c
add edx, edx
not edx
sar edx, 3
xor bl, cl
add ecx, esp
lea edx, [eax + edx*8 + 0x3d235c00]
shr edx, 0xd3
inc eax
mov ax, word [ecx + edx - 0x6a4]
mov word [edi + edx - 0x6a4], ax
sar dl, 0xa7
mov edx, dword [edi + edx*2 - 0xdfe]
mov eax, 0xc6251a94
movzx ecx, ax
lea edi, [edi + ecx*2 - 0x3524]
call fcn.1012a938
call fcn.10135a5b
shl al, 2
bswap edx
pop eax
xor eax, ecx
inc edx
pop ecx
rol edx, 3
xor ebx, edx
not cl
jmp 0x10120eb3

Function at 0x100b2e1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je fcn.100b8444
mov dword [esp + edx*4 - 0x18], ebp
ret 0xc

Function at 0x100b3cd2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jae 0x100ea28f
pop ecx
pop edx
jp fcn.100c3c87

Function at 0x100b908a
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
sal cl, 0xe4
rol eax, 1
neg eax
mov dword [esp], ecx
ror eax, 1
neg ecx
pop ecx
lea eax, [eax + edx + 0x1c179d2b]
not eax
inc ecx
shl edx, cl
not edx
rol eax, 2
shr edx, cl
neg edx
inc eax
bswap ecx
ror dx, 0xe2
xor ebx, eax
call fcn.10138dfc
Function at 0x100ba0ad
Capabilities:
Hash data using murmur3

Disassembly:
rol al, 1
mov dword [esp], 0xfda01184
neg al
xadd dword [esp], ecx
ror dword [esp], 0x29
dec dword [esp]
rol al, 1
xor bl, al
ror edx, cl
setae cl
pop ecx
adc eax, esp
neg cl
adc cx, cx
mov ecx, dword [eax + edx*2 - 0x1ec00000]
mov eax, edx
and eax, 0x90bb5337
mov dword [edi + edx*2 - 0x1ec00004], ecx
call fcn.100ef274

Function at 0x100ba42d
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
xor ecx, ebx
bswap edx
lea ecx, [ecx + edx*4 - 0x48aa91b8]
neg edx
neg ecx
xchg dh, al
dec ecx
sub eax, 0x83aa778f
xor ecx, 0x589a0216
or ax, 0xe997
xor ebx, ecx
add ebp, ecx
push eax
jmp 0x100cc0d1
mov dword [esp + edx*8], 0xb324c79e
neg cl
ror byte [esp + edx], 0xc1
sbb cl, 0x30
and edx, edx
setge dl
xor edx, dword [esp + edx - 1]
xor cl, 0x98
shr dx, 0x29
inc cl
mov dword [esp], 0x2b2defbb
shr dl, 0xe7
pop edx
xor bl, cl
add ecx, esp
sal edx, 0xac
shl edx, 0xf6
mov byte [edx + ecx], al
mov eax, 0x951c44a9
mov ecx, dword [esi + edx*4]
lea esi, [esi + edx + 4]
setp al
jns 0x100b70eb
movzx ecx, dl

Function at 0x100bedd7
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push 0
jmp 0x100b0840
je 0x100b6b2b
mov eax, dword [esi]
mov cx, 0x951d
lea ecx, [ebp - 4]
jmp 0x100cb110
push 4
jmp 0x10128432
call fcn.100d8351
push 0
mov dword [ebp - 8], 0
jmp 0x1013a9c4
push 0x1005f7c8
jmp 0x10090053
lea ebx, [ebx*2 + 0x7c9d3298]
mov dword [esp + 0x10], 0x465e6351
mov edi, dword [esp + edi - 0x5518a022]
not ebx
not ebx
not ebx
jg 0x100b345a
xor al, bl
ror al, 1
inc dword [esp + 1]
sub dword [esp + 5], ecx
ror ecx, cl
not al
ja 0x100dd258
inc edx
add ecx, esp
add eax, dword [ecx + eax]
movsx ecx, dx
inc cl
lea edx, [ecx + edx - 0x29dbb2e5]
sub edi, 4
mov dword [edi], eax
call fcn.1009ad16
call fcn.1011da11
push ecx
inc al
shl byte [esp + ecx - 0x74feab2d], 0x45
jbe 0x100beff0
movzx ecx, byte [esp + edx - 0x1c2ba59a]
xor eax, 0x462ed2b2
sub edx, 0xefafc3b9
sal dx, cl
xor ebx, eax
jmp 0x10138c73
push eax
jmp 0x100b4666
push 0x1005f788
call dword [sym.imp.ole32.dll_CoGetClassObject]
mov esi, dword [ebp - 8]
test esi, esi
jmp 0x1009ecb5
jmp 0x100bf5ac
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 8]
jmp 0x10112f6f

Function at 0x100bef78
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
call fcn.100fbf11

Function at 0x100c0793
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [eax + eax*4 - 0x7ed18dd0]
dec edx
jmp 0x100da3d8
xor edx, 0xb33ff9ae
xchg dword [esp + eax - 0x4a9e44fa], eax
lea edx, [edx + ecx*2 - 0x413b4ad8]
shr eax, 0x61
pop ecx
rol edx, 1
rol ax, 0x65
jb 0x100b32e0

Function at 0x100ca2a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, ebx
mov dword [esp], eax
push eax
mov ecx, eax
add edx, 0x2b3ca383
and ax, 0x9931
neg edx
inc edx
not cl
shr ecx, cl
jp 0x100904c2
neg edx
lea eax, [eax + ecx + 0xd010280]
xor ebx, edx
add ebp, edx
call fcn.100e214a
Function at 0x100cea24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [edx + edx*4 + 0x5b2caf21]
mov dword [esp], 0x8d2e1594
lea ecx, [esp + ecx + 8]
sub ax, word [esp + 4]
movzx dx, byte [ecx]
mov ecx, eax
sub edi, 2
mov word [edi], dx
mov edx, dword [esi]
lea eax, [ecx*4 - 0x2dc3484f]
xadd word [esp + 2], cx
add esi, 4
sal eax, 0xc5
xor edx, ebx
and eax, 0x6207368a
not word [esp + eax - 0x600723fe]
sbb edx, 0x4335b70e
jmp 0x10103028
or dword [esp + eax - 0x600723fd], eax
bswap edx
call fcn.100d2dae

Function at 0x100d4ffb
Capabilities:
Parse pe header

Disassembly:
mov word [edi + eax*8 - 0xf1d8], dx
not ecx
mov dword [esp + eax*2 - 0x3c76], eax
dec byte [esp + eax*4 - 0x78ea]
mov eax, dword [esi + eax*4 - 0x78ec]
movzx edx, cl
dec cx
pop edx
lea esi, [esi + edx*2 - 0x1fe3c72]
xor eax, ebx
or cx, cx
not eax
and dx, 0xa2a
dec ecx
bswap eax
push ecx
sbb cl, dl
xor eax, 0xda385334
sar dx, 0xa2
jbe 0x100ddd68
lea esi, [esi + ecx - 0x4e654af5]
xor dl, bl
jmp 0x10123b08
not eax
sal edx, cl
inc edx
push edx
xor ebx, eax
call fcn.101189ed
inc cl
add dl, 0x87
xor ecx, 0x78135e03
shr ecx, cl
shl eax, 0x8e
rol dl, 1
neg dl
or ecx, ecx
jge 0x10123296

Function at 0x100d68cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub dx, dx
adc cl, byte [edi + ecx - 0x6ffc]
shr edx, 0x85
rol edx, 0x1c
shr eax, cl
movsx ecx, dx
call fcn.100fa6b6
call fcn.10104188
xor eax, 0xcf22c425
xor cx, cx
xadd dl, ch
xor ebx, eax
add ebp, eax
ror cl, 0x83
mov eax, dword [ecx + edi - 0x7000]
jae 0x1008fef4

Function at 0x100d7047
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call dword [eax + 0x4c]
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esi]
jmp 0x1011da45
push dword [ebp + 0xc]
jmp 0x100c015b
call dword [eax + 8]
mov eax, dword [ebp - 4]
xchg esi, esi
pop esi
jmp 0x100cb2f7
sub cl, 0x12
neg word [esp + 3]
mov edx, 0x9ea42e13
inc byte [esp + 1]
xor bl, cl
or dl, dh
lea ecx, [esp + ecx + 0x14]
mov word [ecx], ax
call fcn.10139ebd
call dword [eax + 0x28]
cmp eax, 0x80070490
jmp 0x100e28cf
cmp dword [ebp - 4], 0xffffffff
jmp 0x1010b25f
push esi
jmp 0x1009877d
push esi
jmp 0x10126d2e
push dword [ebp + 8]
jmp 0x1011f835
mov esp, ebp
pop ebp
jmp loc.1002962f
mov ax, word [esi + 2]
mov dword [esp + 4], 0x41350910
mov edx, 0xaf3e1896
add esi, 4
movzx ecx, byte [edi + 5]
xor dx, 0x4986
sbb edi, 0xfffffffa
xor cl, bl
neg cl
dec cl
neg cl
xor dword [esp + 0x14], edx
pop edx
not cl
rol cl, 1
neg dword [esp + 5]
not byte [esp + 9]
js 0x100a1153
mov dword [ebp - 0x108], 0x210003
jmp 0x100e3ced
jne 0x100aaf27
push dword [ebp + 0x10]
jmp 0x100978dd
mov dword [ebp - 0x104], 0x190021
jmp 0x1012f3ab
jne 0x10093259
mov eax, dword [esi]
lea ecx, [ebp + 0x10]
jmp 0x101397d3
ret 0xc
push esi
call dword [eax + 8]
mov eax, dword [ebp - 4]
not esi
pop esi
jmp 0x101228e6
call dword [0x1008cf14]
mov dword [ebp - 4], eax
not ax
mov eax, 0xa63a8424
cwde
mov eax, dword [esi]
jmp 0x100ab1e9
mov esp, ebp
xchg bp, bp
pop ebp
jmp 0x1011b6d4
mov dword [ebp + 0x10], 0
jmp 0x1009324d
mov dword [ebp - 0x100], 0x1a001c
jmp loc.10027a30
push ecx
jmp 0x100b6bb3
Function at 0x100d8807
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror dl, 1
pop eax
push 0x6b06b9bb
neg dl
sal byte [esp + 0xd], 0x22
call fcn.100e7590
add dword [esp], 0xeff196bf
call fcn.1008ffb9
lea esi, [esi + eax - 0x479ce593]
sal dword [esp + edx - 0x479ce587], 0x23
movzx ecx, dx
pop edx
pop edx
pop edx
pop edx
js fcn.100de0b1

Function at 0x100dcf0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, ebx
inc ecx
mov edx, 0x5d352920
pop eax
neg ecx
not edx
Function at 0x100e40b5
Capabilities:
Encode data using base64

Disassembly:
jne 0x100e2c99
sub edx, edi
push esi
stc
test eax, ebx
bts eax, ecx
push 0x100
btr ax, si
push 0x1008ca28
bswap ax
neg ah
cmp ax, cx
lea eax, [edx + ecx]
cmc
cmp eax, 0x100
jae 0x10117832
call fcn.100362e2
jmp 0x10117837
inc edx
ror edx, 2
pop eax
lea edx, [ecx + edx - 0x402df47c]
push ecx
xor ebx, edx
not eax
inc eax
add ebp, edx
pop ecx
call fcn.100d1f98
inc edx
clc
cmp ax, si
test al, al
jmp 0x1009311b
push 0x1005f788
jmp 0x100ef4a6
shl edx, 0xa1
rol al, 1
add dx, cx
dec cl
setg dl
xor bl, al
sal dx, 0xce
neg dl
adc eax, esp
sal ecx, cl
sbb cx, dx
xor dl, dl
mov ecx, dword [edx + eax - 0x4a20000]
sub dx, 0xe223
lea eax, [edx*2 - 0x717023d4]
lea edi, [edi + edx*8 - 0x2510eeec]
mov dword [edi + edx - 0x4a21ddd], ecx
mov ecx, dword [esi + edx - 0x4a21ddd]
lea eax, [edx + edx*4 - 0x68797dda]
adc al, ah
lea esi, [esi + edx*4 - 0x12887770]
xor ecx, ebx
neg ecx
sar dx, 0x8a
lea ecx, [eax + ecx - 0x11a0fb08]
rol al, 0xc2
neg ecx
sal eax, 0xd5
lea ecx, [ecx + eax - 0x110a45d0]
xor ebx, ecx
shl eax, 0x53
call fcn.100d99ea
sub cl, cl
jns 0x100d7fc2
xor ebx, ecx
and eax, edx
rol dx, 0x6c
adc ebp, ecx
or dword [esp], 0x7a1476a4
lea edx, [edi - 4]
jae 0x100df9ec
neg edx
not ecx
xor ebx, edx
jmp 0x100f3de6
sal word [esp + 1], 0xa1
mov dword [edi - 8], edx
setae byte [esp]
mov edx, dword [esp]
sub edi, 8
pop edx
sar eax, 0x6e
push edx
pop edx
jae fcn.100c3c87
sal word [esp + 5], 0xcb
inc cl
shr byte [esp + 2], 0xc5
xor cl, 0x93
xor bl, cl
lea ecx, [esp + ecx + 0xc]
mov edx, 0x520f54ba
shr dword [esp + edx - 0x520f54b8], 0x9e
lea edx, [edx*8 + 0x2d815483]
mov byte [ecx], al
shl byte [esp + 5], 0x86
lea edx, [esp + 0x30]
mov eax, dword [esp + 8]
dec byte [esp + eax - 0x6813241f]
xchg byte [esp + eax - 0x68132418], ah
movzx cx, byte [edx + eax - 0x6813bd1f]
call fcn.100af642
push 0
jmp 0x10100518
inc edx
neg edx
xor edx, 0x29174208
jmp 0x100d7d19
mov al, byte [edx]
jmp 0x100c75a0
xor edx, 0xa85f498
mov dword [esp + eax - 0x39], eax
neg eax
js 0x100e10ba
mov edx, 0x7ba504a2
movsx ecx, dx
movzx eax, dx
movzx eax, byte [ecx + esi - 0x4a2]
shl edx, 0x11
shr edx, cl
lea esi, [edx + esi - 0x250ffff]
shl ecx, 0xcc
neg cl
xor al, bl
ror dl, 1
adc al, 0x87
dec dl
rol al, 1
bswap ecx
and cx, dx
neg al
jmp 0x100ca0d8
call dword [sym.imp.ole32.dll_CoGetClassObject]
mov esi, dword [ebp - 8]
cmc
test esi, esi
jmp 0x1011df32
xchg al, cl
mov eax, dword [edi + ecx - 0x46d597c7]
sar cx, cl
mov dword fs:[edx + ecx - 0x46d5ff2f], eax
movsx edx, cl
sub dword [esp + ecx - 0x46d5ff2f], 0xdf35ebbc
mov edx, dword [esi + ecx - 0x46d5ff2b]
xor edx, ebx
bswap edx
jmp 0x100c7586
push 4
jmp 0x100c8a48
call fcn.10036166
add esp, 0xc
mov eax, 0x100ae547
jmp 0x1001f789
Function at 0x100e5a28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setae cl
xadd cx, ax
xor dl, bl
lea ecx, [ecx*8 + 0xd296106]
not ecx
ror dl, 1
sub cx, ax
call fcn.10027ef3
inc edx
cmc
cmp edx, 0x13
jb 0x100e4d42
mov eax, dword [ebp - 0x118]
bt dx, 0x3b
shld cx, sp, 0x80
lea edx, [ebp - 0xac]
cmp dword [ebp - 0x98], 8
setns ch
push 0x37
cmovnp cx, bx
mov ch, 0x39
cmovae edx, dword [ebp - 0xac]
mov ecx, dword [eax]
push edx
jmp 0x1012e02f
mov edx, dword [esi + 1]
jl 0x100b2e38
inc dword [esp + 4]
sbb esi, 0xfffffffb
xor edx, ebx
call fcn.100fe550
xor eax, 0x14357cae
neg dword [esp + edx*8 - 0x4cfddfff]
ror ecx, cl
bswap eax
lea eax, [eax + edx - 0x7f5ede91]
dec ecx
sbb ecx, 0x8c8c4e0f
ror eax, 1
pop edx
mov byte [esp + ecx - 0x4858cfad], dl
dec dx
xor ebx, eax
pop ecx
sar dl, 0x63
add ebp, eax
lea eax, [ecx*2 + 0x56982787]
not cl
movzx edx, byte [edi + eax - 0x40482900]
shr al, 0x84
shl cl, 0x41
lea edi, [edi + eax - 0x404828fa]
jnp 0x100916cf
mov ah, 0xf5
out dx, eax
pop esi
outsb dx, byte [esi]
in eax, 0xab
and esi, ecx
inc esi
adc dl, byte [ebp + edx*4 - 0x55]
and esi, ecx
sar ah, 1
cmp ch, dh
xlatb
sub dl, dh
stosd dword es:[edi], eax
and dl, byte [ebx + 0x3a]
xchg edx, eax
inc edx
int3
jb 0x1012aa73
mov ecx, dword [ebp - 0xac]
xor eax, 0xf90846b3
lea edx, [edx*2 + 2]
shrd eax, esi, 0xba
clc
cmp cx, di
mov eax, ecx
cmp edx, 0x1000
jb 0x100bcaf7
mov ecx, dword [ecx - 4]
test ecx, 0x28328ebb
jmp 0x1013b9bd
cmp dword [ebp - 0x98], 8
bswap eax
cmovg eax, edi
movzx eax, cx
lea ecx, [ebp - 0xac]
lea eax, [edx + 0x49]
jmp 0x10020922
xor dl, 0x3b
mov dword [esp + ecx*2 - 0x2e3ca44a], 0xda1e4cba
neg dl
neg word [esp + ecx*4 - 0x5c794893]
and cx, word [esp + ecx - 0x171e5224]
sbb dl, 0x30
dec ecx
xor dl, 0x98
and dword [esp + ecx - 0x171e4023], ecx
setb cl
inc dl
ror cl, 0xc6
push ecx
sal ecx, 0xf6
xor bl, dl
add ecx, ecx
lea edx, [esp + edx + 8]
mov byte [esp + ecx + 6], cl
neg cl
mov byte [edx + ecx], al
lea ecx, [edi + ecx*2 + 2]
mov dword [edi - 2], ecx
mov edx, 0xbb19a304
jae 0x100b6e73
call dword [ecx + 0x78]
mov byte [ebp - 4], 0
rcr edx, 0x96
btr dx, 0xb9
mov edx, dword [ebp - 0x98]
cmc
jmp 0x10138ffe
push eax
jmp 0x10123f28
cmp edx, 8
jmp 0x100d8a17
add edx, 0x23
cmc
test ch, 0xb3
test ebx, eax
sub eax, ecx
cmp ebp, 0x86961294
lea eax, [eax - 4]
jmp 0x1009ef02

Function at 0x100e9701
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol dl, 1
movzx ecx, ax
ror cl, cl
sub dl, 0x11
xor dl, 0xb3
sar ecx, cl
push eax
ror dl, 1
add ecx, ecx
xor bl, dl
shl ecx, 0xed
lea edx, [esp + edx + 8]
push ecx
adc cl, byte [ecx + edx]
mov word [edi - 2], cx
and byte [esp + 4], 0x17
call fcn.100e7f5d

Function at 0x100ea297
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, cl
lea edi, [edi + eax*2 - 0xb4]
mov dword [esp + eax - 0x57], eax
not eax
xchg ecx, eax
mov ecx, dword [esi + 2]
sub esi, 0xfffffffa
xor ecx, ebx
sub ecx, 0x4335b70e
call fcn.1009e62d
shr dl, cl
call fcn.100ef7be