joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41f7008], 0x8088405
inc edx
mov dword [ebx + 0x41f7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d254
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d285
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d26d
add dl, dl
jne 0x41d290
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2e1
xor eax, eax
add dl, dl
jne 0x41d29d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d37e
add dl, dl
jne 0x41d2ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d2d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d27c
mov eax, 1
add dl, dl
jne 0x41d2ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2e6
sub eax, ebx
mov ebx, 1
jne 0x41d32d
mov ecx, 1
add dl, dl
jne 0x41d313
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d31e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d30a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d33b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d39f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d27c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x41da89e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f3ff
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
jmp 0x41f41e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f490
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f479
test esi, esi
jbe 0x41f490
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f46b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f490
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f448
jmp 0x41f490
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f490
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41da8a5
ret
Function at 0x4205fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x41dbc17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420637
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420650
lea eax, [ebp - 0x10]
mov edx, dword [0x41f95f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420663
lea eax, [ebp - 0x10]
mov edx, dword [0x41f95f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42066f
adc edx, 0
mov edx, dword [edx*4 + 0x41f83fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4207e9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4207dc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4207dc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42077a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42077a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42077a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42077a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4207dc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4207dc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420801
inc ebx
cmp ebx, 0x19
jne 0x420629
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dbc1e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4eaef0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa8000]
push edi
jmp 0x4eaf0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4eaf11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf00
mov eax, 1
add ebx, ebx
jne 0x4eaf23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4eaf34
jne 0x4eaf53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf53
dec eax
add ebx, ebx
jne 0x4eaf40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4eaf18
add ebx, ebx
jne 0x4eaf4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4eafa5
xor ecx, ecx
sub eax, 3
jb 0x4eaf6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4eafda
sar eax, 1
mov ebp, eax
jmp 0x4eaf76
add ebx, ebx
jne 0x4eaf76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf44
inc ecx
add ebx, ebx
jne 0x4eaf84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaf44
add ebx, ebx
jne 0x4eaf91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4eaf86
jne 0x4eafa2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4eaf86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4eafc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4eafb6
jmp 0x4eaf06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4eafc4
add edi, ecx
jmp 0x4eaf06
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4eafe2
cmp byte [edi], 0x13
jne 0x4eafe2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4eafe7
lea edi, [esi + 0xe6000]
mov eax, dword [edi]
or eax, eax
je 0x4eb05f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x123d4c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x123ea0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4eb014
mov ecx, edi
jns 0x4eb043
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x123ea4]
or eax, eax
je 0x4eb059
mov dword [ebx], eax
add ebx, 4
jmp 0x4eb031
call dword [esi + 0x123eb4]
mov ebp, dword [esi + 0x123ea8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4eb093
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x4012e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x234
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 0x134]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x134]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x134]
push 0x5c
push ecx
call fcn.00409ef0
add esp, 8
test eax, eax
je 0x401325
mov byte [eax], 0
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x134]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0xc]
push 0x421114
push eax
call fcn.00409ac8
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push str.SoftwareBeaView
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401386
lea edx, [esp + 4]
push edx
push str.SoftwareBeaView
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4013b8
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push 0
push str.InstallPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x234
ret
Function at 0x40a12e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a14e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c8b7
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40a171
test byte [esp + 8], 2
je 0x40a171
call fcn.0040c92a
mov dword [eax], 0xd
call fcn.0040c933
mov dword [eax], 5
jmp 0x40a14a
xor eax, eax
ret

Function at 0x40f949
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4232e8
cmp edx, dword [eax]
je 0x40f96b
add eax, 8
inc ecx
cmp eax, 0x423378
jl 0x40f95c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4232e8]
jne 0x40fa99
mov eax, dword [0x4274fc]
cmp eax, 1
je 0x40fa73
test eax, eax
jne 0x40f99c
cmp dword [0x422864], 1
je 0x40fa73
cmp edx, 0xfc
je 0x40fa99
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40f9d3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040e850
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004111e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40fa16
lea eax, [ebp - 0x1a4]
push eax
call fcn.004111e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41d660
push edi
call fcn.00411b10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040e850
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e860
lea eax, [ebp - 0xa0]
push 0x41d640
push eax
call fcn.0040e860
push dword [esi + 0x4232ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e860
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041246e
add esp, 0x2c
pop edi
jmp 0x40fa99
lea eax, [ebp + 8]
lea esi, [esi + 0x4232ec]
push 0
push eax
push dword [esi]
call fcn.004111e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x4032f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x403351
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403351
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x403351
cmp dword [edx + ecx], 0x4550
jne 0x403351
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x40333c
mov edi, 0x8664
cmp ax, di
je 0x403351
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x403351
add ecx, 0xc
cmp esi, ecx
jae 0x403353
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x10002a4c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 1]
push edi
push eax
lea ecx, [ebp - 0x18]
call dword [0x100100dc]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ecx, eax
dec eax
test ecx, ecx
je 0x10002b88
mov edi, dword [ebp + 0xc]
inc eax
mov dword [ebp - 8], eax
mov al, byte [edi]
mov byte [ebp + esi + 0x10], al
mov bl, byte [ebp + 0x11]
inc esi
inc edi
cmp esi, 3
jne 0x10002ae5
mov al, byte [ebp + 0x10]
mov cl, bl
shr al, 2
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0x10]
and al, 3
shl al, 4
shr cl, 4
add al, cl
mov cl, byte [ebp + 0x12]
mov byte [ebp + 0xd], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp + 0xe], al
mov al, byte [ebp + 0x12]
and al, 0x3f
xor esi, esi
mov byte [ebp + 0xf], al
movzx eax, byte [ebp + esi + 0xc]
push eax
mov ecx, 0x10032b78
call dword [0x10010108]
mov al, byte [eax]
lea ecx, [ebp - 0x18]
push eax
call dword [0x10010104]
inc esi
cmp esi, 4
jl 0x10002ac0
xor esi, esi
dec dword [ebp - 8]
jne 0x10002a79
test esi, esi
je 0x10002b88
cmp esi, 3
jge 0x10002b13
push 3
lea edi, [ebp + esi + 0x10]
pop ecx
xor eax, eax
sub ecx, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov bl, byte [ebp + 0x11]
mov al, byte [ebp + 0x10]
lea edi, [esi + 1]
mov cl, al
and al, 3
shr cl, 2
mov byte [ebp + 0xc], cl
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
and bl, 0xf
mov byte [ebp + 0xd], al
mov al, byte [ebp + 0x12]
mov cl, al
and al, 0x3f
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp + 0xf], al
mov byte [ebp + 0xe], bl
xor ebx, ebx
test edi, edi
jle 0x10002b70
movzx eax, byte [ebp + ebx + 0xc]
push eax
mov ecx, 0x10032b78
call dword [0x10010108]
mov al, byte [eax]
lea ecx, [ebp - 0x18]
push eax
call dword [0x10010104]
inc ebx
cmp ebx, edi
jl 0x10002b4e
cmp esi, 3
jge 0x10002b88
push 4
pop esi
sub esi, edi
push 0x3d
lea ecx, [ebp - 0x18]
call dword [0x10010104]
dec esi
jne 0x10002b7a
push 0
call dword [0x10010194]
push eax
call dword [0x10010190]
pop ecx
mov esi, 0x10032b78
pop ecx
mov ecx, esi
call dword [0x100100e8]
mov edi, eax
call dword [0x1001018c]
xor edx, edx
mov ecx, esi
div edi
push edx
call dword [0x10010100]
mov al, byte [eax]
lea ecx, [ebp - 0x18]
push eax
push 1
push 1
call dword [0x100100fc]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call dword [0x100100ec]
lea ecx, [ebp - 0x18]
call dword [0x100100d8]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1015c37f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
call fcn.10172011
jmp fcn.1019591e
Function at 0x10196066
Capabilities:
Encrypt data using aes

Disassembly:
mov ch, byte [esp]
and edi, esi
lea ebp, [edx*4]
bswap ebx
shl bh, 5
jmp 0x10196080
jmp 0x1019603c
lea ebp, reloc.MSVCRT.dll___dllonexit
mov edi, dword [ebp]
pop ebp
mov ebx, eax
call 0x10196066
clc
mov byte [esp], al
jmp 0x101960b4
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x10196054
mov byte [esp + 1], ch
mov ebp, eax
lea esp, [esp + 3]
lea esp, [esp + 0xc]
and eax, 0xff000000
jmp 0x101960c9
lea esp, [esp + 8]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
sub esp, 0xf
shr bp, cl
jmp 0x1019608c
stc
xor eax, edi
lea edi, [ebx + ebp]
xchg di, bp
jmp 0x101961c1
lea ebp, [ecx + ebp]
xchg edi, ebp
call fcn.101960ee
mov edi, edx
sub esp, 0x1b
add esp, 0xf
pop word [esp + 5]
lea esp, [esp + 2]
jmp 0x10196181
shr edi, 0x18
movzx edi, byte [edi*4 + 0x10166a40]
stc
xor eax, edi
jmp 0x10196104
add ebp, 0x30764a0b
lea esp, [esp + 0x10]
sub esp, 0x1f
jmp 0x10196164
neg ebp
mov ebp, 0xcf8ab4f5
sub esp, 0x10
push word [esp + 0xa]
lea esp, [esp + 2]
jmp 0x10196139
lea esp, [esp + 3]
and edi, ebp
sub esp, 0x10
jmp 0x101961a9
and edi, esi
mov bp, 0x128b
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
mov ebp, dword [esp]
jmp 0x1019614f
lea esp, [esp + 0x3c]
xor eax, dword [ecx]
lea edi, [esp + edi]
lea edi, [eax + ebp]
jmp 0x10196275
xor eax, edi
bts di, sp
lea edi, [esi*4]
jmp 0x10196193
mov edi, edx
mov bp, word [esp]
bswap ebp
push ebp
jmp 0x10196129
xor eax, ebx
call fcn.101961cf
push edx
mov edx, ecx
add edx, 0x18
jmp 0x10196227
mov esi, ecx
add esi, 8
mov eax, dword [esi]
pop esi
jmp 0x101961e5
xor edx, eax
jmp 0x10196254
mov dword [edx], eax
pop edx
add ebx, eax
shl bh, 4
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x10196211
mov dword [edi], eax
sub esp, 0x17
lea esp, [esp + 3]
push esi
jmp 0x10196207
mov dword [ecx + 0x1c], edx
lea edx, reloc.MSVCRT.dll___dllonexit
mov ebx, 0x10168244
jmp 0x101962a1
lea edi, [ebp*4]
lea edi, [ecx + 0x10]
xor ebx, eax
jmp 0x10196248
lea esp, [esp + 0x2c]
jmp 0x10195922

Function at 0x10196a0a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x101969d0
and edi, ecx
sub esp, 0xf
call 0x10196a0a
out dx, al
xchg ebp, eax
salc
test eax, 0x2eab5839
dec eax
jmp 0x10196a08
and ebx, ecx
jmp 0x10196a2d
cmp dl, byte [0x324648d]
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x101969f4
mov dword [esp + 4], edi
lea esp, [esp + 3]
jmp 0x10196a61
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
movzx ebx, byte [esi + 6]
sub esp, 0x17
jmp 0x10196a17
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
and ebx, ecx
cmc
sub esp, 1
jmp 0x10196aa0
mov byte [esp], dl
lea esp, [esp + 1]
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
ror bx, 1
jmp 0x10196a8a

Function at 0x10196baf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
pushfd
clc
jmp 0x10196b65
Function at 0x10196cec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 0x11]
lea edi, [edx*4]
mov di, 0xc3cf
jmp 0x101967ed
jmp 0x10196d21
rol dh, cl
lea edx, [eax + edx]
jmp 0x101968d7
and edi, ecx
sub esp, 0x10
jmp 0x1019685a
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x10196836
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
pushal
add esp, 0
call 0x1019686b
inc esp
and ebx, ecx
jmp 0x101968a8
push esi
mov esi, ebx
jmp 0x10196892
mov edx, dword [esi]
sub esp, 9
cmc
lea esp, [esp + 1]
jmp 0x1019684c
lea esi, [esi*4]
lea esi, reloc.MSVCRT.dll___dllonexit
mov ebx, dword [esi]
pop esi
jmp 0x101968bd
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
mov bx, 0x60e2
movzx ebx, byte [esi + 2]
jmp 0x1019686f
sub esp, 0x12
clc
pop dword [esp + 6]
lea esp, [esp + 2]
jmp 0x10196950
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
dec dl
add esi, 0x10
mov dl, byte [esp]
jmp 0x10196886
and ebx, ecx
call 0x101968fe
mov edi, edx
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x10196987
mov al, 0x35
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
btc edi, edi
inc di
mov edi, ebx
mov di, 0x2534
jmp 0x10196957
shr edi, 0x18
sub esp, 0xb
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
call fcn.101969ba
inc esi
mov esp, 0x44b5d23c
mov ebx, 0x6e4b2889
cld
wait
jbe 0x10196970
clc
cmp eax, 0xffffff83
in al, dx
sbb ecx, dword [ebp - 0x76fcdb9c]
notrack jmp 0x10196973
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
mov ebx, 0xc89c1073
inc ebx
add bl, dl
jmp 0x10196cf4
and ebx, ecx
lea esp, [esp + 0x20]
jmp 0x10196cc3
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
stc
clc
jmp 0x10197170
pushfd
lea esp, [esp + 4]
pop edi
jmp 0x10196d50
lea esp, [esp + 8]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x1015c9dd
je 0x1015ca17
pop esi
call 0x10196d57
push 0x2ceb5b5b
call fcn.10172988
sub al, bh
mov si, 0x622d
jmp 0x10196d89
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
pushfd
pushfd
mov word [esp + 2], cx
jmp 0x10196d3a
pushal
mov dword [esp + 4], eax
sub esp, 5
call 0x10196d97
xchg bh, bh
je 0x10196dbe
add ecx, dword [ebp - reloc.MSVCRT.dll___dllonexit]
cmp dword [eax], esi
mov cl, 0x21
inc eax
mov bl, 0x52
xor dh, byte [edx + 0x4db24720]
xor ebp, dword [edx]
and edx, ecx
push eax
mov byte [esp + 1], ah
pop word [esp]
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x10196d77
and ebx, ecx
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0x10196daf
mov edx, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
sub esp, 0x13
mov dword [esp], ecx
pop dword [esp + 9]
lea esp, [esp + 3]
jmp 0x10196dfd
and edx, ecx
sub esp, 0xe
pop dword [esp + 3]
pushal
lea esp, [esp + 2]
jmp 0x10197123