joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10051c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x871a139e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
sub eax, 0x871a139e
je 0x1000108d
jmp 0x1000103c
mov eax, dword [ebp - 0x24]
sub eax, 0xe2ae7e2
je 0x100011c1
jmp 0x1000104f
mov eax, dword [ebp - 0x24]
sub eax, 0x18e102d7
je 0x100010d1
jmp 0x10001062
mov eax, dword [ebp - 0x24]
sub eax, 0x3c3f372e
je 0x100011af
jmp 0x10001075
mov eax, dword [ebp - 0x24]
sub eax, 0x7d8c3368
je 0x10001144
jmp 0x10001088
jmp 0x100011c8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push eax
mov edx, esp
mov dword [ebp - 0x14], ecx
mov dword [edx], eax
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
mov ecx, dword [ebp - 0x14]
mov edi, dword [edx]
not byte [edi]
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
add byte [edi], 0x47
sub byte [edi], 0x25
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
imul byte [edi]
inc edi
loop 0x100010a8
mov dword [ebp - 0x18], 0x18e102d7
jmp 0x100011c8
mov ecx, dword [0x10052f50]
mov eax, dword [0x10052f4c]
mov edx, ecx
sub edx, 0x8ba65ad7
sub edx, 1
add edx, 0x8ba65ad7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe2ae7e2
mov ecx, 0x7d8c3368
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x100011c8
mov ecx, dword [0x10052f50]
mov eax, dword [0x10052f4c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe2ae7e2
mov ecx, 0x3c3f372e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x100011c8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100182a0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], 0x7d8c3368
jmp 0x10001026
Function at 0x1001b673
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001b6b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b6b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b6b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001b6b2
cmp dword [ecx + 0x74], 0xe
jbe 0x1001b6b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001e32f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001e3cc
push ebx
push esi
call fcn.1001e2f8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001e28c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001e379
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e3cb
push edi
push eax
call fcn.1001f2ea
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001e399
call fcn.1001cdd4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e3ca
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001e28c
add esp, 0x20
test eax, eax
jne 0x1001e3b8
push edi
call fcn.1001cdd4
jmp 0x1001e3c0
push ebx
call fcn.1001cdd4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001e639
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cc8
push 0x10026cc0
push str.FlsAlloc
push 0x1f
call fcn.1001e555
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e66d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002514c]
call esi
jmp 0x1001e673
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001e6b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cd8
push 0x10026cd0
push str.FlsGetValue
push 0x21
call fcn.1001e555
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e6ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002514c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001e6f6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026ce0
push 0x10026cd8
push str.FlsSetValue
push 0x22
call fcn.1001e555
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e730
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002514c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10023ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10023ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4011a0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x409048]
push esi
lea ecx, [esp + 8]
push edi
push ecx
push 0x104
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 8]
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x401247
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, esi
sub edx, ecx
lea ecx, [esp + 8]
push ecx
lea eax, [esp + edx + 0x10]
push eax
call fcn.00406e60
add esp, 8
test eax, eax
jne 0x401247
mov ecx, 0x41
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0xc]
sub esi, ecx
lea eax, [esp + 0x110]
push esi
push edx
push eax
call fcn.00401e50
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
add esp, 0x20c
ret

Function at 0x401280
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2060
call fcn.00401f50
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004013d0
xor eax, eax
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov edi, str.java
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
mov al, byte [ebx + 4]
test al, al
jne 0x4012b8
mov edi, str.javaw
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2000
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [ebx + 0x909]
and ecx, 3
test al, al
rep movsb byte es:[edi], byte [esi]
je 0x4012f7
lea ecx, [esp + 0x70]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.00401460
jmp 0x40130c
lea eax, [esp + 0x70]
lea ecx, [ebx + 5]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, ebx
call fcn.00401520
test al, al
jne 0x40131c
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x2060
ret
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov al, byte [ebx + 4]
test al, al
je 0x40136e
push 0
lea ecx, [esp + 0x70]
push 0x40a374
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0x10
jmp 0x40137e
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x88]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401310
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
mov ecx, dword [esp + 0x18]
pop edi
mov dword [ebx], ecx
pop esi
mov al, 1
pop ebx
add esp, 0x2060
ret
Function at 0x4013f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
xor eax, eax
push esi
lea esi, [ecx + 5]
push edi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x401414
pop edi
mov al, 1
pop esi
add esp, 0x20c
ret
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 8]
lea edx, [esp + 0x110]
push ecx
push edx
push 0x104
push 0
lea eax, [esp + 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
pop edi
pop esi
setg al
add esp, 0x20c
ret

Function at 0x401650
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x41
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 8]
push 0x409078
push ecx
mov ecx, esi
call fcn.004016a0
pop edi
pop esi
add esp, 0x104
ret
Function at 0x404a05
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409618
cmp edx, dword [eax]
je 0x404a27
add eax, 8
inc ecx
cmp eax, 0x4096a8
jl 0x404a18
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409618]
jne 0x404b55
mov eax, dword [0x40a394]
cmp eax, 1
je 0x404b2f
test eax, eax
jne 0x404a58
cmp dword [0x4091e4], 1
je 0x404b2f
cmp edx, 0xfc
je 0x404b55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404a8f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406850
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403f60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404ad2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403f60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40852c
push edi
call fcn.00401e50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406850
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406860
lea eax, [ebp - 0xa0]
push 0x40850c
push eax
call fcn.00406860
push dword [esi + 0x40961c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406860
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406940
add esp, 0x2c
pop edi
jmp 0x404b55
lea eax, [ebp + 8]
lea esi, [esi + 0x40961c]
push 0
push eax
push dword [esi]
call fcn.00403f60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4d341b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x4d3068
call 0x4d3051
jmp 0x4d33da
call 0x4d306d
jmp 0x4d33f8
mov dword [esp + 0x24], eax
jmp 0x4d3cb8
jmp 0x4d34b8
call 0x4d33c0
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
push eax
mov word [eax - 0x7c], fs
test eax, eax
jmp 0x4d33e2
pop eax
sub eax, 0x84629e24
jmp 0x4d33ae
je 0x4d2fe8
jne 0x4d3406
call 0x4d33ef
jmp 0x4d3c8f
pop eax
sub eax, 0x171aae94
call dword [eax + 0x17189ca4]
jmp 0x4d33c6
call 0x4d341b
push edx
inc ebx
jb fcn.004d3476
popal
je 0x4d3479
dec ebx
jns 0x4d345d
js 0x4d345b
add cl, ch
jo 0x4d341f
add byte [eax], al
add al, ch
add byte [eax], al
add byte [eax], al
call 0x4d3425
jmp 0x4d3ecb
jne 0x4d3370
pushal
jmp 0x4d304c
xchg dword [esi], ebp
cmp dword [ebp + reloc.Common.bpl__System_initialization_qqrv], ebx
add byte [eax], al
pushfd
pushal
lea esp, [esp + 0x1a]
lea esp, [esp + 4]
jmp 0x4d3495
add byte [eax], al
sbb byte [ebx + 0x52], bh
int 0xff
inc esp
and al, 8
jmp 0x4d367a
push word [esp]
push word [esp]
pop word [esp + 1]
mov dword [esp], edx
lea edx, [eax*4]
mov dx, 0x48f
jmp 0x4d34da
inc dword [esp + 8]
popfd
ret
mov edx, ecx
mov edx, 0x62098df2
not dh
mov ebx, esp
jmp 0x4d3505
mov dx, word [esp]
mov edx, dword [esp]
lea edx, [edi + 0xcf]
setb dh
mov dh, 0xeb
push ebx
jmp 0x4d34c4
mov bx, sp
mov edx, eax
setne bh
mov edx, dword [esp]
push eax
jmp 0x4d352e
mov ebx, 0xa4de8bc2
mov dh, byte [esp]
mov bh, byte [esp]
xchg dh, dl
not dh
mov edx, esp
jmp 0x4d34ef
mov edx, 0x9a743df4
lea ebx, [esi*4]
jmp 0x4d3576
mov ebx, 0x9e821631
rdtsc
not eax
mov dx, 0x5b3
xchg al, ah
jmp 0x4d3518
mov bx, 0x963
rdtsc
mov eax, esi
call fcn.004d3560
call 0x4d3588
jmp 0x4d4101
popfd
ret
lea esp, [esp + 4]
cmp dword [esp + 4], 0
jmp 0x4d342e
pop ecx
jmp 0x4d3cd8
popal
inc dword [esp + 8]
call fcn.004d3d0d
popfd
ret
sub ecx, 0x1001aa37
mov dword [ecx + reloc.Common.bpl__System_initialization_qqrv], eax
movzx ebx, byte [eax]
add ebx, 0x15082c69
jmp 0x4d3cf3
cmp ebx, 0x15082d35
jmp 0x4d3d2e
je 0x4d3d57
jne 0x4d3348
sti
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fcom qword [ebx]
mov word [edx], es
xchg esp, eax
and byte [edi + 0x1be88919], al
invalid
pop dword [esp + 4]
jmp 0x4d3d9f
mov bx, word [esp]
mov bl, byte [esp + 4]
pop word [esp + 1]
jmp 0x4d3dee
lea esp, [esp + 2]
mov dword [esp], ebx
push ecx
setg bh
pop bx
pushfd
jmp 0x4d3d89
push eax
mov eax, dword [esp]
mov ebx, dword [esp]
mov ax, word [esp]
bswap eax
bswap eax
jmp 0x4d3e01
mov bh, byte [esp + 2]
not ebx
mov ebx, dword [esp + 1]
pop ebx
mov bx, 0x3b3a
bswap ebx
jmp 0x4d3dd6
mov bl, 0xf1
push ebp
not ah
pushal
mov bp, word [esp]
call fcn.004d3f2b
sub byte [edx + 0x3902b445], ch
sbb byte [ebx + 0x52], bh
int 0xf
test dword [esi - 3], esi
invalid
pop eax
sub eax, 0xfc32f09c
jmp 0x4d3f14
call 0x4d3f24
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
fmul dword [edi - 0x2a]
inc ecx
ret
mov eax, dword [esp]
Function at 0x4d3b3c
Capabilities:
Encode data using xor

Disassembly:
push 0
jmp 0x4d331f
call 0x4d3301
jmp 0x4d3a5e
mov dword [esp + 0x24], eax
jmp 0x4d3b01
call 0x4d3324
jmp 0x4d3ab6
call 0x4d3389
jmp 0x4d3c36
jmp 0x4d3a9d
popfd
ret
jne 0x4d3a30
pushal
jmp 0x4d32fc
pop eax
sub eax, 0x52177c8f
jmp 0x4d3b2a
je 0x4d31c4
jne 0x4d3ae3
pop ecx
sub ecx, 0x1001a9ad
push edi
jmp 0x4d3ac4
inc dword [esp + 8]
jmp 0x4d3a32
pop eax
sub eax, 0x3a264baa
call dword [eax + 0x3a243703]
jmp 0x4d3b42
mov edi, ecx
lea edi, reloc.Common.bpl__System_initialization_qqrv
mov dword [edi], eax
pop edi
jmp 0x4d3b12
call 0x4d3af6
push edx
dec edi
jo 0x4d3b53
outsb dx, byte [esi]
dec ebx
jns 0x4d3b38
js 0x4d3b36
add byte [eax - 0x18], dl
invalid
popal
inc dword [esp + 8]
call 0x4d3b0c
sub byte [ebp - 0x14fbdb9c], cl
dec ebp
movzx ebx, byte [eax]
jmp 0x4d3b49
call 0x4d3b3c
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
or ebp, dword [eax + 0x15]
push edx
test eax, eax
jmp 0x4d3a8b
add ebx, 0x7dd4cd79
jmp 0x4d3b61
add byte [eax], al
add byte [ecx - 0x17], bl
pop ecx
invalid
adc eax, 0x6c000013
jg 0x4d3ba5
popfd
ret
cmp ebx, 0x7dd4ce45
aam 0x7d
je 0x4d3bc5
jne 0x4d3306
cmc
jno 0x4d3b53
xor byte [ebx - 0x50], 0xf5
jb 0x4d3b58
xchg dword [edx - 0x3f], esi
cmc
ja 0x4d3b65
xor byte [ecx - 0x37], 0xea
add eax, 0x8118b60f
ret
inc dword [esp + 8]
jmp 0x4d3cb0
std
scasd eax, dword es:[edi]
sub edi, dword [ebx - reloc.Common.bpl__System_initialization_qqrv]
mov ebx, 0xcee92dde
pop ecx
mov dword [esp], edi
lea esp, [esp + 4]
jmp 0x4d3bd1
cmp dword [esp + 4], 0
jmp 0x4d3e1b
cmp cl, byte [ebp - 0x1570e06f]
sbb dword [ebx - 0x3003120e], edx
push 0
pushfd
push bx
mov byte [esp], bh
lea esp, [esp + 2]
jmp 0x4d3bb7
call 0x4d3c21
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
salc
or al, 0x80
push ss
jno 0x4d3ba8
inc ebp
mov dl, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
xchg dword [esi + ecx - 0x58e90464], ebx
pop ds
pop eax
sub eax, 0x79e62b73
jmp 0x4d3c0f
popfd
ret
jne 0x4d3b97
pushal
jmp 0x4d3384
Function at 0x4e1a74
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [ebp - 8]
jmp 0x4e1b1a
jmp 0x4e1a5e
lea esp, [esp + 4]
jmp 0x4b9dfa

Function at 0x4e1a76
Capabilities:
Encrypt data using aes

Disassembly:
pop ebp
call 0x4e221d
cmp eax, 0x9bb66f99
push 0xfffffffffffffff5
loope 0x4b9eb3
je 0x4b9dda
add dword [edx], edi
jne 0x4b9ea9
xchg edi, eax
dec byte [ecx + 0x2c89241c]
mov dword [esp], ebx
mov dword [esp], ebp
mov bp, word [esp]
fadd dword [esi]
push ss
pop ebp
lodsb al, byte [esi]
mov edi, 0x24748886
invalid
je 0x4b9ed7
add ebx, ebp
in al, 0x3c
setbe byte [ecx]
mov word [esp], bp
mov byte [esp + 2], dl
jmp 0x4e1ac5
lea esp, [esp + 4]
jle 0x4b9e31
clc
mov bh, dh
rol bh, cl
jmp 0x4e1aa1

Function at 0x4e1b2f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov dword [esp], eax
jmp 0x4e1a95
lea edx, [ebx + ebp]
movzx ebx, byte [esi + 0x11]
mov dh, byte [esp]
jmp 0x4e1b00
jmp 0x4e17a1
mov word [esp], ax
jmp 0x4e17dd
mov bx, 0xab1e
and dword [ebp - 4], 0
mov ebx, eax
push si
jmp 0x4e17f1
lea esp, [esp + 4]
call fcn.004d88fb
sbb ebx, 0xf2fdcfc0
inc ebx
not ebx
jmp 0x4e17bc
mov byte [esp], al
lea esp, [esp + 2]
shl ebx, 2
push sp
push sp
jmp 0x4e1854
test ebx, ebx
call fcn.004e181a
lea esp, [esp + 4]
jle 0x4b9dfa
sub esp, 0x1c
xchg dx, ax
mov dword [esp], ecx
jmp 0x4e1983
mov dword [esp], ebx
pushal
mov dword [ebp - 8], eax
lea esp, [esp + 0x24]
jmp 0x4e1830
xchg byte [esp + 1], ch
lea esp, [esp + 4]
lea ecx, [esi + 8]
jmp 0x4b9de0
mov dword [esp + 0x11], edx
lea esp, [esp + 0x1c]
lea edx, [esi + ebx*4 + 8]
push ebp
mov di, dx
jmp 0x4e191f
lea esp, [esp + 4]
cmp eax, 1
call fcn.004e1a76
lea ecx, [eax - 1]
mov bx, 0x43b3
neg dh
mov dword [ebp - 4], ecx
mov ebx, dword [esp]
jmp 0x4e1aec
mov ecx, 0xff
jmp 0x4b9e10
mov edx, dword [esp]
sub esp, 0xd
mov byte [esp + 2], dl
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0x4e1ad6
push esi
mov esi, ebx
lea esi, [esi*4]
lea esi, reloc.Common.bpl__System_initialization_qqrv
jmp 0x4e1b4d
add esi, 0x10
mov edx, dword [esi]
cmc
call 0x4e1b2f
rcl bl, 0xd7
jmp 0x4e1b5a
clc
pushfd
push esi
mov esi, edi
jmp 0x4e1b66
mov ebx, dword [esi]
pop esi
stc
bswap edi
mov edi, 0xc70c1ab
jmp 0x4e1b23
mov edi, edx
pushfd
shr edi, 0x18
sub esp, 0
clc
jmp 0x4e1b33
lea esi, [esi*4]
lea esi, reloc.Common.bpl__System_initialization_qqrv
mov edi, dword [esi]
pop esi
cmc
jmp 0x4e1b99

Function at 0x4e1bc4
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 1], dx
mov ebx, dword [ebx*4 + reloc.Common.bpl__System_initialization_qqrv]
jmp 0x4e1bff
and ebx, ecx
pushal
add esp, 0x1e
mov word [esp], bp
call fcn.004e1be9
push 0xffffffffffffffff
outsd dx, dword [esi]
or bh, cl
mov byte [eax - 0x30], 0x46
and eax, edx
int 0xf8
Function at 0x4e1be9
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x4e1c4c
movzx ebx, byte [esi + 5]
sub esp, 4
sub esp, 5
pop word [esp + 2]
lea esp, [esp + 3]
jmp 0x4e1c77
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.Common.bpl__System_initialization_qqrv]
mov bh, 0x80
btc ebx, ecx
mov ebx, dword [esp]
jmp 0x4e1c2d
and edx, ecx
sub esp, 0xa
sub esp, 0x19
pop word [esp + 0x1c]
jmp 0x4e286d
and edx, ecx
sub esp, 0x19
lea esp, [esp + 0xd]
mov edx, dword [edx*4 + reloc.Common.bpl__System_initialization_qqrv]
jmp 0x4e1c61
lea esp, [esp + 2]
jmp 0x4e1cea
lea esp, [esp + 3]
lea esp, [esp + 0x18]
popal
pushfd
lea esp, [esp + 2]
add esp, 0
jmp 0x4e1cab
shr edi, 0x18
call 0x4e1cd4
and dword [edx + reloc.Common.bpl__System_initialization_qqrv], edi
add dword [edi + reloc.Common.bpl__System_initialization_qqrv], ebx
jb 0x4e1d6d
jl 0x4e1d51
salc
inc ecx
bsr esi, ecx
mov dword [esp + 4], edx
clc
sub esp, 0x19
mov word [esp + 0x12], ax
pop word [esp + 0x10]
jmp 0x4e1cc1
add bl, ch
fnsave dword [ebx]
cmp al, 0x9d
adc byte [ebp + 0x4c], 0
xor edi, dword [ebx*4 + reloc.Common.bpl__System_initialization_qqrv]
mov ebx, dword [esp]
dec ebx
jmp 0x4e1d79
or byte [ebp + 0x4c], 0
and ebx, ecx
lea esp, [esp + 0x4c]
jmp 0x4e1d54
movzx ebx, byte [esi + 6]
sub esp, 0x11
lea esp, [esp + 0xe]
push word [esp]
lea esp, [esp + 1]
jmp 0x4e1e15
mov edi, dword [esp]
pushal
xchg di, ax
cmc
push edi
jmp 0x4e1d04
mov ebx, dword [ebx*4 + reloc.Common.bpl__System_initialization_qqrv]
sub esp, 0xe
mov dword [esp], ebx
call 0x4e1dca
mov dword [esi + 4], edi
btr edi, eax
bts edi, ecx
stc
jmp 0x4e1e4f
mov ebx, dword [ebx*4 + reloc.Common.bpl__System_initialization_qqrv]
lea edi, reloc.Common.bpl__System_initialization_qqrv
inc edi
lea edi, [ecx + edx]
mov edi, 0xd25d6a20
jmp 0x4e1e77
mov edi, edx
push dx
add esp, 1
cmc
lea esp, [esp + 1]
jmp 0x4e1ec9
mov dword [esi], edi
bswap edi
neg di
mov ebx, dword [ebx*4 + reloc.Common.bpl__System_initialization_qqrv]
jmp 0x4e1d93
shr edi, 0x18
sub esp, 0x11
lea esp, [esp + 1]
mov edi, dword [edi*4 + reloc.Common.bpl__System_initialization_qqrv]
call fcn.004e1e85
sub esp, 0xc
mov word [esp], bp
lea esp, [esp + 3]
mov dword [esp + 4], esp
jmp 0x4e1f1d
lea esp, [esp + 1]
and ebx, ecx
call fcn.004e1f07
test byte [ebx], dl
and esi, 0x15
lodsb al, byte [esi]
sbb dl, byte [edx + ecx - 0x73d56393]
add dword [ecx + reloc.Common.bpl__System_initialization_qqrv], edx
add edi, dword [edx - reloc.Common.bpl__System_initialization_qqrv]
and al, 3
add esp, 2
lea esp, [esp + 3]
mov edx, dword [esi + 4]
stc
pushal
jmp 0x4e1e9b
lea esp, [esp + 1]
lea esp, [esp + 0x30]
xor edi, dword [edx*4 + reloc.Common.bpl__System_initialization_qqrv]
mov dx, 0xb4b6
sub esp, 5
jmp 0x4e1f3d

Function at 0x4e1df8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp]
mov byte [esp + 1], dh
jmp 0x4e1e6d
lea esp, [esp + 0x34]
xor edi, dword [edx*4 + reloc.Common.bpl__System_initialization_qqrv]
shl dh, cl
mov edx, dword [esi + 8]
jmp 0x4e1e27
and edx, ecx
stc
clc
push ebx
mov dword [esp], eax
jmp 0x4e1e3d