joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020fc53
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov edx, 0xb8952339
mov ecx, dword [edi]
mov eax, 0x5427e986
lea edi, [edi + eax - 0x5427e982]
or eax, edx
not al
mov dword [esp], eax
xor ecx, ebx
ror ecx, 2
xor ecx, 0x43954139
dec dx
or dl, byte [esp + 1]
sbb ecx, 0x32985fb5
shl eax, 0x28
pop eax
sal ax, 0xe
xor ecx, 0xf38c731d
cwde
xor ebx, ecx
add esi, ecx
push edx
movzx edx, byte [edi + eax]
lea edi, [eax + edi + 1]
ror dword [esp + eax], 0xc2
dec al
movzx ecx, byte [esp + eax - 0xff]
xor dl, bl
lea eax, [ecx*2 - 0x2f73d05e]
not dl
rol dl, 1
ror dword [esp + ecx - 0xfe], 0xf9
dec dl
ror byte [esp + ecx*2 - 0x1fb], 0xa3
jae 0x10225f57
rol dl, 1
add dword [esp + ecx - 0xfe], 0xa814a512
xadd cl, ch
sbb cl, ah
xor bl, dl
dec eax
lea ebp, [ebp + ecx - 0xfed1]
shr byte [esp + ecx*2 - 0x1fd9a], 0x83
jae 0x1019cdba

Function at 0x1020ffc1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
bt ecx, eax
xor dx, 0x9820
neg dx
sub dx, 0x1d3e
xor dx, 0x521f
pop ecx
xor bx, dx
cwde
lea edi, [edi + eax - 0x6cab]
shr dword [esp + ecx - 0x7fffffff], cl
pop eax
jb 0x102354f8
xor ebx, edx
add esi, edx
mov dword [esp + ecx - 0x7fffffff], ecx
movzx edx, cx
mov dx, word [ebp + edx*2 - 0x1fffe]
mov eax, 0x1e146ca7
lea ebp, [ebp + ecx - 0x7ffffffd]
xor dx, bx
jmp 0x101f8ded
mov dword [edi + ecx - 0x7fffffff], edx
movsx edx, ax
jns 0x10235b8e

Function at 0x10216cac
Capabilities:
Read file on windows
Terminate process

Disassembly:
rol dl, 1
add cl, 0x84
xchg dword [esp + ecx - 0x7c], ecx
neg dl
rol dl, 1
rol cl, 0xc4
not dl
xadd word [esp + ecx - 0x75761dea], cx
rol dl, 1
neg cx
adc dl, 0xa2
bswap ecx
neg dl
inc ecx
dec dl
shl dword [esp + 4], 0xbc
call fcn.10198b2f
mov dword [ebp + ecx*8 - 0x7f668], edx
pop eax
jp fcn.10190646
neg edx
add dword [esp + 4], 0x7314d615
dec edx
add ecx, eax
rol edx, 1
bswap eax
cbw
xor ebx, edx
neg eax
setns cl
add esi, edx
cwde
pop eax
pop edx
jmp fcn.1024af8a
lea ecx, [ecx + ecx*8 + 0x283b979c]
add edi, eax
lea eax, [edx + edx*2 - 0x5f6be674]
shl edx, 0x3e
sar dl, 0xe2
mov ax, word [ebp + ecx - 0x496ba326]
lea ebp, [ebp + ecx - 0x496ba324]
lea esi, [ecx + esi - 0x496ba327]
shr cx, 0xc1
push edx
setle dl
movzx edx, byte [ecx + esi - 0x496b5193]
mov dword [esp + ecx - 0x496b518f], ecx
ror dword [esp + ecx - 0x496b5190], cl
xor dl, bl
sar cx, 0x46
and ecx, 0x9e961b0d
xor ecx, ecx
not dl
jns 0x1019cd86
xor cx, 0x5491
mov dx, word [ecx + edi - 0x51a0dc93]
push ecx
shr ecx, 0x72
shl dword [esp + ecx*4 - 0x51a0], 0x9f
lea edi, [edi + ecx*8 - 0xa33e]
xchg dword [esp + ecx - 0x1468], ecx
adc ax, dx
xor cl, ch
lea ecx, [ecx*4 + 0x3495f194]
mov word [edi + ecx - 0x3495f194], ax
movsx edx, word [esp + ecx - 0x3495f194]
imul dx, cx
seto byte [esp + ecx - 0x3495f191]
mov dword [esp + ecx*2 - 0x692be328], ebp
ret
Function at 0x10217d7e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cwd
lea ecx, [edx + eax*2 - 0x73d8ea5c]
pop ecx
jne fcn.1017fa23
xor cx, bx
mul eax
jb 0x10239f8e
shr dl, 0x46
sar eax, 0xed
shr edx, 0x1b
dec ecx
idiv word [esp + edx*4 - 0xa]
xor ebx, ecx
add esi, ecx
mov ecx, dword [esp + edx - 0x1450]
or ecx, dword [esp + edx - 0x1450]
lea ebp, [ebp + edx*2 - 0x28a2]
movzx ecx, word [ebp + edx - 0x1450]
ja 0x101cd40f
adc esi, 6
shrd edx, eax, cl
mov dword [esp], 0x130bfe87
mov dword [esi], edx
mov eax, dword [esp]
movzx edx, al
lea edi, [edi + eax - 0x130bfe8b]
ror byte [esp + eax - 0x130bfe86], 0xc7
mov edx, dword [edi + eax - 0x130bfe87]
inc word [esp + eax*2 - 0x2617fd0e]
inc eax
xor edx, ebx
push eax
bswap edx
push eax
lea ecx, [eax + eax*2 + 0x322825b3]
sal cx, 0x6d
not edx
sbb ecx, 0x4936830d
js 0x101e3ca1
xchg ecx, eax
rol edx, 1
dec edx
neg edx
dec edx
and byte [esp + eax - 0x2215dcec], cl
mov dword [esp + eax*2 - 0x442bb9d4], eax
bswap edx
pop ecx
xor ebx, edx
shr cx, cl
call fcn.101e0c49
sub ebp, 4
mov edx, dword [ebp]
xor edx, ebx
mov eax, 0x77aabe9c
shr al, 0x83
shl ax, 0xc7
neg edx
not ax
movsx ecx, ax
sub edx, 0x55b19f9b
or al, al
bt ax, cx
bt ecx, ecx
ror edx, 2
btc cx, ax
cwde
sbb edx, 0xe6230e18
shl cx, 0xa6
bts eax, eax
inc ecx
xor edx, 0x29302e93
sal eax, cl
cwde
xor ecx, eax
xor ebx, edx
add edi, edx
not cx
bt ecx, ecx
mov esi, dword [ecx + esi - 0x8cc0]
sub cl, 0x8a
push ecx
sar word [esp + ecx*2 - 0x1186c], 0xe2
pop eax
js fcn.10242672
xor cx, 0xd622
shl byte [esp], 0xc5
sar eax, 0xb6
sbb cx, ax
sal word [esp], 0x25
xchg dword [esp], eax
xor cx, 0xdf39
add al, byte [esp + eax*4 - 0x76140ffd]
sbb al, 0xa7
sbb cx, 0x85b6
xor cx, 0xc5a7
add cx, 0x131c
rol edx, 0x85
xor bx, cx
lea edi, [edi + eax - 0x1d85045c]
cbw
xor word [esp + eax - 0x1d850058], dx
and edx, eax
mov dword [edi + eax - 0x1d850058], ecx
jge 0x101b3b60
dec edx
xor ebx, eax
movsx ecx, dl
xchg ecx, edx
btr dx, cx
add esi, eax
pop ecx
pop edx
jmp esi

Function at 0x10218b7d
Capabilities:
Read file on windows

Disassembly:
xor ebx, eax
btr dx, 0x31
or dword [esp + ecx - 0x2882], edx
sbb ecx, ecx
adc esi, eax
xor cx, cx
mov dword [esp + ecx], esi
ret 4
inc byte [esp + ecx - 0x27fa]
rol eax, 1
bts edx, ecx
dec eax
ror dx, 0xa6
rol eax, 3
mov dword [esp + ecx - 0x2800], edx
xor cl, 0x82
jae 0x1019a0cc

Function at 0x102198bc
Capabilities:
Read file on windows
Terminate process

Disassembly:
not ecx
btc ax, 0xb5
div al
mov dword [esp + eax*4 - 0x530810ec], 0xbc3fcc87
xor ebx, ecx
shr byte [esp + eax - 0x14c20438], 0xe4
add ebp, ecx
call fcn.10227b69
mov edx, 0x2d84aa95
lea edi, [edi + edx - 0x2d84aa99]
mov eax, 0xfc893222
mov edx, dword [edx + edi - 0x2d84aa95]
xor edx, ebx
push eax
dec dword [esp]
inc edx
bswap edx
sal dword [esp], 0x2f
sal word [esp + 2], 0x81
lea ecx, [eax*2 + 0x419716bc]
lea edx, [edx + ecx*4 - 0x4f904b4e]
and word [esp + ecx*2 - 0x7552f5fe], cx
inc ecx
ror edx, 3
shl cx, cl
add eax, ecx
not edx
setle byte [esp + ecx - 0x3aa9f602]
xadd byte [esp + ecx - 0x3aa9f5ff], cl
sbb edx, 0x681d2d1b
shl dword [esp + eax - 0x37332824], 0xa2
inc byte [esp + ecx - 0x3aa9f630]
rol edx, 1
call fcn.1025af27
Function at 0x1021a437
Capabilities:
Read file on windows
Terminate process

Disassembly:
not ecx
lea eax, [eax + 0x20bd30ad]
setno byte [esp + eax - 0x4cfd26c4]
pop eax
not edx
neg eax
add al, 0x27
and ecx, edx
movsx edx, byte [esp + 3]
cwde
rol dl, 0x21
mov dword [edi + eax - 0x6326], ecx
cdq
setno byte [esp + eax*2 - 0xc64a]
mov dword [esp + eax*2 - 0xc64c], ebp
ret 4
mov dword [edi], eax
not word [esp + 5]
pop eax
pop ecx
jmp esi
inc dword [esp + eax*2 - 0x587fec28]
jb 0x10184c52
mov eax, dword [ebp]
xor eax, ebx
mov edx, 0xf170632
shr edx, 0x5e
neg eax
xor edx, edx
lea ecx, [edx*8 + 0x482650b0]
call fcn.101d4f77
not word [esp + 2]
jmp 0x10194fb6
neg word [esp + eax - 0x2c3ff616]
lea edi, [edi + eax*2 - 0x587fec2a]
jle 0x101beca3
mov ecx, 0x1f9a74ac
lea edx, [ecx + ecx + 0x3082cf19]
movsx eax, cx
lea edi, [ecx + edi - 0x1f9a74b0]
lea eax, [eax*2 + 0xea6c4af]
mov edx, dword [edi + ecx*2 - 0x3f34e958]
xor ax, 0xedb5
and eax, 0x2fa8acb3
rol eax, 0x48
xor edx, ebx
xor eax, ecx
jl 0x10207bdf
mov edx, 0xd4b48eb7
mov edx, dword [esi]
mov ecx, 0xb53af230
mov eax, dword [esi + 4]
or cl, ch
and ecx, ecx
add cx, cx
adc esi, 3
ror cl, 1
adc cl, ch
bts ecx, ecx
and edx, eax
movzx eax, cx
call fcn.101cc3e6
dec edx
rol edx, 1
cwde
xadd ecx, eax
inc edx
rol edx, 1
sub edx, 0x7e93ab0a
add al, cl
xor ebx, edx
add ebp, edx
jmp 0x1017cd5a
mov dword [esp + edx*4 - 0x3419900c], edx
bswap ecx
mov dword [esp + edx - 0xd0663ff], eax
neg ecx
rol eax, 0x36
xor ebx, ecx
not ax
add ebp, ecx
mov ecx, dword [edi + edx*2 - 0x1a0cc806]
add edx, dword [esp + edx*8 - 0x68332016]
setne dl
mov edx, dword [edi + eax*2 - 0x587fec2a]
jl 0x101d92ea
jmp 0x102614c3
movzx ecx, byte [esi - 1]
mov edx, 0xe7b362a9
xor edx, edx
xor cl, bl
lea eax, [edx*4 + 0x83120ac]
rol cl, 1
ror dl, 0x66
adc cl, 0x21
bts edx, eax
cwde
idiv al
xor cl, 0xaa
and eax, edx
add edx, edx
ror cl, 1
add dx, 0x5cae
jg 0x101e7e47

Function at 0x1021a5e3
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
xor edx, 0xbb392603
neg al
mov byte [esp + ecx - 0x5113717c], ch
not al
neg dword [esp + ecx - 0x5113717f]
not dx
sal ecx, 0xc8
sbb al, cl
rol al, 1
mov dword [esp + ecx*4 - 0x4dc60c00], edx
or byte [esp + ecx - 0x13718300], dh
sbb al, 0xb7
jmp 0x10267977

Function at 0x1021b13e
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esi, 4
call fcn.10239f36
mov edx, 0xdd99250c
movsx ecx, dl
lea edi, [edi + ecx*8 - 0x64]
dec dx
xor ecx, 0x931909a6
sub ecx, edx
mov ecx, dword [edi]
sar edx, 0xb
lea eax, [edx + edx*4 + 0x7b09f12]
imul al
xor ecx, ebx
inc ecx
neg ecx
sar dl, 0xc4
or eax, edx
xadd al, ah
bswap ecx
shl eax, 0xde
or edx, edx
neg ecx
cwd
xor ebx, ecx
add ebp, ecx
movsx ecx, dl
sub al, ah
sar eax, 0xf
lea edi, [edi + eax - 0x8001]
call fcn.101ec23e
Function at 0x1021b2b5
Capabilities:
Read file on windows
Terminate process

Disassembly:
rol ecx, 0xfc
dec edx
xadd dword [esp + eax - 0x132002], ecx
mov dword [esp + eax*4 - 0x4c8018], eax
xor ebx, edx
xchg dword [esp + eax - 0x132003], ecx
and ecx, ecx
shl word [esp + ecx*4 - 0x8817fc], 0xa7
adc esi, edx
cwde
sar ecx, 0xf2
bt ax, ax
pop ecx
pop ecx
jae fcn.10190646
mov ecx, 0x240f6922
movzx eax, cl
lea ebp, [ebp + ecx - 0x240f6926]
add ecx, eax
mov eax, dword [ecx + ebp - 0x240f6944]
imul ecx, ecx
mov edx, 0x95a3e596
ror dx, 0x6f
xor eax, ebx
neg dl
sar ecx, 0xff
neg cl
ror eax, 2
not dl
btr edx, ecx
dec eax
lea edx, [edx + edx*2 - 0x5ac0bff4]
neg eax
sar ecx, 0x9b
sal ecx, cl
sbb ecx, 0x942adea2
rol eax, 1
xchg ch, cl
inc eax
sar ecx, cl
xor ecx, ecx
rol dx, 0x61
bswap eax
imul edx, edx
rol cx, 0x2e
call fcn.101b5fb9

Function at 0x1021c092
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
mov word [edi], dx
bts ecx, 0xd
jb 0x1025d96a
rol eax, 0xd8
lea edi, [edi + eax - 0x1c60d5f1]
neg eax
sal dl, cl
lea ecx, [eax + eax*8 - 0x39ef845a]
jmp 0x101f1a5f
mov dword [esp + 4], 0xcebec01c
adc edi, 6
shld eax, edx, cl
mov ecx, 0x3a092b1
lea edx, [ecx + ecx - 0x2064abd4]
mov dword [edi + ecx*4 - 0xe824ac4], eax
push edx
dec cx
lea eax, [edx + ecx*2 + 0x1109b900]
lea esi, [ecx + esi - 0x3a092b4]
cwd
mov edx, dword [esi + ecx - 0x3a092b0]
rol al, 0xa3
xor edx, ebx
not eax
mov dword [esp + ecx - 0x3a092ac], eax
rol edx, 1
shr ecx, 0x2c
pop eax
lea edx, [ecx + edx - 0x45027f98]
jbe 0x101cf36f
dec cx
jnp 0x10238964
lea ecx, [eax + eax*4 + 0x4e36d429]
movzx dx, byte [edi + ecx - 0x6a0d9400]
sub al, 0x11
not eax
neg ax
add cl, byte [edi + eax - 0x60d5f319]
inc eax
jne 0x101f8bcc
mov ecx, dword [ebp + edx*2 - 0x4f272f7c]
sar dx, 0xc3
lea edx, [edx + eax + 0x238d1f0e]
xor ecx, ebx
bt dx, ax
neg dx
neg eax
bswap ecx
sub dx, ax
not ecx
neg eax
lea edx, [edx + eax*4 + 0x74bd4d8a]
or eax, edx
neg ecx
xchg dh, dl
dec ecx
rol dl, 2
neg al
sub ax, dx
xor ebx, ecx
div dl
cdq
add esi, ecx
call fcn.1022083a
call fcn.10207e2e
jne 0x1020d345
mov ecx, 0xe10ff91f
bswap ecx
push ecx
mov eax, dword [ebp + ecx - 0x1ff90fe1]
lea ebp, [ebp + ecx*4 - 0x7fe43f80]
mov word [esp + ecx - 0x1ff90fe1], 0x50a2
lea ecx, [ecx*8 - 0x61c51056]
xor eax, ebx
xor cl, cl
pop ecx
ror eax, 1
movzx edx, cl
bswap edx
bt cx, dx
neg eax
lea eax, [eax + ecx - 0x628db8e0]
rol eax, 1
xadd ecx, edx
xor ebx, eax
dec edx
not cx
neg dl
add esi, eax
push ecx
add dx, 0x3ba8
js 0x101d4047
neg edx
call fcn.10239259
mov edx, 0x279397be
lea ebp, [ebp + edx*2 - 0x4f272f80]
movsx eax, dx
jmp 0x102184e4
lea edx, [ecx*4 - 0x5342c7cc]
sbb esi, 3
mov ecx, dword [esi]
xchg edx, eax
inc dx
xor ecx, ebx
ror dl, 0xc1
shl ax, 0x8a
bswap ecx
sal dl, 0xc4
lea ecx, [eax + ecx - 0x223e8ed1]
btr dx, 4
not ecx
mul al
xadd al, ah
setnp dl
neg ecx
shr eax, 0x9d
bswap eax
xor ebx, ecx
dec eax
bt eax, eax
adc ebp, ecx
lea ecx, [edx + edx*4 - 0x406bc800]
cwde
jmp ebp
Function at 0x1021c348
Capabilities:
Read file on windows
Terminate process

Disassembly:
sal cl, 0x26
mov dword [esp + ecx - 0x790e23c0], 0x8e163d0e
xor ebx, edx
xchg byte [esp + ecx - 0x790e23be], ch
and byte [esp + ecx - 0x790e16be], 0x20
adc esi, edx
lea edx, [eax + 0x1a3e3536]
sar ax, 0x45
movzx eax, byte [ecx + edi - 0x790e16c0]
dec cx
jp 0x102134ef
shr cl, 0x61
lea edi, [ecx + edi - 0x790e165e]
sar word [esp + ecx - 0x790e165e], 0x4a
xor al, bl
neg byte [esp + ecx - 0x790e165d]
ror al, 1
not al
sub al, 0x39
or dx, dx
xchg dword [esp + ecx - 0x790e165f], edx
neg al
sal dword [esp + ecx - 0x790e165f], 0x82
xor bl, al
rol edx, 0xe9
bswap ecx
inc cl
lea eax, [esp + eax + 4]
rol dword [esp + ecx - 0x5f160e7a], 0x5b
mov dx, word [eax + ecx - 0x5f160e7a]
lea ebp, [ebp + ecx - 0x5f160e7c]
sbb cl, byte [esp + ecx - 0x5f160e7a]
movzx eax, cl
mov word [ebp + eax - 0xd4], dx
pop ecx
jg fcn.10190646
movzx eax, dl
xor ebx, ecx
not dl
call fcn.10269e29
jmp 0x102694fd
add edi, 2
mov edx, 0xec9ec128
shl edx, 0x61
add ax, cx
neg edx
bt edx, edx
mov word [edi + edx*2 - 0x4d84fb60], ax
movzx eax, dl
mov edx, dword [ebp + edx*2 - 0x4d84fb60]
lea ebp, [ebp + eax*2 - 0x15c]
mov ecx, 0xc28faa9b
ror cl, 5
xor edx, ebx

Function at 0x1021dd9a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor cl, 0xa9
call fcn.10267626
jmp 0x101891d5

Function at 0x1021f175
Capabilities:
Terminate process

Disassembly:
dec eax
call fcn.101a8804
mov edx, 0xc280e600
mov eax, dword [edi]
call fcn.10188677

Function at 0x1022046c
Capabilities:
Read file on windows
Terminate process

Disassembly:
dec byte [esp + edx - 0x5287fffc]
and al, cl
movzx ecx, byte [esp + edx - 0x5287fffc]
xor al, cl
sar dx, 0xa5
call fcn.101b1383
movzx ecx, byte [edi]
mov eax, 0xe6b4c38d
add edi, 1
inc ax
call fcn.1021419d
push 0x699a66ad
mov ecx, 0x85a02108
mov ecx, dword [edi]
pop edx
lea edi, [edi + edx - 0x699a66a9]
jmp fcn.101c41e9
mov cl, byte [edi + ecx*4 - 0x2cca]
mov edx, dword [esp + 4]
mov dword [esp + edx - 0x52880000], edx
lea edi, [edx + edi - 0x5287fffe]
jae 0x101b2ebe

Function at 0x1022048b
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp + edx - 0x455b0072], 0xbaad96b5
xor ebx, eax
add esi, eax
pop edx
movzx eax, cl
cbw
jmp fcn.10190646

Function at 0x1022154a
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
pop ecx
or dl, al
pop ecx
mov word [ebp + ecx - 0x6aae128f], dx
mov edx, ecx
xor cx, dx
jbe 0x101d522b
mov ecx, 0x98390509
movzx eax, cx
mov ecx, dword [edi + eax - 0x509]
bts ax, 0x3a
sar al, 0xc5
cdq
lea edi, [edi + eax - 0x4fc]
lea ebp, [edx*8 - 0x75d8657a]
mov ebp, ecx
jae 0x10183749
Function at 0x102221a7
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
or edx, ecx
inc edx
lea ebp, [ebp + ecx - 0x71379c24]
mov ecx, dword [ecx + ebp - 0x71379c20]
sal dx, 0xc8
movzx eax, dx
dec dx
xor ecx, ebx
btc ax, 0xa7
shl dx, 0xa9
ror ecx, 2
not ecx
jmp 0x1018e26d
mov word [edi + ecx - 0x71379c20], ax
jo 0x10191dd9
mov dword [ebp - 4], edx
jmp 0x101cd5d1
adc esi, 5
call fcn.101ec88e
mov eax, 0xbf1d4732
rol eax, 0xb4
mov ecx, dword [edi + eax - 0x732bf1d4]
call fcn.1021518b
movzx ax, byte [edi]
mov cl, byte [edi + 2]
add edi, 2
mov edx, 0xb980ea21
sal al, cl
lea ecx, [edx + edx*8 - 0x145102e8]
ror cx, cl
jo 0x101e465f
push 0x8d02cf09
mov dx, word [esi]
call fcn.101bc018
sub ebp, 4
call fcn.1024dc3a
mov word [edx + edi - 0xbff], ax
not word [esp + edx*2 - 0x1802]
movzx ecx, byte [esi + edx - 0xc06]
call fcn.101e5d8c
sub esi, 4
mov eax, 0x72bb2313
mov ecx, dword [esi + eax - 0x72bb2313]
movsx edx, ax
neg edx
call fcn.10187f8a
sbb cx, 0xcf14
mov cl, byte [ecx + esi - 0x30e4]
push 0x3e87f8a5
not byte [esp + 2]
jb 0x10212c19
mov eax, 0x60b8b29
lea esi, [esi + eax - 0x60b8b2d]
lea edx, [eax + 0x54956300]
lea ecx, [edx*2 - 0x255a7356]
btr eax, eax
mov ecx, dword [esi + eax - 0x60b8929]
bts dx, dx
xor ecx, ebx
lea edx, [edx + edx*2 + 0x2977937]
bswap ecx
ror al, 1
add al, al
bts edx, 0x2e
neg ecx
lea ecx, [ecx + eax - 0x52474833]
xchg dx, ax
ror ecx, 1
neg edx
xor ebx, ecx
sar edx, 0xa9
adc edi, ecx
movzx ax, byte [ebp + eax - 0x60b43b2]
sal dl, 0x41
mov cl, byte [ebp + 2]
and edx, 0x6b345624
add dl, dh
lea ebp, [ebp + edx - 0x6b344264]
or al, cl
mov ecx, edx
push ecx
not al
sal dword [esp + ecx - 0x6b344266], cl
call fcn.10208b29

Function at 0x10224b08
Capabilities:
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
pop ecx
pop ecx
pop ecx
jae fcn.101b3e0d

Function at 0x10227791
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov word [ebp], ax
sub dl, 0x15
btr dx, cx
sbb cl, cl
sbb esi, 3
pop ecx
imul dx, dx
mov edx, dword [esi]
mov eax, 0xa50dc637
xor edx, ebx
ror edx, 3
rol ax, 0x61
ror eax, 0x1a
bts ax, ax
sbb edx, 0xbb0b9db4
neg edx
movzx ecx, al
bswap edx
xor ebx, edx
xor al, ah
bswap eax
ror ecx, 0xf
adc edi, edx
add ecx, ecx
movsx edx, cx
xor ecx, ecx
je fcn.1018699d
mov ecx, ebp
sub ebp, 2
mov edx, 0x750a04b2
neg dx
mov word [edx + ebp - 0x750afb4e], cx
movzx ecx, dx
lea eax, [ecx + edx*4 - 0x24701865]
btr edx, eax
mov edx, dword [ecx + edi - 0xfb4e]
cwde
or cx, ax
dec ax
lea edi, [ecx + edi - 0xfb6b]
sar ecx, cl
sar eax, cl
xor edx, ebx
shl cl, 0x85
jne 0x10234b47
shr eax, 0xb7
rol edx, 3
sal ax, 0x82
bts eax, 0x3c
sub cl, cl
not edx
and cx, cx
sar ax, 0xf
neg edx
xor edx, 0x603d1407
sub edx, 0xff0e4f0d
xor edx, 0xd6aaf825
btr ax, ax
not edx
xor ecx, ecx
not ecx
xor ebx, edx
sal al, 0xc7
adc esi, edx
lea eax, [ecx + eax*8 - 0x314abce9]
jmp fcn.1024af8a
Function at 0x10228993
Capabilities:
Read file on windows
Terminate process

Disassembly:
shr cx, cl
lea edi, [edi + edx - 0x31782]
xor eax, ebx
not eax
sal edx, cl
bswap eax
mov dword [esp + ecx - 0x5e], 0xe5b879b2
ror eax, 3
push ecx
jmp 0x10268771
sub eax, 0xc137d83b
xor ebx, eax
shr dl, 0x26
bswap edx
not byte [esp + edx*4 - 0x1fb]
adc esi, eax
btc ecx, 0x18
pop eax
pop ecx
jae fcn.10190646

Function at 0x10229fc2
Capabilities:
Authenticate hmac
Encrypt data using aes
Read file on windows
Reference aes constants
Terminate process

Disassembly:
rep movsb byte es:[edi], byte [esi]
pop edi
mov edi, 0x93865fa6
push dword [esp + 4]
popfd
movsx esi, di
mov esi, dword [esp + esi*4 - 0x17e90]
not edi

Function at 0x1022b33e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esi, eax
sal dl, 0x41
lea eax, [edx + edx + 0x6d93ee3e]
pop ecx
pop ecx
pop eax
jbe fcn.1017fa23
mul ax
not al
not ecx
lea ecx, [ecx + edx*8 - 0x207c0bd1]
add dx, dx
cwde
pop eax
xor ecx, 0xcca7282d
dec ecx
lea eax, [edx + edx*4 + 0x6a1d5d2d]
rol byte [esp + edx - 0x23d0505a], 0xa1
add byte [esp + eax - 0x1d2eef0a], dl
rol ecx, 1
neg dx
xor ebx, ecx
add eax, dword [esp + edx - 0x23d0af9f]
adc edi, ecx
call fcn.10230f30
mov edx, 0x429124b1
mov eax, edx
lea esi, [edx + esi - 0x429124b5]
rol dl, 0x45
or eax, edx
mov ecx, dword [eax + esi - 0x429124b7]
sub al, 0x8a
xor ecx, ebx
cdq
call fcn.10266d3d
mov edx, 0xa7a43f96
mov edx, dword [edi]
mov ecx, 0xa81e33bc
mov ecx, dword [edi + 4]
add edi, 4
and edx, ecx
mov eax, 0xe1a0ad8e
push eax
not edx
rol dword [esp], 0x94
sal byte [esp + 1], 1
mov dword [edi], edx
inc eax
mov edx, 0x52a7cb31
mov ecx, dword [ebp + edx - 0x52a7cb31]
dec edx
pop edx
neg edx
lea ebp, [ebp + edx - 0x2711cbf2]
call fcn.1020ce57
mov eax, 0xf5b2332b
sub ebp, 4
bts ax, ax
mov edx, 0x859e0fba
cbw
mov eax, dword [ebp]
xor eax, ebx
inc eax
push edx
not eax
xor eax, 0x542f8701
not eax
mov ecx, edx
xchg cl, dl
bt ecx, 0x87
xor ebx, eax
add edi, eax
dec edx
and ecx, ecx
btc edx, ecx
mov cx, word [esi]
or edx, 0xc58a02a9
pop eax
mov ax, word [esi + 2]
adc edx, edx
xor dx, 0x9831
adc esi, 2
not cx
add dx, dx
imul dx, dx
not ax
jae 0x10236f7e
or cx, ax
inc dl
mov word [esi], cx
mov ecx, edx
or ecx, edx
jmp edi
mov edx, dword [esp + ecx*2 - 0x323c0008]
xor dword [esp + ecx - 0x191e0005], 0x5a35df35
neg eax
xor ecx, 0x5060f07
jno 0x1024b392
bswap ecx
dec eax
and cx, word [esp + ecx*4 - 0x43c6066]
adc byte [esp + ecx - 0x10f1805], dl
neg dword [esp + edx*4 - 0x64780016]
not eax
ror cx, 0x65
or dword [esp + edx*4 - 0x64780017], ecx
ror dword [esp + ecx*8 - 0x87a05fb], 2
bswap eax
inc eax
rol dx, 0xa5
xor ebx, eax
jmp 0x1017e407

Function at 0x102305c4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [edi + edx*8]
shr ax, 0xc1
add dx, word [edi + edx + 4]
shl eax, 0x44
adc edi, 6
dec al
sal ax, 0x81
pop eax
mov word ss:[eax + ecx - 0x6e4e0000], dx
not byte [esp + eax - 0x6e4dffff]
sbb al, al
mov dword [esp + eax - 0x6e4e0000], esi
ret
add esi, ecx
sal dl, 0x83
mov dword [esp + eax - 0x6e4e0000], eax
jns 0x10222171
Function at 0x10236f9e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea ebp, [ebp + eax*8 - 0x84]
call fcn.101a145b
add ecx, dword [esp + 5]
movzx eax, byte [edi + ecx - 0x47fbd3cb]
lea edi, [ecx + edi - 0x47fbd3ca]
xor edx, 0x922cdb06
dec word [esp + edx - 0x6dd3fd9f]
xor al, bl
mov dword [esp + ecx - 0x47fbd3cb], 0xa535d0b9
pop edx
ror al, 1
bswap ecx
xchg cx, dx
dec al
btr dx, dx
not al
ror al, 1
push ecx
neg ecx
adc dword [esp + ecx*2 - 0x68585e86], ecx
inc al
neg word [esp + ecx*2 - 0x68585e89]
sar ecx, cl
xor al, 0x3c
xadd byte [esp + ecx*8 - 0x342c2ea], ch
xor bl, al
shl cx, 0x24
sar dl, 0xa6
shl dl, 0xe4
lea eax, [esp + eax + 0xc]
mov ecx, dword [eax + ecx*2 - 0xd1cbc0]
jbe 0x1018375a
movzx eax, dl
ja 0x101db63b

Function at 0x1023a300
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
neg cl
xor bl, cl
bt eax, 0x8e
lea ecx, [esp + ecx + 4]
push eax
sbb eax, eax
mov dword [ecx + eax], edx
push eax
mov edx, dword [edi + eax*4 - 5]
sbb eax, 0xb12fa0a2
mov ecx, eax
xor edx, ebx
btc eax, ecx
and ax, word [esp + eax - 0xed05f5b]
shr word [esp + eax - 0xecffffa], 0x81
neg edx
sub ecx, 0x140b4ca7
dec eax
mov dword [esp + eax*2 - 0x1d9ffff6], 0x862e9a3b
ror edx, 3
ror cx, 0x2c
not ecx
call fcn.1017ec47
Function at 0x1023d83d
Capabilities:
Read file on windows
Terminate process

Disassembly:
adc ecx, 0x8da568b3
jmp 0x1021f1da
xor eax, eax
mov dword [esp + eax*2], eax
rol ecx, 2
shl dword [esp + eax], 0x85
pop eax
shl eax, 0xaf
xor ecx, 0x54b7ee37
sal edx, 7
inc dl
sar dx, 0x6f
neg ecx
bts edx, edx
bswap edx
jae 0x101cfecf

Function at 0x1023d869
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov dword [esp], 0xa3060ab
mov word [ebp], dx
movzx edx, cl
push edx
or word [esp + edx*8 - 5], 0x5585
mov eax, dword [edi + edx - 1]
ror word [esp + edx + 5], 0xad
lea edi, [edi + edx + 3]
sar dword [esp + edx], cl
xor eax, ebx
neg eax
inc ecx
xor ecx, edx
not eax
ror cl, 0x46
bt dx, 0xb2
dec word [esp + edx + 4]
adc eax, edx
add edx, 0xcdb8c52d
sal ecx, cl
btc ecx, 0x1d
ror eax, 1
sal edx, 0x38
inc cl
not eax
add cx, dx
inc dword [esp + edx*2 - 0x5bfffffc]
xor ebx, eax
xor edx, ecx
adc esi, eax
pop edx
pop ecx
jmp fcn.10190646

Function at 0x1023d964
Capabilities:
Read file on windows
Terminate process

Disassembly:
ror edx, 1
ror byte [esp + eax - 0x3cb71765], 0xa6
cbw
not edx
and cl, ah
call fcn.101b53b5
mov ecx, 0x3eb8462c
movsx edx, cx
mov eax, ecx
mov ecx, dword [edx + edi - 0x462c]
neg al
inc al
rol edx, 0x9a
lea edi, [eax + edi - 0x3eb846d1]
btr eax, eax
jae 0x101f3053
and ax, dx
xor ecx, ebx
ror ecx, 2
sub dl, al
ja 0x10248385
bt edx, edx
xor ecx, 0x43954139
lea ecx, [ecx + eax - 0x71305fc5]
sar eax, 0xb3
xor ecx, 0xf38c731d
xor al, dh
rol dx, 0xe8
btc eax, edx
xor ebx, ecx
add esi, ecx
movzx eax, byte [edi + eax*4 - 0x1f40]
jmp 0x10194f66