joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fcb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x49a1c8
je 0x46fd70
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46fd58
mov esi, dword [ebx + 4]
jmp 0x46fd52
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46fd42
cmp dword [ebp - 0xc], 4
jne 0x46fd42
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x46fd3a
or dword [eax + 0x9c], ecx
jmp 0x46fd42
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x46fd06
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x46fce9
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x47015e
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4795c9
call fcn.0044ad8c
sub esp, 0x11c
mov eax, dword [0x49ae1c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x470257
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x47022b
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403160
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0047015e
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401340
test bl, bl
jne 0x47022b
or dword [ebp - 4], 0xffffffff
jmp 0x47019c
cmp esi, 0x103
je 0x47023b
cmp esi, 0x3f2
jne 0x47024b
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00447453
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x470f1d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x470f52
cmp edi, dword [esi + 0xc]
jge 0x470f52
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470f52
cmp edi, dword [eax + 8]
jge 0x470f52
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x470f54
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x471058
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x47108c
jmp fcn.00461ba0
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x4710fd
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4711f6
cmp eax, dword [edi + 0xc]
jge 0x4711f6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x47114e
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4711df
cmp dword [ebp + 0xc], ebx
je 0x4711df
jmp 0x471178
push 0x10
call fcn.00470de9
cmp eax, ebx
je 0x471164
mov ecx, eax
call fcn.0047104f
mov esi, eax
jmp 0x471166
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x47118f
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x47119f
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4711b1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00461ba0
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00449cb0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4711f1
cmp ecx, dword [esi + 8]
jge 0x4711f1
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4711f7
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x474826
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc

Function at 0x47483e
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_send]
ret 0xc

Function at 0x4748e6
Capabilities:
Connect socket

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x474e33
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x474e50
cmp dword [ebp + 0xc], edi
je 0x474f45
push 1
push ebx
call fcn.00474884
test eax, eax
jne 0x474f45
push esi
push edi
push ebx
call fcn.00474884
mov esi, eax
cmp esi, edi
jne 0x474e9c
call fcn.00470b12
mov ecx, dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.004628a7
mov esi, eax
cmp esi, edi
je 0x474f44
push edi
push 0xffffffffffffffff
mov dword [esi + 4], ebx
call fcn.00474d53
push edi
push esi
push dword [esi + 4]
call fcn.00474c8c
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
shr ebx, 0x10
dec eax
je 0x474ef5
dec eax
je 0x474eeb
dec eax
dec eax
je 0x474ee1
sub eax, 4
je 0x474ed7
sub eax, 8
je 0x474ecd
sub eax, 0x10
jne 0x474f44
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x30]
jmp 0x474f44
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x2c]
jmp 0x474f44
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x28]
jmp 0x474f44
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x24]
jmp 0x474f44
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x20]
jmp 0x474f44
mov eax, dword [esi + 4]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 8]
push eax
push edi
push edi
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x474f32
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp dword [ebp + 0xc], 1
je 0x474f3c
cmp ebx, edi
je 0x474f44
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x1c]
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x808029
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.008080a8
jae 0x808035
xor ecx, ecx
call fcn.008080a8
jae 0x80805f
xor eax, eax
call fcn.008080a8
jae 0x808070
mov al, 0x10
call fcn.008080a8
adc al, al
jae 0x808051
jne 0x80809d
stosb byte es:[edi], al
jmp 0x808036
call fcn.008080b4
dec ecx
loop 0x80807c
mov eax, ebp
call fcn.008080b2
jmp 0x80809e
lodsb al, byte [esi]
shr eax, 1
je 0x8080c4
adc ecx, 2
mov ebp, eax
jmp 0x80809e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.008080b2
cmp eax, 0x7d00
jae 0x80809c
cmp eax, 0x500
jae 0x80809d
cmp eax, 0x7f
ja 0x80809e
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x808036
pop ebp
ret 8
Function at 0x1922081d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
sub esp, 0xbc
jmp 0x1922083a
pop word [esp]
jmp 0x19220803

Function at 0x19220872
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ebx, byte [ebp]
call 0x19220872
fsubr st(3)
xor al, 0xf
enter 0x648d, 0x24
add dword [ebp + 0x8514], ecx
add byte [eax], al
jmp 0x19220920
mov eax, 0xbdcc7f64
mov edx, 0x91d3abc8
mov dh, 0x85
cmc
jg 0x19220972
jle 0x1922097b
cmp al, 0xbd
sub eax, 0x279dc734
retf 0x869c
lea eax, [edi + edi]
jmp 0x192209ae
lea eax, [edi + edi]
jmp 0x192209ae
stc
jmp 0x192209bc
stc
lea edx, [eax*4]
jmp 0x19220a0e
add bl, cl
mov edx, 0xcabd2688
neg dx
js 0x19220980
jns 0x19220987
lea edx, [eax*4]
jmp 0x19220a0e
xchg dword [esp], edx
mov dword [esp], ebx
lea esp, [esp + 2]
lea edx, [esp + edx]
xchg byte [esp], dl
mov edx, 0xd3887d5d
jmp 0x19220a1c
mov al, bl
push edi
xchg byte [esp], dh
not edx
mov dh, byte [esp + 3]
jmp 0x192209ec
lea esp, [esp + 1]
mov edx, dword [esp]
lea esp, [esp + 1]
jmp 0x19220abf
inc dx
lea edx, [eax + esi]
jmp 0x19220a89
stc
lea edx, [eax*4]
dec dl
jmp 0x19220a4a
stc
lea edx, [eax*4]
dec dl
inc dx
lea edx, [eax + esi]
lea edx, [ebx + edi]
pushfd
bswap edx
jmp 0x19220a95
mov dh, 0xb3
mov dh, 0x5d
pop word [esp]
call 0x19220aa3
pop edx
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x19220ace
add al, 0x26
lea edx, [edx*4]
sub dh, al
js 0x19220a7a
jns 0x19220a63
xor al, 0x48
call fcn.19221d3b
lea edx, [ecx*4]
jmp 0x19221181
mov word [esp + 1], sp

Function at 0x19220aa3
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ebx, byte [ebp]
call 0x19220872
fsubr st(3)
xor al, 0xf
enter 0x648d, 0x24
add dword [ebp + 0x8514], ecx
add byte [eax], al
jmp 0x19220920
mov eax, 0xbdcc7f64
mov edx, 0x91d3abc8
mov dh, 0x85
cmc
jg 0x19220972
jle 0x1922097b
cmp al, 0xbd
sub eax, 0x279dc734
retf 0x869c
lea eax, [edi + edi]
jmp 0x192209ae
lea eax, [edi + edi]
jmp 0x192209ae
stc
jmp 0x192209bc
stc
lea edx, [eax*4]
jmp 0x19220a0e
add bl, cl
mov edx, 0xcabd2688
neg dx
js 0x19220980
jns 0x19220987
lea edx, [eax*4]
jmp 0x19220a0e
xchg dword [esp], edx
mov dword [esp], ebx
lea esp, [esp + 2]
lea edx, [esp + edx]
xchg byte [esp], dl
mov edx, 0xd3887d5d
jmp 0x19220a1c
mov al, bl
push edi
xchg byte [esp], dh
not edx
mov dh, byte [esp + 3]
jmp 0x192209ec
lea esp, [esp + 1]
mov edx, dword [esp]
lea esp, [esp + 1]
jmp 0x19220abf
inc dx
lea edx, [eax + esi]
jmp 0x19220a89
stc
lea edx, [eax*4]
dec dl
jmp 0x19220a4a
stc
lea edx, [eax*4]
dec dl
inc dx
lea edx, [eax + esi]
lea edx, [ebx + edi]
pushfd
bswap edx
jmp 0x19220a95
mov dh, 0xb3
mov dh, 0x5d
pop word [esp]
call 0x19220aa3
pop edx
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x19220ace
add al, 0x26
lea edx, [edx*4]
sub dh, al
js 0x19220a7a
jns 0x19220a63
xor al, 0x48
call fcn.19221d3b
lea edx, [ecx*4]
jmp 0x19221181
mov word [esp + 1], sp
Function at 0x19220da8
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
sub esp, 3
not edx
lea esp, [esp + 0x1f]
lea edx, [0x6d8a64a2]
bswap edx
mov edx, 0x13512423
neg dh
jmp 0x19220dcb
neg al
sub esp, 0x1d
jb 0x19220d11
clc
jmp 0x19220d76
lea edx, [0x6d8a64a2]
jmp 0x19220d21
mov edx, 0xb18b380c
mov dh, byte [esp]
mov dh, 0x84
jmp 0x19220d9d
lea esp, [esp + 1]
jmp 0x19220d9f
sub esp, 3
not edx
lea esp, [esp + 0x1f]
jmp 0x19220d3a
lea edx, [edx + ebp]
mov edx, 0xb18b380c
mov dh, byte [esp]
mov dh, 0x84
jmp 0x19220d30
add al, 0xeb
push esi
call 0x19220da8
adc esp, dword [esi + 0x5a]
xchg word [esp + 1], dx
pop dx
jmp 0x19220ee7
js 0x19220d5d
lea esp, [esp + 1]
jmp 0x19220d9f
neg eax
jl 0x19220dfb
neg ax
not dh
jmp 0x19220e5c
lea esp, [esp + 2]
lea esp, [esp + 8]
add cl, al
mov eax, 0x95a53eec
jmp 0x19220dd3
neg ax
not dh
jmp 0x19220e5c
setg al
xchg dx, ax
lea eax, [ecx*4]
adc dh, ch
lea edx, [esp + esi]
jmp 0x19220e66
pop word [esp + 4]
mov dh, byte [esp + 1]
jmp 0x19220dea
cmc
jbe 0x19220e19
pop word [esp + 4]
mov dh, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x19220dee
setg al
xchg dx, ax
lea eax, [ecx*4]
jmp 0x19220e8f
inc ebp
not dh
neg dx
jns 0x19220e02
js 0x19220e45
mov ax, word [esp]
btr edx, ecx
jmp 0x19220eac
mov dh, byte [esp]
xchg dh, al
bswap edx
mov ax, word [esp]
mov al, 0x47
jmp 0x19220ece
adc dh, ch
lea edx, [esp + esi]
jmp 0x19220e66
bswap edx
mov ax, word [esp]
mov al, 0x47
jmp 0x19220ece
jp 0x19220e73
mov dh, byte [esp]
xchg dh, al
jmp 0x19220e96
shl edx, 0x17
not dx
sub esp, 3
mov edx, dword [esp]
lea esp, [esp + 3]
jmp 0x19220f20
inc bl
mov dx, cx
neg dl
jae 0x19220eb5
jb 0x19220f6a
sub al, 0xad
cmp eax, 0x8dedb744
retf 0x7c7
seto dh
xchg dword [esp], edx
push dword [esp + 1]
mov dl, ch
mov dl, bh
push dword [esp + 7]
jmp 0x19220e33
mov edx, esp
mov dx, 0x49c9
sub esp, 0xf
jb 0x19220f41
pop dword [esp + 2]
lea esp, [esp + 3]
jmp 0x19220f4f
not bl
lea eax, [edi + edi]
not dh
rdtsc
mov dh, byte [esp]
jmp 0x19220efe
mov edx, dword [esp]
lea esp, [esp + 3]
jmp 0x19220f20
pop dword [esp + 2]
jmp 0x19220f4b
lea esp, [esp + 3]
lea esp, [esp + 8]
ror bl, 0
neg ax
jmp 0x1922102c
shl edx, 0x17
not dx
sub esp, 3
jmp 0x19220f38
neg dh
jge 0x19220fd0
adc dl, dl
or dh, 0xa7
mov eax, dword [esp]
jmp 0x19220fa0
stc
and dh, ch
rdtsc
jmp 0x1922107b
add bl, 0x6a
btr edx, esi
jno 0x19221008
mov al, cl
mov ax, 0x33ad
mov edx, esp
mov eax, dword [esp]
jmp 0x19220ff7
mov eax, dword [esp]
jmp 0x19220fa0
adc dl, dl
or dh, 0xa7
jmp 0x19220fb9
mov ax, 0x33ad
mov edx, esp
mov eax, dword [esp]
call fcn.19220fd7
add eax, 0x8d7e1b8b
mov cl, 0x11
or byte [ebx - 0xa], al
push 0x52
mov al, cl
jmp 0x19220fee
js 0x19221071
rdtsc
not ax
jmp 0x19220f96
rdtsc
not ax
stc
and dh, ch
rdtsc
mov ax, bx
jmp 0x19220f75
not dx
inc edx
je 0x19220d90
lea edx, [edx + ebp]
jmp 0x19220d51
lea esp, [esp + 4]
inc al
mov dx, word [esp]
jmp 0x192210a8
Function at 0x19221d3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx*4]
mov word [esp + 1], sp
jmp fcn.19221186
mov dx, word [esp]
xchg dword [esp], edx
bt dx, di
js 0x19220ad5
jns 0x19220ae2
lea esp, [esp + 2]
lea ebx, [ebx + 0x2d]
stc
push dx
cmc
pushfd
jmp 0x19221d6a
mov dword [esp], ecx
lea esp, [esp + 2]
xchg dword [esp + 0x3c], ebx
call fcn.19221dbb
lodsb al, byte [esi]
invalid
Function at 0x1922afd8
Capabilities:
Decompress data using aplib

Disassembly:
call int.1926dc59
jmp 0x1922afad

Function at 0x19239270
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x192392b5
lea esp, [esp + 1]
mov dword [esp + 0x2c], esi
pushal
pop dword [esp + 0x12]
pop word [esp + 0x10]
call fcn.19239272
rdtsc
rdtsc
not bp
jmp 0x1923931a
mov esi, dword [esp + 0x28]
bswap eax
sub esp, 0xa
jb 0x19239304
jae 0x19239345
pop word [esp + 1]
mov ecx, 0x716df60c
jmp 0x19239327

Function at 0x19239272
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dx
jmp 0x1923929f
pop dword [esp + 0xd]
lea esp, [esp + 0x10]
push dword [esp + 2]
mov dword [esp + 0x38], edi
jmp 0x192392e2
lea esp, [esp + 0x38]
pushfd
dec cl
jle 0x192392cc
jg 0x1923939b
call 0x192392f6
jmp 0x1923afc8
mov dword [esp + 0x24], eax
jmp 0x1923b00a
rdtsc
rdtsc
not bp
jmp 0x1923931a
mov ecx, 0x6525390e
mov ecx, dword [esp]
pushfd
lea esp, [esp + 8]
jmp 0x1923b020
popal
jmp 0x1923b05e
sub ecx, 0x1001120e
mov dword [ecx + 0x10012e3c], eax
movzx ebx, byte [eax]
jmp 0x1923b045
add ebx, 0x6c02869c
jmp 0x1923b088
popfd
ret
cmp ebx, 0x6c028768
je 0x1923b0ec
jne 0x19239310

Function at 0x192647eb
Capabilities:
Encrypt data using aes

Disassembly:
mov ah, byte [esp]
pushal
mov byte [esp + 6], dh
mov eax, dword [esp + 0xb]
mov eax, dword [ebp - 8]
jmp 0x19264776
lea esp, [esp + 0x24]
jl 0x192295e8
jge 0x1926478c

Function at 0x19264aa8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
clc
jmp 0x19264adb
push edx
mov edx, edi
lea edx, [edx*4]
jmp 0x19264ac5

Function at 0x192658e7
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x19265904

Function at 0x19265edb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x19265f60
popal
lea ebx, [ebx*4]
lea ebx, [ebx + 0x19236ec0]
mov edi, dword [ebx]
pop ebx
jmp 0x19265f23
lea ecx, [eax + 0xfc]
mov dword [esp + 0x34], edi
push ax
pushfd
lea esp, [esp + 2]
lea esp, [esp + 0x28]
jmp 0x19265f39
Function at 0x19265f77
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, 0x57fad249
jmp 0x19266331
xor edi, dword [ebx*4 + 0x192372c0]
sub esp, 0x16
sub esp, 0x15
jmp 0x19266255
and ebx, ecx
push si
mov word [esp], di
add esp, 1
lea esp, [esp + 1]
jmp 0x192661a8
and edx, ecx
call fcn.192661e5
xor dh, 0xd6
jmp 0x192662d3
lea esp, [esp + 3]
lea esp, [esp + 0x28]
movzx ebx, byte [esi + 0xd]
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x19266220
mov edi, edx
pushfd
add esp, 0
add esp, 2
mov word [esp], ax
jmp 0x192662b0
pushal
pop di
neg di
push dword [esp + 0x1b]
lea esp, [esp + 2]
jmp 0x1926626a
neg edi
pushal
mov edi, dword [esp + 1]
pop dword [esp + 0x14]
mov ebx, dword [ebx*4 + 0x19236ac0]
jmp 0x19266280
lea esp, [esp + 2]
shr edi, 0x18
call 0x192662bd
adc byte [esi - 0x71], ah
add al, 0x24
sub esp, 0xd
lea esp, [esp + 3]
jmp 0x192662f9
mov edx, dword [esi + 0xc]
push cx
lea esp, [esp + 2]
mov dword [esi + 8], edi
jmp 0x1926629c
and ebx, ecx
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + 0x192376c0]
push ax
jmp 0x1926630b
mov edi, dword [edi*4 + 0x19236ac0]
and edi, ecx
mov edi, dword [edi*4 + 0x19236ec0]
jmp 0x192662e1
sub esp, 2
mov bx, 0xf13e
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xe]
clc
jmp 0x1926635b
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + 0x19236ac0]
jmp 0x192661be
mov eax, ebx
jmp 0x1926637b
stc
push si
lea esp, [esp + 2]
push eax
jmp 0x19266345
mov byte [esp + 1], bh
jmp 0x192665fc
lea eax, [eax*4]
lea eax, [eax + 0x19236ac0]
mov ebx, dword [eax]
pop eax
pushfd
jmp 0x19266365
xor edi, dword [ebx*4 + 0x192372c0]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x192665d2
lea esp, [esp + 2]
and ebx, ecx
cmc
lea esp, [esp + 4]
jmp 0x192665a2
and edx, ecx
call 0x192665da
xor byte [eax - 0x73], dl
and al, 0x20
xor edi, dword [edx*4 + 0x19237ac0]
jmp 0x19266631
and edx, ecx
mov edx, dword [edx*4 + 0x19236ac0]
push si
clc
jmp 0x192665c5
push esp
lea esp, [esp + 4]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
call fcn.1926660a
mov esi, dword [esp]
mov ebx, 0x547e1e31
lea esp, [esp + 4]
pop ebx
jmp 0x19266686
push esi
push dword [esp]
lea esp, [esp + 8]
leave
call fcn.19266670

Function at 0x192661e5
Capabilities:
Encrypt data using aes

Disassembly:
mov esi, edx
jmp 0x192661ff
push ebp
push esi
jmp 0x192661cf
and edx, ecx
cmc
push si
lea esp, [esp + 2]
jmp 0x1926623d
lea esi, [esi*4]
lea esi, [esi + 0x19236ac0]
mov edx, dword [esi]
pop esi
jmp 0x192661e9
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x19237ac0]
lea edx, [eax + 0x3f42]
jmp 0x19266227
Function at 0x192662bd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, 0x57fad249
jmp 0x19266331
xor edi, dword [ebx*4 + 0x192372c0]
sub esp, 0x16
sub esp, 0x15
jmp 0x19266255
and ebx, ecx
push si
mov word [esp], di
add esp, 1
lea esp, [esp + 1]
jmp 0x192661a8
and edx, ecx
call fcn.192661e5
xor dh, 0xd6
jmp 0x192662d3
lea esp, [esp + 3]
lea esp, [esp + 0x28]
movzx ebx, byte [esi + 0xd]
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x19266220
mov edi, edx
pushfd
add esp, 0
add esp, 2
mov word [esp], ax
jmp 0x192662b0
pushal
pop di
neg di
push dword [esp + 0x1b]
lea esp, [esp + 2]
jmp 0x1926626a
neg edi
pushal
mov edi, dword [esp + 1]
pop dword [esp + 0x14]
mov ebx, dword [ebx*4 + 0x19236ac0]
jmp 0x19266280
lea esp, [esp + 2]
shr edi, 0x18
call 0x192662bd
adc byte [esi - 0x71], ah
add al, 0x24
sub esp, 0xd
lea esp, [esp + 3]
jmp 0x192662f9
mov edx, dword [esi + 0xc]
push cx
lea esp, [esp + 2]
mov dword [esi + 8], edi
jmp 0x1926629c
and ebx, ecx
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + 0x192376c0]
push ax
jmp 0x1926630b
mov edi, dword [edi*4 + 0x19236ac0]
and edi, ecx
mov edi, dword [edi*4 + 0x19236ec0]
jmp 0x192662e1
sub esp, 2
mov bx, 0xf13e
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xe]
clc
jmp 0x1926635b
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + 0x19236ac0]
jmp 0x192661be
mov eax, ebx
jmp 0x1926637b
stc
push si
lea esp, [esp + 2]
push eax
jmp 0x19266345
mov byte [esp + 1], bh
jmp 0x192665fc
lea eax, [eax*4]
lea eax, [eax + 0x19236ac0]
mov ebx, dword [eax]
pop eax
pushfd
jmp 0x19266365
xor edi, dword [ebx*4 + 0x192372c0]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x192665d2
lea esp, [esp + 2]
and ebx, ecx
cmc
lea esp, [esp + 4]
jmp 0x192665a2
and edx, ecx
call 0x192665da
xor byte [eax - 0x73], dl
and al, 0x20
xor edi, dword [edx*4 + 0x19237ac0]
jmp 0x19266631
and edx, ecx
mov edx, dword [edx*4 + 0x19236ac0]
push si
clc
jmp 0x192665c5
push esp
lea esp, [esp + 4]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
call fcn.1926660a
mov esi, dword [esp]
mov ebx, 0x547e1e31
lea esp, [esp + 4]
pop ebx
jmp 0x19266686
push esi
push dword [esp]
lea esp, [esp + 8]
leave
call fcn.19266670