joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bab5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44bbcd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44bbcd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046cec1
mov esi, eax
test esi, esi
je 0x44bbcd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44bbcd
mov ecx, esi
call fcn.0044ba20
cmp edi, eax
jge 0x44bbcd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44bb53
mov dword [esp + 0x34], 1
jmp 0x44bbae
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44bbcd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044afd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x44f310
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44f376
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44f376
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44f357
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x44f700
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44f738
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x450370
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4503b9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x450830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c0b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004503e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00450460
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00450460
lea ecx, [esi + 0xc]
call fcn.0046b3ff
lea ecx, [esi + 0x10]
call fcn.0046b3ff
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004519f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004519f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004519f0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046b474
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046b474
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46d864
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46d89c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046b91b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046b8f3
jmp 0x46d8a8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46ef55
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46ef97
call fcn.00474efc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46ef97
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46ef8e
xor eax, eax
jmp 0x46ef9f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046efa5
pop edi
pop esi
pop ebx
ret 4

Function at 0x47542c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47545a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475478
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475392
jmp 0x475478
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475478
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00475392
test edi, edi
mov eax, edi
jne 0x475462
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x47cb7a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1000f810
push 0x10004a00
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x10011040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov dword [ebp - 0x88], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], ecx
test eax, eax
mov esi, 0x10000
je 0x47cbcd
lea esi, [eax + 0x10000]
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov ebx, dword [0x1000c010]
push 0x1c
lea edx, [ebp - 0x84]
push edx
push esi
push edi
call dword [0x1000c00c]
test eax, eax
je 0x47cc0f
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x84]
cmp eax, esi
jae 0x47cc2f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0047f5e9
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x74], 0x1000
jne 0x47cd0a
mov eax, dword [ebp - 0x70]
cmp al, 1
je 0x47cd0a
test eax, 0x100
jne 0x47cd0a
mov dword [ebp - 4], 0
push 0
push 0x40
lea edx, [ebp - 0x64]
push edx
push esi
push edi
call ebx
test eax, eax
jne 0x47cc7e
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x78]
add esi, dword [ebp - 0x84]
jmp 0x47cbed
mov eax, 0x5a4d
cmp word [ebp - 0x64], ax
jne 0x47cc69
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x78]
ja 0x47cc69
cmp eax, 0x40
jb 0x47cc69
push 0
push 0xf8
mov ecx, dword [ebp - 0x68]
push ecx
add eax, esi
push eax
push edi
call ebx
test eax, eax
jne 0x47ccc0
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x78]
add esi, dword [ebp - 0x84]
jmp 0x47cbed
mov edx, dword [ebp - 0x68]
cmp dword [edx], 0x4550
je 0x47cce0
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x78]
add esi, dword [ebp - 0x84]
jmp 0x47cbed
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x47cc11
mov esi, dword [ebp - 0x78]
add esi, dword [ebp - 0x84]
jmp 0x47cbed
Function at 0x47da4a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1000f7f0
push 0x10004a00
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10011040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [0x1000c038]
mov dword [ebp - 4], 0
mov edx, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], dx
jne 0x47daec
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x47daec
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x47daec
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x47daec
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47dd5a
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push edi
lea ebx, [esi - 0x7ff80000]
cmp esi, 0x7ff80000
ja 0x47dd76
mov ebx, 0x10000
cmp esi, 0x80000000
jae 0x47dd89
lea edi, [esi + 0x7ff80000]
mov dword [ebp - 4], edi
jmp 0x47dd93
mov dword [ebp - 4], 0xfff80000
mov edi, dword [ebp - 4]
mov eax, dword [0x10012b4c]
mov edx, dword [0x10012b48]
test eax, eax
jne 0x47ddad
test edx, edx
je 0x47ddc0
mov eax, edx
mov dword [0x10012b4c], eax
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x47ddc0
cmp ecx, ebx
jb 0x47ddc0
cmp ecx, edi
jbe 0x47dec4
mov eax, edx
mov dword [0x10012b4c], eax
test edx, edx
je 0x47ddee
test eax, eax
je 0x47dde2
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x47dde2
cmp ecx, ebx
jb 0x47dde2
cmp ecx, edi
jbe 0x47debf
mov eax, dword [eax + 4]
test eax, eax
jne 0x47ddcf
mov dword [0x10012b4c], eax
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, 0x40000000
jbe 0x47de2e
push esi
lea eax, [esi - 0x40000000]
call fcn.0047dbea
add esp, 4
test eax, eax
jne 0x47de83
push ebx
lea eax, [esi - 0x40000000]
call fcn.0047dcaa
add esp, 4
test eax, eax
jne 0x47de83
mov edi, dword [ebp - 4]
cmp esi, 0x40000000
jae 0x47de5c
push esi
lea eax, [esi + 0x40000000]
call fcn.0047dcaa
add esp, 4
test eax, eax
jne 0x47de83
mov ecx, dword [ebp - 4]
push ecx
lea eax, [esi + 0x40000000]
call fcn.0047dbea
add esp, 4
test eax, eax
jne 0x47de83
mov edi, dword [ebp - 4]
push ebx
mov eax, esi
call fcn.0047dcaa
add esp, 4
test eax, eax
jne 0x47de86
push edi
mov eax, esi
call fcn.0047dbea
add esp, 4
test eax, eax
jne 0x47de86
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 4]
xor edx, edx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov ecx, dword [0x10012b48]
mov dword [eax + 4], ecx
mov dword [0x10012b4c], eax
mov dword [0x10012b48], eax
lea ecx, [eax + 0xffa8]
mov esi, 0x38b
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
dec esi
jne 0x47deaf
mov dword [eax + 8], edx
jmp 0x47dec4
mov dword [0x10012b4c], eax
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x47de7a
cmp esi, edi
ja 0x47de7a
mov edx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], edx
call fcn.00484b5a
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47df2a
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov eax, dword [0x10012b48]
push ebx
mov ebx, 0x10012b48
test eax, eax
je 0x47df95
push esi
push edi
cmp dword [eax], 0x52727464
jne 0x47df8a
lea edi, [eax + 0x10000]
xor edx, edx
lea esi, [eax + 0x88]
mov ecx, dword [esi]
test ecx, ecx
je 0x47df5f
cmp ecx, eax
jb 0x47df8a
cmp ecx, edi
jae 0x47df8a
inc edx
add esi, 0x48
cmp edx, 0x38d
jb 0x47df51
mov ecx, dword [eax + 4]
push 0x8000
push 0
push eax
mov dword [ebx], ecx
call dword [0x1000c048]
mov dword [0x10012b4c], 0
jmp 0x47df8d
lea ebx, [eax + 4]
mov eax, dword [ebx]
test eax, eax
jne 0x47df3b
pop edi
pop esi
pop ebx
ret
Function at 0x522327
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x44], ebx
jmp 0x522331
push edx
push dword [esp + 2]
pop word [esp + 3]
push word [esp + 3]
mov byte [esp + 3], bh
pop word [esp + 3]
jmp 0x522395
pop dword [esp + 4]
mov word [esp + 2], dx
lea esp, [esp + 2]
mov dword [esp + 0x48], esp
call fcn.005223cb
add eax, 0x62ced698
call fcn.00522db4
jno 0x522405
push word [esp + 3]
push word [esp + 5]
push word [esp + 7]
mov word [esp + 4], sp
pop word [esp + 3]
push esp
jmp 0x522373

Function at 0x52236d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
mov word [esp], di
call fcn.00522301
pop word [esp]
jmp 0x52231a

Function at 0x522446
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov si, 0x81e5
jmp 0x522469
pushfd
inc di
jb 0x522405
neg di
jmp 0x52240a
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x522420

Function at 0x522690
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 0x96d64b70
jmp 0x5224c8
mov byte [esp + 1], ch
pop dword [esp]
pop word [esp]
lea esp, [esp + 2]
push eax
call fcn.0052236d
neg di
jmp 0x52242e
rdtsc
mov si, 0x81e5
jmp 0x522469
lea esi, [esp + 0x20]
mov ax, 0x6b9f
bsr cx, bp
jno 0x522525
jo 0x5224b4
cmp byte [0x8be69f0c], 0x7c
and al, 0x28
mov edi, dword [esp + 0x28]
mov bp, di
mov dl, byte [esp]
pushal
mov dl, 0x7c
jmp 0x522450
mov ebp, esp
mov ax, dx
rdtsc
xchg ah, bl
mov bx, 0xe34d
mov ecx, edi
jmp 0x5224e7
mov ax, 0xc80d
lea ebp, [esi - 0xdd]
jmp 0x52252f
mov al, byte [esp]
jmp 0x52230d
jmp 0x52250e
not dx
mov al, ah
inc dh
jnp 0x5224c0
mov al, byte [esp]
jmp 0x52230d
xchg bx, ax
mov al, 0xee
lea ebx, [edx*4]
bswap edx
mov ax, 0xc80d
lea ebp, [esi - 0xdd]
sub esp, 0xa0
jmp 0x522491
mov dword [esp], ecx
mov word [esp], sp
mov dword [esp], ecx
push esp
mov word [esp + 2], dx
jmp 0x5223f0

Function at 0x522cec
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x522389
Function at 0x543e85
Capabilities:
Encrypt data using aes

Disassembly:
setp al
jmp 0x543bf6
jmp 0x543e26
mov di, word [esp]
jmp 0x543f7b
call fcn.0054467f
lea esp, [esp + 4]
pop edi
not bx
jmp 0x544668
rcr edi, cl
pop ecx
leave
test al, 0x5b
out dx, al
aas
mov edx, 0x9ba4f28
sbb esi, dword [edx + 0x6d]
jl 0x543bd8
salc
lea esp, [esp + 4]
jle 0x51529d
jg 0x543c0d
dec ecx
rcl dword [ecx + 0x30], 0xc3
jle 0x543b77
inc edi
xlatb
mov dl, 0x41
invalid
lea esp, [esp + 1]
jmp 0x543b9a
mov eax, dword [edx - 8]
bswap edi
bsr di, cx
cmc
jmp 0x543c1b
stc
mov al, byte [esp]
push edx
jmp 0x543bd5
lea edx, [esi + ebx*4 + 8]
inc di
lea ecx, [esi + 8]
jmp 0x515283
mov edi, dword [ecx - 8]
call fcn.00543c4a
pushal
push dword [esp + 0x1a]
mov word [esp], di
push word [esp + 0x13]
lea esp, [esp + 2]
jmp 0x543e78
lea esp, [esp + 0x24]
cmp eax, 1
call 0x543e85
sub bh, bh
xor al, 0x24
lea esp, [esp + 8]
jmp 0x543eaf
jle 0x5152eb
mov edx, eax
lea ebx, [ebp*4]
jmp 0x544220
mov bh, 0xf0
mov word [esp + 0x1a], sp
lea esp, [esp + 2]
shr edi, 0x18
sub esp, 0xc
add esp, 7
call fcn.00543f1c
loop 0x543f73
out 0x82, eax
jno 0x543ece
clc
push 0xad6899fe
add eax, 0x59cea7b4
mov di, word [esp]
mov edi, edx
sub esp, 6
mov dword [esp], ebp
sub esp, 0x18
jmp 0x543ee3
add esi, 0x10
inc dx
mov edx, dword [esi]
lea edi, [esi*4]
jmp 0x543f0b
mov dl, dh
inc dh
mov ebx, dword [ebx*4 + 0x51f4e0]
bswap edi
xchg di, dx
jmp 0x543f32
test dword [edx], 0xd5fa43c4
inc esp
test dword [edx + 0x3c8b2414], 0x5eb60f24
adc dword [ebx + 0x3c8d243c], ecx
adc bl, ch
ror dword [ebp + 0x9514], 1
add byte [eax], al
mov dl, byte [esp]
mov edi, dword [esp]
movzx ebx, byte [esi + 0x11]
mov edi, dword [esp]
lea edi, [eax + edx]
jmp 0x543f5e
lea edx, [edx + 0x51f4e0]
mov ebx, dword [edx]
pop edx
jmp 0x543fbe
and ebx, ecx
push esp
push word [esp + 1]
sub esp, 0x16
mov word [esp + 4], bx
jmp 0x544006
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x51fce0]
mov bl, byte [esp]
jmp 0x544053
and edx, ecx
sub esp, 0
mov edx, dword [edx*4 + 0x51f4e0]
clc
cmc
jmp 0x54403d
cmc
jmp 0x54405e
movzx ebx, byte [esi + 5]
cmc
clc
sub esp, 0x14
jmp 0x544029
and edx, ecx
pushal
push dword [esp + 0x18]
push dword [esp + 0xa]
jmp 0x54408b
lea esp, [esp + 0x3c]
xor edi, dword [edx*4 + 0x5204e0]
mov dx, word [esp]
setg dh
cmc
jmp 0x5440db
mov edx, dword [esi + 4]
sub esp, 0
cmc
sub esp, 4
add esp, 1
jmp 0x5440c1
lea esp, [esp + 3]
mov dword [esi], edi
mov edi, 0xfd2a9e12
neg edi
bsr di, bp
jmp 0x544180
mov edx, 0x8eafffbc
jmp 0x5440a0
mov dword [ebp - 4], ecx
bsf di, ax
mov ecx, 0xff
jmp 0x5152d3
lea ecx, [eax - 1]
mov edi, 0x68bacb46
clc
mov edi, dword [esp]
dec bx
jmp 0x5440f4
mov esi, dword [esp]
lea ebx, [ebp + 0x40bbcaff]
call fcn.0054475f
ret

Function at 0x543fd8
Capabilities:
Encrypt data using aes

Disassembly:
lea edx, [edx*4]
mov byte [esp + 2], ch
mov word [esp], sp
push edx
mov edx, ebx
jmp 0x543f8d
mov byte [esp], ch
jmp 0x543fb1
Function at 0x54412a
Capabilities:
Encrypt data using aes

Disassembly:
shr edi, 0x18
push esp
mov word [esp], bx
mov edi, dword [edi*4 + 0x51f4e0]
jmp 0x54412c
jmp 0x544105
clc
sub esp, 0x18
add esp, 0xb
lea esp, [esp + 1]
jmp 0x544209
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0x5200e0]
jmp 0x5441e2
and ebx, ecx
jmp 0x54418f
mov ebx, 0xe34de756
jae 0x5441cb
in eax, 0x26
mov ch, 0x24
mov edx, 0xd19f2cdd
mov edi, dword [edi*4 + 0x51f8e0]
clc
jmp 0x5441a7
and ebx, ecx
pushal
add esp, 9
lea esp, [esp + 3]
jmp 0x5441f0
movzx ebx, byte [esi + 6]
stc
mov ebx, dword [ebx*4 + 0x51f4e0]
jmp 0x5441c8
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + 0x51fce0]
jmp 0x544255
and edi, ecx
call 0x5441be
fimul dword [ebp - 0x23]
movsb byte es:[edi], byte [esi]
push edi
xchg ebx, eax
inc esp
fimul word [ebx + ebp - 0x1a]
pop eax
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x5441ae
dec eax
invalid
mov edx, dword [edx*4 + 0x51f4e0]
cmc
call fcn.00544289
cmp ah, byte [edi + 0x6aa15237]
inc eax
fmul dword [esi + 0x29]
fsubr dword [ebp - 0x52]
xor eax, 0x883fcca5
movsb byte es:[edi], byte [esi]
xlatb
movzx ebx, byte ds:[esi + 9]
movzx ebx, byte [esi + 9]
and edx, ecx
clc
jmp 0x544233

Function at 0x5441be
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
shr edi, 0x18
push esp
mov word [esp], bx
mov edi, dword [edi*4 + 0x51f4e0]
jmp 0x54412c
jmp 0x544105
clc
sub esp, 0x18
add esp, 0xb
lea esp, [esp + 1]
jmp 0x544209
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0x5200e0]
jmp 0x5441e2
and ebx, ecx
jmp 0x54418f
mov ebx, 0xe34de756
jae 0x5441cb
in eax, 0x26
mov ch, 0x24
mov edx, 0xd19f2cdd
mov edi, dword [edi*4 + 0x51f8e0]
clc
jmp 0x5441a7
and ebx, ecx
pushal
add esp, 9
lea esp, [esp + 3]
jmp 0x5441f0
movzx ebx, byte [esi + 6]
stc
mov ebx, dword [ebx*4 + 0x51f4e0]
jmp 0x5441c8
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + 0x51fce0]
jmp 0x544255
and edi, ecx
call 0x5441be
fimul dword [ebp - 0x23]
movsb byte es:[edi], byte [esi]
push edi
xchg ebx, eax
inc esp
fimul word [ebx + ebp - 0x1a]
pop eax
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x5441ae
dec eax
invalid
mov edx, dword [edx*4 + 0x51f4e0]
cmc
call fcn.00544289
cmp ah, byte [edi + 0x6aa15237]
inc eax
fmul dword [esi + 0x29]
fsubr dword [ebp - 0x52]
xor eax, 0x883fcca5
movsb byte es:[edi], byte [esi]
xlatb
movzx ebx, byte ds:[esi + 9]
movzx ebx, byte [esi + 9]
and edx, ecx
clc
jmp 0x544233

Function at 0x5447d2
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + 0x51f4e0]
call fcn.00544444
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x5204e0]
push edx
pop word [esp]
jmp 0x544602
lea esp, [esp + 8]
dec dword [ebp - 4]
call fcn.00544665
mov word [ecx], es
xchg ecx, eax
invalid
push word [esp + 1]
push dword [esp + 2]
jmp 0x5445ec
mov byte [esp + 1], bh
add esp, 1
lea esp, [esp + 3]
jmp 0x544597
Function at 0x629d58
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xa
stc
pop eax
cpuid
xchg ch, dl
sub bl, ah
jmp 0x629d92
lea esp, [esp + 3]
add esp, 0
lea esp, [esp + 1]
pushal
mov ecx, dword [esp]
cpuid
jmp 0x629d10
mov byte [esp + 1], ah
cld
jmp 0x629d30
bswap ebx
rdtsc
rdtsc
bsf bp, si
inc bl
mov byte [esp + 0x12], ch
jmp 0x629e3f
not ebp
lea edx, [ecx - 0x73]
pop ecx
pop word [esp + 1]
mov al, ah
sub esp, 0x1a
jmp 0x629d5f
mov dword [esp], esi
mov cl, ch
xchg edi, esi
mov ebp, dword [esp + 3]
push dword [esp]
mov dl, 0xa4
jmp 0x629d79
add esp, 0x1d
lea esi, [ecx*4]
cpuid
lea edi, [eax + 0x89]
xchg ecx, ebp
not cx
jmp 0x629e23
mov word [esp + 0x16], sp
xchg dh, al
mov edi, dword [esp + 0x13]
lea ebp, [ecx + 0xab]
lea edx, [ebp*4]
shr edx, 0x13
jmp 0x629dc6
mov esi, 0xadb6edea
xchg bh, cl
lea esp, [esp]
lea esp, [esp]
cmc
setl ah
call fcn.00629e05
rol dword [eax + 0x44d5fa43], 0x66
neg edi
neg di
mov edi, 0x91e39de4
lea edi, [ecx*4]
mov dl, 0x2c
lea edi, [ebx*4]
mov bp, di
jmp 0x629de8

Function at 0x629e05
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x629e8e
lea esi, [edi*4]
pop ebp
cmc
not ah
cld
mov esi, ecx
jmp 0x629e72
lea eax, [ebx*4]
xchg ecx, ebx
xchg dh, al
mov bh, byte [esp]
jmp 0x629f1b
rdtsc
bswap esi
lea esp, [esp]
inc bx
stc
bswap ebp
jmp 0x629e5c
pop ebx
mov bx, 0x718d
rdtsc
push edx
xor ax, 0xbac
xchg ebp, ebx
jmp 0x629e0a
inc edx
xchg ch, dl
mov bp, word [esp]
xchg ch, dl
xchg si, di
lea ebp, [edx + edi]
jmp 0x629f6c
add esp, 0
xchg ah, bl
xchg byte [esp], bl
mov dx, 0xe67d
lea ecx, [eax + 0x3b4c1e51]
lea edi, [eax + 0xc7558b9]
jmp 0x629eae
sub bl, ah
xchg bp, cx
xchg bx, bp
lea ebp, [ecx + ebx]
lea edi, [esi + 0xc5]
add esp, 0
jmp 0x629ed6
lea edx, [esp + esi]
lea esp, [esp]
mov si, word [esp]
mov byte [esp], ch
lea esp, [esp]
lea eax, [esi + 0x25]
jmp 0x629efa
mov bp, word [esp]
mov cx, word [esp]
lea edx, [ebx*4]
mov si, word [esp]
setle ch
cmc
jmp 0x629f9b
btr eax, esp
lea esp, [esp]
btc esi, ebx
xchg byte [esp], cl
mov dx, word [esp]
lea ecx, [eax + edx]
jmp 0x629f30
btc esi, ebx
add si, 0x8656
mov byte [esp], dh
mov edi, esi
mov byte [esp], dh
mov bl, bh
jmp 0x629f4e
shr bh, 3
mov bl, bh
mov bp, word [esp]
bsr ax, bp
mov edx, ecx
mov dl, 0xc4
jmp 0x629fe2
sub esp, 2
mov bl, bh
lea ebx, [ecx + edi]
xchg dh, al
neg ebp
mov byte [esp + 1], ch
jmp 0x629f80
mov al, 0x9e
add esp, 0
mov dx, 0x1707
cmc
lea ebp, [esi - 0x168e0fb3]
jmp 0x62b13a
shl si, cl
pop di
rcr esi, 0x1b
not ax
mov eax, 0xd09dfe40
mov cl, ch
jmp 0x629fad
mov cx, 0x42a9
btr ebp, edx
cld
bsf dx, si
mov esi, 0x3fd79520
xchg byte [esp], cl
jmp 0x629fc5
lea esp, [esp]
call int.0062a521