joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb37dea
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl dx, cl
not ax
xchg edx, eax
lea eax, [ebp - 0x73]
sub dh, cl
jmp 0xb36bd8
movzx ebx, byte [edi]
mov dl, byte [esp]
mov eax, dword [esp]
add al, 0x24
neg eax
jmp 0xb36b00
jnp 0xb36ad9
shl dx, cl
not ax
call fcn.00b36b42
cli
jo 0xb36af6
xor dword [eax - 9], reloc.MSVCRT.dll_malloc
mov al, 0xcb
fistp dword [ebx + ebp*8]
rcr byte [edi - 0x2c], cl
dec edx
sub eax, 0x41c15bdc
sal dword [eax + reloc.MSVCRT.dll_malloc], 1
cli
lea eax, [edx + ebx]
call fcn.00b36bec
inc ebx
retf
jmp 0xb36b9b
mov dl, bl
mov ah, byte [esp]
jmp 0xb36bbe
mov eax, dword [esp]
not eax
mov eax, dword [esp]
ror eax, 0xd
jo 0xb36c60
jno 0xb36c60
outsd dx, dword [esi]
jbe 0xb36c39
sub bl, cl
mov ax, word [esp]
mov edx, eax
clc
jno 0xb36bb1
lea eax, [edx + ebx]
jmp 0xb36bb3
mov al, 0x70
sete al
xchg dword [esp], esi
ror al, 6
bts eax, ebp
push bp
jmp 0xb36c23
mov ax, 0x28c3
mov ah, 0x96
lea esp, [esp + 2]
push dword [esp]
ret 4
mov ah, dl
inc ax
bsf eax, esi
mov eax, esp
lea esi, [esi + 0x10]
mov ax, dx
jmp 0xb36bfc
add dl, 0xdd
mov al, dl
neg ax
jge 0xb36c62
mov ax, 0x52cb
jmp 0xb36f10
jmp 0xb36c4a
mov ax, 0x52cb
jmp 0xb37117
lea eax, [ecx*4]
mov ax, word [esp]
mov ax, bx
jmp 0xb37125
lea eax, [ecx*4]
mov ax, word [esp]
mov ax, bx
call fcn.00b36cdf
mov esp, ebp
mov dl, 0xba
mov dx, bp
sub esp, 9
jle 0xb37167
mov edx, edi
lea esp, [esp + 1]
jmp 0xb3714f
mov edx, edi
lea esp, [esp + 1]
push eax
ret
jmp 0xb37149
mov edx, dword [eax]
mov ax, sp
sub esp, 0x1c
ja 0xb37dcb
jbe 0xb37d55
mov dword [eax], ebp
lea edx, [edx + ebx]
lea esp, [esp + 3]
jmp 0xb37e83
lea edx, [ebx + edi]
jmp 0xb36aef
bswap eax
pushal
add esi, 4
lea edx, [esi + edi]
bswap edx
jmp 0xb37c86
mov ax, word [esp + 0x1b]
call fcn.00b37cff
mov ax, word [esp + 0x1b]
mov dword [ebx + ebp], edx
xchg bx, ax
mov ah, bl
jmp 0xb37c9c
call fcn.00b37e2b
lea eax, [eax + 0x37]
call fcn.00b37e15
fistp dword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
in al, 0x3f
mov edi, 0x76b94a2f
adc cl, byte [ebp + 0x61766f1c]
jns 0xb37e77
sub esp, 0x13
rdtsc
jmp 0xb37c4c
sub esp, 0x13
rdtsc
lea edx, [edx + ebx]
lea esp, [esp + 3]
mov eax, esi
jmp 0xb37c36

Function at 0xb37e2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
lea esp, [esp + 2]
xchg dword [esp + 4], eax
jmp 0xb37def

Function at 0xb37e8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jno 0xb37ed5
jo 0xb37ed5
cmp dword [edx + reloc.MSVCRT.dll_malloc], esi
xor esi, dword [edi + reloc.MSVCRT.dll_malloc]
sub al, byte [ebp - 0x79]
push esp
and al, 0x28
Function at 0xb37eb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xb37ebd
add byte [eax], al
call fcn.00b37ef0
jmp 0xb37eda
pushfd
jmp 0xb36157
setle al
add si, bx
jb 0xb37ef5
jae 0xb37f31
cmc
jbe 0xb37eae
cmp dword [esi - 0x31], reloc.MSVCRT.dll_malloc
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fisttp dword [esi]
cdq
call fcn.00b37eab
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0xb37eb7
mov ax, word [esp]
mov esi, eax
mov edi, dword [esp + 0x2c]
bsr ecx, ebp
jmp 0xb37f5a
not ebp
cpuid
rol ecx, 9
jmp 0xb37f78
mov ax, word [esp]
mov esi, eax
jmp 0xb37efb
rol ecx, 9
jmp 0xb37f78
mov ebp, esp
mov dl, byte [esp]
sub esp, 5
jnp 0xb37f62
jp 0xb37f9f
push ss
pushfd
xor dl, byte [ebp - 0x5c]
and esp, dword [eax - 0x17]
jns 0xb37f6c
jmp fcn.00b37fc4
jnp 0xb37f1b
not ebp
cpuid
jmp 0xb37f39
pushal
lea esp, [esp + 1]
mov ecx, edi
lea ebx, [ecx*4]
add byte [eax], al
add byte [eax], al
jmp 0xb37ffd
lea esi, [esp]
xchg cl, ch
mov dx, 0x2e93
sub esp, 0xc0
jmp 0xb37f3e
pushal
lea esp, [esp + 1]
call fcn.00b37f89
in eax, 0x8d
add al, 0x3c
xchg dword [esp], ecx
lea eax, [eax + ebp]
lea ebx, reloc.MSVCRT.dll_malloc
call fcn.00b384d3
adc al, 0x87
cmp dword cs:[eax], ebx
xchg edx, ebx
clc
mov ebx, esi
jmp 0xb3802a
neg ebx
jmp 0xb37fd0
mov dx, 0xb62c
mov al, byte [esp]
stc
jg 0xb37fe6
neg ebx
xchg edx, ebx
clc
mov ebx, esi
mov bl, 0xdf
jmp 0xb3802c
not edi
not ah
mov bx, dx
lea ebx, [esp + eax]
rcr bx, 5
jmp 0xb38050
mov bl, 0xdf
mov dx, sp
mov bl, 0x8f
lea eax, [eax*4]
jmp 0xb38012
jnp 0xb38069
xchg al, ah
mov dx, 0x70dc
jmp 0xb380bc
xchg al, ah
mov dx, 0x70dc
xchg dx, bx
neg edi
setnp bh
mov al, ch
mov bl, 0x82
jmp 0xb38098
mov dl, 0x1c
mov eax, edi
neg edi
bswap eax
sub esp, 0xd
jb 0xb380a2
lea eax, [ecx*4]
jmp 0xb380a4
xchg ebx, eax
btr ebx, esi
jne 0xb3807d
mov dl, 0x1c
jmp 0xb380c1
jmp 0xb380c5
bswap edx
mov dl, byte [esp + 0xa]
mov edx, 0x8eb50151
jmp 0xb381e2
xchg dx, bx
jmp 0xb38072
mov eax, edi
jmp 0xb38081
lea eax, [ecx*4]
bswap edx
mov dl, byte [esp + 0xa]
mov edx, 0x8eb50151
rdtsc
lea esp, [esp + 1]
jmp 0xb38141
jb 0xb38116
mov ebx, dword [esp]
lea edx, [ebx + esi]
jmp 0xb38124
mov ebx, dword [esp]
lea edx, [ebx + esi]
not edx
jmp 0xb381ad
not edx
jmp 0xb381ad
lea esp, [esp + 0xc]
inc edi
mov al, cl
not dl
btc dx, bp
jmp 0xb38100
neg edi
mov bh, byte [esp]
lea edx, reloc.MSVCRT.dll_malloc
rdtsc
jmp 0xb380d9
Function at 0xb37eb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xb37ebd
add byte [eax], al
call fcn.00b37ef0
jmp 0xb37eda
pushfd
jmp 0xb36157
setle al
add si, bx
jb 0xb37ef5
jae 0xb37f31
cmc
jbe 0xb37eae
cmp dword [esi - 0x31], reloc.MSVCRT.dll_malloc
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fisttp dword [esi]
cdq
call fcn.00b37eab
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0xb37eb7
mov ax, word [esp]
mov esi, eax
mov edi, dword [esp + 0x2c]
bsr ecx, ebp
jmp 0xb37f5a
not ebp
cpuid
rol ecx, 9
jmp 0xb37f78
mov ax, word [esp]
mov esi, eax
jmp 0xb37efb
rol ecx, 9
jmp 0xb37f78
mov ebp, esp
mov dl, byte [esp]
sub esp, 5
jnp 0xb37f62
jp 0xb37f9f
push ss
pushfd
xor dl, byte [ebp - 0x5c]
and esp, dword [eax - 0x17]
jns 0xb37f6c
jmp fcn.00b37fc4
jnp 0xb37f1b
not ebp
cpuid
jmp 0xb37f39
pushal
lea esp, [esp + 1]
mov ecx, edi
lea ebx, [ecx*4]
add byte [eax], al
add byte [eax], al
jmp 0xb37ffd
lea esi, [esp]
xchg cl, ch
mov dx, 0x2e93
sub esp, 0xc0
jmp 0xb37f3e
pushal
lea esp, [esp + 1]
call fcn.00b37f89
in eax, 0x8d
add al, 0x3c
xchg dword [esp], ecx
lea eax, [eax + ebp]
lea ebx, reloc.MSVCRT.dll_malloc
call fcn.00b384d3
adc al, 0x87
cmp dword cs:[eax], ebx
xchg edx, ebx
clc
mov ebx, esi
jmp 0xb3802a
neg ebx
jmp 0xb37fd0
mov dx, 0xb62c
mov al, byte [esp]
stc
jg 0xb37fe6
neg ebx
xchg edx, ebx
clc
mov ebx, esi
mov bl, 0xdf
jmp 0xb3802c
not edi
not ah
mov bx, dx
lea ebx, [esp + eax]
rcr bx, 5
jmp 0xb38050
mov bl, 0xdf
mov dx, sp
mov bl, 0x8f
lea eax, [eax*4]
jmp 0xb38012
jnp 0xb38069
xchg al, ah
mov dx, 0x70dc
jmp 0xb380bc
xchg al, ah
mov dx, 0x70dc
xchg dx, bx
neg edi
setnp bh
mov al, ch
mov bl, 0x82
jmp 0xb38098
mov dl, 0x1c
mov eax, edi
neg edi
bswap eax
sub esp, 0xd
jb 0xb380a2
lea eax, [ecx*4]
jmp 0xb380a4
xchg ebx, eax
btr ebx, esi
jne 0xb3807d
mov dl, 0x1c
jmp 0xb380c1
jmp 0xb380c5
bswap edx
mov dl, byte [esp + 0xa]
mov edx, 0x8eb50151
jmp 0xb381e2
xchg dx, bx
jmp 0xb38072
mov eax, edi
jmp 0xb38081
lea eax, [ecx*4]
bswap edx
mov dl, byte [esp + 0xa]
mov edx, 0x8eb50151
rdtsc
lea esp, [esp + 1]
jmp 0xb38141
jb 0xb38116
mov ebx, dword [esp]
lea edx, [ebx + esi]
jmp 0xb38124
mov ebx, dword [esp]
lea edx, [ebx + esi]
not edx
jmp 0xb381ad
not edx
jmp 0xb381ad
lea esp, [esp + 0xc]
inc edi
mov al, cl
not dl
btc dx, bp
jmp 0xb38100
neg edi
mov bh, byte [esp]
lea edx, reloc.MSVCRT.dll_malloc
rdtsc
jmp 0xb380d9

Function at 0xb37f12
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x2c], esi
call fcn.00b37eb0
Function at 0xb3b95e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov bl, byte [ecx + 1]
call 0xb3b95e
add ebx, dword [ecx + ebp*8 + reloc.MSVCRT.dll_malloc]
jmp 0x983026db
call fcn.00b95944
sbb ch, bh
les ebx, [ecx + 0x7efa71e3]
out 0xb0, al
ljmp 0x5077
cmp al, 0x2b
call fcn.00b95a00
push ebp
les esi, [edi + 0x5e]
adc edx, dword [ebp - reloc.MSVCRT.dll_malloc]
je 0xb3ba05
popal
test eax, 0xe7e954f5
mov al, byte [0x87ac0005]
and ebp, dword [eax + reloc.MSVCRT.dll_malloc]
lodsd eax, dword [esi]
mov bh, byte [edi + 0x6bc8a95a]
add byte [eax - 0x639fcf05], 0xe9
mov dword [reloc.MSVCRT.dll_malloc], eax
movsw word es:[edi], word [esi]
jmp 0xbe2490
or al, byte [eax]
shl byte [ebp - 0x57f99ee], cl
popal
lea esp, [esp + 2]
jb 0xb3b974
cmp al, 0x5a
jmp 0xb959dc
lea esp, [esp + 4]
cmp al, 0x61
call fcn.00b9598a
xchg edi, eax
adc byte [esi + 0xba010e1], al
lea ebx, reloc.MSVCRT.dll_malloc
mov byte [esp + 8], bl
lea esp, [esp + 3]
lea esp, [esp + 0x10]
cmp al, 0x41
push cx
jmp 0xb95933
jbe 0xb3b955
ja 0xb3b974
lea esp, [esp + 4]
jbe 0xb3b955
ja 0xb3b9c9
push es
mov cl, 0xb0
mov bl, 0xaa
invalid
jbe 0xbe24ab
mov bh, 0xdf
int1
aam 0xe5
retf
push 0x3bb29908
call fcn.00b4c9a3
jl 0xbe24eb
salc
inc ecx
fisubr word [eax + 0x714271f4]
test al, 0xa9
loope 0xbe2480
pop ss
pop ebp
into
cmp al, 0x6c
xchg edi, eax
pop ebp
xchg ebx, eax
mov esi, es
add al, 0x5d
movsb byte es:[edi], byte [esi]
aas
shr byte [ecx], 0x45
sub byte [edx], bh
cmp edi, dword [eax - 0x3d]
jp 0xbe2515
les edx, [ebx + 0x70]
pop es
or ch, byte [eax + 0x49]
sub bh, byte [edx - 0x55c5bd49]
in eax, dx
fst dword [reloc.MSVCRT.dll_malloc]
dec ebx
sbb byte [ebx + 0x6f], ah
mov dword [reloc.MSVCRT.dll_malloc], eax
adc byte gs:[edi + 0x5e], dh
test eax, 0x758312c8
imul esi, ecx, 0x1d0e3a59
imul esp, dword [eax - 0x4f], 0x64
push cs
sbb eax, 0x64b1606b
out dx, eax
and ch, byte [ebp + 0xb0ba4b7]
js 0xbe24f1
rol dword [ebx], 0x62
inc ebx
fisttp word [ecx]
pop edx
mov edi, 0x2af77ec6
xchg ecx, eax
xor eax, 0x42b76740
or byte [esi + 0x44f9d9d1], 0xea
test al, 0xa6
xchg esi, eax
cdq
cmc
inc esi
xchg ecx, eax
popal
int1
pushal
jg 0xbe256e
push eax
cmp byte [0xc9d09f0c], 0x74
imul esi, ecx, 0x5d0cbcdb
loope 0xbe2593
cli
popfd
insb byte es:[edi], dx
fist word [ecx]
nop
adc eax, dword [eax + reloc.MSVCRT.dll_malloc]
sbb dh, byte [edi + 0x6c5bf28d]
sbb bl, byte [edx]
mov bh, 0x8d
pop ebx
insb byte es:[edi], dx
fdivr qword [edx - 0x75dd73b1]
and eax, 0xa63ac754
movsd dword es:[edi], dword [esi]
and dword [edi], ebp
push ecx
inc ebx
bound ebx, qword [eax]
xchg ebp, eax
lodsd eax, dword [esi]
push esp
push 0x19
dec eax
jmp 0xe0644a27
inc eax
mov ah, 0xf5
pop eax
jno 0xbe253a
sar byte [ecx], 0x9d
aad 0x25
sbb eax, 0x465eb54a
into
dec esp
push cs
jg 0xbe255a
push cs
dec ebp
fidivr dword [ecx + 0xade3109]
imul edi, dword [edx + reloc.MSVCRT.dll_malloc], 0x51
sub al, 0xb
inc edi
int3
or eax, dword [edi - 0x34]
adc ch, bl
ret 0xcdc4
Function at 0xb5357e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edi
call 0xb5355a
mov ebp, dword [esp + 0x2c]
rol ah, 7
je 0xb535c1
setne bl
rcl edx, cl
call fcn.00b535c6
xchg dword [ebx], edx
and esi, 0x15
xchg esp, eax
push ss
xchg esp, eax
or ch, byte [ebp - 0x64]
sub al, 0x81
shr ebp, 0x12
jmp 0xb53586
rcl edx, cl
jmp 0xb535dc
setne bl
jmp 0xb535ab
lea esi, [esp]
rdtsc
jmp 0xb53652
stc
neg edx
cpuid
push dword [esp + 0x18]
ret 0x1c
mov ch, byte [esp]
sub esp, 0x17
push dword [esp + 0x14]
mov ecx, dword [esp + 0x17]
lea esp, [esp + 3]
xchg dword [esp + 0x18], eax
jmp 0xb5360e
rdtsc
sub esp, 9
jmp 0xb536ab
neg di
jl 0xb5363c
rdtsc
sub esp, 9
lea esp, [esp + 1]
call fcn.00b5367c
shl byte [esi - 0x6d], cl
mov edx, 0xd7f06ec8
xchg dword [esp], esi
jmp 0xb53686
lea edi, [ecx*4]
not bx
bswap edx
bsr ax, sp
lea esi, [esi + 0x4a]
call 0xb536c5
popal
loop 0xb53711
pop ss
loop 0xb536f7
mov eax, dword [reloc.MSVCRT.dll_malloc]
lahf
fimul dword [ebp - reloc.MSVCRT.dll_malloc]
in al, dx
mov eax, 0xeb000000
jl 0xb536ee
lea esp, [esp + 1]
sub esp, 0xb8
jmp 0xb53733
mov ch, 0x25
dec esp
mov edi, 0x34a62003
push ebx
scasb al, byte es:[edi]
pop ds
push edi
mov esi, 0x2ceb310f
mov word [ecx], cs
cdq
clc
or edi, dword [ecx + reloc.MSVCRT.dll_malloc]
stosb byte es:[edi], al
sbb ecx, dword [edi + ecx*8 + 0x5f]
cmp cl, cl
loop 0xb536fa
btr ebx, esp
lea ecx, [ebp*4]
mov bh, 0xc0
mov edi, edx
lea eax, [eax + 0x43]
rcr bl, cl
jmp 0xb53624
in al, dx
add esp, dword [esi - 0x75]
invalid
mov eax, edi
lea esp, [esp + 3]
xchg dword [esp + 4], esi
lea ecx, [ebp*4]
jmp 0xb5375d
div byte [ecx + 0x7f]
add edx, dword [ebx + reloc.MSVCRT.dll_malloc]
int1
mov edi, esp
inc bl
jmp 0xb537ad
xchg ebx, eax
neg cl
inc bh
inc bh
jmp fcn.00b53742
jnp 0xb5373d
xchg ebx, eax
neg cl
jmp 0xb53782

Function at 0xb64018
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
bswap eax
mov dword [esp + 2], edx
lea eax, [eax + 0x49]
call fcn.00b63b7e
pushal
mov dword [esp + 0x17], eax
mov ax, 0xbfa5
not al
bswap eax
lea eax, [edx + ebp]
jmp 0xb63db2
push dword [esp + 1]
jmp 0xb63dfd

Function at 0xb94988
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebp
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0xb949b3
xor eax, edi
mov edi, edx
and edi, esi
jmp 0xb949bf
mov edi, dword [edi*4 + reloc.MSVCRT.dll_malloc]
mov ebp, 0xff00
sub esp, 0xa
mov byte [esp + 5], ch
jmp 0xb94a04
xor eax, edi
rcl di, 0xe
not edi
dec edi
lea edi, [eax + esi]
jmp 0xb94a26
add esp, 8
lea esp, [esp + 2]
and edi, ebp
pushfd
jmp 0xb949ee
lea edi, [ecx + 0x10]
call fcn.00b94a49
test al, 0x3e
pop ecx
test al, 0x19
inc eax
lds edx, [ebp + 0x3c]
iretd
lea esp, [esp + 0x20]
xor eax, dword [ecx]
not edi
mov edi, dword [esp]
jmp 0xb94a10
Function at 0xb94a49
Capabilities:
Encrypt data using aes

Disassembly:
setnp dh
jmp 0xb94afb
mov eax, dword [ecx + 8]
jmp 0xb94a65
xor ebx, eax
mov dword [edi], eax
jmp 0xb94a33
mov dword [ecx + 0x18], eax
bsf ebx, ecx
jmp 0xb94d44
xor eax, ebx
mov dword [ecx + 0x14], ebx
bts bx, bx
jmp 0xb94a4f
bswap ecx
xchg cl, ch
mov ecx, edx
lea edi, [ebx*4]
jmp 0xb94ace
mov ebx, eax
add ebx, 0xc
mov edx, dword [ebx]
pop ebx
jmp 0xb94a92
and ecx, esi
jmp 0xb94adc
shr ecx, 8
sub esp, 2
lea esp, [esp + 2]
mov edi, edx
jmp 0xb94ab8
mov ecx, dword [ecx*4 + reloc.MSVCRT.dll_malloc]
shr edi, 0x10
jmp 0xb94b19
mov eax, edi
mov edi, ebp
clc
push ebx
jmp 0xb94aae
and ecx, 0xff0000
pushfd
jmp 0xb94c4f
and edi, esi
mov edi, dword [edi*4 + reloc.MSVCRT.dll_malloc]
jmp 0xb94b03
mov ebx, 0xb4b700
lea esp, [esp + 0x18]
jmp 0xb3b1cd
shr edi, 0x18
call fcn.00b94b58
xor ecx, edx
pushfd
mov byte [esp + 2], cl
jmp 0xb94bbb
lea esp, [esp + 0x2c]
xor ecx, dword [ebx]
neg edx
lea edi, [eax + 0x10]
jmp 0xb94c0a
sub esp, 0xd
pop word [esp + 7]
lea esp, [esp + 3]
mov edx, dword [edx*4 + reloc.MSVCRT.dll_malloc]
jmp 0xb94b6f
xor ecx, dword [eax]
bts dx, di
jmp 0xb94c33
mov dx, word [esp]
jmp 0xb94bf4
mov edi, edx
sub esp, 7
mov dword [esp], edi
lea esp, [esp + 3]
and edx, esi
jmp 0xb94bdc
add ebx, 4
call fcn.00b94c73
add al, 0xe8
cmp byte [eax], al
add byte [eax], al
jge 0xb94c35
outsb dx, byte [esi]
or eax, edi
dec ebx
pop ebp
aad 0x45
sub al, 0xdf
pop edx
les eax, [esi - 0x2c]
mov bl, 0x4e
invalid
lea esp, [esp + 4]
and edi, 0xff000000
xor ecx, edi
jmp 0xb94c23
lea esp, [esp + 1]
mov dword [ecx + 0x1c], edx
rcl cl, cl
bswap ebx
mov ebx, 0x1b2f7827
jmp 0xb94b34
xor edx, eax
sub esp, 0x17
mov bl, ah
lea esp, [esp + 2]
mov bx, 0xee
jmp 0xb94ca3

Function at 0xb94b58
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0xb49efc]
jmp 0xb94ba7
sub esp, 0xf
push word [esp + 5]
lea esp, [esp + 1]
jmp 0xb94b42
and edx, ebp
lea edi, [esp + 0x10]
lea edi, [ecx*4]
mov di, word [esp]
jmp 0xb94b77
xor ecx, edi
sub esp, 9
mov edi, 0xda06ea18
xchg dword [esp + 1], edi
lea esp, [esp + 1]
jmp 0xb94b8d

Function at 0xb94d0f
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
jmp 0xb94e78
pop edi
push edx
mov bx, si
pop word [esp]
xchg bh, bl
jmp 0xb94da3
pushfd
lea esp, [esp + 4]
pop eax
not ebp
mov esi, 0xf6ceab9e
jmp 0xb94d58
mov ebp, dword [esp]
not bx
call fcn.00b94dc8
mov ch, 0x37
cmpsd dword [esi], dword es:[edi]
ret 0x8e31
lea esp, [esp + 2]
pop esi
mov ebx, dword [esp]
not bx
xchg bh, bl
jmp 0xb94d83
mov bp, word [esp]
not ax
mov bh, byte [esp]
push 0xa
mov eax, dword [esp]
jmp 0xb94d74
lea esp, [esp + 0x14]
cmp ebx, 0xb4b724
jne 0xb3b1cd
mov ebx, ecx
jmp 0xb94de2

Function at 0xb9505e
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
jmp 0xb95076
jmp 0xb95048
mov ebx, 0x3e81b4e1
jmp 0xb95091
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
lea ebx, [ecx*4]
mov ebx, 0x34734638
adc ebx, edx
jmp 0xb95060
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
sub esp, 5
mov word [esp + 1], cx
jmp 0xb950c8
Function at 0xb95165
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xb951a3
stc
call fcn.00b951c9
push cs
mov word [edx], es
xchg esp, eax
and al, 0x98
sbb dword [ecx - 0x757e418], ecx
invalid
shr edi, 0x18
pushal
add esp, 0x1c
mov edi, dword [edi*4 + reloc.MSVCRT.dll_malloc]
jmp 0xb9518d

Function at 0xb951c9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0xb95226
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xb951b3
lea esp, [esp + 1]
and ebx, ecx
sub esp, 0xc
jmp 0xb951f5
mov edi, dword [edi*4 + reloc.MSVCRT.dll_malloc]
sub esp, 0x17
cmc
push word [esp + 0xd]
mov word [esp + 0x14], di
jmp 0xb9520b

Function at 0xb95305
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, esi
mov dword [ebx], edi
pop ebx
jmp 0xb951e2
mov dx, 0xbee5
mov dh, dl
mov edx, dword [esi + 4]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0xb9515a
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
bts di, si
mov edi, edx
stc
call fcn.00b95165
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
bswap ebx
jmp 0xb9523d
movzx ebx, byte [esi + 6]
clc
cmc
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
jmp 0xb95250
and ebx, ecx
cmc
jmp 0xb952e7
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.MSVCRT.dll_malloc]
mov edx, ebx
mov dx, word [esp]
jmp 0xb9517b
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.MSVCRT.dll_malloc]
stc
jmp 0xb952d0
and edx, ecx
cmc
jmp 0xb9527d
movzx ebx, byte [esi + 9]
and edx, ecx
mov edx, dword [edx*4 + reloc.MSVCRT.dll_malloc]
push esp
jmp 0xb95293
push eax
jmp 0xb95323
mov edx, 0x6d634f20
mov dx, cx
jmp 0xb952ba
xor edi, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
mov bl, 0x74
inc bx
mov ebx, 0x16035832
jmp 0xb952aa
sub esp, 4
mov dword [esi + 4], edi
call 0xb95305
popfd
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll_malloc]
lea edi, [edx + edi]
jmp 0xb95343
mov eax, esi
add eax, 8
mov edx, dword [eax]
pop eax
jmp 0xb952f9
mov edi, dword [edi*4 + reloc.MSVCRT.dll_malloc]
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0xb9534f
mov di, 0xbdde
mov edi, edx
shr edi, 0x18
push ebx
jmp 0xb9532d
and edi, ecx
push ebp
mov ebp, edi
jmp 0xb9591d
lea ebp, [ebp*4]
lea ebp, reloc.MSVCRT.dll_malloc
mov edi, dword [ebp]
pop ebp
jmp 0xb9575e

Function at 0xb95425
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
lea esp, [esp + 1]
jmp 0xb95442
Function at 0xb95a00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xb95d76
mov dword [esp], edi
jmp 0xb96139
cmp al, 0x2f
jne 0xb3b9a0
je 0xb3b955
lea esp, [esp + 4]
je 0xb3b955
pushfd
lea esp, [esp + 4]
jmp 0xb95b2d

Function at 0xb95a1b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], ecx
sub esp, 0xf
jmp 0xb9595c

Function at 0xb95a5f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp bl, 0x61
jmp 0xb95a77
push esp
jmp 0xb95acc
cmp bl, 0x30
pushal
pushfd
jmp 0xb95aa2
call 0xb95de7
cmp eax, 0x7fe69f0c
call fcn.00b96083
lea esp, [esp + 4]
jbe 0xb3ba25
ja 0xb3b98a
add dword [eax + 3], reloc.MSVCRT.dll_malloc
call 0xec3455e5
pop edx
mov al, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xb21c9688
aad 0x24
mov dword [reloc.MSVCRT.dll_malloc], eax
jge 0xb95a87
jmp 0xb95a49
cmp bl, 0x7a
jmp 0xb95ac0
jb 0xb3b9f5
cmp byte [eax + 0x5f], 0xfa
push dword [ebx - 0x1e]
jae 0xb95a61
dec esp
into
pop esp
cmp edx, esi
fisub word [ebx - 0xd]
xchg esi, eax
xchg esi, eax
shl byte gs:[esi], cl
push ecx
rcl byte [ebx - 0x36]
lea esp, [esp + 0x1c]
jb 0xb3b98a
cmp bl, 0x5a
call fcn.00b95a5f
mov byte [esp + 4], dl
lea esp, [esp + 0x24]
jb 0xb3b9df
pushfd
jmp 0xb95ae2
jbe 0xb3ba25
ja 0xb3b9f5
push word [esp + 2]
lea esp, [esp + 2]
jmp 0xb95b0b
lea esp, [esp + 4]
cmp bl, 0x39
jbe 0xb3ba25
ja 0xb3b9df
lea esp, [esp + 4]
cmp bl, 0x2f
jmp 0xb96037
lea esp, [esp + 4]
cmp bl, 0x2b
je 0xb3ba25
push eax
jmp 0xb95af5
jne 0xb3b9a0
je 0xb3ba25
push 0x3e
jmp 0xb95737

Function at 0xb9601f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp]
lea esp, [esp + 4]
jmp 0xb956df
cmp al, 0x2f
jmp 0xb95e7a
jmp 0xb95f1e
add eax, 4
jmp 0xb956df
add byte [edx + ebx*2], bh
cmp al, 0x5a
call fcn.00b95ee1
lcall 0xf8aa, 0x1aef881a
jg 0xb955e2
mov bh, byte [ecx + 0x39]
ror byte [ebp - 0x24], cl
das
call 0xb95fdc
push ecx
fisttp dword [ebx + 0x2e]
invalid
call 0xb95f58
out dx, al
jl 0xb9564a
div byte [ecx + 0x7f]
add edx, dword [ebx + reloc.MSVCRT.dll_malloc]
int1
ljmp 0x39fb
add esi, 4
jmp 0xb95677
push eax
jmp 0xb96011
push dx
lea esp, [esp + 2]
jmp 0xb955e3
jmp 0xb95eed
lea esp, [esp + 4]
cmp al, 0x2b
jmp 0xb95e4e
jmp 0xb95e36
jne 0xb955c0
push 0x3e
jmp 0xb9559f
jne 0xb955d6
push edx
lea esp, [esp]
lea esp, [esp + 4]
jmp 0xb95f51
push esi
push ebp
push dword [esp]
jmp 0xb95f2e
cmp al, 0x39
ja 0xb95692
movzx eax, al
jmp 0xb955db
lea esp, [esp + 8]
cmp bl, 0x2b
pushal
mov dword [esp + 0xf], ebp
jmp 0xb95f82
push 0x3f
jmp 0xb9559f
lea esp, [esp + 0x20]
jne 0xb95626
push 0x3e
jmp 0xb95610
mov eax, edi
mov edi, dword [eax]
pop eax
cmp edi, 2
call 0xb9601f
adc ebp, ecx
rol byte [eax], 1
add byte [eax], al
invalid
Function at 0xb96073
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dl, 0x2f
pushal
jmp 0xb960a6
mov edx, dword [ebp - 8]
jmp 0xb958da
call 0xb95746
pop edi
fisttp qword [ebp + 0x14]
out 0x55, eax
scasd eax, dword es:[edi]
mov esp, 0xbf8836db
xchg byte [ecx], dh
xor byte [ebx], dh
cmp dl, 0x2b
jne 0xb956f5
je 0xb96043
or al, 0x8d
sbb eax, 0x9e249764
push ds
mov ebx, gs
xchg esi, eax
out dx, eax
mul cl
lea esp, [esp + 2]
lea esp, [esp + 4]
jb 0xb9570b
jmp 0xb96059
lea esp, [esp + 0x20]
jne 0xb95721
push 0x3f
jmp 0xb95737

Function at 0xb96083
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
pop edx
jmp 0xb958da
push eax
jmp 0xb9627f
cmp edi, 3
jmp 0xb9616f
jmp 0xb9573c
jne 0xb95778
cmp cl, 0x2b
pushfd
lea esp, [esp + 2]
jmp 0xb96269
push 0x3e
jmp 0xb957a4
mov byte [esp], bl
mov word [esp], sp
lea esp, [esp + 2]
jne 0xb957c1
jmp 0xb961c3
push edx
mov edx, ebp
lea edx, [edx - 8]
jmp 0xb9628b
mov ecx, dword [edx]
pop edx
lea esp, [esp + 4]
jmp 0xb9584e

Function at 0xb960b7
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
add edx, 4
jmp 0xb958da

Function at 0xb960d5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xb9614d
add ch, bl
xor al, 0x23
mov byte [0x1ca25730], al
out 0x77, eax
adc ah, cl
pop esi
lcall 0x850f, 0x2024648d
jno 0xb960a4
invalid
jg 0xb96096
in al, 0x17
jle 0xb96116
movzx edx, dl
call fcn.00b960b7
pop word [esp]
jmp 0xb96113
push word [esp]
lea esp, [esp + 4]
and al, 0x8d
and al, 4
cmp dl, 0x5a
call fcn.00b960db
ja 0xb9578e
call fcn.00b96163
mov dword [ebp - 0x2b], 0x74fd4fbc
mov ds, word [bx + di]
js 0xb960c7
and al, 4
sub edx, 0x47
jmp 0xb958da

Function at 0xb960db
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
jmp 0xb960fd
movzx edx, dl
jmp 0xb96123

Function at 0xb96163
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
sub edx, 0x41
jmp 0xb958da
Function at 0xb962dd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xe
lea esp, [esp + 2]
jmp 0xb96313
lea esp, [esp + 0x10]
cmp edi, 2
jb 0xb9582f
jae 0xb962fd
or eax, 0x8f7c1585
or dh, byte [esi + esi - 0x71c13c5c]
cmpsd dword [esi], dword es:[edi]
into
pop ecx
mov eax, 0x4245c89