joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7eaf14
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005853b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [reloc.PSAPI.DLL_GetMappedFileNameW]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], reloc.PSAPI.DLL_GetMappedFileNameW
call fcn.007fc8f4
push 4
mov dword [ebp - 4], 0
call fcn.007ec75b
mov edi, eax
add esp, 4
test edi, edi
je 0x7eaf94
call fcn.007fc368
mov dword [edi], eax
call fcn.007fc127
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.007fc05c
mov eax, dword [ebx + 4]
cmp eax, reloc.PSAPI.DLL_GetMappedFileNameW
jae 0x7eaf8a
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.007fc084
jmp 0x7eaf96
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x803b34
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
mov ecx, edx
shr eax, 8
or eax, esi
mov esi, edx
shr esi, 0x10
push edi
mov edi, dword [ebp + 0xc]
and ecx, 0xff0000
or ecx, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr ecx, 8
or ecx, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 0xc]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov edi, ebx
and edi, 0xff0000
mov dword [ebp + 8], ebx
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 4]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 0xc], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
or edi, ebx
mov dword [ebp + 8], edi
mov edi, 0x10
mov dword [ebp + 0xc], 0
sub dword [ebp + 0xc], reloc.PSAPI.DLL_GetMappedFileNameW
dec edi
mov dword [ebp - 8], edi
mov edi, ecx
shr edi, 5
add edi, esi
mov ebx, ecx
shl ebx, 4
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, ecx
xor edi, ebx
add eax, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp + 8]
mov ebx, eax
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, eax
xor edi, ebx
add ecx, edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x803c56
mov esi, eax
and esi, 0xff0000
mov edx, eax
shr edx, 0x10
or esi, edx
mov edx, eax
shl eax, 0x10
shr esi, 8
and edx, 0xff00
or edx, eax
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
shr eax, 8
pop edi
or eax, esi
pop esi
mov dword [edx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x803cf4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
mov eax, edx
shr ecx, 8
or ecx, esi
mov esi, edx
shr esi, 0x10
push edi
mov edi, dword [ebp + 0xc]
and eax, 0xff0000
or eax, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr eax, 8
or eax, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 0xc]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov edi, ebx
and edi, 0xff0000
mov dword [ebp + 8], ebx
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 4]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 0xc], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
or edi, ebx
mov dword [ebp + 8], edi
mov edi, 0x10
mov dword [ebp + 0xc], 0xe3779b90
dec edi
mov dword [ebp - 8], edi
mov edi, ecx
shr edi, 5
add edi, dword [ebp + 8]
mov ebx, ecx
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
add edi, esi
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0x61c88647
add ebx, eax
xor edi, ebx
sub ecx, edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x803e16
mov esi, ecx
and esi, 0xff0000
mov edx, ecx
shr edx, 0x10
or esi, edx
mov edx, ecx
shl ecx, 0x10
shr esi, 8
and edx, 0xff00
or edx, ecx
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
shr ecx, 8
pop edi
or ecx, esi
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x804384
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, reloc.PSAPI.DLL_GetMappedFileNameW
test ecx, ecx
je 0x8043b3
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
inc edx
dec ecx
jne 0x804396
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x805b04
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005853b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [reloc.PSAPI.DLL_GetMappedFileNameW]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], reloc.PSAPI.DLL_GetMappedFileNameW
call fcn.007fc8f4
push 4
mov dword [ebp - 4], 0
call fcn.007ec75b
mov edi, eax
add esp, 4
test edi, edi
je 0x805b84
call fcn.007fc368
mov dword [edi], eax
call fcn.007fc127
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.007fc05c
mov eax, dword [ebx + 4]
cmp eax, reloc.PSAPI.DLL_GetMappedFileNameW
jae 0x805b7a
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.007fc084
jmp 0x805b86
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x811e74
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], reloc.PSAPI.DLL_GetMappedFileNameW
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x82c464
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x82c47d
mov edi, ebx
mov ebx, eax
jmp 0x82c47f
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jg 0x82c48f
mov eax, esi
jmp 0x82c499
push eax
push esi
call fcn.0080ffa4
add esp, 8
test eax, eax
jne 0x82c4a1
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x82c4bf
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x82c4a8
cmp eax, dword [edi + 4]
jge 0x82c4d6
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x82c4c4
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x82c4fa
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, reloc.PSAPI.DLL_GetMappedFileNameW
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x82c4fa
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x82c4e9
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0xa4a263
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0xc6
neg dh
jge 0xa4a303
rol dh, cl
jmp 0xa4a2d2
xchg word [esp], ax
mov ax, word [esp]
jmp 0xa4a24a
mov eax, ebx
pop eax
lea edx, [edx*4]
jmp 0xa4a2b3
mov eax, ebx
pop eax
lea edx, [edx*4]
lea esp, [esp + 1]
mov edx, ebx
mov ax, 0x32e6
mov ah, 0xbe
bts eax, edi
jmp 0xa4a2d8
lea esp, [esp + 1]
jmp 0xa4a297
lea eax, [ecx + edx]
mov al, byte [esp]
inc eax
mov eax, 0x20c41c87
jmp 0xa4a330
bsf dx, bx
jmp 0xa4a309
js 0xa4a2b9
lea eax, [ecx + edx]
mov al, byte [esp]
jmp 0xa4a2e6
inc eax
mov eax, 0x20c41c87
jmp 0xa4a330
rol dh, cl
bsf dx, bx
sub ebx, ecx
sub esp, 0x19
je 0xa4a289
jne 0xa4a26d
push dword [esp + 2]
jbe 0xa4a336
mov al, byte [esp]
mov word [esp + 4], bx
jmp 0xa4a40e
dec edx
call 0xa4a31a
mov al, byte [esp]
jmp 0xa4a6ea
jnp 0xa4a36b
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0xa4a371
mov ax, bx
mov al, dh
cmp ax, bp
jge 0xa4a391
mov al, 0x51
mov ax, word [esp]
jmp 0xa4a395
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
inc edx
lea eax, [ebp*4]
jmp 0xa4a349
mov ax, word [esp]
jmp 0xa4a395
mov al, 0x51
jmp 0xa4a37b
neg edx
bswap eax
lea eax, [eax + edi]
lea eax, [edx*4]
neg ax
jmp 0xa4a3bd
lea esp, [esp + 8]
neg edx
mov ax, word [esp]
mov ax, 0x3cd5
stc
jmp 0xa4a33f
js 0xa4a3d7
mov eax, ebp
jmp 0xa4a3d9
mov eax, ebp
inc edx
lea eax, [ecx + edx]
jmp 0xa4a3e3
mov ax, cx
mov ah, byte [esp]
not ah
neg ax
jmp 0xa4a459
mov al, ah
mov eax, 0x36e6d13a
jmp 0xa4a434
xchg dword [esp + 2], eax
bswap eax
push word [esp + 3]
jmp 0xa4a6fa
rdtsc
jmp 0xa4a442
sub ecx, edx
cmp edx, ecx
jns 0xa4a41e
rdtsc
jmp 0xa4a636
sub esp, 8
jmp 0xa4a5a3
jo 0xa4a3f4
mov al, ah
mov eax, 0x36e6d13a
jmp 0xa4a434
mov dx, word [esp + 9]
lea esp, [esp + 2]
jmp 0xa4a492
jmp 0xa4a464
mov edx, 0xbcc5cb79
mov edx, dword [esp]
jmp 0xa4a49e
lea esp, [esp + 0x18]
inc ebx
neg ax
jnp 0xa4a47c
jp 0xa4a507
not ebx
bsf eax, esp
jb 0xa4a4ec
not eax
xchg edx, eax
bt dx, ax
jmp 0xa4a516
rdtsc
sub esp, 0x1a
mov dx, word [esp + 9]
clc
jp 0xa4a47a
mov dx, word [esp + 9]
lea esp, [esp + 2]
jmp 0xa4a492
shr dh, cl
mov ax, bp
rdtsc
jmp 0xa4a4b6
not eax
jmp 0xa4a511
mov edx, 0xbcc5cb79
mov edx, dword [esp]
jmp 0xa4a49e
xchg edx, eax
bt dx, ax
call fcn.00a4a4f0
jmp 0xa4a553
jmp 0xa4a53d
mov al, 0x2c
btc edx, eax
add ah, dl
jmp 0xa4a584
setnp dl
jmp 0xa4a4e3
xchg al, dh
mov eax, dword [esp]
inc edx
jmp 0xa4a51f
lea esp, [esp + 4]
neg ebx
mov dx, word [esp]
dec ax
js 0xa4a51d
xchg al, dh
mov eax, dword [esp]
inc edx
mov al, 0x2c
btc edx, eax
jmp 0xa4a524
mov al, cl
jmp 0xa4a5d8
not ebx
or eax, ebx
jp 0xa4a56e
mov al, cl
neg dh
jmp 0xa4a5da
sub esi, 4
shr dh, 0
jge 0xa4a538
setnp dl
shr dh, cl
mov ax, bp
rdtsc
rdtsc
jmp 0xa4a4b8
neg dh
call fcn.00a4a5bc
sub esp, 8
jmp 0xa4a5a3
mov word [esp + 4], bx
xchg dword [esp + 2], eax
bswap eax
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xa4a3ac
Function at 0xa4a31a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0xc6
neg dh
jge 0xa4a303
rol dh, cl
jmp 0xa4a2d2
xchg word [esp], ax
mov ax, word [esp]
jmp 0xa4a24a
mov eax, ebx
pop eax
lea edx, [edx*4]
jmp 0xa4a2b3
mov eax, ebx
pop eax
lea edx, [edx*4]
lea esp, [esp + 1]
mov edx, ebx
mov ax, 0x32e6
mov ah, 0xbe
bts eax, edi
jmp 0xa4a2d8
lea esp, [esp + 1]
jmp 0xa4a297
lea eax, [ecx + edx]
mov al, byte [esp]
inc eax
mov eax, 0x20c41c87
jmp 0xa4a330
bsf dx, bx
jmp 0xa4a309
js 0xa4a2b9
lea eax, [ecx + edx]
mov al, byte [esp]
jmp 0xa4a2e6
inc eax
mov eax, 0x20c41c87
jmp 0xa4a330
rol dh, cl
bsf dx, bx
sub ebx, ecx
sub esp, 0x19
je 0xa4a289
jne 0xa4a26d
push dword [esp + 2]
jbe 0xa4a336
mov al, byte [esp]
mov word [esp + 4], bx
jmp 0xa4a40e
dec edx
call 0xa4a31a
mov al, byte [esp]
jmp 0xa4a6ea
jnp 0xa4a36b
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0xa4a371
mov ax, bx
mov al, dh
cmp ax, bp
jge 0xa4a391
mov al, 0x51
mov ax, word [esp]
jmp 0xa4a395
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
inc edx
lea eax, [ebp*4]
jmp 0xa4a349
mov ax, word [esp]
jmp 0xa4a395
mov al, 0x51
jmp 0xa4a37b
neg edx
bswap eax
lea eax, [eax + edi]
lea eax, [edx*4]
neg ax
jmp 0xa4a3bd
lea esp, [esp + 8]
neg edx
mov ax, word [esp]
mov ax, 0x3cd5
stc
jmp 0xa4a33f
js 0xa4a3d7
mov eax, ebp
jmp 0xa4a3d9
mov eax, ebp
inc edx
lea eax, [ecx + edx]
jmp 0xa4a3e3
mov ax, cx
mov ah, byte [esp]
not ah
neg ax
jmp 0xa4a459
mov al, ah
mov eax, 0x36e6d13a
jmp 0xa4a434
xchg dword [esp + 2], eax
bswap eax
push word [esp + 3]
jmp 0xa4a6fa
rdtsc
jmp 0xa4a442
sub ecx, edx
cmp edx, ecx
jns 0xa4a41e
rdtsc
jmp 0xa4a636
sub esp, 8
jmp 0xa4a5a3
jo 0xa4a3f4
mov al, ah
mov eax, 0x36e6d13a
jmp 0xa4a434
mov dx, word [esp + 9]
lea esp, [esp + 2]
jmp 0xa4a492
jmp 0xa4a464
mov edx, 0xbcc5cb79
mov edx, dword [esp]
jmp 0xa4a49e
lea esp, [esp + 0x18]
inc ebx
neg ax
jnp 0xa4a47c
jp 0xa4a507
not ebx
bsf eax, esp
jb 0xa4a4ec
not eax
xchg edx, eax
bt dx, ax
jmp 0xa4a516
rdtsc
sub esp, 0x1a
mov dx, word [esp + 9]
clc
jp 0xa4a47a
mov dx, word [esp + 9]
lea esp, [esp + 2]
jmp 0xa4a492
shr dh, cl
mov ax, bp
rdtsc
jmp 0xa4a4b6
not eax
jmp 0xa4a511
mov edx, 0xbcc5cb79
mov edx, dword [esp]
jmp 0xa4a49e
xchg edx, eax
bt dx, ax
call fcn.00a4a4f0
jmp 0xa4a553
jmp 0xa4a53d
mov al, 0x2c
btc edx, eax
add ah, dl
jmp 0xa4a584
setnp dl
jmp 0xa4a4e3
xchg al, dh
mov eax, dword [esp]
inc edx
jmp 0xa4a51f
lea esp, [esp + 4]
neg ebx
mov dx, word [esp]
dec ax
js 0xa4a51d
xchg al, dh
mov eax, dword [esp]
inc edx
mov al, 0x2c
btc edx, eax
jmp 0xa4a524
mov al, cl
jmp 0xa4a5d8
not ebx
or eax, ebx
jp 0xa4a56e
mov al, cl
neg dh
jmp 0xa4a5da
sub esi, 4
shr dh, 0
jge 0xa4a538
setnp dl
shr dh, cl
mov ax, bp
rdtsc
rdtsc
jmp 0xa4a4b8
neg dh
call fcn.00a4a5bc
sub esp, 8
jmp 0xa4a5a3
mov word [esp + 4], bx
xchg dword [esp + 2], eax
bswap eax
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xa4a3ac
Function at 0xa67e60
Capabilities:
Encrypt data using aes

Disassembly:
pushal
mov dword [esp + 0x18], eax
sub esp, 0x18
lea esp, [esp + 0x18]
popal
jmp 0xa67e2b
xor edx, esi
xchg edi, ebp
sub esp, 0x14
push ecx
jmp 0xa67df5
shl edx, 8
jmp 0xa67e3b
add ecx, 0xb
movzx esi, byte [ecx]
pop ecx
sub esp, 0xd
lea esp, [esp + 1]
jmp 0xa67e15
xor edx, esi
neg bh
neg si
mov dword [ecx + 8], edx
jmp 0xa67f3f
lea edi, reloc.PSAPI.DLL_GetMappedFileNameW
sbb di, 0xa28f
jmp 0xa67e85
xchg di, bp
lea ebx, [edx - 0x92]
mov byte [esp + 2], al
jmp 0xa67e0b
bswap edi
jmp 0xa67ea8
xor edx, esi
movzx esi, byte [eax + 0xe]
mov ebx, dword [esp]
inc bl
jmp 0xa67e6f
xor edx, esi
jmp 0xa67ec8
movzx eax, byte [eax + 0xf]
shl edx, 8
cmc
jmp 0xa67e92
mov dword [ecx + 0xc], edx
jmp 0xa67eeb
shl edx, 8
btr esi, esp
mov bl, byte [esp]
xor edx, eax
jmp 0xa67eb2
mov esi, 0xff
lea edi, [esp + eax]
jmp 0xa67f0a
mov eax, edx
mov edi, esp
shr eax, 0x10
jmp 0xa67ed5
lea esp, [esp + 2]
jmp 0xa67f16
and eax, esi
neg ebp
dec edi
or edi, eax
sub esp, 2
jmp 0xa67ef4
mov eax, dword [eax*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
xchg ebx, edi
lea esp, [esp + 0x30]
xor eax, 0x1000000
jmp 0xa67f65
movzx edx, byte [eax + 0xc]
movzx esi, byte [eax + 0xd]
shl edx, 8
jmp 0xa67e4a
shr edi, 8
mov bp, word [esp]
jmp 0xa67f8a
pushal
mov ah, byte [esp]
mov dword [esp], edx
popal
mov ebp, 0x881432c1
jmp 0xa67f4f
mov edi, dword [edi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov bh, ch
jmp 0xa67f94
and edi, esi
bsf ebp, esi
pushfd
bswap ebp
jmp 0xa67f74
lea esp, [esp + 4]
and edi, 0xff0000
mov bl, 0x44
push esi
jmp 0xa67fa7
mov esi, ecx
add esi, 4
mov ebx, dword [esi]
pop esi
jmp 0xa68044
shl ebp, cl
call 0xa67fc7
sub esp, 2
lea esp, [esp + 2]
and eax, 0xff000000
xor eax, edi
jmp 0xa67fe4

Function at 0xa6857d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
popal
mov edi, dword [ebp]
pop ebp
jmp 0xa68599
lea esp, [esp + 4]
jmp 0xa68567
mov dword [edx], edi
stc
mov dword [ecx], eax
mov ah, byte [esp]
mov eax, dword [edx + 4]
jmp 0xa68583

Function at 0xa68619
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xa68652
lea esp, [esp + 0x30]
sub ebx, 4
stc
add ecx, 0x10
jmp 0xa6863c

Function at 0xa6871d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 1]
jmp 0xa68738
sub esp, 0x19
jmp 0xa68707
shr edi, 0x18
mov edi, dword [edi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
and edi, ecx
call fcn.00a68722
aaa
mov ah, 0x2a
dec ebp
mov esp, 0x31a12354
push eax
mov dword [reloc.PSAPI.DLL_GetMappedFileNameW], eax

Function at 0xa68815
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xa688ab
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
pushal
push si
lea esp, [esp + 2]
jmp 0xa68841
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
and edx, ecx
jmp 0xa6886b

Function at 0xa6887f
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esi], edi
mov ebx, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
or edi, 0xa4de69ab
jmp 0xa68849
Function at 0xa689ac
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [esi + 8]
jmp 0xa689e0
mov word [esp + 1], cx
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68996
mov dword [esi + 4], edi
mov edi, 0x104b999
push ecx
jmp 0xa68da2
mov edi, edx
clc
shr edi, 0x18
call fcn.00a68a25
cmc
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68abf
movzx ebx, byte [esi + 0xa]
call fcn.00a68a8d
lea esp, [esp + 2]
and ebx, ecx
push ecx
push edx
call 0xa68ad6
pop edx
jmp 0xa68b15
movzx ebx, byte [esi + 0xd]
and edx, ecx
jmp 0xa68aff
mov edx, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
pushfd
jmp 0xa68b29
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
bswap ebx
xchg bh, bl
not bx
jmp 0xa68ad8
and edx, ecx
sub esp, 0xe
add esp, 4
push ebp
pop dword [esp]
jmp 0xa68b3b
lea esp, [esp + 2]
jmp 0xa68b8b
mov dword [esi + 8], edi
mov di, word [esp]
push ebx
dec edi
jmp 0xa68bd9
push sp
lea esp, [esp + 2]
jmp 0xa68b5e
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edx, edi
mov edx, dword [esi + 0xc]
jmp 0xa68b74
sub esp, 5
lea esp, [esp + 1]
jmp 0xa68bc2
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [eax]
pop eax
not edi
mov edi, edx
jmp 0xa68b9d
shr edi, 0x18
call fcn.00a68bfb
retf 0xd84a
push eax
mov eax, ebx
lea eax, [eax*4]
jmp 0xa68bb3
popal
lea ecx, [ecx*4]
lea ecx, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [ecx]
pop ecx
jmp 0xa68a74
pushal
mov dword [esp + 0x18], ebx
sub esp, 0xb
push word [esp + 2]
lea esp, [esp + 5]
lea esp, [esp + 8]
jmp 0xa68c14

Function at 0xa68a25
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
jmp 0xa68a3d
jmp 0xa68a0f
pop ebp
cmc
jmp 0xa68a51
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.PSAPI.DLL_GetMappedFileNameW
mov edi, dword [ebp]
jmp 0xa68a27
and edi, ecx
call 0xa68a59
xchg edi, edi
je 0xa68a80
add esp, dword [esi - 0x71]
inc esp
and al, 1
lea esp, [esp + 2]
jmp 0xa68b52
mov edi, dword [edi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
call fcn.00a68af3
Function at 0xa68a7f
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [esi + 8]
jmp 0xa689e0
mov word [esp + 1], cx
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68996
mov dword [esi + 4], edi
mov edi, 0x104b999
push ecx
jmp 0xa68da2
mov edi, edx
clc
shr edi, 0x18
call fcn.00a68a25
cmc
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68abf
movzx ebx, byte [esi + 0xa]
call fcn.00a68a8d
lea esp, [esp + 2]
and ebx, ecx
push ecx
push edx
call 0xa68ad6
pop edx
jmp 0xa68b15
movzx ebx, byte [esi + 0xd]
and edx, ecx
jmp 0xa68aff
mov edx, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
pushfd
jmp 0xa68b29
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
bswap ebx
xchg bh, bl
not bx
jmp 0xa68ad8
and edx, ecx
sub esp, 0xe
add esp, 4
push ebp
pop dword [esp]
jmp 0xa68b3b
lea esp, [esp + 2]
jmp 0xa68b8b
mov dword [esi + 8], edi
mov di, word [esp]
push ebx
dec edi
jmp 0xa68bd9
push sp
lea esp, [esp + 2]
jmp 0xa68b5e
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edx, edi
mov edx, dword [esi + 0xc]
jmp 0xa68b74
sub esp, 5
lea esp, [esp + 1]
jmp 0xa68bc2
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [eax]
pop eax
not edi
mov edi, edx
jmp 0xa68b9d
shr edi, 0x18
call fcn.00a68bfb
retf 0xd84a
push eax
mov eax, ebx
lea eax, [eax*4]
jmp 0xa68bb3
popal
lea ecx, [ecx*4]
lea ecx, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [ecx]
pop ecx
jmp 0xa68a74
pushal
mov dword [esp + 0x18], ebx
sub esp, 0xb
push word [esp + 2]
lea esp, [esp + 5]
lea esp, [esp + 8]
jmp 0xa68c14

Function at 0xa68a8d
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0xa68aa9
mov ebx, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
sub esp, 8
pop word [esp + 2]
jmp 0xa68ac8