joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3750
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4c379a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x4c37c9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x4c380b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x4cc080
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x540460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.004cc450
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.004cc450
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.004cc4c0
lea ecx, [esp + 0x10]
call fcn.0046ae80
cmp eax, 1
jae 0x4cc128
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x4cc193
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4cc193
push esi
push edi
call ebx
push esi
lea ecx, [esp + 0x14]
call fcn.004cc4c0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x10]
call fcn.0046ae80
cmp eax, 1
jb 0x4cc193
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.004cbf20
test eax, eax
je 0x4cc193
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.004cc200
mov edi, dword [esp + 0x44]
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.004cc520
push edi
lea ecx, [esp + 0x24]
call fcn.004cc540
push esi
lea ecx, [esp + 0x24]
call fcn.004cc5e0
push str..tmp
lea ecx, [esp + 0x24]
call fcn.004cc540
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.004cbf00
test eax, eax
je 0x4cc1c9
inc esi
cmp esi, 0x7a0a1f00
jb 0x4cc14a
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004cc470
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004cc470
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.004cc520
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004cc470
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004cc470
mov eax, 1
jmp 0x4cc1b4
Function at 0x4cc950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x540518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.004cc450
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.004cc4c0
push 0
mov ecx, esi
call fcn.004cc8d0
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x4cca88
lea ecx, [esp + 0xc]
call fcn.0046ae80
cmp eax, 1
jae 0x4cc9d7
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004cc470
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x34]
lea edi, [esi + 0xc]
test eax, eax
jne 0x4cca24
push 0
lea ecx, [esp + 0x10]
call fcn.0046ae70
push eax
push edi
mov ecx, 0x5f1e1c
call fcn.004cc080
test eax, eax
jne 0x4cca2c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004cc470
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push eax
mov ecx, edi
call fcn.004cc4c0
push edi
mov ecx, 0x5f1e1c
call fcn.004cbfe0
push 0
push 2
push 2
push 0
push 3
push 0xc0000000
mov ecx, edi
call fcn.0046ae60
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4cca88
push 0
push ebx
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x4cca88
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x4ccab8
push 1
mov ecx, esi
call fcn.004cc8d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004cc470
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.004cc470
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x4cd3e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004cc4c0
pop edi
add esp, 0x104
ret 4
Function at 0x4e01b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4e01e3
push esi
call fcn.004e4f40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4e01dc
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4e0269
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4e0252
mov eax, dword [esi + 8]
test eax, eax
je 0x4e0207
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4e024e
cmp eax, 2
je 0x4e0252
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4e01fa
cmp eax, 3
je 0x4e022d
cmp eax, 1
jne 0x4e01fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4e01fa
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4e01fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004e02a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4e0289
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004e02a0
add esp, 4
pop esi
ret

Function at 0x5109b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5109bb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x510abe
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x569de8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x569de8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x569de8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x569de8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x569de8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x569de8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x569de8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x569de8]
xor eax, edx
inc ecx
dec edi
jne 0x5109d6
pop edi
test esi, esi
je 0x510ae0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x569de8]
xor eax, edx
inc ecx
dec esi
jne 0x510ac2
pop esi
pop ebx
not eax
ret
Function at 0x53220e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x532246
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0053029b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00530273
jmp 0x532252
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x533903
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x533945
call fcn.005396dc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x533945
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x53393c
xor eax, eax
jmp 0x53394d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00533953
pop edi
pop esi
pop ebx
ret 4

Function at 0x539c0c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x539c3a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x539c58
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00539b72
jmp 0x539c58
mov eax, dword [esi + 0x14]
test eax, eax
je 0x539c58
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00539b72
test edi, edi
mov eax, edi
jne 0x539c42
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x53c620
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, dh
lea edx, [ecx + edx]
rdtsc
mov eax, dword [esp]
jmp 0x53b8b2
mov eax, ebp
movzx ebx, byte [eax]
dec dx
jmp 0x53b8a9
jnp 0x53b886
mov al, dh
lea edx, [ecx + edx]
jmp 0x53b8f6
lea eax, [ebx*4]
rdtsc
mov eax, dword [esp]
lea eax, [ebx*4]
js 0x53c3d4
lea esp, [esp + 3]
jmp 0x53c3d8
lea esp, [esp + 3]
lea eax, [edi - 0x80]
call fcn.0053c3f7
pushal
jmp 0x53c3fc
and al, 0xfc
pushfd
sub eax, ebx
stc
jmp 0x53c4be
mov esp, eax
pushfd
jmp 0x53c47a
mov ax, bp
lea esp, [esp + 1]
rcl al, 4
jmp 0x53c3be
mov ecx, ebx
jmp 0x53c460
push ecx
mov esi, edx
mov edi, eax
jmp 0x53c42d
not edi
mov di, bx
stc
jle 0x53c498
jg 0x53c482
inc ebp
les ebx, [edx + 0x3d]
int3
cld
rep movsb byte es:[edi], byte [esi]
pop ecx
jmp 0x53c44a
lea esi, [eax + ebx - 0x40]
push esi
push edi
jmp 0x53c443
add di, 0x1206
mov edi, dword [esp]
sub esp, 0x15
jmp 0x53c504
add di, 0x1206
mov edi, dword [esp]
sub esp, 0x15
mov word [esp + 0xf], di
lea esp, [esp + 1]
lea esp, [esp + 0x18]
jmp 0x53c4e0
je 0x53c408
jne 0x53c408
mov ah, byte [esp]
mov dx, word [esp]
jmp 0x53c4e7
pop esi
popfd
jmp 0x53b89c
btr edx, edi
jg 0x53c525
neg al
lea eax, [edx + 0x58b63674]
sete dh
not dl
jmp 0x53c52f
invalid
mov word [esp + 0xf], di
lea esp, [esp + 1]
jmp 0x53c4ac
sete dh
not dl
jmp 0x53c52f
neg al
lea eax, [edx + 0x58b63674]
jmp 0x53c50f
sub bl, 0xba
lea edx, [eax + edx]
call 0x53c53b
add byte [eax], al
xchg ebx, eax
mov word [esp + 1], dx
mov dx, word [esp + 3]
push word [esp + 2]
jmp 0x53c580
mov dl, byte [esp]
mov al, 0x29
mov dh, byte [esp]
rdtsc
sub dh, ch
jle 0x53c588
jg 0x53c59e
loope 0x53c5db
loop 0x53c4f6
je 0x53c538
jmp 0x7bdcaef1
jo 0x53c5b4
lea esp, [esp + 2]
jmp 0x53c5b8
jmp 0x53c59e
lea esp, [esp + 4]
sub bl, 0x78
rdtsc
push eax
lea edx, [esi + 0x6b7bf916]
jmp 0x53c75e
lea esp, [esp + 2]
rol bl, 0
bswap eax
jmp 0x53c55d
xor bl, 0xbf
bswap eax
sete dh
push edx
xchg edx, eax
jmp 0x53c5de
sbb dh, byte [ebp + 0x40]
inc eax
mov eax, ecx
mov ax, 0x7d57
jmp 0x53c5bf
jge 0x53c5c8
loope 0x53c562
and ebx, 0x3c
jecxz 0x53c61d
mov eax, edx
mov edx, dword [esp]
call 0x53c620
jb 0x53c5d3
je 0x53c602
out dx, al
pop ecx
xchg edi, eax
dec cl
push 0x8d24148b
xchg edx, eax
fldl2t
add byte [eax], al
mov edx, dword [esp]
lea edx, [edx + 0xe9d9]
jmp 0x53c5d5
les ecx, [ebp + 0xad04]
add byte [eax], al
rcl ax, 6
jo 0x53c624
lea eax, [edi + 0x46]
jmp 0x53c62d
lodsb al, byte [esi]
mov edi, 0xeb178b86
fmul qword [ebp + 0x4eb4647]
xor dword [eax], esi
xor ebp, dword [edx]
lea eax, [edi + 0x46]
jmp 0x53c62d
mov dword [ebx + esi], edx
lea edx, [esp + ebx]
xchg dx, bx
sub edx, 0x91a94c5c
jb 0x53c67e
xchg ah, al
jmp 0x53c723
btr eax, esp
jp 0x53c5f5
mov edx, dword [esp]
lea edx, [edx + 0xe9d9]
inc eax
mov eax, ecx
mov ax, 0x7d57
jmp 0x53c5bf
xchg ah, al
jmp 0x53c723
jmp 0x53c668
add edi, 4
lea eax, [edx + 0x808f]
lea eax, [0x7349280]
lea eax, [esp - 0xd355]
jmp 0x53b89c
xchg ah, dh
mov dl, cl
lea esp, [esp + 4]
sub bl, 0x2a
mov ax, word [esp]
jmp 0x53c64e

Function at 0x547bb9
Capabilities:
Encode data using xor

Disassembly:
push bx
lea esp, [esp + 2]
jmp 0x547bc5
pushal
lea esp, [esp + 0x20]
jmp 0x52da32
Function at 0x55ba3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
jmp 0x55b4ca
sub edi, dword [ebp + 0xc]
sub esp, 8
lea esp, [esp + 6]
lea esp, [esp + 2]
jmp 0x55bac7
inc edx
jmp 0x55b569
mov edx, ebp
lea edx, [edx - 4]
movzx eax, word [edx]
pop edx
jmp 0x55bb04
sub esp, 4
mov word [esp + 1], cx
call 0x55ba3b
mov al, byte [0x3fcca535]
jmp dword [edi + edx*8 + 0x4408b3e]
mov word [esp], di
jmp 0x55ba33
jmp 0x55ba05
mov ecx, dword [ebp - 0x10]
call fcn.0055ba1d
jmp 0x55bae1
ja 0x55b494
call 0x55ba81
jb 0x55b47e
jae 0x55b494
xor eax, 0x9f6c0595
sbb al, byte [edi + esi + 0x648d691e]
and al, 8
jne 0x55b47e
cmp edi, dword [ebp + 0xc]
jmp 0x55baa2
or eax, 0xffffffff
jmp 0x55bbab
lea esp, [esp + 8]
test ecx, ecx
push esi
lea esp, [esp + 4]
jmp 0x55ba97
shl eax, 0x10
jmp 0x55bb16
mov edi, ebx
movzx ecx, dx
bswap ebx
mov edi, 0xc099273a
mov si, 0x70f0
jmp 0x55baee
pop edi
mov bh, cl
rol esi, cl
mov bx, 0x4c4b
jmp 0x55bb64
dec ecx
jmp 0x55b4c4
lea ebx, [ebx + 8]
mov ecx, dword [ebx]
pop ebx
jmp 0x55bb83
mov ebx, ebp
jmp 0x55bb37
add eax, ecx
xchg bh, bl
mov esi, esp
push ebx
jmp 0x55bb4d
mov esi, dword [esp]
call fcn.0055bb6d
sub eax, dword [ebp + 0xc]
cmp edi, eax
jbe 0x55b4c4
ja 0x55bb31

Function at 0x55f11b
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp + 4], edx
clc
lea esp, [esp + 4]
popal
mov bp, word [esp]
jmp 0x55f138
setl bl
xchg ebp, ecx
jmp 0x55f105
movzx edi, byte [edi*4 + 0x536a98]
jmp 0x55f14b
shr edi, 0x18
lea ebp, [esi + ebp]
lea ebp, [eax*4]
mov bp, 0x2718
jmp 0x55f122
xor eax, edi
pushfd
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x55f184
mov edi, edx
pushfd
and edi, esi
jmp 0x55f16e
Function at 0x55f1e2
Capabilities:
Encrypt data using aes

Disassembly:
xor dx, 0x6dbf
mov cl, byte [esp]
jmp 0x55f285
mov word [esp + 1], cx
push dword [esp]
xor ebx, eax
jmp 0x55f1f2
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
jmp 0x55fb4e
cmc
mov edi, esi
jmp 0x55f240
neg edi
clc
shr ecx, 8
btr di, bx
mov edi, dword [esp]
jmp 0x55f21b
mov edi, edx
clc
clc
jmp 0x55f268
mov edx, dword [eax + 0xc]
setp ch
lea edi, [eax*4]
mov ecx, edx
jmp 0x55f231
and ecx, esi
stc
mov ecx, dword [ecx*4 + 0x536a98]
jmp 0x55f2be
pushal
rdtsc
xchg bp, bx
mov dword [esp + 0x1c], edi
popal
jmp 0x55f257
shr edi, 0x10
call fcn.0055f292
push ax
lea esp, [esp + 2]
jmp 0x55f2e3
lea esp, [esp + 8]
and ecx, 0xff0000
jmp 0x55f31e
lea esp, [esp + 8]
jmp 0x52b860
mov di, 0x13e8
jmp 0x55f3a4
and edi, 0xff000000
pushfd
xor ecx, edi
neg edi
jmp 0x55f308
not ebx
push si
lea esp, [esp + 2]
mov ebx, 0x53829c
jmp 0x55f2ff
and edx, esi
sub esp, 7
lea esp, [esp + 3]
jmp 0x55f389
sub esp, 0x18
lea esp, [esp + 0x18]
popal
pushal
lea esp, [esp + 0x18]
jmp 0x55f34e
shr edi, 0x18
sub esp, 0xa
mov word [esp + 5], ax
push dword [esp + 7]
jmp 0x55f5e5
mov edx, dword [edx*4 + 0x536a98]
push esi
mov dword [esp], eax
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x55f373
pushal
bsr ecx, esi
mov ch, 0x95
mov dword [esp], edx
clc
jmp 0x55f364
xor ecx, edi
and edx, ebp
rol di, cl
rol di, cl
jmp 0x55f46f
lea esp, [esp + 0x2c]
xor ecx, dword [ebx]
shl edx, 1
inc dh
mov di, 0xe6c0
jmp 0x55f41f
lea edx, [edx*4]
lea edx, [edx + 0x536a98]
movzx edi, byte [edx]
pop edx
push ecx
jmp 0x55f3b0
push ebx
jmp 0x55f444
xor ecx, dword [eax]
or dx, sp
add ebx, 4
mov dword [edi], ecx
jmp 0x55f3eb
lea edi, [eax + 0x10]
sub esp, 0x10
lea edx, [edx + ebp]
lea esp, [esp + 0x10]
jmp 0x55f401
clc
stc
jmp 0x55f44e
mov ebx, eax
add ebx, 4
mov edx, dword [ebx]
pop ebx
jmp 0x55f42e
xor edx, ecx
push ebx
pushal
jmp 0x55f458
btc ebp, edi
mov dword [esp + 0x10], eax
popal
jmp 0x55f4d1
xor ecx, edx
sub esp, 9
setg dl
bsf edi, esi
lea esp, [esp + 1]
jmp 0x55f3bf
mov dword [eax + 0x18], ecx
jmp 0x55f4b9
rcr cl, 2
mov ecx, dword [eax + 8]
xor ecx, edx
jmp 0x55f483
xor edx, ecx
cmc
jmp 0x55f4f9
mov edx, dword [eax + 0xc]
clc
jmp 0x55f4a3
add ebx, 0x14
mov dword [ebx], edx
pop ebx
mov ecx, dword [esp]
lea ecx, [ebx*4]
jmp 0x55f499
mov dword [esi], edx
pop esi
call fcn.0055f589
ljmp 0xf8ca
push esi
mov esi, eax
add esi, 0x1c
jmp 0x55f4e3
lea esp, [esp + 2]
push edx
mov edx, edi
jmp 0x55f3d7
xor edx, eax
bt ebx, ecx
sub esp, 2
lea esp, [esp + 2]
mov dword [ecx + 0x1c], edx
jmp 0x55f33f
mov dword [ecx + 0x14], ebx
setne bl
mov dword [ecx + 0x18], eax
jmp 0x55f711

Function at 0x55f292
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 7
pop word [esp + 3]
lea esp, [esp + 1]
jmp 0x55f2dc
and edi, esi
call 0x55f2a0
Function at 0x55f589
Capabilities:
Encrypt data using aes

Disassembly:
mov ebp, dword [esp]
not bh
jmp 0x55f52c
push 0xa
lea eax, [ecx*4]
mov si, word [esp]
mov eax, dword [esp]
lea ebp, [ecx + ebp]
jmp 0x55f501
lea esp, [esp + 4]
pop edi
pushal
xchg esi, ebp
xchg word [esp + 0x19], si
jmp 0x55f564
jne 0x52b860
pushal
mov ebp, dword [esp + 0xa]
pop dword [esp + 0x14]
lea esp, [esp + 0x1c]
jmp 0x55f517
lea esp, [esp + 0x20]
pop esi
pop ebp
mov ebx, esp
jmp 0x55f572
push bx
mov ebx, ecx
lea esp, [esp + 2]
jmp 0x55f5ab
lea esp, [esp + 4]
cmp ebx, 0x5382c0
jmp 0x55f54f
pop ebx
ret
Function at 0x55f79f
Capabilities:
Encrypt data using aes

Disassembly:
cmp al, dl
jmp 0x52bef9
lea eax, [ebp*4]
btr di, bp
neg ah
jmp 0x55f5fd
cmp eax, 1
jmp 0x55f7a4
call 0x55f831
mul cl
and byte [ebp - 0x32d7e48c], dh
add cl, byte [ebp + 0x64dacb01]
xchg edi, eax
dec cl
jo 0x52bfb7
add al, 0x24
push esi
jmp 0x52c01a
lea esp, [esp + 4]
push ebx
jmp 0x52bfe3
mov esi, ecx
call fcn.0054725a
mov bl, 0xf8
jmp 0x52c052
push edi
mov si, cx
mov si, word [esp]
mov si, word [esp]
jmp 0x52c000
mov ebx, eax
sub esp, 5
sub esp, 4
lea esp, [esp + 1]
jmp 0x55f595
and dword [ebp - 4], 0
dec bh
jmp 0x52c028
shl ebx, 2
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x55f5c3
lea esp, [esp + 0x3c]
test ebx, ebx
pushal
mov word [esp + 0xc], bx
jmp 0x55f6c4
mov dword [ebp - 8], eax
pushal
pop word [esp + 6]
push word [esp + 8]
jmp 0x55f5ad
mov eax, dword [edx - 8]
lea edi, [edi*4]
jmp 0x55f662
mov al, byte [esp]
bts di, dx
call fcn.0055f5f1
mov eax, dword [edx - 4]
jmp 0x55f643
mov edi, ecx
add edi, 0xfffffff8
mov dword [edi], eax
pop edi
jmp 0x55f620
mov dword [edx - 8], edi
not di
mov edi, 0x7e4186f9
sub esp, 0x15
add esp, 0xe
jmp 0x55f686
mov edi, dword [ecx - 8]
add dword [ebp - 4], 4
push edi
jmp 0x55f636
mov ax, word [esp]
mov ax, 0x5507
mov eax, ecx
jmp 0x55f6a9
lea esp, [esp + 3]
mov edi, dword [ecx - 4]
push eax
mov dword [ecx - 4], eax
jmp 0x55f66c
mov dword [ecx], eax
lea eax, [ebp*4]
shr eax, cl
sub esp, 0xa
jmp 0x55f6f0
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, dword [ecx]
jmp 0x55f693
lea esp, [esp + 0x20]
jle 0x52bf14
lea edx, [esi + ebx*4 + 8]
lea eax, [ebx + ebp]
jmp 0x55f614
mov dword [edx], edi
mov di, word [esp]
mov di, cx
jmp 0x55f8b2
lea eax, [edx - 0x9ee5]
lea esp, [esp + 2]
mov eax, dword [edx + 4]
sub esp, 1
lea esp, [esp + 1]
jmp 0x55f6da
mov dword [edx + 4], edi
push di
lea esp, [esp + 2]
jmp 0x55f77d
add edx, 4
mov dword [edx], eax
pop edx
cmc
jmp 0x55f725
lea esp, [esp + 0x20]
jl 0x52bef1
mov ax, 0x9404
call 0x55f7bd
and eax, 0xea83c754
adc byte [ecx], bh
pop ebp
cld
sub edx, 0x10
cmp dword [ebp - 4], ebx
pushal
jmp 0x55f74b
lea esp, [esp + 0x10]
sub ebx, 4
add ecx, 0x10
jmp 0x55f761
lea esp, [esp + 8]
jmp 0x52bf14
mov dl, byte [eax]
xchg cl, ah
adc byte [edx + 0x641d8d14], ah
xchg edi, eax
and eax, 0xf8458b9c
mov eax, dword [ebp - 8]
jmp 0x55f789
jle 0x52bf57
jg 0x55f7d8
cmc
jae 0x55f792
xchg byte [ebp - 0x4a], dh
in eax, dx
je 0x55f79f
lea edi, [esp + ecx*8 - 0x1f]
and byte [ebx - 0x66], ah
cmc
call 0x55f79f
mov dword [ebp - 4], ecx
lea ebx, [eax + ebx]
dec cx
lea ecx, [edx + edi]
mov ecx, dword [esp]
jmp 0x55f871
lea ecx, [eax - 1]
mov dl, al
xchg ebx, edi
xchg dl, dh
not bx
jmp 0x55f7c2
mov edi, dword [eax]
pop eax
push edx
mov edx, ecx
jmp 0x55f742
mov ecx, 0xff
jmp 0x52bf40
push eax
mov eax, ecx
add eax, 4
jmp 0x55f7f7
Function at 0x55f933
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
lea esp, [esp + 2]
jmp 0x55f97b
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + 0x537a98]
jmp 0x55f965
mov edx, dword [esi + 4]
jmp 0x55f990
mov edx, dword [edx*4 + 0x536a98]
and edx, ecx
sub esp, 9
add esp, 0
lea esp, [esp + 1]
jmp 0x55f93d
mov dword [esi], edi
pushfd
mov ebx, dword [ebx*4 + 0x536a98]
neg edi
jmp 0x55fa29
shr edi, 0x18
mov edi, dword [edi*4 + 0x536a98]
call fcn.0055f9b8
and ebx, ecx
sub esp, 1
push edi
lea esp, [esp + 1]
jmp 0x55fa0f
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + 0x537698]
jmp 0x55fa4c
ror di, cl
mov edi, 0x187d477e
mov edi, edx
stc
jmp 0x55f9de
movzx ebx, byte [ecx]
pop ecx
call fcn.0055faa5
xchg esp, eax
add dl, byte [eax + 0x56b102f7]
invalid
push ecx
mov ecx, esi
add ecx, 6
jmp 0x55fa36

Function at 0x55f9ac
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx ebx, byte [esi + 2]
stc
clc
jmp 0x55f959
and ebx, ecx
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x537698]
setne bl
jmp 0x55f8bd
xor edi, dword [ebx*4 + 0x537298]
mov ebx, ecx
jmp 0x55f922
lea edi, [edi + 0x536a98]
mov ebx, dword [edi]
pop edi
and ebx, ecx
stc
jmp 0x55f8e5
and edx, ecx
sub esp, 0x12
clc
call fcn.0055f933
mov bl, 0x23
inc esi
mov ch, 0
cmp al, 0xb4
sub cl, byte [ebp - 0x44]
or al, 0x21
pushal
movzx ebx, byte [esi + 5]
sub esp, 0xd
mov dword [esp + 1], esp
lea esp, [esp + 1]
jmp 0x55f909
push edi
mov edi, ebx
lea edi, [edi*4]
jmp 0x55f8fb
mov edi, dword [edi*4 + 0x536e98]
jmp 0x55f8d3

Function at 0x55f9c1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
and edi, ecx
call 0x55f9c1
add eax, 0x898d40eb
cwde
outsb dx, byte [esi]
push ebx
add byte [ebx - 0x137ca6c7], cl
push ds
lea esp, [esp + 2]
jmp 0x55f9ed

Function at 0x55fa8d
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0x537a98]
xchg dl, dh
jmp 0x55fab1
bts dx, cx
not edx
jmp 0x55face

Function at 0x55faa5
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 8
jmp 0x55fa7e
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x537298]
inc bl
mov ebx, dword [esp]
jmp 0x55fa54
movzx ebx, byte [esi + 9]
and edx, ecx
mov edx, dword [edx*4 + 0x536a98]
jmp 0x55fac7
add esp, 0
mov ebx, dword [ebx*4 + 0x536a98]
jmp 0x55fa6a
and edx, ecx
call fcn.0055fa8d
mov edx, dword [esi + 8]
push ebx
mov ebx, esi
jmp 0x55fada
add ebx, 4
mov dword [ebx], edi
pop ebx
jmp 0x55fb14
mov ebx, dword [ebx*4 + 0x536a98]
mov edi, edx
push di
mov word [esp], di
jmp 0x55fafc