joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4076c0
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4076c0
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x407673
test edx, 3
jne 0x407662
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40766d
jmp 0x407673
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x407673
cmp dword [ecx - 8], 1
je 0x40767d
mov edx, ebx
or edx, 3
call fcn.00404b78
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40768f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004044ac

Function at 0x4076cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40775c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40775c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40770f
test edx, 3
jne 0x4076fe
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x407709
jmp 0x40770f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40770f
cmp dword [ecx - 8], 1
je 0x407719
mov edx, ebx
or edx, 3
call fcn.00404b78
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40772b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004044ac

Function at 0x407e08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040494c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407e21
test al, 0x10
je 0x407e25
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x407e2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040494c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407e45
test al, 0x10
jne 0x407e49
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a73c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a775
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040459c
jmp 0x40a77e
mov eax, ebx
mov edx, esi
call fcn.00404500
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a788
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a7aa
movzx eax, byte [esp]
jmp 0x40a7ac
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ae3c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40acb4
mov eax, dword [0x43b73c]
cmp byte [eax], 0
je 0x40aeb8
mov eax, dword [0x43b634]
call fcn.00402fc4
call fcn.00402d4c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407fdc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40af00
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40aeee
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x43b60c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x43e7f8]
call fcn.0040585c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x41c6d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040493c
lea eax, [ebp - 8]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x41c7a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d9c
push eax
call sub.ntdll_RtlDosPathNameToNtPathName_U
push 0
push 0
push 0
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x34]
mov ecx, 0x40
call fcn.0041c6a4
push 0
push 0
push 0x20
push 2
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x100002
lea eax, [ebp - 0xc]
push eax
call sub.ntdll_NtCreateFile
mov esi, dword [ebp - 4]
test esi, esi
je 0x41c75e
sub esi, 4
mov esi, dword [esi]
push 0
push 0
push esi
lea eax, [ebp - 4]
call fcn.004049a4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.ntdll_NtWriteFile
mov eax, dword [ebp - 0xc]
push eax
call sub.ntdll_NtClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c7ad
lea eax, [ebp - 8]
call fcn.00404c0c
lea eax, [ebp - 4]
call fcn.004044ac
ret

Function at 0x41c7b8
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x41c888
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004044ac
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
push eax
call sub.ntdll_RtlDosPathNameToNtPathName_U
push 0
push 0
push 0
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, 0x40
call fcn.0041c6a4
push 0x20
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100001
lea eax, [ebp - 8]
push eax
call sub.ntdll_NtOpenFile
push 5
push 0x18
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ntdll_NtQueryInformationFile
mov esi, dword [ebp - 0x40]
mov eax, ebx
mov edx, esi
call fcn.00404b78
push 0
push 0
push esi
mov eax, ebx
call fcn.004049a4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ntdll_NtReadFile
mov eax, dword [ebp - 8]
push eax
call sub.ntdll_NtClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c88f
lea eax, [ebp - 4]
call fcn.00404c0c
ret

Function at 0x41cc94
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, 0x41ccd8
call fcn.00407a78
push eax
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x1f4
jae 0x41cccb
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x41cf48
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x41cf50
push ebx
push esi
mov ebx, eax
mov esi, dword [0x43b650]
xor eax, eax
push ebp
push 0x41d0ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41d0c8
push dword [esi]
push 0x41d0d4
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040480c
mov eax, dword [ebp - 8]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 4]
call fcn.004046a4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0x10]
mov edx, 0x41d0c8
call fcn.00404798
mov eax, dword [ebp - 0x10]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004046a4
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00417df4
push 0x41d0c8
push dword [esi]
push 0x41d0e8
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040480c
mov eax, dword [ebp - 0x18]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004046a4
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0x20]
mov edx, 0x41d0c8
call fcn.00404798
mov eax, dword [ebp - 0x20]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004046a4
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00417df4
push 0x41d0c8
push dword [esi]
push 0x41d0fc
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040480c
mov eax, dword [ebp - 0x28]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.004046a4
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0x30]
mov edx, 0x41d0c8
call fcn.00404798
mov eax, dword [ebp - 0x30]
call fcn.0040494c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004046a4
mov eax, dword [ebp - 0x2c]
pop edx
call fcn.00417df4
push 0
push 1
mov eax, ebx
call fcn.0040494c
push eax
call sub.wininet_InternetCheckConnectionA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d0b5
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.004044d0
ret

Function at 0x41d310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040493c
mov eax, dword [ebp - 8]
call fcn.0040493c
mov eax, dword [ebp + 8]
call fcn.0040493c
xor eax, eax
push ebp
push 0x41d3bf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x43f644
mov eax, dword [ebp - 4]
call fcn.0040494c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d365
sub eax, 4
mov eax, dword [eax]
mov dword [0x43f648], eax
mov eax, dword [0x43f648]
push eax
lea eax, [ebp + 8]
call fcn.004049a4
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040494c
push eax
mov eax, dword [0x43f644]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x43f644]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d3c6
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044d0
lea eax, [ebp + 8]
call fcn.004044ac
ret
Function at 0x41d3e8
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x41d407
add edx, 3
sar edx, 2
test edx, edx
jle 0x41d515
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x41d43c
je 0x41d47f
sub ecx, 0x2b
je 0x41d475
sub ecx, 4
je 0x41d47a
dec ecx
sub ecx, 0xa
jb 0x41d467
jmp 0x41d482
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x41d44e
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x41d459
jmp 0x41d482
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x41d482
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x41d482
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x41d482
mov byte [eax], 0x3e
jmp 0x41d482
mov byte [eax], 0x3f
jmp 0x41d482
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x41d41f
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x41d4d3
cmp byte [esp + 7], 0xff
jne 0x41d4d3
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x41d50a
cmp dl, 0xff
je 0x41d50a
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x41d416
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x419f14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x419f34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041dbcc
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x419f55
test byte [esp + 8], 2
je 0x419f55
mov dword [0x451d74], 0xd
mov dword [0x451d78], 5
jmp 0x419f30
xor eax, eax
ret
Function at 0x1003cb81
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jg 0x1003c7e2
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp], ecx
pushal
mov word [esp + 0xf], bx
jmp 0x1003c753
Function at 0x1004283e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp]
stc
call fcn.1004293b
inc esi
in al, 0x7a
sbb eax, 0x10916bec
xchg ebx, eax
or ah, byte [ebp + 0x24648dd4]
adc al, 0x80
mov al, 0xc8
add edi, dword [eax - 0x6a]

Function at 0x100428e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
add cl, dl
setg ah
rdtsc
bswap eax
jmp 0x10042914
btr edx, ecx
jbe 0x100428fe
ja 0x100428fe

Function at 0x10042a7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, ch
sub esp, 8
pop dx
xchg al, dh
push word [esp + 5]
jmp 0x10042ac5
xchg dword [esp + 8], ebp
pushfd
call fcn.10042a8c

Function at 0x10043087
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x10043071
mov dword [esp + 0x34], ebp
pushfd
mov byte [esp + 2], dl
jmp 0x100430ca
mov dword [esp + 0x34], esi
jmp 0x100430d4
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
call 0x1004310e
mov cl, byte [ebx]
wait
dec byte [0x18392ecd]
jnp 0x1004313e
mov esp, 0x7c43552
or dword [eax - 0x70999d35], ebp
add al, 0x24
mov word [esp], cx
lea esp, [esp + 2]
push dword [esp + 0x20]
ret 0x24

Function at 0x1004aed6
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x10031107
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x10031121
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x10031110
pop esi
jmp 0x1003112c
ret 4
lea esp, [esp + 4]
jmp 0x100310fa

Function at 0x100532c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jl 0x10053287
sbb al, 0x66
mov edx, dword [esp]
jbe 0x10053317
clc
js 0x10053331
jns 0x10053308
js 0x100532b4
je 0x100532e3
out dx, al
push eax
mov bl, byte [ebx]
mov ebp, esi
sbb eax, 0x127ce0aa
jne 0x10053261
inc eax
leave
push 0x8dcdbc0f
lodsd eax, dword [esi]
invalid
add bl, cl
jo 0x100532f2
rdtsc
jmp 0x10053314
mov dx, word [esp]
sub esp, 0x12
mov byte [esp + 5], dl
lea esp, [esp + 2]
and al, 0x83
in al, dx
adc cl, byte [eax - 0x72fadbac]
and al, 2
jmp fcn.100533cc
jmp 0x10053308
Function at 0x10061918
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, esi
jmp 0x10061819
pushal
mov edi, dword [esp + 0xb]
jmp 0x100617fc
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
jmp 0x10061849
shl edx, 8
jmp 0x100618f5
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
movzx esi, byte [eax + 9]
jmp 0x10061824
xor edx, esi
mov dword [ecx + 8], edx
jmp 0x100618c7
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
jmp 0x10061882
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
jmp 0x100618d4
movzx edx, byte [eax + 0xc]
movzx esi, byte [eax + 0xd]
shl edx, 8
jmp 0x100618a7
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x10061916
lea esi, [esi + 0xc]
mov dword [esi], edx
pop esi
jmp 0x10061900
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
jmp 0x1006189c
mov eax, edx
jmp 0x10061933
xor edx, eax
push esi
mov esi, ecx
jmp 0x100618de
mov eax, dword [eax*4 + 0x1003a160]
jmp 0x100619cb
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x1006191d
mov bx, 0x2cd5
and edi, esi
push ecx
jmp 0x100619b1
lea ecx, [ecx*4]
lea ecx, [ecx + 0x1003a160]
mov edi, dword [ecx]
pop ecx
mov bl, bh
jmp 0x1006199b
bsf ebp, esp
mov bx, cx
mov bp, 0x1e39
bswap ebx
shr edi, 8
jmp 0x10061962
bt bx, ax
jmp 0x10061d0d
pushal
mov dword [esp + 0x18], edi
sub esp, 0xd
lea esp, [esp + 1]
lea esp, [esp + 0xc]
popal
jmp 0x1006196b
lea esp, [esp + 0x60]
xor eax, 0x1000000
mov edi, 0x3e0b1d84
mov edi, edx
jmp 0x1006198a
mov ebx, dword [ecx + 4]
bts ebp, ecx
cmc
lea ebp, [ecx + edx]
call fcn.10061a21
lea esp, [esp + 0x34]
jmp 0x1002ef1e
and edi, 0xff0000
lea ebx, [edx + edi]
lea ebp, [edx + esi]
mov bx, word [esp]
jmp 0x10061b3c

Function at 0x10061bfe
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
mov word [esp], cx
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x10061c22
Function at 0x10061c4f
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, edi
xchg di, dx
and cl, 0x35
jmp 0x10061b6d
mov edx, dword [eax + 0xc]
xchg cl, ch
bsf di, di
neg cl
call 0x10061b8e
mov edx, 0x36dbbc2e
cmp dword [edi - 0x54867e45], 0xffffffc1
call fcn.10061b61
jmp 0x10061be4
bsr di, bp
mov di, dx
push di
lea esp, [esp + 2]
mov edi, edx
jmp 0x10061bc2
pushal
lea edi, [ebp + ebp]
sbb di, cx
lea esi, [edx*4]
jmp 0x10061bc8
clc
and ecx, esi
push ebx
jmp 0x10061ba1
mov dword [esp + 0x10], ecx
popal
lea ebx, [ebx*4]
lea ebx, [ebx + 0x1003a160]
mov ecx, dword [ebx]
jmp 0x10061bf6
mov ecx, edx
not di
mov edi, 0xf15b94c
mov edi, dword [esp]
shr ecx, 8
jmp 0x10061b90
pop ebx
clc
cmc
shr edi, 0x10
jmp 0x10061c48
and edi, esi
call fcn.10061bfe
and edx, esi
jmp 0x10061c82
lea esi, [esi + 0x1003a160]
mov edx, dword [esi]
pop esi
jmp 0x10061cac
push esi
mov esi, edx
lea esi, [esi*4]
jmp 0x10061c6c
shr edi, 0x18
movzx edi, byte [edi*4 + 0x1003a160]
xor ecx, edi
jmp 0x10061cee
xor ecx, edx
xchg edi, edx
jmp 0x10061fee
and edx, ebp
rol di, 0xd
not di
bsf di, sp
jmp 0x10061cd8
mov cl, byte [esp]
adc ecx, ecx
sub esp, 2
lea esp, [esp + 2]
jmp 0x10061d72
mov esi, eax
add esi, 0x14
mov dword [esi], edx
pop esi
jmp 0x10061d22
mov edx, dword [eax + 4]
xor edx, ecx
push esi
jmp 0x10061d38
mov dword [eax + 0x18], ecx
mov dh, bh
clc
mov dh, byte [esp]
rcl dx, 4
jmp 0x10061d90
mov ecx, dword [eax + 8]
cmc
xor ecx, edx
jmp 0x10061d5c
mov edx, dword [eax + 0xc]
xor edx, ecx
cmc
call fcn.10061d7a
add edi, 0x1c
mov dword [edi], edx
pop edi
jmp 0x10061ec7
add ebx, 4
mov dword [edi], ecx
bt edx, ecx
push bp
lea esp, [esp + 2]
jmp 0x10061d54
lea esp, [esp + 4]
cmp ebx, 0x1003b988
jne 0x1002ef1e
call fcn.10061e58
xor ecx, dword [eax]
mov dl, bh
mov edx, dword [esp]
mov dx, word [esp]
xchg dl, dh
jmp 0x10061dc8
lea esp, [esp + 8]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
jmp 0x10061f17

Function at 0x10062238
Capabilities:
Encrypt data using aes

Disassembly:
lea edi, [edi*4]
lea edi, [edi + 0x1003a160]
mov ebx, dword [edi]
pop edi
jmp 0x100621c7
sub esp, 8
push edi
mov edi, ebx
jmp 0x100621dd
lea esp, [esp + 1]
movzx ebx, byte [esi + 2]
jmp 0x100621f9

Function at 0x1006233b
Capabilities:
Encrypt data using aes

Disassembly:
movzx ebx, byte [esi + 6]
pushfd
add esp, 1
mov word [esp], dx
lea esp, [esp + 3]
jmp 0x1006234a
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + 0x1003ad60]
not bl
jmp 0x10062325
mov ebx, dword [ebx*4 + 0x1003a160]
push ax
stc
lea esp, [esp + 2]
jmp 0x10062612
bts ebx, edi
push ebp
pushal
not eax
jmp 0x1006237c
and ebx, ecx
cmc
xor edi, dword [ebx*4 + 0x1003a960]
mov bh, byte [esp]
jmp 0x100623a8
Function at 0x10062546
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 2]
lea esp, [esp + 1]
and edx, ecx
jmp 0x100625d1
lea ecx, [ecx + 0x1003a160]
mov edx, dword [ecx]
pop ecx
cmc
jmp 0x1006258e
xor edi, dword [edx*4 + 0x1003b160]
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x100625b4
and edx, ecx
sub esp, 0xe
pop word [esp + 1]
lea esp, [esp + 0x14]
jmp 0x10062578
push eax
jmp 0x100625f6
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
bt edi, ecx
jmp 0x1006259e
push ecx
mov ecx, edx
lea ecx, [ecx*4]
jmp 0x10062553
pop eax
lea edi, [ecx + edx]
bswap edi
jmp 0x1006264a
mov eax, ebx
lea eax, [eax*4]
lea eax, [eax + 0x1003a160]
mov ebx, dword [eax]
jmp 0x100625e0
lea esp, [esp + 3]
lea esp, [esp + 0xc]
popal
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0x100626c2
pushal
lea ebp, [edi + 0xf9]
mov dword [esp], edx
sub esp, 0xd
push word [esp + 3]
jmp 0x10062624
shr edi, 0x18
mov edi, dword [edi*4 + 0x1003a160]
sub esp, 8
and edi, ecx
call fcn.10062674
mov edx, dword [edx*4 + 0x1003a160]
sub esp, 0xb
lea esp, [esp + 3]
and ebx, ecx
jmp 0x1006271a
and edx, ecx
jmp 0x10064532
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + 0x1003a960]
jmp 0x10062704
xor edi, dword [edx*4 + 0x1003b160]
call fcn.10062d79

Function at 0x10062d79
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop edi
jmp 0x10062773
btr edx, ecx
mov edi, dword [esp]
rcl ebx, cl
jmp 0x10062113
add esi, 0x10
xchg dl, dh
neg edx
inc edi
jmp 0x10062142
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + 0x1003a160]
add edx, 0xd35675ce
setbe dl
mov dh, byte [esp]
jmp 0x100620fd
lea esp, [esp + 2]
jmp 0x1006214f
mov edx, dword [esi]
shl di, 0xb
mov edi, edx
sub esp, 6
jmp 0x1006212c
shr edi, 0x18
push esi
mov esi, edi
jmp 0x1006215b
lea esi, [esi*4]
lea esi, [esi + 0x1003a160]
mov edi, dword [esi]
pop esi
jmp 0x10062192
and edi, ecx
clc
mov edi, dword [edi*4 + 0x1003a560]
call fcn.1006217c
mov ebx, esp
pop ebx
call 0x10062727
lea ebx, [ecx*4]
bswap ebx
mov si, word [esp]
bswap ebx
pop esi
jmp 0x1006273d
mov dword [ebp], edi
pop ebp
jne 0x1002f621
je 0x1002f5b9
cmp dl, 0x5a
jmp 0x1006329d
ja 0x10062930
clc
sub edx, 0x41
jmp 0x1006291a
push ebp
mov ebp, esi
lea ebp, [ebp + 0xc]
jmp 0x100628e3
pop word [esp]
lea esp, [esp + 2]
dec dword [ebp - 4]
jmp 0x10062ab7
movzx edx, dl
jmp 0x100628fb