joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x434068]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x434], ecx
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax]
push ecx
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0xffffffff
jne 0x408dbd
xor al, al
jmp 0x408e2c
mov dword [ebp - 0x42c], 0x428
lea edx, [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x408df0
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x408e2c
lea edx, [ebp - 0x42c]
push edx
mov ecx, dword [ebp - 0x434]
add ecx, 4
call fcn.00408e60
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x408df0
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c585
mov esp, ebp
pop ebp
ret

Function at 0x4096e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x434068]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x18]
push eax
push 0x20
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x409710
xor al, al
jmp 0x409794
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x409733
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x409794
mov dword [ebp - 0x14], 1
mov edx, 0xc
imul eax, edx, 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp + eax - 0x10], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp + eax - 0xc], edx
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 8], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x409788
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x409794
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c585
mov esp, ebp
pop ebp
ret 4
Function at 0x4097b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x434068]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x4097e6
xor al, al
jmp 0x409838
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40980c
xor al, al
jmp 0x409838
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp - 0x238]
call fcn.00409870
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40980c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c585
mov esp, ebp
pop ebp
ret

Function at 0x40abc8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x434068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x40abed
xor eax, eax
jmp 0x40ac49
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x40ac1a
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x40ac1a
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x40acce
cmp dword [edi + 0x4c], 0
je 0x40ac43
mov ecx, edi
call fcn.0040a7bf
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40ac59
push dword [edi + 0x4c]
push ebx
call fcn.0040a03e
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x40ac48
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040c585
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x424168]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x40ac43
cmp eax, 1
jle 0x40aca1
cmp eax, 3
jne 0x40ac43
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40ac35
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40acbe
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.00412290
add esp, 0x10
cmp esi, eax
jne 0x40ac43
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x40ac43
mov ax, bx
jmp 0x40ac48

Function at 0x41651b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161de

Function at 0x416526
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041635f

Function at 0x41d268
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041cf28
Function at 0x401310
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x22c]
push esi
push 0x228
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.0040f3c0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40136d
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4013a8
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00408bf5
add esp, 8
test eax, eax
je 0x4013c4
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x401386
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4

Function at 0x401440
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x1ac], ax
lea eax, [ebp - 0x1aa]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x1ac]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4014ac
or eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x1b0]
push 4
push eax
push 0x1005
push 0xffff
push edi
mov dword [ebp - 0x1b0], 0xbb8
call esi
push 4
lea eax, [ebp - 0x1b0]
push eax
push 0x1006
push 0xffff
push edi
call esi
push 4
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], 4
push eax
push 0x1001
push 0xffff
push edi
call esi
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x18], xmm0
push 0x501
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0
push 4
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x14], 0x8223c48b
push eax
push edi
mov dword [ebp - 0x1b4], 0xd0d0d
call dword [sym.imp.WS2_32.dll_sendto]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
Function at 0x1020d027
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
jb 0x1020d08c
jae 0x1020d06f
add eax, 0x726bafcb
jmp 0x1020d649
add eax, 0x98723c49
jmp 0x1020d676
mov dword [esp + 8], ecx
pushfd
mov dword [esp + 8], edx
jmp 0x1020d0b2
push esi
mov word [esp + 1], bp
jmp 0x1020d09b
jmp 0x1020d66b
mov eax, dword [eax - reloc.SHLWAPI.dll_PathFindFileNameA]
jmp 0x1020d046
mov esp, ebp
not edx
jmp 0x1020d680
mov edx, 0xaf0d0c50
bsr dx, bp
jne 0x1020d6c4
je 0x1020d6c4
xor eax, 0xbe4324b6
push esi
daa
dec esi
fincstp
fidiv dword [eax + reloc.SHLWAPI.dll_PathFindFileNameA]
btc edx, ebx
jmp 0x1020d6dc
mov edx, esi
mov al, bl
not ax
bswap eax
btc dx, si
mov edx, dword [esp]
jmp 0x1020d71a
push eax
ret
not ax
bswap eax
btc dx, si
jmp 0x1020d6b3
ja 0x1020d6a6
mov edx, esi
mov al, bl
jmp 0x1020d6c6
neg cl
clc
jb 0x1020d77e
sets dh
mov ax, word [esp]
mov al, bh
jmp 0x1020d741
lea edx, [ebx*4]
jmp 0x1020d704
neg ax
rdtsc
jmp 0x1020d762
mov ax, word [esp]
mov al, bh
neg ax
rdtsc
rol cl, 0
jo 0x1020d799
setb al
mov ax, word [esp]
neg edx
mov ax, sp
mov edx, dword [esp]
jmp 0x1020d7a1
sets dh
jmp 0x1020d757
setb al
mov ax, word [esp]
neg edx
call fcn.1020d7d4
cmpsb byte [esi], byte es:[edi]
and byte [esi - 0x223adf2f], dh
sub al, 0xeb
call 0x9be56305
adc al, 0x24
jmp 0x1020d783
bswap edx
xchg dx, ax
jmp 0x1020d7e5
add cl, 0xff
pushfd
pop edx
mov edx, 0x20d0d14e
stc
jmp 0x1020d85c
rcr dl, cl
bswap edx
jmp 0x1020d864
pop dx
jmp 0x1020d826
mov dx, word [esp]
cmc
lea esp, [esp + 2]
call fcn.1020dd9f
add al, 0xb7
sahf
jmp 0x2a45d552
jno 0x1020d818
rcr dl, cl
bswap edx
jmp 0x1020d81c
inc cl
push edx
adc dl, ch
jnp 0x1020d81e
pop dx
mov dx, word [esp]
cmc
lea esp, [esp + 2]
jmp 0x1020de8f
lea ecx, [ebp + 0x50]
jmp 0x1020dcf7
mov eax, dword [ecx + ebp]
mov dword [edi], eax
jmp 0x1020dcbf
cmp edi, ecx
jmp 0x1020dd4c
not dx
bswap edx
mov edx, ebp
jmp 0x1020e36c
mov edx, ebp
jmp 0x1020e36c
jns 0x1020dcff
not dx
bswap edx
jmp 0x1020dd0c
xor cl, 0x3c
and ecx, 0x3c
sub edi, 4
jmp 0x1020dcd5
ja 0x1020dd36
mov ecx, ebp
lea edx, [ebp + 0x40]
jmp 0x1020e37d
lea eax, [eax*4]
lea eax, [edx*4]
sub edx, ecx
jmp 0x1020e403
lea eax, [edi - 0x80]
jmp 0x1020e407
ja 0x1020e3e2
jbe 0x1020e3e2
and al, 0xfc
sub eax, edx
jmp 0x1020e44a
push esi
jmp 0x1020e453
mov esp, eax
pushfd
lea ebp, [eax + edx - 0x40]
jmp 0x1020e434
push edi
push ecx
pushal
jmp 0x1020e96b
pop ecx
pop edi
pop esi
jmp 0x1020e47b
popfd
jmp 0x1020d36a
mov ecx, edx
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x1020e472
add esp, 3
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
mov edi, eax
jmp 0x1020e496
mov dh, dl
mov dword [esp + 4], ecx
sub esp, 0xa
jmp 0x1020e4d5
bswap esi
lea ebp, reloc.SHLWAPI.dll_PathFindFileNameA
jmp 0x1020e50e
shr ebp, 0x1b
jnp 0x1020e6ef
bswap esi
lea ebp, reloc.SHLWAPI.dll_PathFindFileNameA
mov dh, dl
mov dword [esp + 4], ecx
sub esp, 0xa
jmp 0x1020e4d5

Function at 0x1020d439
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
mov dx, word [esp + 1]
bts edx, esp
jo 0x1020d47d
dec dl
lea edx, [ebx + 0x91]
lea esp, [esp + 2]
jmp 0x1020d47f
jmp 0x1020d467
Function at 0x1020d4a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror al, 0
mov dx, word [esp]
call fcn.1020d439
dec dl
lea edx, [ebx + 0x91]
lea esp, [esp + 2]
jmp 0x1020d47f
lea esp, [esp + 0x10]
dec al
neg dx
jmp 0x1020d4c8
mov dx, word [esp]
mov edx, 0x9a9f0cde
mov dh, byte [esp]
cmp dx, 0x3497
cmc
setnp dl
jmp 0x1020d4d5
bswap edx
bswap edx
jmp 0x1020d45b
mov dh, byte [esp]
cmp dx, 0x3497
cmc
jmp 0x1020d4a0
jb 0x1020d48e
mov dx, word [esp]
mov edx, 0x9a9f0cde
jmp 0x1020d4af
sub al, 0xd8
lea edx, [ebx + ebx]
mov edx, ebx
mov dl, 0x21
sub esp, 0xa
jmp 0x1020d56d
mov edx, eax
lea esp, [esp + 1]
add bl, al
dec esi
jmp 0x1020d50c
lea eax, [ebp*4]
neg dx
ja 0x1020d54f
mov al, ch
jmp 0x1020d539
lea esp, [esp + 8]
add al, 0x6a
lea edx, [eax + edi]
mov dh, byte [esp]
pushfd
lea esp, [esp + 3]
jmp 0x1020d4fd
neg eax
rdtsc
jmp 0x1020d555
mov al, ch
neg eax
rdtsc
neg cl
mov dh, ah
jmp 0x1020d59c
jo 0x1020d5d0
mov dx, 0x79b0
lea esp, [esp + 2]
jmp 0x1020d5d8
lea edx, reloc.SHLWAPI.dll_PathFindFileNameA
lea eax, [eax*4]
jmp 0x1020d5b4
sub esp, 0x18
jb 0x1020d579
lea edx, reloc.SHLWAPI.dll_PathFindFileNameA
lea eax, [eax*4]
jmp 0x1020d7b3
xchg dword [esp + 0xc], edx
bswap eax
lea esp, [esp + 0x18]
add cl, 0x91
jmp 0x1020d61e
mov dx, 0x79b0
lea esp, [esp + 2]
jmp 0x1020d526
mov edx, 0x3b711eb4
jmp 0x1020d5fb
bsr eax, ebx
mov edx, 0x3b711eb4
ror cl, 0
jmp 0x1020d642
cmc
mov dh, 0x75
mov dx, 0x1ae2
mov al, byte [esp]
jmp 0x1020d734
mov ax, word [esp]
neg dx
js 0x1020d5f3
bsr eax, ebx
jmp 0x1020d5dd
mov dx, 0x1ae2
mov al, byte [esp]
jmp 0x1020d734
jno 0x1020d604
cmc
mov dh, 0x75
jmp 0x1020d62c
inc cl
mov eax, ecx
shl eax, 2
jmp 0x1020d02f
neg edx
mov al, 0xdf
jmp 0x1020d65f
neg dl
jp 0x1020d696
neg edx
mov al, 0xdf
jmp 0x1020d65f
neg cl
mov dh, 0x41
lea eax, [ecx + ecx]
xchg edx, eax
mov al, 0x92
jmp 0x1020d6f7
xchg dword [esp + 0xc], edx
bswap eax
jmp 0x1020d5ba
Function at 0x1022152e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x211c8c
jmp 0x1022154b
pop word [esp]
lea esp, [esp + 3]
jmp 0x10221561
mov ah, ch
dec ebx
jmp 0x102215c4
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp 0x10220c54
clc
mov edi, dword [esp + 0x2c]
dec esi
jbe 0x10221700
neg si
not bp
jmp 0x1022162a
ja 0x1022156f
clc
call 0x102215a4
or ah, byte [esi - 9]
fisttp dword [edi]
mov ebp, 0x242c87f3
bswap ecx
setp dh
push esp
jmp 0x1022165f
neg si
not bp
lea ebp, [esp]
jmp 0x1022160e
sub esp, 8
add esp, 4
jmp 0x1022162f
sub esp, 0xbc
mov esi, esp
bsf ebx, edi
jle 0x10221645
sub esp, 8
add esp, 4
jmp fcn.10221635
jmp 0x10221624

Function at 0x10221549
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], ax
mov word [esp + 1], di
mov dword [esp + 0x1c], esi
call fcn.10221506
jmp 0x1022151c
Function at 0x1022181c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, edi
btr dx, bx
jmp 0x10221692
mov eax, 0x1649fb72
btc cx, si
xchg ecx, eax
dec cx
bsr eax, ecx
mov ah, dh
jmp 0x1022167c
xchg ecx, eax
dec cx
bsr eax, ecx
jmp 0x10221656
neg ax
jo 0x102216b5
mov ecx, 0x63513cce
mov cx, ax
jmp 0x1022169f
jle 0x10221647
mov eax, 0x1649fb72
btc cx, si
jmp 0x10221674
inc edi
adc eax, esp
je 0x102216d5
mov cx, 0x37ea
neg cl
jmp 0x102216db
mov ecx, 0x63513cce
mov cx, ax
jmp 0x1022169f
neg cl
lea eax, [esi*4]
add dx, di
rdtsc
xchg edx, ecx
jmp 0x102216e9
mov cx, 0x37ea
jmp 0x102216bf
lea eax, [esi*4]
add dx, di
rdtsc
jmp 0x102216cd
mov dx, 0xf2f0
jmp 0x102217a6
neg edi
rdtsc
clc
jmp 0x10221749
dec cx
mov ch, 0x84
sub esp, 0x17
mov dh, byte [esp + 0xd]
lea esp, [esp + 3]
jmp 0x1022178b
lea esp, [esp + 0x10]
jmp 0x10221705
sub esp, 0x17
mov dh, byte [esp + 0xd]
lea esp, [esp + 3]
jmp 0x1022178b
jg 0x10221710
dec cx
mov ch, 0x84
jmp 0x10221733
mov ax, 0xfda5
mov dx, 0x56f9
push dword [esp + 9]
jae 0x1022172d
jb 0x1022172d
xchg byte [esp + 3], al
xchg byte [esp + 1], ch
dec cl
lea esp, [esp + 1]
jmp 0x102217cd
lea esp, [esp + 0x14]
xor edi, 0x1bd93914
mov edx, 0xd9a9a057
sub esp, 9
jmp 0x10221876
add edi, 0x6e6b7396
mov cl, 0xa2
pushal
push sp
lea esp, [esp + 0x16]
jmp 0x10221765
add edi, dword [ebp]
stc
jl 0x10221810
jge 0x102217fa
lodsb al, byte cs:[esi]
and al, byte [ebp - 0x4c]
dec edx
cmp byte [ecx + 0x51bb4829], bh
sbb byte [ebx - 0x73], bh
and al, 8
lea esp, [esp + 8]
add edi, 0x7260d5b4
mov ax, 0xf5b
mov eax, dword [esp]
adc dl, 0x29
jmp 0x10221840
dec cl
lea esp, [esp + 1]
jmp 0x102217cd
lea eax, reloc.SHLWAPI.dll_PathFindFileNameA
call 0x1022184c
movsd dword es:[edi], dword [esi]
and dword [ecx - reloc.SHLWAPI.dll_PathFindFileNameA], esi
and ebx, dword [edx - 0x4b]
movsb byte es:[edi], byte [esi]
lea eax, reloc.SHLWAPI.dll_PathFindFileNameA
call 0x1022181c
xlatb
jmp 0x10221889
jbe 0x102217b7
ja 0x102217b7
mov cx, word [esp]
mov ch, cl
mov cx, bp
mov dh, dl
mov cx, si
jmp 0x10221860
xchg dword [esp], edx
rol eax, cl
bsf ecx, ebx
bsr ecx, edx
bswap eax
lea edx, [edx + 0x11]
jmp 0x102218c6
jp 0x10221775
xchg byte [esp + 3], al
xchg byte [esp + 1], ch
jmp 0x102217f2
xchg edx, ecx
jmp 0x1022181e
xchg edx, ecx
neg ax
neg eax
mov ax, 0x29ac
neg eax
push dword [esp + 0x1c]
ret 0x20
xchg cx, ax
lea eax, [eax*4]
sub esp, 0x1e
mov ecx, 0xec056f83
lea esp, [esp + 2]
xchg dword [esp + 0x1c], edx
jmp 0x1022189f
Function at 0x1024bb3e
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x1024bca9
lea esp, [esp + 0x40]
xor eax, 0x1000000
bswap ebp
jmp 0x1024bba0
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
jmp 0x1024bb7a
mov edi, edx
mov bp, cx
mov bp, di
mov bp, 0xe88b
jmp 0x1024bbe1
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
jmp 0x1024bb90
lea esp, [esp + 1]
push esi
mov esi, edi
jmp 0x1024bbed
lea esp, [esp + 0xc]
and edi, 0xff0000
setb bh
mov bh, 0x67
bswap ebx
jmp 0x1024bc7b
shr edi, 8
and edi, esi
bswap ebp
sub esp, 0xd
jmp 0x1024bbc1
lea esi, [esi*4]
lea esi, reloc.SHLWAPI.dll_PathFindFileNameA
mov edi, dword [esi]
pop esi
jmp 0x1024bbca
xor edx, esi
shl edx, 8
xor edx, eax
jmp 0x1024bbb7
mov ebx, dword [ecx + 4]
call fcn.1024bc31
xor eax, edi
mov ebp, dword [esp]
mov bp, bx
pushal
jmp 0x1024bc92
mov dword [esp], edx
popal
lea ebp, reloc.SHLWAPI.dll_PathFindFileNameA
mov bp, word [esp]
jmp 0x1024bd49
clc
mov dword [esp], edi
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0x1024bc12
mov edi, dword [ebp]
pop ebp
jmp 0x1024bd12
mov word [esp], ax
lea esp, [esp + 2]
popal
lea ebp, [ebp*4]
lea ebp, reloc.SHLWAPI.dll_PathFindFileNameA
jmp 0x1024bcb9
push ebp
pushal
neg ah
mov dword [esp + 8], edi
push bp
jmp 0x1024bccf
cmc
lea esp, [esp + 1]
jmp 0x1024bd1f
mov ebp, 0xff00
and edi, ebp
sub esp, 0x19
push ebx
jmp 0x1024bcfc
xor eax, edi
call 0x1024bd27
insd dword es:[edi], dx
mov di, word [esp + 1]
pop word [esp]
lea esp, [esp + 2]
jmp 0x1024bd6f
and edi, esi
sub esp, 0x1d
mov word [esp + 6], bp
lea esp, [esp + 1]
jmp 0x1024bcf0
lea esp, [esp + 0x38]
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
call fcn.1024bd59
retf 0xd84a

Function at 0x1024be44
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
jmp 0x1024be7b
shr ecx, 8
mov edi, edx
pushfd
jmp 0x1024be65

Function at 0x1024c0d0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x1024c0d2
jmp 0x1024c0ba
lea esp, [esp + 0x10]
cmp ebx, 0x1021e1e4
jmp 0x1024c157
jne 0x1024b819
mov al, 0x4b
call fcn.1024c128
Function at 0x1024c31b
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [edx - 4]
jmp 0x1024c1ff
jmp 0x1024c1b3
mov dword [esp + 0xc], edx
lea esp, [esp + 3]
jmp 0x1024c220
mov dword [esi], edi
pop esi
mov edi, dword [esp]
mov edi, dword [ecx - 4]
sub esp, 0x1b
jmp 0x1024c1cd
push esi
mov esi, edx
add esi, 0xfffffff8
jmp 0x1024c1e3
mov eax, dword [edx]
stc
sub esp, 0x1e
mov word [esp + 1], di
lea esp, [esp + 2]
jmp 0x1024c24c
mov dword [ecx - 4], eax
clc
bsr ax, dx
shl ah, 5
jmp 0x1024c20a
mov dword [edx - 4], edi
bt di, di
lea edi, [ecx + ecx]
push esp
jmp 0x1024c2ba
mov eax, dword [edx + 4]
pushfd
jmp 0x1024c2a2
mov edi, ecx
mov dword [edi], eax
pop edi
mov ax, 0xc921
neg al
bt ax, bx
jmp 0x1024c27b
mov dword [edx], edi
push ebx
jmp 0x1024c304
mov edi, dword [ecx]
push bp
lea esp, [esp + 2]
push edi
jmp 0x1024c291
mov dword [edi], eax
pop edi
jmp 0x1024c2e3
push edi
mov edi, ecx
lea edi, [edi + 4]
jmp 0x1024c2c5
mov dword [edx + 4], edi
lea esp, [esp + 0x40]
sub ebx, 4
pushfd
jmp 0x1024c339
mov ebx, ecx
lea ebx, [ebx + 4]
mov edi, dword [ebx]
pop ebx
jmp 0x1024c2db
lea esp, [esp + 2]
sub edx, 0x10
call 0x1024c31b
cmp dword [ebx + reloc.SHLWAPI.dll_PathFindFileNameA], eax
and al, 3
jmp 0x1024c34d
push word [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
add ecx, 0x10
sub esp, 2
jmp 0x1024c30e
cmp dword [ebp - 4], ebx
call fcn.1024c3c0
mov eax, dword [ebp - 8]
jmp 0x1021297a

Function at 0x1024c3c0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jl 0x10212912
mov ax, bp
jmp 0x1024c355

Function at 0x1024c813
Capabilities:
Encrypt data using aes

Disassembly:
pushfd
jmp 0x1024c833
and edx, ecx
jmp 0x1024c917
lea esp, [esp + 1]
jmp 0x1024c894
sub esp, 0xf
lea esp, [esp + 3]
mov edi, edx
sub esp, 0x1d
mov dword [esp + 2], esp
jmp 0x1024c86c
shr edi, 0x18
cmc
push dx
lea esp, [esp + 2]
jmp 0x1024c8e3
mov dword [esi + 8], edi
mov edi, 0x47d8e4fd
mov ebx, dword [ebx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
mov di, si
jmp 0x1024c882
lea esp, [esp + 1]
and edi, ecx
call 0x1024c8ca
xchg edi, eax
push esi
jmp 0x1024c8f4
push edx
pop word [esp]
mov edi, dword [edi*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
cmc
sub esp, 0x1e
add esp, 0x1d
push esi
jmp 0x1024c8be
mov esi, edi
lea esi, [esi*4]
lea esi, reloc.SHLWAPI.dll_PathFindFileNameA
mov edi, dword [esi]
pop esi
jmp 0x1024c8cd
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
cmc
mov edx, dword [esi + 0xc]
jmp 0x1024c8aa

Function at 0x1024c86a
Capabilities:
Encrypt data using aes

Disassembly:
push edi
jmp 0x1024c829
and ebx, ecx
stc
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
stc
jmp 0x1024c7da
add edi, 0xd
movzx ebx, byte [edi]
pop edi
call int.1024c80e
add ah, byte [ecx]
and edx, ecx
cmc
invalid
pushal
not bp
mov dword [esp], esi
popal
jmp 0x1024c801
jmp 0x1024c7f0
Function at 0x1024c9a2
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
jmp 0x1024c9e4
xor edi, dword [edx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
pushal
jmp 0x1024c9ce
lea esp, [esp + 0x20]
dec dword [ebp - 4]
jmp 0x1024cb95
xor edi, dword [ebx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
and edx, ecx
push edi
lea esp, [esp + 4]
jmp 0x1024c9a8
mov dword [esi + 0xc], edi
call fcn.1024cab1
mov eax, dword [eax]
jmp 0x1024cbb8
lea esp, [esp + 8]
jmp 0x10212abc

Function at 0x1024ca1f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 4]
pop edi
mov si, word [esp]
call fcn.102128f3
pop eax
jecxz 0x1024caa3
push ss
in eax, 0x50
cmpsb byte [esi], byte es:[edi]
ror dword [edi], 1
test dword [ebx], eax
pop edi
cld
dec dword [edi]
test byte [ebp - 0x170003a2], ch
test al, 0xce
std
call edx
stc
cmp al, 0xd4
mov dword [reloc.SHLWAPI.dll_PathFindFileNameA], eax
shl eax, cl
and ebx, dword [edx - 0x4b]
movsb byte es:[edi], byte [esi]
xlatb