Function at 0x101e74b2
Capabilities:
Read file on windows
Terminate process

Disassembly:
lea eax, [ecx + ecx*8 + 0x5906400c]
imul dx, word [esp + edx - 0x308d551e]
pop eax
pop edx
pop eax
jo fcn.10190646
dec cx
adc ecx, 0xdb988616
xor ebx, edx
shl cl, 0xc3
xor al, byte [esp + 3]
adc edi, edx
movzx cx, byte [ebp + 2]
and eax, dword [esp + 4]
mov al, byte [ebp + eax]
jge 0x1022ada5
shr byte [esp + 4], 1
and cl, al
not cl
mov word [ebp + 4], cx
call fcn.1026beb5
sub ebp, 4
mov ecx, 0x2bae9019
lea eax, [ecx + ecx*4 - 0x5ec7926c]
mov eax, dword [ebp + ecx*2 - 0x575d2032]

Function at 0x101e837b
Capabilities:
Read file on windows
Terminate process

Disassembly:
inc al
rol cl, 0xa1
ror al, 1
shl edx, cl
mov dword [esp + edx], edx
dec al
xor bl, al
lea eax, [esp + eax + 4]
imul edx, edx
btr edx, edx
movzx cx, byte [edx + eax]
lea eax, [edx + edx + 0x29b6df8c]
dec ax
sub eax, edx
lea ebp, [ebp + edx - 2]
shl dl, 0xa5
xor eax, eax
mul dword [esp + edx]
mov word [ebp + edx*8], cx
rol dl, 0x27
or edx, edx
pop eax
jp fcn.1024af8a

Function at 0x101e83c3
Capabilities:
Read file on windows
Terminate process

Disassembly:
not eax
xor ebx, eax
add esi, eax
xor edx, 0xe973baf
movzx eax, byte [edi + ecx*2 - 0x100]
imul cx, cx
mov dword [esp + ecx - 0x4000], ecx
lea edi, [ecx + edi - 0x3fff]
shl dword [esp + ecx - 0x4000], 0x5f
bt ecx, edx
inc cl
xor al, bl
sub al, cl
xor al, 0xab
xchg byte [esp + ecx - 0x4000], cl
rol al, 1
xor cl, cl
dec al
mov dword [esp + ecx*2 - 0x8000], ecx
neg al
sar dl, 0xc1
rol ecx, 0xa2
pop edx
xor bl, al
add eax, esp
add cl, byte [eax + ecx - 0x10000]
lea ebp, [ebp + edx - 0x4002]
mov eax, 0x2e916d3e
mov word [ebp + edx*2 - 0x8000], cx
mov ecx, edx
inc ecx
rol dl, 0xe1
jne fcn.10190646

Function at 0x101ea73d
Capabilities:
Encrypt data using aes
Reference aes constants
Terminate process

Disassembly:
adc al, 0xa1
xor bl, al
lea ebp, [ebp + ecx - 0xe0102]
shr dword [esp + ecx - 0xe00f8], 0x3c
mov word [ebp + ecx - 0xe0100], ax
pop eax
pop ecx
pop ecx
jae fcn.1018699d
mov edx, 0x6e1b9005
mov ecx, dword [edi + edx - 0x6e1b9005]
shl edx, 0x4b
shl edx, 0xb5
or dx, dx
lea edi, [edi + edx*2 + 4]
bt edx, edx
jae 0x101fefd7
movzx eax, byte [esi + ecx*2 - 0x1e0000]
xor al, bl
push ecx
or cx, dx
or dword [esp + ecx - 0xf0080], edx
rol al, 1
sub byte [esp + ecx*4 - 0x3c01f4], 0xc
and ecx, 0x2ebe6888
inc al
pop edx
not al
add cx, dx
jno 0x10195ba1
mov edx, 0xed1f623f
movzx eax, dx
lea esi, [eax + esi - 0x6241]
movsx ecx, al
mov ax, word [esi + eax*2 - 0xc47e]
inc edx
or ecx, ecx
xor ax, bx
dec edx
sar cx, 0xcd
sbb cl, dl
not ax
call fcn.1023a60f

Function at 0x101eb3e3
Capabilities:
Read file on windows

Disassembly:
or dx, 0x619
mov dword [esp + edx - 0x619], eax
dec ecx
cbw
xor ecx, 0xbf260e91
xchg word [esp + edx*2 - 0xc31], dx
inc eax
add ecx, 0xa7bb529e
not al
sar edx, 0x41
lea eax, [eax + edx + 0x151b8099]
not ecx
shl eax, 0xe5
xor ebx, ecx
xchg byte [esp + edx*4 - 0x86], al
xchg word [esp + edx - 0x22], ax
neg dword [esp + edx - 0x22]
add esi, ecx
call fcn.101b8e0b
not ecx
btr ecx, ecx
not al
sub cl, 0x95
dec al
bt ecx, ecx
jb 0x101f4ed9
ror al, 1
bswap ecx
xor bl, al
add eax, esp
mov dword [eax + ecx*2 - 0x58000000], edx
call fcn.101c98ea