joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404eb9
Capabilities:
Enumerate files on windows

Disassembly:
push 0x270
mov eax, 0x41ef37
call fcn.0040dc60
mov dword [ebp - 0x278], ecx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
push ebx
mov dword [ebp - 0x27c], ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.0040f99c
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404f10
xor eax, eax
jmp 0x40501d
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0xffffffffffffffff
push 0x401328
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0040d6dc
add esp, 0x10
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404f09
xor esi, esi
test byte [ebp - 0x270], 0x10
je 0x404fbb
and dword [ebp - 0x120], 0
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404f7b
sub ecx, edx
push ecx
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x130]
call fcn.00403c3b
and dword [ebp - 4], 0
lea eax, [ebp - 0x130]
or ebx, 1
push eax
mov dword [ebp - 0x27c], ebx
call fcn.004067fb
mov byte [ebp - 0x271], 1
test al, al
jne 0x404fc2
mov byte [ebp - 0x271], 0
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x404fdd
push 0
push 1
lea ecx, [ebp - 0x130]
and ebx, 0xfffffffe
call fcn.00403f4f
cmp byte [ebp - 0x271], 0
je 0x404ffe
mov ecx, dword [ebp - 0x278]
lea eax, [ebp - 0x244]
push eax
call fcn.00404e05
mov esi, eax
test esi, esi
jne 0x405014
lea eax, [ebp - 0x270]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404f51
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
call fcn.0040dce3
ret
Function at 0x40725a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
call fcn.00406fd7
mov esi, dword [ebp + 8]
test al, al
je 0x4072d0
test byte [ebp + 0xc], 2
je 0x4072d0
test esi, esi
jne 0x40727e
xor eax, eax
jmp 0x40728b
push 0x40000
push esi
call fcn.0040fe92
pop ecx
pop ecx
add eax, eax
cmp eax, 0x80000
jne 0x4072bc
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp + 0xc], 0x401580
call fcn.0040dad4
push 0x42046c
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x4011e8
call fcn.0040dbab
and dword [ebp + 8], 0
push 0
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [edi + 0x19], 0
je 0x4072f8
test byte [ebp + 0xc], 1
je 0x4072f8
push esi
push 0x401594
call fcn.0041024d
call fcn.0040feb2
add eax, 0x20
push eax
call fcn.004101f1
add esp, 0xc
pop edi
pop esi
leave
ret 8

Function at 0x4085e8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42326c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
xor esi, esi
push 0x28
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408630
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x18], 0
mov esi, eax
je 0x40862c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x408699
lea eax, [ebp - 0x10]
push eax
push 0x401668
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x408615
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x408615
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x408677
call esi
jmp 0x40861b
push 0x80040001
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x408673
cmp dword [ebp - 0x18], 0
je 0x408697
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040db9d
leave
ret
Function at 0x40b287
Capabilities:
Create thread

Disassembly:
push 0x48
mov eax, 0x41f9c8
call fcn.0040dc60
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
je 0x40b2c4
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x38], 0x401a58
call fcn.0040dad4
mov dword [ebp - 0x54], 0x4011e8
push 0x42046c
lea eax, [ebp - 0x54]
push eax
call fcn.0040dbab
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x40b331
push 0x13
push 0x401a70
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00403c3b
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x18], 0x10
mov esi, eax
jb 0x40b30b
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
jmp 0x40b311
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040dad4
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x48], 0x4015d0
push 0x420854
lea eax, [ebp - 0x48]
jmp 0x40b2be
mov al, byte [ebp + 8]
mov byte [esi + 0x10], al
lea eax, [ebp - 0x34]
push eax
push ebx
push esi
push 0x40b18b
push ebx
push ebx
mov dword [ebp - 0x34], ebx
call fcn.004114cd
add esp, 0x18
push 0xffffffffffffffff
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], ebx
call fcn.0040dce3
ret 4

Function at 0x40db9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42326c]
jne 0x4148e1
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x424d00], eax
mov dword [0x424cfc], ecx
mov dword [0x424cf8], edx
mov dword [0x424cf4], ebx
mov dword [0x424cf0], esi
mov dword [0x424cec], edi
mov word [0x424d18], ss
mov word [0x424d0c], cs
mov word [0x424ce8], ds
mov word [0x424ce4], es
mov word [0x424ce0], fs
mov word [0x424cdc], gs
pushfd
pop dword [0x424d10]
mov eax, dword [ebp]
mov dword [0x424d04], eax
mov eax, dword [ebp + 4]
mov dword [0x424d08], eax
lea eax, [ebp + 8]
mov dword [0x424d14], eax
mov eax, dword [ebp - 0x320]
mov dword [0x424c50], 0x10001
mov eax, dword [0x424d08]
mov dword [0x424c04], eax
mov dword [0x424bf8], 0xc0000409
mov dword [0x424bfc], 1
mov eax, dword [0x42326c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x423270]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x424c48], eax
push 1
call fcn.00419129
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x40279c
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x424c48], 0
jne 0x4149cd
push 1
call fcn.00419129
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x418d53
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42326c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411fcd
and dword [ebp - 0x14], 0
cmp dword [0x425170], 0
mov dword [ebp - 0x18], eax
jne 0x418e06
push 0x402b84
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418eae
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402b78
push ebx
call edi
test eax, eax
je 0x418eae
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402b68
push ebx
mov dword [0x425170], eax
call edi
push eax
call esi
push 0x402b54
push ebx
mov dword [0x425174], eax
call edi
push eax
call esi
push 0x402b38
push ebx
mov dword [0x425178], eax
call edi
push eax
call esi
mov dword [0x425180], eax
test eax, eax
je 0x418e06
push 0x402b20
push ebx
call edi
push eax
call esi
mov dword [0x42517c], eax
mov eax, dword [0x42517c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418e5f
cmp dword [0x425180], ecx
je 0x418e5f
push eax
call esi
push dword [0x425180]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418e5f
test ebx, ebx
je 0x418e5f
call edi
test eax, eax
je 0x418e56
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x418e56
test byte [ebp - 8], 1
jne 0x418e5f
or dword [ebp + 0x10], 0x200000
jmp 0x418e92
mov eax, dword [0x425174]
cmp eax, dword [ebp - 0x18]
je 0x418e92
push eax
call esi
test eax, eax
je 0x418e92
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x418e92
mov eax, dword [0x425178]
cmp eax, dword [ebp - 0x18]
je 0x418e92
push eax
call esi
test eax, eax
je 0x418e92
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x425170]
call esi
test eax, eax
je 0x418eae
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418eb0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040db9d
leave
ret
Function at 0x4a816c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x4a8130
rdtsc
xchg bl, ch
sub esp, 0xa
js 0x4a8146
lea esp, [esp + 2]
jmp 0x4a8134
Function at 0x4a90c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], ax
dec ax
jne 0x4a919a
je 0x4a9112
xor eax, 0xbc4d2ab4
loope 0x4a90f6
pushal
mov dword [reloc.oleaut32.dll_SysFreeString], eax
xchg byte [esi + 0xf], ah
mov dword [reloc.oleaut32.dll_SysFreeString], eax
mov eax, dword [esp]
lea eax, [eax + esi]
lea esp, [esp + 2]
jmp 0x4a91ac
add bl, ch
pop ecx
jmp 0x4a9152
inc edi
xchg edx, eax
xchg al, dh
clc
jge 0x4a9135
mov eax, edx
mov dh, byte [esp]
shr eax, cl
sub esp, 0x1b
jmp 0x4a9174
xchg word [esp + 1], ax
pop ax
mov word [esp], sp
jmp 0x4a90eb
mov eax, edx
mov dh, byte [esp]
shr eax, cl
jmp 0x4a9137
jmp 0x4a911f
sub esp, 0x1b
mov edx, edi
lea esp, [esp + 3]
jmp 0x4a915e
mov al, byte [esp]
setg ah
bts dx, bp
jmp 0x4a90f9
lea esp, [esp + 0x18]
dec cl
xchg dh, dl
mov ax, 0x3825
rdtsc
jmp 0x4a9178
mov edx, edi
jmp 0x4a913c
bsr edx, eax
jno 0x4a91f6
dec eax
call 0x4a9184
mov eax, 0xebd48b66
push eax
xchg ebx, eax
pop ds
invalid
xchg word [esp + 1], ax
pop ax
mov word [esp], sp
lea eax, [eax + esi]
lea esp, [esp + 2]
add bl, dl
je 0x4a90f7
mov al, byte [esp]
setg ah
bts dx, bp
jmp 0x4a90f9
dec eax
jmp 0x4a920d
rol cl, 0
mov ax, 0x65dd
lea edx, [eax + edi]
xchg al, ah
rol edx, 0x1d
jmp 0x4a925a
ja 0x4a9284
mov edx, dword [esp]
sub esp, 2
jmp 0x4a9268
lea esp, [esp + 2]
jmp 0x4a928e
jmp 0x4a92a1
mov edx, dword [esp]
sub esp, 2
lea esp, [esp + 2]
sub cl, 0xbb
bswap eax
or edx, ecx
jge 0x4a926e
xchg dx, ax
jmp 0x4a92a4
xchg dx, ax
xor cl, 0xb8
mov dx, word [esp]
and ax, cx
jmp 0x4a95e0
je 0x4a9668
rdtsc
bswap eax
jmp 0x4a966c
rdtsc
bswap eax
call 0x4a953d
mov si, 0x3ddc
mov esi, ecx
mov esi, esp
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x4a968d
popfd
jmp fcn.004a8ed3
Function at 0x4c2dfb
Capabilities:
Encode data using xor

Disassembly:
push 0xf04af36c
jmp 0x4c319a
lea esp, [esp + 1]
mov dword [esp], eax
push ecx
call 0x4c2ddf
scasb al, byte es:[edi]
lea esp, [esp + 1]
lea esp, [esp + 3]
push edx
jmp 0x4c2e55
push si
lea esp, [esp + 1]
pushfd
jmp 0x4c2dd1
call 0x4c2e36
aaa
mov ah, 0x2a
dec ebp
mov esp, 0x31a123b0
push eax
mov dword [reloc.oleaut32.dll_SysFreeString], eax
xor eax, 0x24648d24
add ecx, dword [ebp - reloc.oleaut32.dll_SysFreeString]
and al, 0x1c
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x1c], esp
pushfd
push dword [esp]
jge 0x4c2e04
jl 0x4c2e04
push esp
fisttp dword [ebx + 0x2e]
fnsave dword [esi + edi*4 - reloc.oleaut32.dll_SysFreeString]
je 0x4c2e5f
inc eax
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x4c2e65
push eax
pushal
mov dword [esp + 0x20], ebx
pushfd
mov dword [esp], eax
mov byte [esp + 2], bh
jmp 0x4c2e1a
pushfd
jmp 0x4c2261
mov di, sp
jmp 0x4c2f06
bsr cx, bx
mov di, sp
jmp 0x4c2f06
lea edi, reloc.oleaut32.dll_SysFreeString
btc ax, bp
jns 0x4c2ec5
bsr cx, bx
jmp 0x4c2eaf
sub esp, 0xc0
jmp 0x4c2f2c
lea esi, [esp]
lea ebx, [ebp - 0x33]
not di
mov cx, si
xchg dl, ah
jmp 0x4c2ef0
mov cl, ch
jmp 0x4c2f3b
mov edi, esp
sub esp, 1
jo 0x4c2f16
mov cl, ch
jmp 0x4c2faa
not cx
lea esp, [esp + 1]
mov edx, ebp
sub esp, 0x13
jmp 0x4c2fdb
rcl dx, 0xa
rol ch, cl
mov ebp, dword [esp + 0x2c]
jmp 0x4c2ede
not cx
lea esp, [esp + 1]
call fcn.004c2f78
mov cx, word [esp + 0x28]
lea esp, [esp + 3]
mov eax, 0xa7fd5d5b
jmp 0x4c302a
jle 0x4c3017
pushal
bsf bx, bp
jmp 0x4c2fb6
not ebp
mov ebx, edx
neg ah
jle 0x4c3044
jg 0x4c302e
sub byte [eax - 0x635faeca], ah
pop ebp
lodsb al, byte [esi]
mov edi, 0x81303186
cmc
or ah, bl
cmp ebp, dword [ebx]
xor ebp, 0x2b3bdc08
lea ecx, [eax + edx]
mov ebx, eax
xchg bx, ax
jmp 0x4c2fe4
pushal
bsf bx, bp
mov cx, word [esp + 0x28]
lea esp, [esp + 3]
mov eax, 0xa7fd5d5b
mov al, bh
jmp 0x4c2ffa
not eax
mov cx, word [esp]
neg ebx
jmp 0x4c3081
not eax
mov cx, word [esp]
neg ebx
jmp 0x4c3081
xchg bl, ch
xchg ah, bl
dec ecx
jb 0x4c30aa
jae 0x4c30aa
add byte [edi], 0x97
add dword [eax + 0x3e], esp
mov eax, 0xbab8492e
adc eax, 0xd5eaf581
sti
pop es
xor ebp, 0x7fbd5ea
not ecx
mov ax, word [esp]
mov ecx, esp
not ax
jmp 0x4c306b
lea eax, [ecx + esi]
mov bl, ch
not ebx
xchg al, ah
mov bx, word [esp]
call 0x4c30b2
test byte [edi], dh
push ds
imul eax, dword [ecx + reloc.oleaut32.dll_SysFreeString], 0x87e2eb17
sbb al, 0x24
call fcn.004c3125
lea ecx, [edx]
cwde
dec dword [edx]
xor ebp, dword [reloc.oleaut32.dll_SysFreeString]
fadd dword [ebp - 0x40]
push esi
xor eax, eax
cli
std
xor ebp, 0x17012fc3
jmp 0x4c3094
mov ah, ch
jmp 0x4c2f53
bt edx, ebp
jno 0x4c30cd
mov ah, ch
rcl dx, 0xa
rol ch, cl
jmp 0x4c2f59
Function at 0x4eab2b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
lea edi, [ecx + 0x10]
cmc
xor ebx, eax
pushfd
jmp 0x4eab10
mov dword [edi], eax
mov eax, 0x165a6a99
mov ax, 0x4bae
sbb ax, cx
jmp 0x4eab43
jmp 0x4eaaff
mov eax, dword [edi]
pop edi
pushal
jmp 0x4eab4b
push edi
mov edi, ecx
add edi, 8
jmp 0x4eab2d
xor eax, ebx
jmp 0x4eab85
mov dword [ecx + 0x14], ebx
bswap ebx
push edi
jmp 0x4eab6f

Function at 0x4eae02
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [eax + 0xc]
stc
jmp 0x4eae38
xor edx, ecx
mov dword [eax + 0x1c], edx
push si
lea esp, [esp + 2]
jmp 0x4eae22

Function at 0x4eb0f4
Capabilities:
Encrypt data using aes

Disassembly:
push eax
jmp 0x4eaf52
mov dword [ecx - 4], eax
mov eax, dword [edx]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x4eaf2e
mov eax, edx
jmp 0x4eaf7d
mov edi, dword [ecx - 4]
sub esp, 0x18
push word [esp + 9]
add esp, 5
lea esp, [esp + 1]
jmp 0x4eaf44
add eax, 0xfffffffc
mov dword [eax], edi
pop eax
jmp 0x4eafc4
add ecx, 0xfffffff8
mov dword [ecx], edi
pop ecx
stc
jmp 0x4eaf69
mov dword [ecx], eax
shr eax, 4
cmc
or eax, 0x22c5bd12
jmp 0x4eb0c7
push eax
mov eax, ecx
mov edi, dword [eax]
pop eax
jmp 0x4eafa2
sub edx, 0x10
stc
jmp 0x4eb009
sub ebx, 4
add ecx, 0x10
push bp
lea esp, [esp + 2]
jmp 0x4eafcc
mov edx, ebp
lea edx, [edx - 8]
mov eax, dword [edx]
pop edx
jmp 0x4affce
cmp dword [ebp - 4], ebx
jl 0x4b0004
push edx
jmp 0x4eaff0
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
lea esp, [esp + 0x44]
jmp 0x4eafe2
mov edi, dword [ecx + 4]
sub esp, 0x17
mov word [esp + 9], cx
mov dword [esp + 0xa], edx
lea esp, [esp + 3]
jmp 0x4eb035
mov eax, dword [edx + 4]
mov dword [edx], edi
bts di, bx
bswap edi
lea edi, [edi - 0x74]
jmp 0x4eb06a
push ecx
mov ecx, edx
jmp 0x4eaf96
Function at 0x4eb235
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi], edi
jmp 0x4eb269
push edi
pushal
stc
mov si, di
jmp 0x4eb253

Function at 0x4eb4d1
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x4eb511
pushal
pop dword [esp + 0x11]
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.oleaut32.dll_SysFreeString]
sub esp, 0x1e
jmp 0x4eb4f8

Function at 0x4eb59e
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], eax
lea esp, [esp + 4]
popal
lea eax, [eax*4]
jmp 0x4eb588

Function at 0x4eb651
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.oleaut32.dll_SysFreeString]
and edi, ecx
mov edi, dword [edi*4 + reloc.oleaut32.dll_SysFreeString]
jmp 0x4eb697
mov dword [esp], esi
jmp 0x4eb62f
movzx ebx, byte [esi + 0xe]
jmp 0x4eb681
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.oleaut32.dll_SysFreeString]
not ebx
lea ebx, [eax + esi]
bts ebx, ebx
jmp 0x4eb656
push ecx
jmp 0x4eb6e6
push ebx
sub esp, 2
mov word [esp + 2], di
lea esp, [esp + 2]
and ebx, ecx
jmp 0x4eb66c
and edx, ecx
jmp 0x4eb706
lea ecx, [ecx*4]
lea ecx, reloc.oleaut32.dll_SysFreeString
mov ebx, dword [ecx]
pop ecx
pushfd
jmp 0x4eb6a8
pushal
xchg ah, dl
mov dword [esp + 0x18], ebx
popal
jmp 0x4eb6be
and ebx, ecx
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x4eb713
mov edx, dword [edx*4 + reloc.oleaut32.dll_SysFreeString]
cmc
push ebx
clc
stc
jmp 0x4eb6f0
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.oleaut32.dll_SysFreeString]
call fcn.004eb757
ret

Function at 0x4eb735
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 2]
shr edi, 0x18
call fcn.004eb651
push ebx
sub esp, 8
jmp 0x4eb798
dec dword [ebp - 4]
jmp 0x4eb7d6
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.oleaut32.dll_SysFreeString]
pushal
lea esp, [esp + 0x20]
jmp 0x4eb782
mov dword [eax], edi
pop eax
call 0x4eb7b3
out dx, eax
push dword [esp + 3]
pop dword [esp]
lea esp, [esp + 4]
jmp 0x4eb7de
push eax
mov eax, esi
lea eax, [eax + 0xc]
jmp 0x4eb7aa
jne 0x4b0070
je 0x4affee
lea esp, [esp + 4]
pop edi
not esi
mov esi, esp
seto bh
jmp 0x4ebe7d
leave
ret
pop esi
mov bl, byte [esp]
pop ebx
jmp 0x4ebaa6

Function at 0x4eb7b3
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 2]
shr edi, 0x18
call fcn.004eb651
push ebx
sub esp, 8
jmp 0x4eb798
dec dword [ebp - 4]
jmp 0x4eb7d6
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.oleaut32.dll_SysFreeString]
pushal
lea esp, [esp + 0x20]
jmp 0x4eb782
mov dword [eax], edi
pop eax
call 0x4eb7b3
out dx, eax
push dword [esp + 3]
pop dword [esp]
lea esp, [esp + 4]
jmp 0x4eb7de
push eax
mov eax, esi
lea eax, [eax + 0xc]
jmp 0x4eb7aa
jne 0x4b0070
je 0x4affee
lea esp, [esp + 4]
pop edi
not esi
mov esi, esp
seto bh
jmp 0x4ebe7d
leave
ret
pop esi
mov bl, byte [esp]
pop ebx
jmp 0x4ebaa6
Function at 0x57983f
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc di, ax
je 0x57984c
not dh
jmp 0x57984e
push ebp
mov ebp, esp
sete dh
mov bl, cl
mov bp, dx
jmp 0x579825
not dh
pop esi
call fcn.0057988c
test eax, 0x6ff3bd66
btr edx, esp
jbe 0x57989c
ja 0x5798e4
retf 0xd84a
mov ah, 0xc6
jmp 0x579922
mov ah, 0xc6
jmp 0x579922
lea esp, [esp + 2]
jmp 0x5799e4
pop ebp
mov ebx, dword [esp]
mov ah, al
push bp
xchg edx, eax
jmp 0x57990c
pop edi
jmp fcn.004a42a3

Function at 0x5cf953
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], eax
mov dx, di
bt ax, bp
btc edx, esp
cld
rdtsc
jmp 0x5cf910
sub esp, 0x11
mov dh, byte [esp + 2]
sub esp, 0x13
pop edx
mov dh, cl
bsf dx, di
jmp 0x5cf8b1
rdtsc
inc bp
and ax, bp
rdtsc
lea edx, [eax + ebp]
cmp dh, dh
jmp 0x5cf939
lea eax, [esi*4]
neg al
mov dh, byte [esp]
clc
bsf ax, dx
jmp 0x5cf923
mov dword [esp + 2], ebp
shr edx, 0x1e
xchg al, ah
dec ax
mov ax, word [esp]
rcl ebp, cl
jmp 0x5cf8e9
mov ax, 0xad59
bsf bp, dx
dec al
jmp 0x5cf97f
rdtsc
mov ah, byte [esp]
xchg ebp, eax
lea ebp, [eax + esi]
mov ax, word [esp]
lea edx, [ebp - 0x61]
jmp 0x5cf8f9
push word [esp + 1]
push sp
cmc
mov dword [esp + 1], edx
mov edx, 0xdd63a873
jmp 0x5cf8d6
bt bp, dx
lea esp, [esp + 4]
std
setbe al
mov al, byte [esp]
jmp 0x5cfa4c
lea edx, [esi*4]
push bx
lea eax, reloc.oleaut32.dll_SysFreeString
pushfd
lea esp, [esp + 1]
rcr dl, cl
jmp 0x5cf969
mov bp, bx
mov byte [esp + 3], bh
stc
push word [esp + 3]
xchg bp, dx
lea esp, [esp + 2]
jmp 0x5cf9b2
pushfd
not ax
inc dx
mov dx, word [esp + 4]
xchg byte [esp + 3], al
xchg dx, bp
jmp 0x5cf9c8
not dl
cmc
cmp dh, 0xc5
mov al, 0xd5
clc
setp dh
jmp 0x5cf9e3

Function at 0x5cfd9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edi*4]
mov dh, 0x87
lea eax, reloc.oleaut32.dll_SysFreeString
jmp 0x5cfe77
pop word [esp + 8]
mov ebp, dword [esp + 3]
rol al, cl
not dx
mov ebp, dword [esp + 1]
bt dx, sp
jmp 0x5cfd5e
push word [esp + 0x18]
mov eax, 0x6ae28c5d
mov edx, edi
xchg dh, dl
jmp 0x5cfd74
mov eax, dword [esp + 5]
lea edx, reloc.oleaut32.dll_SysFreeString
pop dword [esp + 0x14]
mov dx, 0x9dfd
jmp 0x5cfe08
sub esp, 8
pop word [esp + 0x1d]
clc
mov bp, word [esp + 3]
mov byte [esp + 0x15], al
sub esp, 2
jmp 0x5cfdad
mov byte [esp + 1], dl
lea eax, [edi + ebp]
push word [esp]
clc
mov al, 0x24
neg eax
jmp 0x5cfe49
inc edx
pop dx
push dword [esp + 4]
rdtsc
btr bp, sp
neg dl
call fcn.005cfe21
fdivr dword [ebx]
adc cl, byte [ebp + 0x524748a]
mov dh, byte [esp + 5]
pop word [esp + 6]
push dword [esp + 0x1d]
neg dx
add esp, 0xd
xchg byte [esp + 0xb], ah
jmp 0x5cfdde
shr ah, 4
bswap eax
rdtsc
push word [esp + 0x10]
xchg word [esp + 0xb], dx
bsf ebp, esp
jmp 0x5cfdf0
bsf ax, si
sbb al, 0xda
neg ax
inc dx
mov bp, dx
lea eax, [ecx*4]
jmp 0x5cfdc7
Function at 0x5cfe23
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
sets dl
xchg ebp, eax
jmp 0x5cfe31
add esp, 2
pushal
mov dx, 0xc9ea
pop ax
pop dword [esp + 0x1f]
jmp 0x5cfe91
lea eax, reloc.oleaut32.dll_SysFreeString
xchg ebp, eax
pop dx
lea edx, [esi*4]
push dword [esp + 0x13]
jmp 0x5cff6c
bsf dx, cx
bswap edx
pop ax
clc
pop ax
sub esp, 0x17
jmp 0x5cfee0
mov edx, 0xcf405bd3
rdtsc
sub esp, 7
cld
push dword [esp + 0x33]
mov dword [esp + 0x13], ebx
jmp 0x5cfeff