joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035257
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x10049e00
je 0x10035313
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100352fb
mov esi, dword [ebx + 4]
jmp 0x100352f5
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100352e5
cmp dword [ebp - 0xc], 4
jne 0x100352e5
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x100352dd
or dword [eax + 0x9c], ecx
jmp 0x100352e5
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x100352a9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x1003528c
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x100356cd
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x10038951
call fcn.1001e510
sub esp, 0x11c
mov eax, dword [0x1004a0f0]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x100357c6
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x1003579a
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.100022a0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.100356cd
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.10001100
test bl, bl
jne 0x1003579a
or dword [ebp - 4], 0xffffffff
jmp 0x1003570b
cmp esi, 0x103
je 0x100357aa
cmp esi, 0x3f2
jne 0x100357ba
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.1001b3e9
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10035c7b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x10035cb0
cmp edi, dword [esi + 0xc]
jge 0x10035cb0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10035cb0
cmp edi, dword [eax + 8]
jge 0x10035cb0
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x10035cb2
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x10035e0f
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x10035e43
jmp fcn.1002b589
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x10035eb4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x10035fad
cmp eax, dword [edi + 0xc]
jge 0x10035fad
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x10035f05
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x10035f96
cmp dword [ebp + 0xc], ebx
je 0x10035f96
jmp 0x10035f2f
push 0x10
call fcn.10035b47
cmp eax, ebx
je 0x10035f1b
mov ecx, eax
call fcn.10035e06
mov esi, eax
jmp 0x10035f1d
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x10035f46
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x10035f56
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x10035f68
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1002b589
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.1001e4b0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x10035fa8
cmp ecx, dword [esi + 8]
jge 0x10035fa8
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x10035fae
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003606c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x1003609a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100360b8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.10035fd6
jmp 0x100360b8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100360b8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.10035fd6
test edi, edi
mov eax, edi
jne 0x100360a2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x419610
Capabilities:
Get disk information

Disassembly:
push 0
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
push 0x4d2064
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [0x4d5aec]
add ecx, eax
mov dword [0x4d5aec], ecx
mov eax, ecx
ret

Function at 0x4ae19c
Capabilities:
Packed with generic packer

Disassembly:
iretd
insd dword es:[edi], dx
pushfd
and ebp, dword [esi + 0x1b345c4e]
dec ebp
popal
mov ecx, 0xc840a55e
mov al, byte [0x8c50151e]
jecxz 0x4ae0d9
cmp dh, bh
cmpsb byte [esi], byte es:[edi]
add eax, 0x2a1709c5
loop 0x4ae13a
test al, 0xa2
invalid
xchg edi, eax
xchg ebp, eax
or ah, al
call 0x3017b654
jbe 0x4ae153
push ds
push ebp
sub eax, 0x942b7fdf
adc eax, 0x1b3cb7ba
fisub dword [esi + 0x7e05753d]
das
mov bh, 0xc9
mov eax, 0x9fe3a709
lahf

Function at 0x4c7e5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d23a8
cmp edx, dword [eax]
je 0x4c7e7f
add eax, 8
inc ecx
cmp eax, 0x4d2438
jl 0x4c7e70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d23a8]
jne 0x4c7fad
mov eax, dword [0x4d7dd0]
cmp eax, 1
je 0x4c7f87
test eax, eax
jne 0x4c7eb0
cmp dword [0x4d22d0], 1
je 0x4c7f87
cmp edx, 0xfc
je 0x4c7fad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c7ee7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c8840
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8cd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c7f2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8cd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cde04
push edi
call fcn.004caba0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c8840
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c8850
lea eax, [ebp - 0xa0]
push 0x4cdde4
push eax
call fcn.004c8850
push dword [esi + 0x4d23ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c8850
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004cab14
add esp, 0x2c
pop edi
jmp 0x4c7fad
lea eax, [ebp + 8]
lea esi, [esi + 0x4d23ac]
push 0
push eax
push dword [esi]
call fcn.004c8cd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4055fd
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004058c8
test bl, 8
mov dword [ebp - 8], eax
je 0x40563c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429228], eax
jmp 0x4057b9
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405656
test eax, eax
je 0x405767
test bl, 2
je 0x405767
mov esi, 0x4246a0
push edi
push esi
call fcn.00405d75
cmp dword [ebp + 8], 0
je 0x405675
push 0x409500
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x40567b
push edi
call fcn.0040580c
cmp word [edi], 0
jne 0x40568b
cmp word [0x4246a0], 0x5c
jne 0x405696
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40575c
cmp word [ebp - 0x22c], 0x2e
jne 0x4056e0
cmp word [ebp - 0x22a], 0
je 0x40573f
cmp word [ebp - 0x22a], 0x2e
jne 0x4056e0
cmp word [ebp - 0x228], 0
je 0x40573f
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00405d75
test byte [ebp - 0x258], 0x10
je 0x40570b
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40573f
push dword [ebp + 0xc]
push edi
call fcn.004055fd
jmp 0x40573f
push dword [ebp - 4]
push edi
call fcn.004055b5
test eax, eax
jne 0x405737
cmp dword [ebp - 4], eax
je 0x40572f
push edi
push 0xfffffffffffffff1
call fcn.0040501f
push 0
push edi
call fcn.00405c0f
jmp 0x40573f
inc dword [0x429228]
jmp 0x40573f
push edi
push 0xfffffffffffffff2
call fcn.0040501f
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4056b8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405767
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4057b9
cmp dword [ebp - 8], esi
jne 0x40577b
inc dword [0x429228]
jmp 0x4057b9
push edi
call fcn.004060b8
test eax, eax
je 0x4057b9
push edi
call fcn.004057c0
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004055b5
test eax, eax
jne 0x4057b1
cmp dword [ebp - 4], esi
je 0x405773
push edi
push 0xfffffffffffffff1
call fcn.0040501f
push esi
push edi
call fcn.00405c0f
jmp 0x4057b9
push edi
push 0xffffffffffffffe5
call fcn.0040501f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40618d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d3c], 0
push esi
jne 0x4061c4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40619e
mov dword [ecx*4 + 0x426d38], eax
inc ecx
cmp ecx, 0x100
jl 0x406199
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4061f5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d38]
xor eax, esi
inc ecx
dec edx
jne 0x4061d7
pop edi
not eax
pop esi
ret 0xc
Function at 0x1001f191
Capabilities:
Read file on windows

Disassembly:
jmp 0x1001f194
sub eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.1003dcd0
jmp 0x1003d7f0
adc dh, al
inc esp
add ch, byte [edx + ecx]

Function at 0x10024d30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
inc esi
or dword [edi], ecx
mov dh, 0x42
or cl, byte [eax - 0x49f0f5ba]
inc edx
or ecx, dword [eax - 0x49f0f4ba]
inc edx
or al, 0x88
inc esi
or al, 0xf
mov dh, 0x42
or eax, 0xf0d4688
mov dh, 0x42
push cs
Function at 0x10024d8c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
inc edx
or al, 0x88
inc esi
or al, 0xf
mov dh, 0x42
or eax, 0xf0d4688
mov dh, 0x42
push cs
mov byte [esi + 0xe], al
movzx eax, byte [edx + 0xf]
mov byte [esi + 0xf], al
movzx eax, byte [edx + 0x10]
mov byte [esi + 0x10], al
movzx eax, byte [edx + 0x11]
mov byte [esi + 0x11], al
movzx eax, byte [edx + 0x12]
mov byte [esi + 0x12], al
movzx eax, byte [edx + 0x13]
mov byte [esi + 0x13], al
movzx eax, byte [edx + 0x14]
mov byte [esi + 0x14], al
movzx eax, byte [edx + 0x15]
mov byte [esi + 0x15], al
movzx eax, byte [edx + 0x16]
mov byte [esi + 0x16], al
movzx eax, byte [edx + 0x17]
mov byte [esi + 0x17], al
movzx eax, byte [edx + 0x18]
mov byte [esi + 0x18], al
movzx eax, byte [edx + 0x19]
mov byte [esi + 0x19], al
movzx eax, byte [edx + 0x1a]
mov byte [esi + 0x1a], al
movzx eax, byte [edx + 0x1b]
mov byte [esi + 0x1b], al
movzx eax, byte [edx + 0x1c]
mov byte [esi + 0x1c], al
lea eax, [esi + 0x1d]
movzx ecx, byte [edx + 0x1d]
mov byte [eax], cl
movzx ecx, byte [edx + 0x1e]
mov byte [esi + 0x1e], cl
movzx ecx, byte [edx + 0x1f]
mov byte [esi + 0x1f], cl
mov esi, 8
nop dword [eax]
mov dl, byte [eax + 2]
mov ecx, esi
mov bl, byte [eax - 1]
mov dh, byte [eax]
mov bh, byte [eax + 1]
mov byte [ebp - 1], dl
and ecx, 7
jne 0x10024e69
movzx ecx, dh
mov dl, bl
mov bl, byte [ecx + str.cw]
movzx ecx, bh
mov dh, byte [ecx + str.cw]
movzx ecx, byte [ebp - 1]
mov bh, byte [ecx + str.cw]
movzx ecx, dl
mov dl, byte [ecx + str.cw]
mov ecx, esi
shr ecx, 3
xor bl, byte [ecx + 0x100839d0]
jmp 0x10024e92
cmp ecx, 4
jne 0x10024e92
movzx ecx, bl
mov bl, byte [ecx + str.cw]
movzx ecx, dh
mov dh, byte [ecx + str.cw]
movzx ecx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, dl
mov dl, byte [ecx + str.cw]
movzx ecx, byte [eax - 0x1d]
inc esi
xor cl, bl
mov byte [eax + 3], cl
movzx ecx, byte [eax - 0x1c]
xor cl, dh
mov byte [eax + 4], cl
movzx ecx, byte [eax - 0x1b]
xor cl, bh
mov byte [eax + 5], cl
movzx ecx, byte [eax - 0x1a]
xor cl, dl
mov byte [eax + 6], cl
add eax, 4
cmp esi, 0x3c
jb 0x10024e20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100251ab
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x100251a5
sub ebx, 1
jne 0x100251a0
mov esi, dword [ebp - 0xc]
add esi, 0x10
mov dword [ebp - 8], 0xd
mov ebx, edi
mov dword [ebp - 4], 4
nop dword [eax + eax]
mov ecx, ebx
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
sub edx, 1
jne 0x100251e0
inc ebx
sub dword [ebp - 4], 1
jne 0x100251d0
mov cl, byte [edi + 1]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, edi
mov byte [edi + 0xb], al
call fcn.10049522
mov eax, edi
mov ebx, 4
nop dword [eax]
mov edx, 4
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x10025265
sub ebx, 1
jne 0x10025260
sub dword [ebp - 8], 1
jne 0x100251c2
mov esi, edi
lea ebx, [edx + 4]

Function at 0x10025360
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x10025355
sub ebx, 1
jne 0x10025350
mov eax, dword [ebp - 8]
add eax, 0xd0
mov byte [ebp - 1], 0xd
mov dword [ebp - 0xc], eax

Function at 0x1002538f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
invalid
mov byte [esi + 5], al
invalid

Function at 0x10025393
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add dword [eax - 0x49f0faba], ecx
inc esi
or cl, byte [eax + 0x4e8a014e]
add cl, byte [eax - 0x49f0fdba]
mov dh, 0x46
push cs

Function at 0x100253a1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add dword [eax - 0x49f0faba], ecx
inc esi
or cl, byte [eax + 0x4e8a014e]
add cl, byte [eax - 0x49f0fdba]
mov dh, 0x46
push cs

Function at 0x100253c2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dh, 0x46
js 0x5e8a5f10
invalid

Function at 0x100253e2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add dword [ebp - 0x7f75fbb7], ecx
sar byte [eax], 1
or byte [eax], dl
Function at 0x10025418
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov dh, 0x46
push cs
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
inc esi
pop es
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
add ecx, dword [eax - 0x49f0fcba]
inc esi
or ecx, dword [eax - 0x49f0f8ba]
mov dh, 0x46
js 0x5e8a5f10
invalid
nop dword [eax + eax]
pop ds
inc esp
add byte [eax], al
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x100838d0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x100253e0
inc edi
sub ebx, 1
jne 0x100253d0
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
add dword [ebp - 0xb], esi
sub ebx, 1
jne 0x10025404
mov ecx, esi
call fcn.100497a7
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10

Function at 0x1002541c
Capabilities:
Encrypt data using aes
Encrypt data using rc4 prga
Reference aes constants

Disassembly:
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov dh, 0x46
push cs
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
inc esi
pop es
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
add ecx, dword [eax - 0x49f0fcba]
inc esi
or ecx, dword [eax - 0x49f0f8ba]
mov dh, 0x46
js 0x5e8a5f10
invalid
nop dword [eax + eax]
pop ds
inc esp
add byte [eax], al
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x100838d0]
mov byte [ecx - 4], al
sub edx, 1
jne 0x100253e0
inc edi
sub ebx, 1
jne 0x100253d0
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
add dword [ebp - 0xb], esi
sub ebx, 1
jne 0x10025404
mov ecx, esi
call fcn.100497a7
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10

Function at 0x1002542e
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
invalid
mov byte [esi + 5], al
invalid

Function at 0x10025458
Capabilities:
Encrypt data using aes
Encrypt data using rc4 prga
Reference aes constants

Disassembly:
add dword [eax - 0x49f0faba], ecx
inc esi
or cl, byte [eax + 0x4e8a014e]
add cl, byte [eax - 0x49f0fdba]
inc esi
push cs
Function at 0x100254d3
Capabilities:
Encode data using xor

Disassembly:
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x100254d0
sub dword [ebp - 0xc], 1
jne 0x100254c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp

Function at 0x100254f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [ebp - 4], eax
add eax, 0xf0
mov dword [ebp - 8], eax
mov esi, eax
push edi
mov edi, edx
test ebx, ebx
je 0x10025545
dec ebx
shr ebx, 4
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x10025520
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.10049ab8
mov esi, edi
add edi, 0x10
sub ebx, 1
jne 0x10025516
mov eax, dword [ebp - 8]
movups xmm0, xmmword [esi]
pop edi
pop esi
movups xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100258e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 0
mov esi, ecx
mov dword [ebp - 0x1f], 0x6a726575
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], 0x63726b67
mov word [ebp - 0x1a], 0x756b
mov word [ebp - 0x10], 0x6e62
mov dword [ebp - 0x24], 0x69796766
mov word [ebp - 0x13], 0x6f68
mov dword [ebp - 0xc], 0x62717972

Function at 0x1002592f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x28], 0x77787767
mov byte [ebp - 0x11], 0x67
mov word [ebp - 0xe], 0x6873
mov byte [ebp - 8], 0
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x20], 0x64
call fcn.1002aab5
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1004d423
mov esp, ebp
pop ebp
ret