joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046660
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x10046693
push esi
call fcn.10049770
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1004668c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10046719
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10046702
mov eax, dword [esi + 8]
test eax, eax
je 0x100466b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x100466fe
cmp eax, 2
je 0x10046702
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100466aa
cmp eax, 3
je 0x100466dd
cmp eax, 1
jne 0x100466aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100466aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100466aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10046740
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10046728
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10046740
add esp, 4
pop esi
ret

Function at 0x10064e98
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10064ed0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10062f4c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10062f24
jmp 0x10064edc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1006658f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100665d1
call fcn.1006c059
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100665d1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100665c8
xor eax, eax
jmp 0x100665d9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100665df
pop edi
pop esi
pop ebx
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4151e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415283
push ebx
push esi
call fcn.004151af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413e34
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415230
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415282
push edi
push eax
call fcn.00412001
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415250
call fcn.0040efd8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415281
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413e34
add esp, 0x20
test eax, eax
jne 0x41526f
push edi
call fcn.0040efd8
jmp 0x415277
push ebx
call fcn.0040efd8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41ae50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ae7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ae7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41c20e
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
mov ebx, 0x4ac
xor ebp, ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov edi, 0x46a820
mov esi, eax
push edi
call fcn.0041c168
push ebx
push edi
push esi
call fcn.00405470
add esp, 0x14
call fcn.0041c14e
push ebp
push ebp
push 0x427020
lea eax, [esi + 0x188]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebp
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x104d886a
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
inc si
mov dword [ebx + ecx*8 - 0x1720e0], ebp
inc si
or dword [esp + ecx*4 - 0xb9068], edx
inc ecx
pop edx
inc ecx
pop ecx
jp fcn.104f078d
syscall
inc ecx
push ebp
pushfd
dec ecx
mov ebp, 0x3a0a58b1
sahf
test dword [ecx + 0x2b456610], edx
in eax, dx
dec esp
mov ebp, dword [esp + 8]
dec eax
mov dword [esp + 8], 0xc1e85010
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.104f27f5

Function at 0x104dc47c
Capabilities:
Encrypt data using chaskey

Disassembly:
jmp 0x10537209
mov ecx, 0xcb9f7c96
add edi, 4
xor edx, ebx
mov dword [esp], 0x762b4aa6
and cx, cx
ror edx, 3
movsx eax, cl
shl byte [esp], 0x67
xor edx, 0xda8df420
neg ecx
inc dword [esp + ecx - 0x3460836a]
call fcn.1052a80e
jmp 0x104d932e
adc edi, 3
neg cl
or ax, word [esp + 0xa]
xor edx, ebx
lea edx, [eax + edx - 0x4e563ed7]
ror edx, 3
dec edx
call fcn.10512827
xchg byte [esp + ecx - 0x6425ed15], ch
lea eax, [ecx*4 - 0x54f45cee]
shl word [esp + ecx - 0x64251616], 0x27
mov dword [esp + eax - 0x3b9ffb6a], ebp
ret
call eax
mov esi, 0xf12d4183
push esi
mov ebp, dword [ebp - 4]
xor esi, esi
sub dword [esp + esi*2], esi
mov dword [ebp + esi], eax
jnp 0x105d6aac
inc cx
sar esi, 0x41
dec edx
lea eax, [edi*8 + 0x788f9198]
inc ecx
ror ebp, 1
inc ecx
sub ebp, 0xa13641b6
inc ecx
ror ebp, 2
inc edx
and byte [esp + edx - 0xfffffc], 0x2e
inc esp
movsx eax, ax
inc esi
xadd dword [esp + edx*2 - 0x1fffffb], edx
dec esi
mov dword [esp + edx*4 - 0x3fffcb8], ebx
dec ecx
inc edx
dec ebx
lea ecx, [edi + eax*2 + 0x50b90986]
inc esi
xor dword [esp + edx*4 - 0x3fffcbc], ebp
shr eax, cl
inc ecx
pop ebx
dec ebp
arpl bp, bp
dec ebp
or esi, esi
inc ecx
movzx ebp, al
call fcn.104f848a
mov eax, 0xed369381
cdq
add esi, ebp
mov ebx, dword [esp + 4]
lea ecx, [edx*8 + 0x1db42427]
add dword [esp + ecx*4 - 0x76d0907c], 0x8e3bbb02
mov ebp, dword [esp + ecx - 0x1db42417]
ror edx, 0x24
lea eax, [eax + edx*2 - 0x485b02f5]
mov edi, dword [esp + ecx*2 - 0x3b684832]
ja 0x1050d449
mov dword [esp + ecx - 0x1db42417], edx
mov edx, dword [ecx + edi - 0x1db4241f]
sets cl
lea ecx, [eax + ecx*2 - 0x3dd741e9]
jbe 0x1050b253
Function at 0x104deb8e
Capabilities:
Encode data using xor

Disassembly:
bt eax, eax
mov si, word [esi + eax - 0x11964ad2]
mov dword [esp + eax*4 - 0x46592b48], eax
sbb dword [esp + eax - 0x11964aca], 0x3c3e8eb3
pop edx
pop eax
pop edx
jno fcn.104d9290
inc ecx
ror ebp, 2
inc ecx
ror edi, 0x66
inc ecx
shl esi, 0x56
dec eax
inc edx
inc ecx
push ebx
inc ecx
mov esp, 0x5c1cce18
dec edx
lea ecx, [edi*2 - 0x5a4d1dc1]
dec ebp
lea ebx, [esp + 0x2c969408]
inc esi
xor dword [esp + esi - 0x2f800000], ebp
inc ecx
adc al, 0x41
pop ebx
inc ecx
neg cl
inc esp
sbb cl, dl
dec eax
not ebp
dec ebp
arpl bp, bp
cwde
dec ecx
adc esi, ebp
dec eax
cdq
dec esi
mov esi, dword [ebx + esi - 0x2f800000]
cbw
dec eax
sar edx, 0xa0
dec esp
mov edx, dword [ebx + edx + 8]
call fcn.105e9e19
xor eax, 0xeeb988d4
and edi, edi
wait
dec ebx
adc ebx, esp
jno 0x104debc5
adc bh, bh
idiv ebx
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
pop ecx
xor byte [edx], cl
push cs
push ebp
outsd dx, dword [esi]
mov dh, 0x50
pop edi
xchg ecx, eax
movsb byte es:[edi], byte [esi]
not dword gs:[edx - 0x54]
nop
jne 0x104debe1
outsb dx, byte [esi]
shl dword [edx], 1
pop ebx
scasb al, byte es:[edi]
out dx, eax
dec esp
mov esp, 0x9157a05c
adc dword [edx + ebp*4 + 0x6e], esi
stosb byte es:[edi], al
mov byte [0x6f575971], al
iretd

Function at 0x104f07cc
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov edx, 0xa512b696
add edi, 4
xor ecx, ebx
dec ecx
neg dx
not ecx
mov dword [esp], 0xfa2dee86
jge 0x1052fb2c
inc edx
pop edx
mov dx, word [esi]
mov eax, 0xb182ba
xchg ecx, eax
mov ax, word [esi + ecx*4 - 0x2c60ae6]
sub ecx, ecx
push ecx
xor cl, byte [esi + ecx*2 + 4]
add esi, 4
push 0x22b56132
shrd dx, ax, cl
mov eax, 0x8eb6d60e
and eax, dword [esp]
jg 0x105c55e9
inc ecx
btr dx, 0xd
ror dl, 0xe6
neg byte [esp + 2]
not ecx
btr edx, edx
btr edx, edx
rol dword [esp], 0xc
xor ebx, ecx
bt edx, eax
sbb dx, dx
adc ebp, ecx
lea ecx, [eax + edx + 0x55bb5eb4]
or dword [esp], 0x4819d938
mov cx, word [esi]
neg dx
je 0x1056422b
add bh, byte [ebp + 0x1daf06e5]
cmp edx, ebp
iretd
mov ax, word [esi + 2]
neg dx
push edx
sbb esi, 2
not cx
dec edx
ror dword [esp], 0x46
xor ax, dx
or cx, ax
pushfd
pop edx
mov dword [esp + 4], edx
mov edx, dword [esp]
call fcn.104ed142
mov word [eax + esi - 0x2b44002], dx
rol eax, 0xc5
movsx ecx, al
shl cx, 0xae
mov dword [esp + ecx*8], ebp
ret 4
Function at 0x104f66e1
Capabilities:
Encrypt data using chaskey

Disassembly:
inc eax
xor ch, ch
dec esp
mov dword [esp + ecx - 0x65e8], ebx
call fcn.10661ea1
mov eax, 0x71bbb70e
lea edx, [eax*4 - 0x34aef49]
mov eax, dword [eax + edi - 0x71bbb70e]
add edx, edx
lea ecx, [edx + edx + 0x1203551c]
lea edi, [ecx + edi - 0x209308d4]
jbe 0x105be457
dec eax
ror eax, 1
xor eax, 0x4e9c650f
lea ecx, [edx*4 + 0xbb4ca02]
shr dl, 6
and edx, 0xf08bb50e
xor ebx, eax
add ebp, eax
mov si, word [esi + ecx*2 - 0x13a61404]
or edx, edx
call fcn.10578d36
xor eax, ebx
sar ecx, cl
bswap eax
sar edx, 0xc8
sal dx, 0xec
jp 0x104fb0f8

Function at 0x1050123a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx*2 - 0x3c47b9fc], ecx
xor ebx, eax
add ebp, eax
sar cx, 0xac
ror dl, 0x22
pop edx
jb fcn.104d9290
inc ecx
mov eax, 0x7514b006
dec ebx
lea edx, [eax + eax*2 + 0x418c1db9]
movzx ecx, dl
dec eax
lea edi, [edi + ecx - 0xcf]
mov ebp, edx
and ebp, 0x4c8e53b4
inc cx
or ecx, eax
inc esp
mov edi, dword [edi + ecx*4 - 0x2c33c]
inc ebp
xor edi, ebx
inc ecx
ror edi, 1
inc ebp
movzx esi, ax
call fcn.1050a2f2

Function at 0x10507258
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
mov dword [esi], edx
sete bl
xor ebx, 0xc28652bd
mov ebx, dword [esp + ebx - 0x3d79adb5]
xadd word [esp + 4], ax
setle byte [esp + 4]
neg al
pop ecx
pop eax
pop eax
jnp fcn.104d9290

Function at 0x10507f13
Capabilities:
Execute syscall

Disassembly:
call fcn.104e2c2b
jmp 0x105cb471
call fcn.105bc095
add byte [eax], al
push ebx
je 0x105cb4d0
push 0x64616572
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x105cb4eb
js 0x105cb4fc
add byte [ebx], dh
fldenv [esi + 0x2b]
test byte [esp + ecx + 0x3fffff0], al
jmp 0xd227975a
xor ecx, eax
xor edx, ebx
lea edx, [edx + eax + 0x266fe204]
xor edx, 0x572fdd8c
not al
lea edx, [edx + eax - 0x6eb56b92]
lea ecx, [ecx + 0x4119871b]
mov dword [ebx], ebx
xchg dword [ecx], ebx
inc ecx
shr eax, cl
bswap edx
bt ax, ax
inc edx
not eax
ror cx, 0x22
ror ecx, 0x22
xor ebx, edx
sal cx, 0xe4
or eax, ecx
sal ecx, 0xa7
adc ebp, edx
jmp 0x104fdacf
Function at 0x10513cd5
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
push 0x97b8f183
mov dword [esi + 0xc], eax
mov eax, dword [esp]
xor byte [esp], 7
mov dword [esi + 8], ebx
shl ax, 7
mov dword [esi + 4], ecx
mov dword [esi], edx
movsx edx, al
adc dx, dx
mov ebx, dword [esp + 0x10]
sub dl, byte [esp + 3]
pop eax
pop eax
pop edx
pop edx
pop eax
jg fcn.104d9290
mov ecx, 0xa63d7a06
dec eax
sub edi, 4
inc esp
mov esi, ecx
inc esp
mov esi, dword [edi]
inc ebp
xor esi, ebx
inc ecx
mov eax, 0xd41c3501
inc esp
movzx edx, cl
inc ecx
sub esi, 0xe286af22
inc ebp
mov ecx, edx
sar ecx, 0xac
inc ecx
bswap esi
inc ecx
xor esi, 0x37bb85a8
inc ecx
rol esi, 2
inc ecx
movsx ebp, ax
inc ebp
mov edi, ecx
inc ecx
push ebx
inc esi
xor dword [esp + edx - 6], esi
dec eax
shl ecx, cl
inc ecx
inc ecx
pop ebx
inc ecx
movsx edx, ax
dec ebp
arpl si, si
inc ecx
mov esp, 0xe6b10fbd
or cx, bp
dec ecx
adc esi, esi
not ebp
inc ecx
movsx eax, cl
inc ecx
bswap edx
dec esp
mov edi, ebx
inc ebp
and al, cl
dec edx
lea ebx, [ebx + edx - 0x6000004]
inc ecx
push esp
inc esi
mov dword [ebx + edx*2 - 0xc000000], edi
inc ecx
pop esi
jno fcn.104f078d

Function at 0x10515961
Capabilities:
Encode data using xor

Disassembly:
inc dx
mov dword [esp + ecx*2 - 2], ecx
xor eax, 0xea09bb2a
xor ebx, eax
neg dword [esp + ecx - 1]

Function at 0x10518394
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea ecx, [edx + ecx - 0x7fa2a28c]
movzx eax, dx
je 0x1053eee1
mov dword [esp + edx], eax
bswap ecx
or dx, word [esp + edx*2 + 4]
neg ecx
xor ebx, ecx
bswap eax
sal edx, 0xe3
adc ebp, ecx
mov ecx, eax
ror word [esp + edx*2 - 0xfffef], 0x4f
or dword [esp + edx*2 - 0xffff0], ebp
ret 4

Function at 0x1051b1d2
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
pop ebp
inc ecx
pop edx
inc ecx
pop edx
jb fcn.104f078d
Function at 0x1051b1dd
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
ror edx, cl
add byte [esp + eax - 0x7f00], al
bswap edx
xadd byte [esp + eax*8 - 0x3f808], ch
adc cx, 0x8996
sub cl, byte [esp + eax - 0x7f01]
ror edx, 3
bt ax, cx
rol ax, 0xa1
sbb edx, 0xc6143b0b
xor ebx, edx
xor ax, 0x7087
sub dword [esp + eax - 0x8e85], ecx
xchg ecx, eax
add ebp, edx
mov dword [esp + ecx*2 - 0x11d0a], ebp
ret
jb 0x1055b0b0
not ecx
mov eax, dword [edx + edi - 0x73ed3a7e]
jb 0x105c3e41
ror dl, 0x47
lea edi, [edi + edx - 0x73ed3af8]
xor eax, ebx
or ecx, edx
and dx, 0xd081
jle 0x10552c52
sbb eax, 0xda9a99b1
shr ecx, 0x97
not cx
rol eax, 2
xchg ecx, edx
neg eax
sal edx, 0x1a
bts ecx, edx
sbb eax, 0xfc81f83c
shr cl, cl
btc cx, cx
shl cl, 0x45
rol eax, 1
xor cl, ch
xor ebx, eax
btc cx, cx
dec ecx
adc ebp, eax
movzx eax, cx
add cx, 0xc393
jno fcn.104d9290
lea edx, [edx + ecx*2 - 0x5e18213a]
not edx
adc eax, 0x9d2f9f1b
push ecx
and dword [esp + ecx*2], ecx
lea edx, [edx + ecx*4 - 0x397c78d]
push eax
sbb dword [esp + ecx + 4], eax
push eax
bswap edx
inc cx
xor eax, 0x99a23fa2
sal dword [esp + ecx - 1], cl
xor ebx, edx
add ebp, edx
rol byte [esp + ecx + 8], 0xa2
push ecx
mov eax, dword [ecx + esi - 1]
movzx edx, cl
mov edx, dword [eax + ecx*2 - 2]
movzx eax, byte [esp + ecx*2 + 0xa]
cbw
add eax, dword [esp + ecx*2 + 0xa]
mov dword [esi + ecx*8 - 8], edx
mov dword [esp + ecx*4 - 4], ebp
ret 0xc
pushfd
pop eax
mov dword [esp + ecx - 0x39f69d3f], eax
ror ecx, 0xff
lea eax, [ecx*8 - 0x307a79ed]
pop eax
mov word [esi + ecx - 0x73ed3a7a], dx
mov edx, ecx
bswap ecx
mov dword [ecx + esi - 0x7e3aed73], eax
jae 0x104f34c2
mov ecx, 0xcb87d217
lea eax, [ecx - 0x61cff744]
push eax
mov eax, dword [edi + eax - 0x69b7dad3]
and word [esp + 1], 0xe62e
call fcn.104f31f6
inc edx
adc edi, 0
xor cl, bl
jmp 0x105b6814
mov eax, dword [esp]
call fcn.105794d3
or edx, dword [esp]
adc dx, dx
adc cl, dl
sal edx, 0x5c
xor bl, cl
or dx, dx
neg dword [esp]
lea ecx, [esp + ecx + 4]
and dword [esp], 0xa0279907
setg byte [esp + 1]
ror dl, 0xe1
mov dword [ecx], eax
mov edx, dword [edi]
adc edi, 4
sar dword [esp], 0xd0
jns 0x105bc27d
xor edx, ebx
mov ecx, dword [esp]
lea edx, [ecx + edx - 0xcdb904d]
dec cx
neg cl
neg edx
movzx eax, cx
btr ecx, ecx
jae 0x104ecde9
cld
aam 0xf8
and ecx, dword [esi]
lcall 0xe881, 0x2e93c790
sal byte [edi - 0x1e], 1
mov dword [0x4ea2a25f], eax
cmc
in eax, dx
iretd
dec dword [esp]
dec cl
inc byte [esp + 3]
shr dl, 0xe4
not cl
rol cl, 1
add dl, dh
xor cl, 0x84
jmp 0x105ac549
cdq
pop ecx
pop edx
jmp ebp
ret 4
Function at 0x1052de8e
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
neg ax
rol edx, 2
dec cl
xor ebx, edx
add al, al
ror ax, 0xc9
push ecx
adc ebp, edx
or word [esp + 1], 0xecb5
movzx ax, byte [esi]
mov dl, byte [esi + 2]
call int.105ec3f6
inc ecx
push edx
dec ecx
lea edi, [eax + edi - 0xdf23]
inc cx
neg edx
inc dx
inc dword [esp + edx - 0x481e6e77]
mov edx, 0x260e2eb8
inc ecx
mov eax, dword [eax + edi - 0xdf1f]
inc ebp
movsx edi, al
dec edx
ror dword [esp + edx - 0x481e6e72], 0x15
inc ecx
xor eax, ebx
inc ecx
pop esi
movzx ecx, bp
inc dx
or ecx, dword [esp + edx - 0x481e6e75]
neg eax
rol eax, 3
inc esp
movzx ebp, dl
inc eax
inc edx
rol dword [esp + edx - 0x481e6e78], cl
inc edx
or byte [esp + edx - 0x481e6e75], 0x9f
not eax
dec esi
mov dword [esp + eax*2 - 0x1be3e], ebx
xor dword [esp + edx*2 - 0x4c1c5d70], eax
inc ecx
pop ebx
inc esp
xadd ecx, edi
inc ebp
xchg al, bh
jnp 0x10582879
inc esi
xor dword [esp + edx*4 - 0x32f4], eax
inc ecx
pop ebx
inc ebp
mov ebp, esi
dec eax
ror eax, 0x30
neg ax
dec ebp
arpl ax, ax
inc ebp
xchg dh, dl
dec ebx
lea ecx, [ebp + esi - 0x20e4cf68]
dec ecx
adc esi, eax
inc cx
dec ebp
dec edx
mov ecx, dword [ebx + edx*4 - 0x336c]
dec ecx
neg ebp
dec edx
lea edx, [ecx*4 + 0x29a227b6]
inc esi
mov ah, byte [ebx + edx*8 - 0x66d0]
inc ecx
or edx, ecx
dec esp
btc edx, esi
dec ecx
lea ebx, [edx + ebx - 0xcd1]
jae 0x1057aafb
mov edx, 0xe8bf0936
mov edx, dword [edi]
mov eax, 0x33963388
btc eax, eax
ror eax, 0xd8
adc edi, 3
lea eax, [eax*4 + 0x45114a08]
btc eax, eax
sub eax, eax
xor edx, ebx
inc edx
dec eax
ror edx, 2
lea ecx, [eax + eax*8 - 0x275da77]
jmp 0x1066615e
inc ebp
xor bl, dh
dec esi
lea esi, [esp + esi + 0x10]
inc edi
mov ecx, dword [ecx + esi - 0xdf1f]
dec ecx
lea ebx, [edx + ebx - 0x481e918c]
inc esi
mov dword [ebx + eax*4 - 0x37c7c], ecx
inc ecx
pop esi
jmp 0x1051c5ea
dec eax
not edx
inc esi
mov byte [ecx + edx - 0xcdb], ah
jmp esi
bts ecx, ecx
adc edx, eax
jmp 0x104fbb6b
Function at 0x10539df8
Capabilities:
Encrypt data using chaskey

Disassembly:
inc ebp
xor ecx, ebx
inc ecx
bswap ecx
push eax
inc esp
movsx esp, bp
inc dx
and dword [esp - 0x1e0bf], 0xd141eab9
leave
inc ecx
not ecx
inc ecx
pop eax
inc ebp
mov edx, eax
inc edi
lea ecx, [esp + ecx + 0x4634b4ef]
inc ecx
bswap ecx
inc ebp
mov edi, eax
inc esp
movsx esi, ch
inc ecx
push ebx
inc cx
add edx, 0x31464a91
mov word [eax + edx*8], fs
xchg edi, edi
inc dword [ecx - 0x80]
enter 0x6693, 0x45
add edx, edi
inc ecx
pop ebx
inc ecx
neg edx
dec ebp
arpl cx, cx
jns 0x10527a64
inc ecx
xchg edi, ebp
inc ecx
inc esi
dec ecx
add esi, ecx
inc cx
xor edi, 0x8b4cf48c
mov word [0xba9d6f08], ds
dec eax
lea ebx, [ebx + ebp - 0x456290f0]
inc ecx
movzx ecx, dx
inc ebp
sbb bh, al
dec edx
lea edi, [edi - 0x7831]
inc esi
movzx ebp, byte [edi - 0x3c180]
dec ecx
neg eax
jle 0x10534131
adc ebp, eax
lea esp, [esp + 0x1c]
jmp 0x105ed2d4
pop ecx
js fcn.104f078d
call fcn.105a207a
sub ecx, 0x4fb5b886
neg ecx
inc ebp
movzx edx, cx
dec ecx
neg edx
dec eax
cdq
inc edx
lea ecx, [ecx + edi - 0x6c8b7418]
dec edi
lea eax, [ebp + ecx + 0xb37a537]
inc ecx
mov esi, 0x2e9780a7
sbb edx, 0x109d7c2e
bswap ecx
inc ecx
push ebx
inc ecx
shr ecx, 9
inc ecx
adc ebp, edx
dec ecx
xor edx, 0x33a853b5
inc edx
xor dword [esp + ecx], ecx
sal dx, 0x4c
inc ecx
pop ebx
dec eax
arpl cx, cx
inc esp
xchg dl, ch
push eax
dec eax
cdq
dec eax
add esi, ecx
dec eax
rol ebp, 0x5c
inc cx
bt edi, eax
dec edx
mov dword [esp + ecx*4], esi
ret
inc sp
xchg ecx, edx
inc ebp
xor ch, bl
cbw
inc ecx
ror esp, cl
inc ecx
ror ch, 1
inc bp
xor edx, esp
dec eax
shr eax, 0xa8
inc ecx
dec edi
inc ecx
inc ch
dec ecx
btr edi, ecx
inc ecx
ror ch, 1
inc cx
rol esp, 0xc4
inc eax
inc ch
inc ecx
xor ch, 2
add ax, 0x7e8a
inc cx
dec edi
inc ecx
sar edx, 0xe1
inc ebp
xor bl, ch
inc ecx
bswap esp
inc bp
bt edx, edi
shl cl, 0xc7
dec esp
add ebp, esp
btr bp, bp
dec ebp
mov dword [ebp + eax*2 - 0xfd14], ecx
jmp esi
rol dword [esp + 0xb], 5
jae 0x1051aaee
push ebp
mov dword [esp], 0xc3c48a76
call fcn.10507f13
mov eax, 0x29bba3ac
lea ecx, [eax + eax*2 + 0x2abaaf9e]
sal ecx, cl
mov eax, dword [edi + eax*2 - 0x53774758]
push ecx
movzx edx, cx
ror ecx, 0x1b
lea edi, [edi + edx*2 - 0xd50c]
shr dword [esp + edx*2 - 0xd510], 0x19
xor eax, ebx
lea edx, [edx + ecx*2 - 0x45f3c36b]
sal byte [esp + 1], 0xc1
xor dword [esp], edx
bswap eax
pop ecx
lea ecx, [ecx + edx - 0x45cdf47b]
ror eax, 3
lea edx, [edx*2 + 0x53151da2]
neg eax
push ecx
shr edx, cl
rol eax, 2
rol dx, 0xad
xor ebx, eax
add ebp, eax
mov ax, word [esi + ecx*2 - 0x13013ba8]
mov cl, byte [esi + ecx*4 - 0x2602774e]
and edx, dword [esp + edx - 0xc144]
not dx
xchg byte [esp + edx - 0x7eba], dh
lea esi, [edx + esi - 0x9db9]
jno 0x1066a5cb
mov ebp, 0xdb947830
inc esp
movzx ecx, bp
dec ecx
lea edi, [ecx + edi - 0x7834]
inc ebp
mov ecx, dword [ecx + edi - 0x7830]
dec esp
lea eax, [ebp*4 - 0x5de314c6]
dec ebx
lea eax, [eax + eax*2 + 0x1426730a]
jmp 0x10516459
sal ax, cl
shl edx, 0x9c
rol byte [esp + 2], 0xc3
xadd word [esp + 2], dx
mov word [esi], ax
xchg dword [esp], edx
mov dword [esp + edx*2 - 0x1208fda8], ebp
ret
Function at 0x1053b9b0
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
mov dword [esp + eax - 0xa184], 0x3a1d333d
inc esp
add ah, dl
inc eax
shl ch, 0x46
dec eax
dec ecx
inc ebp
movsx eax, di
inc esp
xor ah, cl
rol word [esp + eax*2 - 0x1431f], 0x46
bswap eax
inc ecx
neg ah
inc ecx
xchg eax, edx
inc ecx
xor ah, 0x28
xor cl, byte [esp + edx*4 - 0xc9ad]
dec ebp
btc edx, edi
inc ebp
xor bl, ah
inc ebp
sub dl, al
inc edx
xchg dword [esp + ecx + 0x6dd2ffef], edx
dec ecx
lea ebx, [ecx + ebx + 0x6dd2ffe1]
adc edx, eax
inc si
mov dword [ebx + eax - 0x281cffff], esp
pop ebp
inc ecx
pop esp
inc ecx
pop esp
jle fcn.104f078d
movzx edx, byte [edi]
mov eax, 0xd0a6c0ab
lea ecx, [eax + eax*2 - 0x3b40cc45]
lea edi, [ecx + edi - 0x36b375bb]
sal ecx, 0xdb
bts eax, ecx
xor dl, bl
inc al
neg ecx
sbb dl, cl
and ecx, 0x379c7287
lea ecx, [eax + eax*8 + 0xd147d18]
btr ecx, 0x14
rol dl, 1
or ecx, eax
setg cl
dec dl
sar eax, 0x29
not dl
rol cx, 0x81
push ecx
xor bl, dl
dec eax
sub esi, 2
or cx, cx
mov word [esi], dx
and ecx, dword [esp]
mov ecx, dword [edi]
or eax, eax
lea edx, [eax + eax + 0x29b46134]
rol al, 1
lea edi, [edi + edx - 0x298507ee]
xchg edx, eax
xadd dword [esp + eax*2 - 0x530a0fe4], edx
bswap edx
xor ecx, ebx
inc ecx
mov byte [esp + eax - 0x298507f2], 0x90
xor ecx, 0x1e296487
inc ecx
sub dword [esp + eax - 0x298507f2], edx
sub dx, 0xa32b
shl dl, 1
ror ecx, 2
xadd byte [esp + edx*8 - 0xc322470], ah
lea eax, [edx + eax*4 - 0x41d1087e]
lea ecx, [eax + ecx - 0x55b951ca]
cmovge eax, edx
xor ebx, ecx
add al, dh
sbb al, ah
add ebp, ecx
pop eax
jmp fcn.104d9290

Function at 0x1056fae2
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea edi, [edi + ebp - 0x14]
inc ecx
mov eax, 0xd4a1b81f
inc esp
xor dh, byte [ebp + edi - 0x13]
je 0x1056fb2e
in eax, dx
inc ebp
xor dh, bl
dec eax
mov dword [esp + ebp - 0x13], 0xfc2ccc1d
cld
inc ecx
rol dh, 1
call fcn.105a60ce
push ebx
mov esi, 0xa236fbbe
push edi
mov al, byte [0xb547b1c1]
sbb dword [eax], esi
jle 0x1056faef
push ebp
xchg dword [esi + 0x21412390], edi
nop
pop esi
jmp 0x1056fafd
and dword [0x738bf075], ebp
ror edx, 0x7f
aas
mov bh, 0xc2
dec eax
mov dword [ebx], edi
jmp [eax]