joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455220
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x455253
push esi
call fcn.00458390
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45524c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4552d9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4552c2
mov eax, dword [esi + 8]
test eax, eax
je 0x455277
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4552be
cmp eax, 2
je 0x4552c2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45526a
cmp eax, 3
je 0x45529d
cmp eax, 1
jne 0x45526a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45526a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45526a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00455300
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4552e8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00455300
add esp, 4
pop esi
ret

Function at 0x460620
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x460686
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x460686
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x460667
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x460a10
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x460a48
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4616d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x461719
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x461b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x492000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00461740
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004617c0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004617c0
lea ecx, [esi + 0xc]
call fcn.0048125e
lea ecx, [esi + 0x10]
call fcn.0048125e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00462d50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00462d50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00462d50
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004812d3
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004812d3
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x465b60
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4bb1e4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x465b73
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x465bb4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4bb28c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x465be6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x465bea
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x465bdb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x465c08
mov bl, byte [esp + ecx + 0x4c]
jmp 0x465c0c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x465bfd
xor ecx, ecx
mov eax, 0x4bb1f4
xor ebx, ebx
mov bl, byte [ecx + 0x4bb29c]
cmp byte [esp + ebx + 0x14], 0
je 0x465c37
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4bb2b4]
cmp byte [esp + ebx + 0x14], 0
je 0x465c4e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x465c1e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x465ba7
lea edx, [esp + 0x84]
push edx
call fcn.00465c90
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4836f0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x483728
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048177a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00481752
jmp 0x483734
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x484de2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x484e24
call fcn.0048ad8f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x484e24
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x484e1b
xor eax, eax
jmp 0x484e2c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00484e32
pop edi
pop esi
pop ebx
ret 4

Function at 0x48b2bf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48b2ed
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48b30b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048b225
jmp 0x48b30b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48b30b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048b225
test edi, edi
mov eax, edi
jne 0x48b2f5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40c955a2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push 0x40c95668
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x40c95659
push ebx
push edi
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
mov ebx, 0x40c95660
push ebx
push dword [ebp - 8]
call edi
cmp eax, 0xea
je 0x40c955fe
cmp eax, esi
jne 0x40c9b88d
add dword [ebp - 4], 2
push dword [ebp - 4]
call fcn.40c93ce9
mov esi, eax
test esi, esi
je 0x40c9b89f
mov eax, dword [ebp - 4]
mov byte [esi + eax - 1], 0
mov eax, dword [ebp - 4]
mov byte [esi + eax - 2], 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp - 8]
call edi
mov edi, eax
test edi, edi
jne 0x40c9b8a4
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, edi
jmp 0x40c95657
push 0x7a
pop edi
jmp 0x40c9b88f
push esi
call sym.IPHLPAPI.DLL_FreeMibTable
jmp 0x40c9b88f

Function at 0x40c96385
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub dword [ebp + 0x10], 2
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x40c963b4
xor al, al
pop esi
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 1
jne 0x40c963ad
mov eax, dword [ebp + 0x10]
cmp eax, 2
jb 0x40c963ad
shr eax, 1
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c963cf
sub eax, edx
sar eax, 1
setne al
jmp 0x40c963af
Function at 0x40c972c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [esi], edi
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.40c95b05
mov ebx, eax
cmp ebx, edi
jne 0x40c9739d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
push edi
mov edi, 0x40c973c8
push edi
push ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x40c9b373
push ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x40c972ef
cmp dword [ebp + 0xc], 1
jne 0x40c973bc
cmp dword [ebp + 0x10], 2
jb 0x40c973bc
add dword [ebp + 0x10], 2
push dword [ebp + 0x10]
call fcn.40c93ce9
mov dword [esi], eax
test eax, eax
je 0x40c973bc
push eax
push dword [ebp + 0x10]
push edi
push ebx
call fcn.40c96385
test al, al
jne 0x40c9b3bb
push dword [esi]
call sym.IPHLPAPI.DLL_FreeMibTable
and dword [esi], 0
jmp 0x40c973bc
push ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c9b3c7
sub eax, edx
sar eax, 1
inc eax
jmp 0x40c972f1
Function at 0x61df45
Capabilities:
Encode data using xor

Disassembly:
push edx
push dword [esp]
mov word [esp], sp
lea esp, [esp + 5]
mov word [esp], bx
call fcn.0061dd58
cmc
push dword [esp + 2]
lea ecx, [ecx + ebx]
jmp 0x61df8f
not ecx
jmp 0x61e13f
mov cl, ch
call fcn.0061e055
pop edx
fmul dword [esi + 0x29]
fdivr dword [esp + esi*4]
xor eax, 0xd03fcca5
movsb byte es:[edi], byte [esi]
xlatb
lea esp, ds:[esp + 8]
lea esp, [esp + 8]
xor bl, 0x46
cmc
ja 0x61dfd4
mov cl, ch
mov ecx, ebp
jmp 0x61e070
call fcn.0061e11c
fistp word [ecx - 0x37]
test al, 0x5b
scasd eax, dword es:[edi]
aas
mov edx, 0x3dba4f28
sbb esi, dword [edx + 0x6d]
mov ecx, dword [esp]
push dword [esp + 0x28]
ret 0x2c
jmp 0x61dfea
Function at 0x64b1f4
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x64b2f1
push esp
mov dword [esp], eax
shl edx, 8
mov bl, 0x42
lea edi, [ebx + edi]
jmp 0x64b2ad
mov dword [ecx + 4], edx
pushal
rcl bx, cl
lea esp, [esp + 0x20]
jmp 0x64b2d5
lea esp, [esp + 4]
movzx esi, byte [eax + 9]
mov edi, 0x50a1695e
mov bl, 0x82
jmp 0x64b271
xor edx, esi
mov esi, dword [esp]
xchg edi, ebx
sub si, 0x8570
bswap esi
jmp 0x64b28e
xor edx, esi
xchg esi, ebx
jmp 0x64b327
movzx edx, byte [eax + 8]
shl edx, 8
setp bl
mov bp, bx
mov bl, 0xba
jmp 0x64b2bd
xor edx, esi
mov esi, dword [esp]
lea esp, [esp + 4]
movzx esi, byte [eax + 7]
not bl
jmp 0x64b1f9
shl edx, 8
xchg bh, bl
xor edx, esi
jmp 0x64b394
xor edx, esi
lea edi, [ebx*4]
jmp 0x64b37d
movzx esi, byte [eax + 0xa]
jmp 0x64b305
movzx edx, byte [eax + 0xc]
jmp 0x64b40c
mov dword [ecx + 8], edx
mov di, word [esp]
mov ebx, 0x3c22f784
stc
jmp 0x64b34c
movzx esi, byte [eax + 0xd]
mov di, 0x4231
inc di
jmp 0x64b363
movzx esi, byte [eax + 0xb]
sub esp, 2
mov di, word [esp]
lea esp, [esp + 2]
shl edx, 8
jmp 0x64b311
shl edx, 8
xor edx, esi
mov bp, word [esp]
clc
jmp 0x64b3bb
shl edx, 8
xchg di, bp
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x64b440
movzx eax, byte [eax + 0xf]
not edi
mov bl, byte [esp]
xchg bl, bh
jmp 0x64b3ab
movzx esi, byte [eax + 0xe]
sub bl, bh
push esp
lea esp, [esp + 4]
jmp 0x64b3d1
shl edx, 8
mov edi, eax
xor edx, esi
lea edi, [eax*4]
jmp 0x64b3ee
rcr bx, cl
mov al, ah
xchg edi, eax
mov eax, edx
setnp bh
jmp 0x64b464
shr eax, 0x10
setns bh
pushal
pop esi
jmp 0x64b44b
xor edx, eax
bswap ebp
bswap eax
mov dword [ecx + 0xc], edx
jmp 0x64b41c
lea esp, [esp + 0x24]
mov esi, 0xff
bsf bp, ax
push esp
pop edi
jmp 0x64b945
mov esi, 0x47389266
inc edi
jmp 0x64b42a
inc bl
mov ebx, dword [ecx + 4]
cmc
inc ebp
call fcn.0064b496
xor eax, edi
mov edi, dword [esp]
lea edi, [eax + edx]
dec ebp
jmp 0x64b500
sub esp, 0xc
bswap ebx
lea esp, [esp + 2]
lea esp, [esp + 0xc]
and edi, 0xff0000
jmp 0x64b4b2
pushal
mov ecx, ebp
bsr bp, cx
mov eax, 0x221343c6
mov eax, dword [esp]
jmp 0x64b515
mov dword [esp], edx
sub esp, 0x18
pop dword [esp]
clc
lea esp, [esp + 0x14]
popal
call fcn.0064b560
inc edx
std
int3
mov bl, bh
mov bl, bh
not bl
mov edi, dword [edi*4 + 0x619d90]
sub esp, 2
jmp 0x64b4eb
shr edi, 8
stc
inc ebp
dec bp
and edi, esi
jmp 0x64b52c
mov dword [esp], edx
clc
popal
mov bl, 0x92
xchg ebx, ebp
jmp 0x64b583
xor eax, 0x1000000
mov bl, bh
inc bl
pushal
jmp 0x64b5e1
mov di, 0xaefd
and eax, esi
btc edi, edi
mov eax, dword [eax*4 + 0x619d90]
jmp 0x64b65e
Function at 0x64b596
Capabilities:
Encrypt data using aes

Disassembly:
mov ebp, 0x51272a82
sub esp, 0xa
mov bp, 0x2fbb
lea esp, [esp + 2]
jmp 0x64b562
jmp 0x64b53e
shr edi, 0x18
mov bp, 0xf617
lea esp, [esp + 0x20]
movzx edi, byte [edi*4 + 0x619d90]
jmp 0x64b5b9
mov edi, edx
call 0x64b596
push edx
not bp
sub esp, 0x14
and edi, esi
jmp 0x64b645
lea esp, [esp + 0x18]
mov ebp, 0xff00
sub esp, 0x16
push dword [esp + 2]
jmp 0x64b613
bsf bp, si
neg bp
lea ebp, [eax*4]
xor eax, edi
mov ebp, 0x93a807d2
jmp 0x64b58e
pop dword [esp + 0xc]
lea esp, [esp + 2]
and edi, ebp
push esp
call fcn.0064b5ec
lea esp, [esp + 0x1c]
xor eax, dword [ecx]
neg di
stc
mov di, 0x210d
jmp 0x64b8de
mov edi, dword [edi*4 + 0x619d90]
mov ebp, dword [esp]
mov ebp, 0x3f8f6302
jmp 0x64b5a3
xor eax, ebx
pushal
mov dword [ecx + 0x14], ebx
call fcn.0064b6a5
mov dword [edi], eax
mov eax, dword [ecx + 8]
push edx
jmp 0x64b814
lea edi, [edx + ebp]
lea edi, [ecx + 0x10]
xor ebx, eax
push esp
jmp 0x64b89f

Function at 0x64b751
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
add esp, 0
lea esp, [esp]
lea esp, [esp + 1]
jmp 0x64b7c8
mov edx, dword [edx*4 + 0x619d90]
push edx
mov word [esp], sp
mov dword [esp], esp
call fcn.0064b7b0
ja 0x64b7d1
add edi, esi
sbb esp, dword [edi - 0x72]

Function at 0x64b969
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jmp 0x64b9c0
pop eax
mov edi, dword [esp]
xchg bl, bh
pop edi
jmp 0x64bdb6
jne 0x64ae86
push 0xa
not ebp
mov esi, 0xee8f301c
jmp 0x64b99f
pop ebp
call 0x64bab4
mov bl, 0x96
bswap ebx
xchg ebp, ebx
mov ebp, dword [esp]
pop esi
jmp 0x64baeb

Function at 0x64bd12
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x64bd56
mov ebx, ecx
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0x60d1e6
cmc
jmp 0x64bd8f
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + 0x619d90]
mov edx, eax
xchg dh, dl
jmp 0x64c2c8
mov edi, dword [edi*4 + 0x619d90]
call 0x64bdc5
mov di, word [esp]
mov edi, edx
shr edi, 0x18
jmp 0x64bde5
setge dh
mov edx, dword [esi]
lea edi, [edx + ebp]
btc edi, edi
shl di, cl
jmp 0x64bf0e
not dh
add esi, 0x10
mov dh, 0x6a
neg dx
bswap edi
jmp 0x64bfc6

Function at 0x64bfd9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 1]
and edi, ecx
jmp 0x64c02b
mov edi, dword [edi*4 + 0x61a190]
and ebx, ecx
jmp 0x64c013

Function at 0x64c0d7
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 2]
add esp, 5
jmp 0x64c167
mov edi, edx
clc
shr edi, 0x18
call 0x64c14f
lea eax, [ebx + 0x44eb03c4]
push ds
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
dec ecx
insb byte es:[edi], dx
arpl word [esi], ax
cmc
push ss
jb 0x64c156
push 0xd
cld
sbb eax, 0x24896661
and al, 0x8d
and al, 3
mov word [esp], sp
lea esp, [esp + 3]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x619d90]
jmp 0x64c143
Function at 0x64c14f
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 2]
add esp, 5
jmp 0x64c167
mov edi, edx
clc
shr edi, 0x18
call 0x64c14f
lea eax, [ebx + 0x44eb03c4]
push ds
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
dec ecx
insb byte es:[edi], dx
arpl word [esi], ax
cmc
push ss
jb 0x64c156
push 0xd
cld
sbb eax, 0x24896661
and al, 0x8d
and al, 3
mov word [esp], sp
lea esp, [esp + 3]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x619d90]
jmp 0x64c143

Function at 0x64c253
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
clc
sub esp, 0x16
cmc
lea esp, [esp + 2]
jmp 0x64c28d
lea esp, [esp + 2]
jmp 0x64c23a

Function at 0x64c451
Capabilities:
Encrypt data using aes

Disassembly:
cmp al, 0x9d
nop
test eax, 0xb60f0061
pop esi
push cs
mov dword [esi + 0xc], edi
pushal
call fcn.0064c453
or al, 0x8e
sbb al, 0x7b
xchg esi, eax
jb 0x64c3e4
and esi, dword [ebx - 0x1931da2a]
adc dword [eax - 0x14da75ed], edx
jmp 0x64c436
invalid
jmp 0x64c436
mov dword [esp + 0x20], ebx
and al, 3

Function at 0x64c453
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 0x20], bx
lea esp, [esp + 0x30]
jne 0x60d1e6
je 0x60d20a
jmp 0x64c4b9
lea esp, [esp + 4]
pop ebx
jmp 0x64c4c7
mov esi, dword [esp]
mov bx, 0xf403
bswap ebx
jmp 0x64c488
lea esp, [esp + 3]
mov byte [esp], bh
lea esp, [esp + 1]
pop edi
jmp 0x64c4a1
leave
push edx
mov byte [esp], dh
call 0x64c4d2
in al, 0x60
jmp 0x64c623
lea esp, [esp + 0x28]
ret

Function at 0x91bda4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x13]
mov eax, 0xec871244

Function at 0x91c27a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x91c2da
lea edx, [edx + esi]
lea esp, [esp + 2]
mov dl, 0xac
add esp, 0
stc
stc
jmp 0x91c2c3
add esp, 0
mov edx, eax
push edx
mov dh, byte [esp + 2]
mov ax, word [esp + 2]
jmp 0x91c335
sets dh
cld
bswap edx
neg esi
mov dx, 0x9339
lea eax, [edx + edi]
jmp 0x91c2ad
lea esp, [esp + 6]
mov dh, bh
mov word [esp], dx
inc dl
mov dh, 0x10
xor esi, esi
jmp 0x91c27c
mov dx, word [esp + 0x19]
mov al, ah
ror ah, 1
mov word [esp + 0x12], di
sub esp, 0xe
jmp 0x91c364
lea esi, [ebp - 0x698d9e49]
mov si, 0xe165
mov word [esp + 8], sp
jmp 0x91c2ec
lea edx, [ebx + edi]
mov word [esp], bx
bsr ax, bp
sub esp, 0x1c
inc edx
clc
jmp 0x91c304
xchg si, ax
mov dh, ch
mov dword [esp], ebp
pop ax
bt edx, esp
neg dx
jmp 0x91c31b
rdtsc
pop edx
mov ax, sp
add esp, 0x1d
cld
mov eax, dword [esp + 5]
jmp 0x91c3fa
pop dx
xchg dword [esp + 2], edx
xchg dword [esp + 2], esi
mov dl, 0x84
xchg byte [esp + 6], al
rdtsc
call fcn.0091c3a0
mov eax, dword [esp + 3]
lea edx, [ecx + 0x7b]
cld
call fcn.0091c3a2
ror dword [ecx - 0x27], 0xb8
dec ebx
into
push 0xea1f78ea
push cs
mov esp, dword [edx]
pop ebp
lodsb al, byte [esi]
mov edi, 0x24748752
add ah, byte [esi + 0x5e]
push edx
xchg dword [esp + 2], esi
pop si
bsf dx, si
pop dword [esp + 2]
lea esi, [edi + edi]
jmp 0x91c3c5
Function at 0x91c66a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x10], dh
mov ax, 0x564d
mov si, di
add al, dh
xchg esi, eax
add esp, 1
jmp 0x91c4c9
mov dx, ax
rdtsc
mov si, 0xb095
mov esi, 0x41e5579e
xchg dword [esp + 3], esi
push word [esp + 0x11]
jmp 0x91c4e6
push dword [esp + 0x19]
mov esi, eax
mov word [esp + 0x17], bx
mov dword [esp + 0x19], ecx
push dword [esp + 0x13]
lea eax, [ecx + edx]
jmp 0x91c511
not ah
inc dl
lea edx, [ecx + 0x7412c46b]
neg dh
push dword [esp + 0x13]
pop dword [esp + 0x11]
jmp 0x91c5d4
xchg word [esp + 0xe], dx
bsf dx, si
not si
xchg esi, edx
jmp 0x91c5f2

Function at 0x91c67d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xa]
mov byte [esp + 1], dh
not dh
jmp 0x91c780
xchg word [esp + 1], ax
add esp, 0x18
xchg dh, al
rdtsc
mov edx, dword [esp + 2]
jmp 0x91c72f
pop ax
xchg byte [esp + 8], dl
lea edx, [ebp*4]
jmp 0x91c6cb
pushal
not esi
push dword [esp + 0x1a]
mov al, 0xce
mov eax, ecx
pop dword [esp + 0x1b]
jmp 0x91c6e1
mov edx, dword [esp]
lea eax, [esp + eax]
push edx
mov word [esp + 4], di
mov byte [esp + 7], dh
bswap eax
jmp 0x91c760
mov al, 0xfe
inc edx
sub esi, ebp
lea edx, [esp + edx]
push dword [esp + 2]
mov dword [esp + 1], ecx
jmp 0x91c709
mov dh, byte [esp]
mov dx, word [esp]
neg si
rdtsc
lea esp, [esp]
and dh, bh
jmp 0x91c6f8
mov eax, ebp
mov dword [esp], esi
bsr dx, bp
mov dh, bh
lea edx, [ebp + 0x4f]
xchg dword [esp + 1], edx
jmp 0x91c7ed
pop dx
setne dh
bts eax, ebx
ror edx, 7
add esp, 0
xchg dh, dl
jmp 0x91c74d
xchg ah, dh
mov si, 0xd851
pop dx
pop ax
bsf si, si
push word [esp]
jmp 0x91c7d2
lea esi, [ebp - 0x39ccffe1]
neg dh
pop edx
pop esi
lea esi, [esi - 0x75]
lea eax, [ecx + edx]
jmp 0x91c842
lea edx, [ebx + ebp]
sub esp, 8
mov ax, bx
bsf dx, si
shl dh, 3
push dword [esp + 0xb]
jmp 0x91c792
and dh, bh
lea eax, [ecx + edi]
rcl ax, cl
bt edx, edx
mov ax, bx
pop dword [esp + 2]
jmp 0x91c7a6
mov si, word [esp]
lea esp, [esp + 0xa]
rdtsc
push word [esp + 1]
xchg dword [esp], esi
mov dword [esp], esi
jmp 0x91c7bc
sub esp, 2
lea esi, [ecx - 0x73]
mov si, sp
mov si, 0x5c41
call fcn.0091c991
out dx, eax
jae 0x91c7fc
xchg byte [ebp - 0x69], dh
div dword [edx + ebp*8 - 0x73]
jl 0x91c7b3
loope 0x91c88a
pop word [esp]
pop dword [esp]
sbb eax, ebp
mov si, cx
xchg dh, dl
bsf ax, ax
shl si, cl
jmp 0x91c804
xchg si, ax
not si
xchg si, dx
push word [esp + 3]
xchg dword [esp], esi
pop word [esp]
jmp 0x91c823
mov byte [esp + 0x21], dh
mov dl, dh
lea edx, [edi*4]
mov byte [esp + 0x25], bh
mov dh, byte [esp + 0xa]
mov ax, bx
jmp 0x91c958
and al, 0x34
jmp 0x91c859
lea edx, [esp + ebx]
rdtsc
xchg dword [esp + 0x12], edx
mov dword [esp + 4], ebp
call fcn.0091c93d
ret
mov ax, 0xaa99
mov si, word [esp + 0x1c]
and dh, bh
btc edx, ebx
xchg dx, ax
add esp, 0xe
jmp 0x91c8cb
bsr si, cx
setns ah
neg dx
xchg dx, ax
lea esi, [esi*4]
bsf ax, si
jmp 0x91c8ec