joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515720
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x515740
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x51ab20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x51abf0
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x51ab8e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0051a780
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51ab60
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x51ac97
call 0x51aba0
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x51ac40
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0051a780
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51abfd
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x51ac97
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0051a780
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x51ac95
jmp 0x51ac97
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x51ad00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x51add9
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x51ad77
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0051a8c0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51ad49
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x51ae80
call 0x51ad89
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x51ae29
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0051a9f0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51ade6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x51ae80
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0051a9f0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x51ae7e
jmp 0x51ae80
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x51d890
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x51d96f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x51d905
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0051cf40
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51d8cf
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x51da26
call 0x51d917
pop edx
lea ecx, [edx + 0x129]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x51d9c7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0051d3f0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51d97c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x51da26
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0051d3f0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x51da24
jmp 0x51da26
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x51e2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x51e39f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x51e335
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0051da80
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51e2ff
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x51e456
call 0x51e347
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x51e3f7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0051dea0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x51e3ac
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x51e456
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0051dea0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x51e454
jmp 0x51e456
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf1e76f
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
mov dword [eax + 8], 0xc8348440
jmp 0xf1e7b6
pushal
lea esp, [esp + 0x20]
mov dword [eax + 0xc], 0x8832be4d
call fcn.00f1e7a0
std
push ds
imul ecx, dword [eax - reloc.MSVCRT.dll___dllonexit], 0xffffffb7
jmp 0xf3fdad
and dword [eax + 4], 0

Function at 0xf29a5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0f1c8f8
jmp 0xf299af
pushfd
jmp 0xf2984a
mov byte [esp], cl
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0xf299fa
mov esi, dword [esp + 0x2c]
dec bl
js 0xf299d4
shl eax, 0xe
jmp 0xf299be
lea edx, [ebx*4]
mov dh, 0x1e
mov ebp, esi
bswap eax
jmp 0xf29993
mov cl, dh
cpuid
jmp 0xf29a28
shl eax, 0xe
mov cl, dh
cpuid
jmp 0xf29a28
mov word [esp], di
mov byte [esp], cl
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0xf29970
mov ax, word [esp]
jmp 0xf29a09
sub esp, 0xc0
mov ebp, esp
mov al, 0xa0
xchg bl, cl
jmp 0xf29a35
lea edi, [esp]
shr bl, 1
jg 0xf299ff
mov ax, word [esp]
jmp 0xf29a09
inc edx
jge 0xf29bca
lea edx, [ecx*4]
jmp fcn.00f29bd1
push dword [esp + 3]
jbe 0xf299eb
mov word [esp], di
jmp 0xf29986
lea edx, [ecx*4]

Function at 0xf566fb
Capabilities:
Encrypt data using aes

Disassembly:
add ebx, 0xc
mov dword [ebx], edx
pop ebx
jmp 0xf5699c
push ebx
mov ebx, ecx
jmp 0xf566e5
mov edi, edx
pushfd
lea ebp, [ecx + edx]
bsr bp, di
mov dword [esp], esi
jmp 0xf5671e
xor eax, 0x1000000
pushfd
lea ebp, [ecx*4]
xchg bp, di
xchg dword [esp], ebx
jmp 0xf56739
and eax, esi
mov eax, dword [eax*4 + reloc.MSVCRT.dll___dllonexit]
lea esp, [esp + 0x40]
jmp 0xf567e2
mov eax, edx
shr eax, 0x10
mov esi, 0xff
jmp 0xf568e7

Function at 0xf5693e
Capabilities:
Encrypt data using aes

Disassembly:
stc
mov word [esp], cx
jmp 0xf56971
push eax
mov eax, ecx
add eax, 0x14
jmp 0xf5695b

Function at 0xf56c17
Capabilities:
Encrypt data using aes

Disassembly:
add esi, 8
mov ecx, dword [esi]
pop esi
xor ecx, edx
lea edx, reloc.MSVCRT.dll___dllonexit
jmp 0xf56bff
push edi
adc dh, ah
jmp 0xf56c23
mov word [esp + 1], bp
lea esp, [esp + 4]
popal
jmp 0xf56beb
mov dword [eax + 0x18], ecx
bswap edx
add edx, 0x27d821dd
push sp
lea esp, [esp + 2]
jmp 0xf56c90
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x2c]
cmp ebx, 0xf28e50
jne 0xf56388
je 0xf56c4e
mov edx, dword [eax + 0xc]
xor edx, ecx
push esi
jmp 0xf56c64
Function at 0xf56fd1
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 1
mov bh, ah
mov byte [esp], ch
lea edi, reloc.MSVCRT.dll___dllonexit
jmp 0xf56ea7
pop edi
push bx
lea esp, [esp + 2]
jmp 0xf57557
pushal
mov dl, cl
mov cx, di
mov ecx, 0xff
jmp 0xf56f13
lea esp, [esp + 1]
movzx ebx, byte [esi + 0x11]
pushal
setg dl
mov edx, dword [esp]
jmp 0xf56eec
rol edi, 0x17
shl dx, 0
xchg dx, bx
mov dx, cx
mov dword [ebp - 4], ecx
jmp 0xf56e9a
mov edx, dword [esi]
neg di
jmp 0xf56efc
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
lea esp, [esp + 0x20]
add esi, 0x10
jmp 0xf56ed6
mov edi, edx
clc
cmc
jmp 0xf56f32
lea esp, [esp + 0x20]
jmp 0xf1d586
shr edi, 0x18
sub esp, 3
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
call fcn.00f56f1c
movsd dword es:[edi], dword [esi]
and byte [esi - 0x2258df2f], dh
pop ebp
int 0x94
sub dword [si], 0x3f
push es
mov cl, 0x66
mov edi, dword [esp]
mov di, word [esp]
mov ebx, 0x448e3c09
mov di, ax
cmc
lea ecx, [eax - 1]
jmp 0xf56ec4
lea esp, [esp + 4]
jle 0xf1d59c
jg 0xf56f58
mov word [esp + 1], dx
jmp 0xf57000
pop esi
lea ebx, [ecx*4]
pushfd
jmp 0xf5757d
lea esp, [esp + 4]
pop ebx
leave
ret

Function at 0xf56fe1
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 1
mov bh, ah
mov byte [esp], ch
lea edi, reloc.MSVCRT.dll___dllonexit
jmp 0xf56ea7
pop edi
push bx
lea esp, [esp + 2]
jmp 0xf57557
pushal
mov dl, cl
mov cx, di
mov ecx, 0xff
jmp 0xf56f13
lea esp, [esp + 1]
movzx ebx, byte [esi + 0x11]
pushal
setg dl
mov edx, dword [esp]
jmp 0xf56eec
rol edi, 0x17
shl dx, 0
xchg dx, bx
mov dx, cx
mov dword [ebp - 4], ecx
jmp 0xf56e9a
mov edx, dword [esi]
neg di
jmp 0xf56efc
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
lea esp, [esp + 0x20]
add esi, 0x10
jmp 0xf56ed6
mov edi, edx
clc
cmc
jmp 0xf56f32
lea esp, [esp + 0x20]
jmp 0xf1d586
shr edi, 0x18
sub esp, 3
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
call fcn.00f56f1c
movsd dword es:[edi], dword [esi]
and byte [esi - 0x2258df2f], dh
pop ebp
int 0x94
sub dword [si], 0x3f
push es
mov cl, 0x66
mov edi, dword [esp]
mov di, word [esp]
mov ebx, 0x448e3c09
mov di, ax
cmc
lea ecx, [eax - 1]
jmp 0xf56ec4
lea esp, [esp + 4]
jle 0xf1d59c
jg 0xf56f58
mov word [esp + 1], dx
jmp 0xf57000
pop esi
lea ebx, [ecx*4]
pushfd
jmp 0xf5757d
lea esp, [esp + 4]
pop ebx
leave
ret
Function at 0xf570b6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
lea ecx, [ecx + edx]
mov dword [esp], edx
sub esp, 0x15
pushfd
jmp 0xf570d5
mov dword [esi], edi
not edi
mov di, word [esp]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
mov di, bx
jmp 0xf5707f
add esp, 3
lea esp, [esp + 1]
jmp 0xf57095
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
push eax
add esp, 2
push word [esp]
jmp 0xf570f9
lea esp, [esp + 1]
lea esp, [esp + 0x18]
popal
shr edi, 0x18
jmp 0xf570bf
mov ecx, edi
jmp 0xf570ff
and edi, ecx
cmc
push ecx
jmp 0xf570e3
lea ecx, [ecx*4]
lea ecx, reloc.MSVCRT.dll___dllonexit
mov edi, dword [ecx]
pop ecx
jmp 0xf57149
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
bswap ebx
jmp 0xf5716e
and ebx, ecx
sub esp, 0x16
lea esp, [esp + 2]
lea esp, [esp + 0x38]
jmp 0xf57133
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
cmc
call fcn.00f57158
lea esp, [esp + 2]
and ebx, ecx
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0xf574bf
movzx ebx, byte [esi + 9]
pushal
pop dword [esp + 0xe]
call fcn.00f571ee
mov edx, dword [ecx]
pop ecx
cmc
jmp 0xf5750b
and edx, ecx
jmp 0xf5751a
and ebx, ecx
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0xf574f5
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0xf5754f
lea ebp, [ebp + 0xc]
mov dword [ebp], edi
pop ebp
jmp 0xf57571
dec dword [ebp - 4]
push ebp
mov ebp, esi
jmp 0xf57539
jne 0xf1d586
je 0xf1d59c

Function at 0xf5731b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xf57381
lea esp, [esp + 3]
call 0xf5736b
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
push edi
jmp 0xf573d9
mov dword [esi + 8], edi
mov di, word [esp]
bsr edi, ecx
jmp 0xf573c1
push eax
pushal
inc cl
lea ebp, [esp + esi]
jmp 0xf57464
mov edi, esi
add edi, 0xc
mov edx, dword [edi]
pop edi
sub esp, 4
jmp 0xf57398
btr eax, ebx
mov dword [esp + 0x1c], ebx
call fcn.00f57438
jmp 0xf574a3
and ebx, ecx
jmp 0xf5778c
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
pushal
jmp 0xf5748d
add al, 0x24
push word [esp + 2]
jmp 0xf575cb
sub esp, 0x16
lea esp, [esp + 2]
and edx, ecx
call fcn.00f57533
mov dword [esp], edx
push word [esp + 2]
jmp 0xf575f6
lea esp, [esp + 2]
lea esp, [esp + 4]
test esi, esi
call 0xf575b5
jmp 0xf57620
test eax, eax
call 0xf5760a
mov ebp, 0x39caaf3f
not byte [ebp + 0x10e18610]
xchg edi, eax
or eax, 0x97641d8d
jae 0xf57592
lea esp, [esp + 2]
lea esp, [esp + 4]
je 0xf1d6da
push esi
call 0xf575da
lea esp, [esp + 4]
je 0xf1d7cb
jne 0xf576ab
out dx, eax
mul cl
and byte [ebx - 0x66], ah
lea esp, [esp + 4]
push 0xf297dc
call fcn.00f34981
jmp 0xf575dc
pushfd
add esp, 2
clc
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0xf575a7
push edi
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
movzx ebx, byte [esi + 0xe]
pushal
jmp 0xf57645
Function at 0xf57438
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edx
push esp
push word [esp]
lea esp, [esp + 2]
jmp 0xf57420
push esi
mov esi, edi
lea esi, [esi*4]
jmp 0xf57446
lea eax, reloc.MSVCRT.dll___dllonexit
mov ebx, dword [eax]
pop eax
mov di, si
push si
lea esp, [esp + 2]
jmp 0xf573e6
shr edi, 0x18
jmp 0xf573f3
lea esp, [esp + 4]
popal
lea eax, [eax*4]
jmp 0xf5740c
lea esi, reloc.MSVCRT.dll___dllonexit
mov edi, dword [esi]
pop esi
call fcn.00f57486
xchg byte [ebx], cl
wait
dec byte [0x22ac2ce0]
inc ebp
mov ah, 0x5a
cmp dword [eax], ebx
jnp 0xf574b6
xor eax, 0xa8092fc4
retf

Function at 0xf57470
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xf57381
lea esp, [esp + 3]
call 0xf5736b
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
push edi
jmp 0xf573d9
mov dword [esi + 8], edi
mov di, word [esp]
bsr edi, ecx
jmp 0xf573c1
push eax
pushal
inc cl
lea ebp, [esp + esi]
jmp 0xf57464
mov edi, esi
add edi, 0xc
mov edx, dword [edi]
pop edi
sub esp, 4
jmp 0xf57398
btr eax, ebx
mov dword [esp + 0x1c], ebx
call fcn.00f57438
jmp 0xf574a3
and ebx, ecx
jmp 0xf5778c
mov edi, dword [edi*4 + reloc.MSVCRT.dll___dllonexit]
pushal
jmp 0xf5748d
add al, 0x24
push word [esp + 2]
jmp 0xf575cb
sub esp, 0x16
lea esp, [esp + 2]
and edx, ecx
call fcn.00f57533
mov dword [esp], edx
push word [esp + 2]
jmp 0xf575f6
lea esp, [esp + 2]
lea esp, [esp + 4]
test esi, esi
call 0xf575b5
jmp 0xf57620
test eax, eax
call 0xf5760a
mov ebp, 0x39caaf3f
not byte [ebp + 0x10e18610]
xchg edi, eax
or eax, 0x97641d8d
jae 0xf57592
lea esp, [esp + 2]
lea esp, [esp + 4]
je 0xf1d6da
push esi
call 0xf575da
lea esp, [esp + 4]
je 0xf1d7cb
jne 0xf576ab
out dx, eax
mul cl
and byte [ebx - 0x66], ah
lea esp, [esp + 4]
push 0xf297dc
call fcn.00f34981
jmp 0xf575dc
pushfd
add esp, 2
clc
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
jmp 0xf575a7
push edi
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
movzx ebx, byte [esi + 0xe]
pushal
jmp 0xf57645

Function at 0xf57533
Capabilities:
Encrypt data using aes

Disassembly:
push ecx
mov ecx, edx
lea ecx, [ecx*4]
lea ecx, reloc.MSVCRT.dll___dllonexit
jmp 0xf574cd
mov byte [esp + 2], ch
jmp 0xf574e3

Function at 0xfaca70
Capabilities:
Check http status code

Disassembly:
call 0xfad8d4
cmp al, 0xc8
out dx, al
cmp al, 0xcf
sub eax, 0xf2cacaa8
mov ch, 0x64
cdq
dec edx
in eax, 0x14
jmp 0xfacaac
lea esp, [esp + 4]
call fcn.00f3f2e9
test eax, eax
jmp 0xfacaf1
mov eax, dword [0xf29798]
jmp 0xfacadb
mov word [esp + 1], ax
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xfaca72
mov ecx, dword [esp + 0x14]
sub esp, 0x1c
jmp 0xfacbbc
je 0xf22757
lea eax, reloc.MSVCRT.dll___dllonexit
cmp ax, sp
shr ecx, 0x16
inc dword [esp + 0x14]
jmp 0xfaca7f
jb 0xf22741
jae 0xf227d9
lea esp, [esp + 0x1c]
add dword [esp + 0x10], 0x14
cmp ecx, dword [eax + ebx + 8]
jmp 0xfacb22