joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481a80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x99eaa8]
xor edx, edx
cmp eax, edx
jne 0x481aa6
xor eax, eax
mov byte [eax + 0x99e9a8], al
inc eax
cmp eax, 0x100
jl 0x481a8e
mov dword [0x99eaa8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x99e9a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x481b37
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x481b0a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x481ad8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x481b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x481b93
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x481b7a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x488530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50f85e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00488e50
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x8dc3b4
call fcn.004ffbe8
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4885c3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ffbe8
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4885bc
push 0
mov ecx, eax
call fcn.0047f6d0
mov dword [esi + 0xc], eax
jmp 0x4885c5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4885c5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x495c70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x495ca3
push esi
call fcn.0049aa40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x495c9c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x495d29
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x495d12
mov eax, dword [esi + 8]
test eax, eax
je 0x495cc7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x495d0e
cmp eax, 2
je 0x495d12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x495cba
cmp eax, 3
je 0x495ced
cmp eax, 1
jne 0x495cba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x495cba
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x495cba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00495d60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x495d49
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00495d60
add esp, 4
pop esi
ret
Function at 0x4cbc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x4cbda1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x4cbd85
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x4cbcd7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x4cbcb5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x4cc7e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4cc840
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4cc840
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x4cc840
xor eax, eax
inc eax
jmp 0x4cc842
xor eax, eax
leave
ret 0x10
Function at 0x4cc86b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4cc8d9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x8f5b9c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4cc8d0
cmp dword [ebp - 0xc], 4
jne 0x4cc8d0
cmp dword [ebp - 0x10], edi
je 0x4cc8d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x92f070], edi
xor eax, eax
jmp 0x4cc918
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x92f070], edi
jge 0x4cc913
lea eax, [ebp - 0x34]
push eax
mov dword [0x92f070], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x4cc913
cmp word [ebp - 0x14], 5
jb 0x4cc913
call fcn.004cc846
test eax, eax
je 0x4cc913
emms
mov dword [0x92f070], 1
mov eax, dword [0x92f070]
pop edi
leave
ret
Function at 0x4f6230
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x510890
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004eb30e
mov eax, dword [0x901870]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004eb240
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004f6d40
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4f62d7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4f62ce
cmp al, 0xff
je 0x4f62ce
dec al
mov byte [ecx], al
jmp 0x4f62d7
push ecx
call fcn.004ffc11
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4f6308
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4f62ff
cmp al, 0xff
je 0x4f62ff
dec al
mov byte [ecx], al
jmp 0x4f6308
push ecx
call fcn.004ffc11
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x50224b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x502283
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00500302
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005002da
jmp 0x50228f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x503939
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x50397b
call fcn.005096bb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x50397b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x503972
xor eax, eax
jmp 0x503983
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00503989
pop edi
pop esi
pop ebx
ret 4

Function at 0x509beb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x509c19
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x509c37
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00509b51
jmp 0x509c37
mov eax, dword [esi + 0x14]
test eax, eax
je 0x509c37
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00509b51
test edi, edi
mov eax, edi
jne 0x509c21
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x9fc3c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0xa6cf19
pop word [esp]
lea esp, [esp + 2]
cmp ebx, edi
jmp 0xa6d07f
cmp eax, edi
lea esp, [esp + 0x18]
jne 0x9fc27e
push 0x4c0
call fcn.00a6cf5b
mov eax, dword [0xa05254]
stc
sub esp, 0x19
lea esp, [esp + 1]
jmp 0xa6cf84
je 0x9fc6f3
mov ah, byte [esp]
mov ax, word [esp]
mov ah, 0x27
rcr ax, cl
jmp 0xa6d00c

Function at 0xa0c064
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa0c1ca
push dword [esp + 2]
jmp 0xa0c073
lea esp, [esp + 1]
mov dword [esp + 0x24], esp
call fcn.00a0c16b
fld qword [edi - 0x29]
mov dl, 0x41
lea esp, [ebp - 8]
outsb dx, byte [esi]
or eax, edi
cmp eax, 0xd377c455
mov byte [esp + 6], ah
lea esp, [esp + 5]
push word [esp + 2]
jle 0xa0c069
push dword [esp + 2]
lea esp, [esp + 1]
mov dword [esp + 0x24], esp
call fcn.00a0c126
jmp 0xa0c20c
mov word [esp + 0xb], si
sub esp, 0x15
ror bx, cl
jmp 0xa0c244
push edx
mov ebx, 0xb4aa2bba
push dx
mov ebx, 0x8b8adc68
call fcn.00a0c490
mov bh, byte [esp]
jmp 0xa0c2a7
inc edi
sub esp, 0x17
jl 0xa0c2e2
xchg word [esp], bx
xchg dword [esp + 0x11], edx
mov ebx, ebp
jmp 0xa0c3ba
xchg dword [esp + 0x11], edx
mov ebx, ebp
lea esp, [esp + 3]
jmp 0xa0c389
xchg word [esp], bx
jmp 0xa0c2cc
ror edi, 0
jmp 0xa0c359
lea ebx, [esi + 0x73]
xchg ebx, edx
lea eax, [eax + ebp]
mov ax, word [esp]
rdtsc
mov ax, cx
jmp 0xa0c342
neg bx
jl 0xa0c30c
jge 0xa0c30c
lea eax, [eax + ebp]
mov ax, word [esp]
rdtsc
jmp 0xa0c323
dec eax
jge 0xa0c362
setg ah
jmp 0xa0c365
jnp 0xa0c315
lea ebx, [esi + 0x73]
xchg ebx, edx
jmp 0xa0c337
setg ah
add edi, 0x335659fc
jmp 0xa0c371
loop 0xa0c38e
mov bx, word [esp]
mov bl, ah
bt ax, bp
jo 0xa0c397
jno 0xa0c397
je 0xa0c36f
jl 0xa0c39e
div byte [edi]
jg 0xa0c3cd
int1
invalid
lea esp, [esp + 0x14]
not edi
xlatb
xchg dx, bx
mov bl, al
xchg ebx, eax
jmp 0xa0c330
add edi, dword [ebp]
jmp 0xa0c3a0
add eax, 0xde8b66b4
mov bx, si
adc al, 0x40
jnp 0xa0c3ef
lea edx, [edi*4]
jmp 0xa0c3d6
lea esp, [esp + 3]
jmp 0xa0c389
test byte [edi - 0x36], dh
cld
iretd
mov ax, 0xee50
jmp fcn.00a0c3c0
lea edx, [edi*4]
mov ax, 0xee50
jmp fcn.00a0c3c0

Function at 0xa0c0ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea eax, reloc.KERNEL32.dll_HeapSize
call fcn.00a0c0df
jle 0xa0c083
jb 0xa0c0be
in al, 0x63
test eax, 0x2474ff66
push word [esp + 2]
jmp 0xa0c096
invalid
push word [esp + 2]
jmp 0xa0c096
sbb al, 0x24
pop dword [esp]
Function at 0xa0c16b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf09f6d70
jmp 0xa0c10b
mov dword [esp], ebx
mov dword [esp + 0x24], ebp
push ebp
push di
pop word [esp]
mov dword [esp], edi
call fcn.00a0c109
mov byte [esp + 3], ah
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0xa0c0f3
pushfd
jmp 0xa0b3cc
or bp, 0xedc7
jp 0xa0c144
shl ecx, cl
xchg ecx, ebp
xchg dl, dh
jmp 0xa0c148
xchg ecx, ebp
xchg dl, dh
jmp 0xa0c148
shl ecx, cl
jmp 0xa0c12e
mov edi, dword [esp + 0x2c]
btc si, bx
js 0xa0c19a
lea esi, [eax*4]
lea ebp, [eax + ebx]
mov bl, 0xc0
jmp 0xa0c175
jmp 0xa0c0b3
lea ebp, [eax + ebx]
mov bl, 0xc0
lea ebp, [esp]
jmp 0xa0c17e
mov esi, dword [esp]
sub esp, 0xc0
jmp 0xa0c1a3
lea esi, [eax*4]
jmp 0xa0c170
mov esi, esp
ror ecx, cl
jmp 0xa0c204
mov ax, 0xbc11
mov ecx, edi
sub esp, 0xf
je 0xa0c1ee
mov word [esp + 0xb], si
sub esp, 0x15
ror bx, cl
push edx
jmp 0xa0c22e
ja 0xa0c1ad
mov ax, 0xbc11
jmp 0xa0c1b1
mov ebx, 0xb4aa2bba
jmp 0xa0c24a

Function at 0xa0c490
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
mov bh, byte [esp]
jmp 0xa0c2a7
xor edi, 0xb570dd4
bsr edx, esi
jne 0xa0c26c
mov eax, dword [esp]
call fcn.00a0c278
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0xa0c294
Function at 0xa2b445
Capabilities:
Encrypt data using aes

Disassembly:
push di
lea esp, [esp + 2]
jmp 0xa2b516
lea edi, [ebx*4]
jmp 0xa2b5f9
mov eax, edi
mov ecx, 0xd30a2bb
jmp 0xa2b535
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
jmp 0xa2b57f
pushal
inc ecx
mov di, bx
mov dword [esp], edx
popal
jmp 0xa2b569
pushal
sub esp, 0xc
call fcn.00a2b5bb
mov byte [0x37c4bd2d], al
invalid
mov di, word [esp]
btr edi, ecx
mov edi, ebp
jmp 0xa2b53f
lea esp, [esp + 4]
lea edi, [ecx + 0x10]
pushfd
call fcn.00a2b512
pushal
mov dword [esp], edx
pushfd
lea esp, [esp + 4]
popal
jmp 0xa2b62c
and edx, esi
cmc
push bx
mov byte [esp], dh
lea esp, [esp + 2]
jmp 0xa2b6b5
clc
lea edi, [ecx + esi]
jmp 0xa2b690
xor ecx, edi
sub esp, 0x18
and edx, ebp
pushal
jmp 0xa2b659
xor ecx, edx
call fcn.00a2b67a
lea esp, [esp + 0x3c]
xor ecx, dword [ebx]
pushal
lea esp, [esp + 0x20]
jmp 0xa2b7a3
mov edx, dword [edx*4 + reloc.KERNEL32.dll_HeapSize]
shr edi, 0x18
movzx edi, byte [edi*4 + 0xa02d78]
jmp 0xa2b670
pushal
push word [esp + 0x13]
not edx
lea esp, [esp + 2]
mov edx, dword [eax + 4]
call fcn.00a2b6c9
add esp, 3
lea esp, [esp + 1]
xor edx, ecx
push ecx
jmp 0xa2b75a
mov ecx, dword [eax + 8]
pushal
push ebx
jmp 0xa2b73e
dec dh
add ebx, 4
mov dword [edi], ecx
lea edx, [ebx*4]
jmp 0xa2b6df
lea esi, [esi + 0x18]
mov dword [esi], ecx
pop esi
jmp 0xa2b77a
xor ecx, edx
push esi
mov esi, eax
jmp 0xa2b728
mov ecx, eax
add ecx, 0x14
mov dword [ecx], edx
pop ecx
jmp 0xa2b6ff
lea esp, [esp + 0x44]
cmp ebx, 0xa045a0
jmp 0xa2b784
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
jmp 0xa2b764
jne 0x9f7b44
lea eax, [ecx + ebx]
push 0xa
xchg al, bh
jmp 0xa2b7e8
lea edi, [eax + 0x10]
xor ecx, dword [eax]
mov edx, 0x24ae25fc
neg dx
not edx
jmp 0xa2b718
pop ebp
lea ebx, [eax + ebp]
pushal
jmp 0xa2b7fb
pop edi
pop esi
mov bp, word [esp]
jmp 0xa2b7b7
mov bx, word [esp]
pop eax
mov bl, dl
mov esi, dword [esp]
lea ebx, [eax*4]
jmp 0xa2b7cd
lea esp, [esp + 0x20]
pop ebx
ret

Function at 0xa2b5bb
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, dword [ecx*4 + reloc.KERNEL32.dll_HeapSize]
push dx
mov word [esp], cx
jmp 0xa2b5d9
mov byte [esp + 0x25], ah
and ecx, esi
jmp 0xa2b5a5
cmc
jmp 0xa2b646
lea esp, [esp + 2]
shr edi, 0x10
cmc
and edi, esi
jmp 0xa2b5c3
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
jmp 0xa2b606
mov edi, dword [edi*4 + reloc.KERNEL32.dll_HeapSize]
push bx
lea esp, [esp + 2]
lea esp, [esp + 0x30]
jmp 0xa2b61c
Function at 0xa2ba52
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0xa2c0bf
movzx ebx, byte [esi + 0x11]
setb dl
jmp 0xa2ba80
mov dword [esp], edx
pushal
jmp 0xa2bace
mov dword [ebp - 4], ecx
mov di, 0xd0e7
jmp 0xa2ba96
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
rol dx, 0
jmp 0xa2bab6
mov ecx, 0xff
jmp 0x9f826c
add esi, 0x10
not dl
bswap edi
jmp 0xa2baf8
lea edi, [ebx*4]
jmp 0xa2baa0
lea esp, [esp + 0x24]
jle 0x9f81fd
dec dx
lea ecx, [eax - 1]
jmp 0xa2ba58
pushal
setns bl
mov cl, dh
mov dword [esp], edx
popal
call fcn.00a2bb33
rcl byte [edx + ecx*8 - 0x53], 0x5c
popfd
inc ecx
mov edx, dword [esi]
sub esp, 0x15
sub esp, 7
jmp 0xa2bae2
pop edi
jmp 0xa2c121
lea esp, [esp + 4]
pop ebx
push ax
lea esp, [esp + 2]
jmp 0xa2c143
mov esi, dword [esp]
mov bl, 0x3b
not bh
lea ebx, [ebx + edi]
jmp 0xa2c101
leave
ret

Function at 0xa2bcc7
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
mov bx, word [esp]
jmp 0xa2bc8f

Function at 0xa2bd8a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xa2bde7
mov word [esp + 1], bp
shr edi, 0x18
mov edi, dword [edi*4 + reloc.KERNEL32.dll_HeapSize]
sub esp, 0x15
jmp 0xa2bdd1

Function at 0xa2bf20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
cmc
jmp 0xa2bec0
mov dword [esp], esi
popal
add edi, 0xd
movzx ebx, byte [edi]
pop edi
jmp 0xa2be9d
push edi
mov edi, edx
lea edi, [edi*4]
jmp 0xa2bed0
push edi
pushal
cmp ebp, edx
mov dh, byte [esp]
jmp 0xa2beb3
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_HeapSize]
mov bl, 0xe9
jmp 0xa2beea

Function at 0xa2c09d
Capabilities:
Encrypt data using aes

Disassembly:
push ebx
mov word [esp + 3], bx
jmp 0xa2c0d5
lea esp, [esp + 4]
dec dword [ebp - 4]
call fcn.00a2c09d
mov dword [esi + 0xc], edi
pushal
lea esp, [esp + 0x28]
jne 0x9f826c
je 0x9f81fd
fstp dword [edi - 0x31]
stosb byte es:[edi], al
pop ecx
aam 0x31
mov al, 0x26
inc ecx
mov al, 0x72
sub eax, 0x224648d
pushfd
lea esp, [esp + 2]
jmp 0xa2c0b3

Function at 0xa2c43c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xa2c476
lea esp, [esp + 1]
mov dword [esp + 0x18], ecx
sub esp, 4
push si
lea esp, [esp + 2]
jmp 0xa2c487
lea esp, [esp + 0x20]
mov ebp, esp
push ecx
sub esp, 0x1f
pop word [esp + 7]
jmp 0xa2c43e
lea esp, [esp + 0x1c]
push ebx
jmp 0xa2c5a9
pushfd
lea esp, [esp + 4]
popal
push edi
pushal
lea edx, [eax + ebp]
mov dword [esp], eax
jmp 0xa2c52d

Function at 0xa2c4b5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
jb 0x9f8457
call fcn.00a2c4d2
invalid
Function at 0xa2c4d2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call 0xa2c569
push ss
mov ebp, 0x75ceac42
out 0x52, al
xlatb
xchg byte [ecx], ch
xor eax, 0xee7f4cb
cdq
cmp al, 0x61
jmp 0xa2c4d5
cmp al, 0x41
call fcn.00a2c4b5
clc
jmp 0xa2c50c
jb 0x9f8367
cmp al, 0x7a
jbe 0x9f83ae
ja 0x9f8367
retf
sub esp, 0xb
mov word [esp + 6], dx
push word [esp + 4]
lea esp, [esp + 1]
lea esp, [esp + 0xc]
jmp 0xa2c4cb
lea esp, [esp + 4]
cmp al, 0x5a
jbe 0x9f83ae
ja 0x9f8457
aad 0x5c
xchg ebp, eax
cmpsd dword fs:[esi], dword es:[edi]
and eax, 0xab5839a9
sbb cl, byte [eax - 0x15]
add bl, byte [ebp + ecx*4 + 0x61042464]
stc
mov al, byte [ecx]
jmp 0xa2c4f5

Function at 0xa2c56b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp al, 0x2b
jmp 0xa2c5e1
push dword [esp + 0x22]
jmp 0xa2c58d
lea esp, [esp + 0x28]
jbe 0x9f83ae
ja 0x9f8351
add byte [eax + 0x56906106], dl
lea ebx, [edi + ebp*2]
jbe 0xa2c609
mov al, byte [0x148d6057]
sub byte [ecx + 0x77e92404], cl
invalid
je 0x9f83ae
call fcn.00a2c5b6
pushfd
pop dword [esp]
jmp fcn.00a2c610
sti
pop edx

Function at 0xa2c5b6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
cmp al, 0x2f
call 0xa2c5c3
jecxz 0xa2c5dd
jmp 0xa2c62c
leave
push 0x840f228b
invalid

Function at 0xa2c5c3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
cmp al, 0x2f
call 0xa2c5c3
jecxz 0xa2c5dd
jmp 0xa2c62c
leave
push 0x840f228b
invalid

Function at 0xa2c5ec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp al, 0x2b
jmp 0xa2c5e1
push dword [esp + 0x22]
jmp 0xa2c58d
lea esp, [esp + 0x28]
jbe 0x9f83ae
ja 0x9f8351
add byte [eax + 0x56906106], dl
lea ebx, [edi + ebp*2]
jbe 0xa2c609
mov al, byte [0x148d6057]
sub byte [ecx + 0x77e92404], cl
invalid
je 0x9f83ae
call fcn.00a2c5b6
pushfd
pop dword [esp]
jmp fcn.00a2c610
sti
pop edx

Function at 0xa6c434
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [eax + 0x10]
jmp 0xa6cc2f
lea esp, [esp + 4]
add esi, dword [ebp - 0xc]
cmp dword [esi], 0
je 0xa6c47d
call fcn.00a6cbb4

Function at 0xa6cbb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [ebp - 0xc]
jmp 0xa6c3e7
mov eax, ebx
jmp 0xa6cbb6
mov dword [esp], edi
jmp 0xa6cbd1
jmp 0xa6cb9e
mov eax, dword [0xa05314]
mov ecx, dword [esp]
mov ecx, ebx
mov cx, word [esp]
call fcn.00a6cbfa
dec edi
insd dword es:[edi], dx
jl 0xa6cbcd
add byte [eax], al
add byte [eax], al
lea esp, [esp + 4]
cmp dword [ebx], 0
je 0xa6c47d
jne 0xa6c52d

Function at 0xa6cf5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0
jmp 0xa6cf5d
jmp 0xa6cf45
lea esp, [esp + 4]
push 8
call fcn.00a6cf69
adc dh, ch
cmc

Function at 0xa6cf69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
lea esp, [esp + 4]
jmp 0xa6cfb9
push dword [0xa052ec]
call fcn.00a6cf9a
Function at 0xa6d159
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 1]
jmp 0xa6d2bf
lea esp, [esp + 0xc]
jb 0x9fc294
jae 0x9fc249

Function at 0xb531a6
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call 0xb53190
mov word [esp], sp
lea esp, [esp]
lea esp, [esp + 2]