joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b38
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x403b61
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x403c28
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x403c4c
cmp edi, 5
je 0x403c51
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x403beb
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call dword [ebp - 0x2c]
mov edi, eax
cmp eax, 7
je 0x403c51
cmp eax, 8
jne 0x403c4c
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403c3c
test edx, edx
je 0x403b58
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
jne 0x403b5b
call sym._GetLastError_0
jmp 0x403b5b
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x403b76
call dbg.fc_key_init_once
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
jmp 0x403bfb
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x403cc8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403d38
test edx, edx
jne 0x403d14
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x403d47
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x403ce7
call dbg.fc_key_init_once
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
jmp 0x403ce0
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
lea esi, [esi]
Function at 0x403e2c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403f11
test edx, edx
jne 0x403eb0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x403ea3
lea esi, [ebp - 0x20]
jmp 0x403e63
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x403e9a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x403ed8
cmp eax, 8
jne 0x403f04
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x403e60
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x403e4f
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x403ea8
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call dbg.fc_key_init_once
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
jmp 0x403e48

Function at 0x403f24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x403f48
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403f9c
test edx, edx
jne 0x403f78
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x403fac
call sym._abort
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x403f5b
call dbg.fc_key_init_once
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
jmp 0x403f54
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
Function at 0x404048
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4040cc
test edx, edx
jne 0x4040a8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x40408c
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x40409d
call sym._abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x404085
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x404067
call dbg.fc_key_init_once
mov eax, dword [0x40bab0]
mov edx, dword [eax + 0x28]
jmp 0x404060
Function at 0x4fd5a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
inc dx
lea esp, [esp]
lea esp, [esp]
mov byte [esp], bh
lea esp, [esp + 1]
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x4fd4d9
mov dword [esp + 0x80], esi
push esp
pop word [esp]
mov byte [esp], bh
lea esp, [esp + 1]
mov byte [esp], ch
jmp 0x4fd4f6
mov dword [esp + 0x64], ebp
pushal
mov word [esp + 0x1c], sp
mov dword [esp + 0x11], ecx
pop dword [esp + 0xe]
push dword [esp + 0xc]
jmp 0x4fd54c
pop word [esp + 2]
lea esp, [esp + 1]
jmp 0x4fd577

Function at 0x4fedec
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4fed1a
mov dl, byte [esp]
jmp 0x4fed5a
mov dl, byte [esp]
inc eax
jmp 0x4fed39
cmc
pop dx
ror edx, 0x13
jmp 0x4fed15
and ecx, 0x3c
mov dh, byte [esp]
bt eax, esp
jo 0x4fedaf
jno 0x4fed88
wait
adc byte [esi + 0xda010e1], al
pushfd
out dx, eax
mul cl
cmc
pop dx
ror edx, 0x13
mov dl, byte [esp]
neg cl
mov eax, dword [esp]
sub edx, ebp
jne 0x4fecff
mov dl, byte [esp]
inc eax
jmp 0x4fed39
sub esp, 0xc
jo 0x4fed8e
lea edx, [eax - 0x722c9b07]
bswap edx
jmp 0x4fedd1
inc dl
neg edx
jmp 0x4fedb3
lea edx, [eax - 0x722c9b07]
bswap edx
inc dl
neg edx
mov eax, dword [esi]
setle dh
jmp 0x4fed69
pop word [esp]
mov dh, bh
inc dl
jae 0x4fed51
jb 0x4fed31
Function at 0x5076ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx*4]
mov ecx, 0xfc0edf70
cmc
jbe 0x507722
clc
lea ecx, [edi*4]
bsr cx, cx
xchg byte [esp], cl
jmp 0x50779f
not ch
xchg word [esp + 1], cx
mov cx, 0x6687
lea esp, [esp + 3]
jmp 0x5076ae
jmp 0x5076d5
lea esp, [esp + 1]
sub ebx, edx
inc ch
js 0x50775a
jns 0x50773f
xor byte [esi + 0x73b65b3c], ch
and al, bl
push ebx
lds esi, ss:[esi + 6]
mov cl, 0x8d
or al, 0xbd
add byte [eax], al
add byte [eax], al
lea ecx, [edi*4]
bsr cx, cx
xchg byte [esp], cl
jmp 0x5076ef
clc
jmp 0x507709
lea esp, [esp + 2]
jmp 0x50776a
lea ecx, [eax + 0x81]
sub esp, 6
mov dword [esp], ecx
jmp 0x507725
lea ecx, [eax + 0x81]
sub esp, 6
mov dword [esp], ecx
lea esp, [esp + 2]
sub ebp, 4
mov ecx, edx
bts edx, esp
jmp 0x5077a8
mov ch, byte [esp]
bts edx, esp
lea edx, [edx*4]
mov edx, dword [esp]
mov ch, 0x76
lea edx, [esi*4]
jmp 0x5077e9
lea esp, [esp + 1]
jmp 0x5076f3
jne 0x507778
mov ch, byte [esp]
bts edx, esp
jmp 0x5077db
lea edx, [edx*4]
mov edx, dword [esp]
mov ch, 0x76
jmp 0x50778a
bswap edx
xchg ch, cl
jmp 0x507877
btr ecx, edx
call fcn.0050780a
xchg byte [esp + 0xd], cl
jmp 0x5078c5
xchg ch, dl
sub cx, 0x1b2
jl 0x50789e
xchg ecx, edx
jmp 0x507883
not eax
sub esp, 0xc
jg 0x507836
btr ecx, edx
jmp 0x507839
bswap ecx
mov edx, 0x45565260
mov ecx, 0x50eeed28
jmp 0x5078db
xchg ecx, edx
bswap ecx
mov edx, 0x45565260
mov ecx, 0x50eeed28
sub esp, 6
lea esp, [esp + 2]
jmp 0x507938
lea esp, [esp + 0x10]
sub eax, 0x8661c9aa
lea edx, [edx + ebx]
xchg ch, dl
mov edx, dword [esp]
jmp 0x507847
sub esp, 6
jmp 0x5078af
setne cl
mov ch, byte [esp]
inc ch
jmp 0x507987
setne cl
mov ch, byte [esp]
inc ch
stc
lea edx, [ebp - 0x2c2c30c9]
setp ch
mov dx, si
jmp 0x507960
lea esp, [esp + 4]
neg eax
shl dx, cl
jae 0x50791d
jb 0x507906
fst dword [ebx - 0x3d]
cmpsb byte [esi], byte es:[edi]
push ebp
loope 0x50798d
aam 0x4a
sub eax, 0x80c163dc
inc ebx
cli
aad 0x44
stc
lea edx, [ebp - 0x2c2c30c9]
jmp 0x50792c
shr ebx, cl
pushfd
shr edx, 3
pop cx
mov byte [esp], ah
lea esp, [esp + 2]
jmp 0x5079d7
neg eax
lea ecx, [esi + 0xbf7114d]
lea ecx, [edi*4]
jmp 0x507aa4
and edx, eax
jae 0x507a7c
lea ecx, [eax - 0x29]
jmp 0x507a7f

Function at 0x50780a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x507820
xchg ch, cl
and ecx, esi
jnp 0x507860
xchg cx, dx
jmp 0x50783e
xchg cx, dx
xchg byte [esp + 0xd], cl
jmp 0x5078c5

Function at 0x5079a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x3835
xchg dh, ch
rcl edx, 7
jmp 0x5079f2
mov byte [esp], ah
lea esp, [esp + 2]
call fcn.005079fb
inc edi
jno 0x507990
shr edx, 3
pop cx
jmp 0x5079ca

Function at 0x512e8f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea edx, [edx*4]
xchg edx, ecx
not ebp
xchg esi, eax
jmp 0x512e78
mov dword [esp + 0x18], edi
popal
jmp 0x512e93
push edx
push ecx
jmp 0x512e64
lea ecx, [ecx + 4]
mov dword [ecx], esi
pop ecx
jmp 0x512ebc
lea esp, [esp + 8]
jmp 0x4ef7f8
Function at 0x51d1ae
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp]
cmc
lea esp, [esp + 3]
jmp 0x51d1d2
movzx eax, byte [eax + 0xf]
push edx
shl edx, 8
push edx
jmp 0x51d159
xchg bh, bl
mov bx, 0x9d7d
mov bl, 0xca
mov bx, 0xe321
jmp 0x51d178
inc ebp
lea esp, [esp + 4]
movzx esi, byte [eax + 0xe]
jmp 0x51d193
xchg word [esp + 7], di
lea esp, [esp + 2]
jmp 0x51d2b1
xor edx, esi
shl edx, 8
sub esp, 0x12
setge bl
jmp 0x51d1b9
sub esp, 0x1a
xchg bl, bh
bswap edi
lea esp, [esp + 2]
and eax, esi
jmp 0x51d216
cmc
inc bl
neg bl
jmp 0x51d27d
bswap ebp
mov ebx, eax
lea esp, [esp + 0x14]
mov esi, 0xff
lea ebp, [ebp - 0x4e6d5fb1]
jmp 0x51d203
mov dword [ecx + 0xc], edx
mov ebx, edx
mov eax, edx
shr eax, 0x10
jmp 0x51d22f
lea esp, [esp + 0x18]
xor eax, 0x1000000
xchg bh, bl
mov edi, edx
jmp 0x51d296
and edi, esi
sub esp, 0xc
bswap ebp
add esp, 0xb
mov ebp, esp
jmp 0x51d30f
mov eax, dword [eax*4 + 0x4fa5a0]
mov di, word [esp]
lea edi, [eax + 0x81]
mov bl, byte [esp]
xchg di, bx
jmp 0x51d258
not bh
mov bl, 0xf0
shr edi, 8
inc ebp
jmp 0x51d267
xor edx, eax
inc al
bswap ebp
mov bp, word [esp]
jmp 0x51d24c
pop dword [esp]
lea esp, [esp + 2]
jmp 0x51d2f8
lea edx, [edx + 4]
mov ebx, dword [edx]
pop edx
mov ebp, 0x575852
sub esp, 0x16
jmp 0x51d2bd
mov bl, 0x22
xchg ebx, ebp
push edx
mov edx, ecx
jmp 0x51d2d5
lea esp, [esp + 0x10]
and eax, 0xff000000
bts ebp, ebx
call fcn.0051d341
in eax, 0x14
xchg dword [esi], ebp
cmp dword [eax], ebx
lea esp, [esp + 1]
mov edi, dword [edi*4 + 0x4fa5a0]
bswap ebp
and edi, 0xff0000
jmp 0x51d2ef

Function at 0x51d341
Capabilities:
Encrypt data using aes

Disassembly:
push edx
neg edi
mov edi, edx
lea ebp, [esp + edi]
push edx
jmp 0x51ebb5
xor eax, edi
jmp 0x51d324
Function at 0x51d53f
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
add esp, 0
lea esp, [esp + 1]

Function at 0x51d7fa
Capabilities:
Encrypt data using aes

Disassembly:
jne 0x4eff34
mov bl, 0x28
mov al, ah
mov word [esp], sp
pop word [esp]
lea esp, [esp + 2]
jmp 0x51d7e4

Function at 0x51dc11
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
jmp 0x51db6f
mov byte [esp], bh
clc
jmp 0x51db44
push esp
lea esp, [esp + 0x34]
sub ebx, 4
push esp
lea esp, [esp + 3]
jmp 0x51dbc5
lea esp, [esp + 0x1c]
sub edx, 0x10
pushal
pop dword [esp + 0xe]
sub esp, 0x10
jmp 0x51dc00
add esp, 0
lea esp, [esp + 1]
add ecx, 0x10
sub esp, 0xc
sub esp, 0x10
jmp 0x51db9e
mov word [esp + 0xa], sp
lea esp, [esp + 0x2c]
cmp dword [ebp - 4], ebx
call fcn.0051dbaf
jmp 0x51dca8
push word [esp + 1]
push word [esp + 1]
mov byte [esp + 6], bh
lea esp, [esp + 8]
cmp eax, 1
call fcn.0051dc16
and edi, ecx
mov edi, dword [edi*4 + 0x4fa9a0]
sub esp, 2
cmc
jmp 0x51ddc8
and ebx, ecx
call 0x51dd14
xchg edx, eax
lea esp, [esp + 3]
sub esp, 0xc
lea esp, [esp + 1]
jmp 0x51dd70
lea ebp, [ebp*4]
lea ebp, [ebp + 0x4fa5a0]
mov ebx, dword [ebp]
pop ebp
jmp 0x51dd0c
cmc
cmc
push ebp
mov ebp, ebx
jmp 0x51dd2d
movzx ebx, byte [esi + 5]
and edx, ecx
call fcn.0051dd9d
push eax
leave
pop ecx
cmp bl, cl
jns 0x51dd5a
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffaf
or esp, dword [edx + 0x24648ddd]
or al, 0x33
cmp al, 0x9d
mov al, byte [0xbb004fad]
cld
xchg ecx, eax
sub eax, 0x37d4ebf4
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 8
aas
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x4fada0]
mov ebx, 0xf42d91fc
jmp 0x51dd56
xor edi, dword [ebx*4 + 0x4fb1a0]
bsr bx, bp
add ebx, eax
movzx ebx, byte [esi + 2]
clc
jmp 0x51dd4f
mov byte [esp], ah
lea esp, [esp + 2]
and ebx, ecx
lea esp, [esp + 0x30]
jmp 0x51dd89

Function at 0x51dc88
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x51de3c
mov di, 0xd84d
not edi
jmp 0x51dd01
sub esp, 0x1c
add esp, 0xf
pushal
lea esp, [esp + 1]
mov edi, dword [edi*4 + 0x4fa5a0]
jmp 0x51dcc2
mov edi, edx
push edx
mov dword [esp], ebp
shr edi, 0x18
jmp 0x51dcde
mov ebx, dword [ebx*4 + 0x4fa5a0]
lea esp, [esp + 8]
add esi, 0x10
mov edx, dword [esi]
jmp 0x51dc8d
Function at 0x51dd14
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
jmp 0x51db6f
mov byte [esp], bh
clc
jmp 0x51db44
push esp
lea esp, [esp + 0x34]
sub ebx, 4
push esp
lea esp, [esp + 3]
jmp 0x51dbc5
lea esp, [esp + 0x1c]
sub edx, 0x10
pushal
pop dword [esp + 0xe]
sub esp, 0x10
jmp 0x51dc00
add esp, 0
lea esp, [esp + 1]
add ecx, 0x10
sub esp, 0xc
sub esp, 0x10
jmp 0x51db9e
mov word [esp + 0xa], sp
lea esp, [esp + 0x2c]
cmp dword [ebp - 4], ebx
call fcn.0051dbaf
jmp 0x51dca8
push word [esp + 1]
push word [esp + 1]
mov byte [esp + 6], bh
lea esp, [esp + 8]
cmp eax, 1
call fcn.0051dc16
and edi, ecx
mov edi, dword [edi*4 + 0x4fa9a0]
sub esp, 2
cmc
jmp 0x51ddc8
and ebx, ecx
call 0x51dd14
xchg edx, eax
lea esp, [esp + 3]
sub esp, 0xc
lea esp, [esp + 1]
jmp 0x51dd70
lea ebp, [ebp*4]
lea ebp, [ebp + 0x4fa5a0]
mov ebx, dword [ebp]
pop ebp
jmp 0x51dd0c
cmc
cmc
push ebp
mov ebp, ebx
jmp 0x51dd2d
movzx ebx, byte [esi + 5]
and edx, ecx
call fcn.0051dd9d
push eax
leave
pop ecx
cmp bl, cl
jns 0x51dd5a
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffaf
or esp, dword [edx + 0x24648ddd]
or al, 0x33
cmp al, 0x9d
mov al, byte [0xbb004fad]
cld
xchg ecx, eax
sub eax, 0x37d4ebf4
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 8
aas
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x4fada0]
mov ebx, 0xf42d91fc
jmp 0x51dd56
xor edi, dword [ebx*4 + 0x4fb1a0]
bsr bx, bp
add ebx, eax
movzx ebx, byte [esi + 2]
clc
jmp 0x51dd4f
mov byte [esp], ah
lea esp, [esp + 2]
and ebx, ecx
lea esp, [esp + 0x30]
jmp 0x51dd89

Function at 0x51ddab
Capabilities:
Encrypt data using aes

Disassembly:
push esi
jmp 0x51dda4
pushal
call 0x51ddab
stosb byte es:[edi], al
add esp, 3
lea esp, [esp + 1]
mov dword [esp + 4], edx
push esp
jmp 0x51de0a
push esp
and edx, ecx
lea esp, [esp + 8]
xor edi, dword [edx*4 + 0x4fb5a0]
jmp 0x51de1a
lea esi, [esi*4]
lea esi, [esi + 0x4fa5a0]
mov edx, dword [esi]
pop esi
clc
jmp 0x51ddd7
stc
pop word [esp]
mov word [esp], di
lea esp, [esp + 2]
popal
jmp 0x51ddf3
mov dx, word [esp]
mov edx, dword [esi + 4]
clc
cmc
sub esp, 0x16
jmp 0x51df18
mov edi, edx
call fcn.0051de51
mov ebx, dword [ebx*4 + 0x4fa5a0]
push edx
cmc
bswap edi
add di, 0xc936
jmp 0x51de69
mov dword [esi], edi
mov edi, 0x558659b0
lea edi, [eax - 0x2b215be7]
lea edi, [esp + ecx]
jmp 0x51deb9
lea esp, [esp + 2]
jmp 0x51deef

Function at 0x51df61
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebp
mov dword [esp], ebp
lea esp, [esp + 2]
jmp 0x51dfe1
push word [esp + 1]
jmp 0x51df48
mov ecx, esi
jmp 0x51dfc4
lea edx, [edx + edi]
mov edx, dword [esi + 8]
push ecx
jmp 0x51df8b
mov ebx, dword [ebx*4 + 0x4fa5a0]
mov di, word [esp]
sub esp, 0x10
jmp 0x51e024
lea ecx, [ecx + 4]
mov dword [ecx], edi
pop ecx
bsr di, cx
jmp 0x51dfab
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x4fb5a0]
shr edx, 0x1b
neg dh
mov edx, 0x99576800
jmp 0x51dfa2
lea esp, [esp + 3]
mov edi, dword [edi*4 + 0x4fa5a0]
push edx
call 0x51e00a
jmp 0x51e02c
mov edi, edx
shr edi, 0x18
sub esp, 0x1a
add esp, 0xf
jmp 0x51dff8
Function at 0x51e152
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 3]
lea esp, [esp + 5]
sub esp, 8
lea esp, [esp + 1]
jmp 0x51e0f4

Function at 0x51e3aa
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
and edx, ecx
sub esp, 2
push edx
lea esp, [esp + 2]
jmp 0x51e2af
mov edx, dword [edx*4 + 0x4fa5a0]
call 0x51e2f8
cmpsd dword [esi], dword es:[edi]
xor eax, 0xfb3fcca5
movsb byte es:[edi], byte [esi]
xlatb
or dword ds:[eax + 0xe5eb60f], ebp
movzx ebx, byte [esi + 0xe]
sub esp, 8
mov ebx, dword [ebx*4 + 0x4fa5a0]
push edx
lea esp, [esp + 3]
jmp 0x51e29b
and ebx, ecx
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + 0x4fb1a0]
mov bx, 0xbff9
jmp 0x51e2c6
jmp 0x51e339

Function at 0x51e45f
Capabilities:
Encrypt data using aes

Disassembly:
stc
mov ebx, dword [ebx*4 + 0x4fa5a0]
jmp 0x51e289

Function at 0x601837
Capabilities:
Execute anti-debugging instructions

Disassembly:
add al, dh
jmp 0x60183f
mov esi, 0xa75c4cfe
popal
mov ebx, dword [esp + 1]
pop bp
pop ax
rdtsc
jmp 0x601889
xchg byte [esp + 5], cl
mov ecx, 0x857363a
xchg byte [esp + 6], cl
rcl ax, cl
btc esi, edi
bsf cx, ax
jmp 0x6019d0
mov cx, 0x7f63
ror bh, 3
xchg dx, si
xchg ch, dl
neg bh
lea ebx, [esp + eax]
jmp 0x601965
mov dword [esp], eax
push word [esp + 1]
mov dword [esp + 3], esi
push word [esp + 1]
jmp 0x6018ed
lea ebp, [ebp - 0x27]
xchg dword [esp], esi
cld
add di, 0x115e
mov dx, di
lea edi, [eax*4]
jmp 0x601907
bsr dx, cx
xor eax, esi
mov eax, dword [esp]
stc
bsf cx, si
jmp 0x6019ab
setbe ah
rdtsc
lea ebp, [edi*4]
xchg ebp, edi
pop ebp
mov ebp, dword [esp]
jmp 0x601936
inc di
pop eax
xchg ebp, eax
lea esp, [esp + 1]
lea esp, [esp]
xchg byte [esp + 2], dl
jmp 0x60194c
xchg bh, cl
cmc
call fcn.00601977
jmp [eax - 2]
mov ebp, dword [esp]
lea esp, [esp]
mov al, 0x76
pushal
push esp
xchg byte [esp + 0x1c], al
jmp 0x601991
cpuid
bswap ebx
neg cx
lea eax, [esi - 0x7df9c563]
not bp
pop bp
jmp 0x60191e
Function at 0x6019f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
xchg esi, ebx
shl di, cl
btc edx, ebx
xchg dx, si
rdtsc
jmp 0x601741
pop ebp
bsr bx, bp
mov word [esp], bx
mov byte [esp], bh
mov dh, byte [esp + 1]
btr ebp, edx
jmp 0x601700
mov ebp, 0x9e920bee
inc al
mov al, 0xfe
mov dx, di
mov edi, eax
jmp 0x601795
add esp, 1
cmc
cpuid
mov edi, 0x9c49b110
neg cx
jmp 0x60172b
setae ah
inc dx
mov dword [esp], ecx
xchg ch, dl
push word [esp + 1]
bsr dx, cx
jmp 0x601716
inc dl
mov bp, sp
cpuid
pop dword [esp]
sub esp, 0
mov ax, word [esp]
jmp 0x6018b0
sub esp, 0xa
push word [esp + 1]
mov ax, word [esp + 1]
mov word [esp + 6], di
xchg dh, al
mov esi, ecx
jmp 0x60176e
pushal
btr eax, edx
push esp
lea esi, [ebx*4]
mov eax, 0x4a79ca9a
mov dl, dh
jmp 0x601759
rdtsc
lea esp, [esp + 3]
mov si, sp
lea eax, [esi + 0x35]
neg ah
pushal
jmp 0x6017e9
pop dx
mov ecx, 0x19011eea
push dword [esp + 4]
mov ax, di
mov dl, dh
jmp 0x601857
lea ecx, [esi*4]
add esp, 0
xchg byte [esp + 6], dl
rdtsc
mov edi, ecx
lea ecx, [esp + ecx]
jmp 0x6017d4
btc edx, ebx
btr edi, edx
mov edx, 0xe8af64a2
mov word [esp + 3], sp
mov ebx, 0x264b56b0
lea esp, [esp + 0xa]
jmp 0x6017ff
xchg word [esp + 0x21], si
xchg ah, bl
xchg di, bx
inc si
lea ebx, [eax + 0x20508ff9]
call fcn.00601837
push ecx
ror byte [ecx + 0xf072474], 1
mov byte [0x148da20f], al
add al, 0x66
mov edi, dword [esp + 5]
mov dword [esp + 7], esi
cpuid
cpuid
lea edx, [esp + eax]
mov di, word [esp + 5]
lea ebp, [ecx*4]
jmp 0x60181c
cpuid
inc ebp
neg ah
sub esp, 0xa
btr eax, esp
lea ebx, [eax*4]
jmp 0x601870
pop dword [esp + 0x1a]
push word [esp + 0x11]
pop word [esp + 0x11]
push dword [esp + 0x24]
sub esp, 2
lea esp, [esp + 0x2c]
jmp 0x6017bf
pushal
sub esp, 4
push word [esp + 0x11]
jmp 0x6018cf

Function at 0x601abc
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf cx, si
mov ebp, 0xc849aac6
jmp 0x601acc
bsr di, cx
mov dword [esp], ecx
xchg esi, edx
add esp, 6
mov eax, ebp
jmp 0x601b23
lea eax, [ecx + 0x6e78b86b]
sub esp, 0xa
mov ebp, 0x660adf6e
xchg dword [esp + 6], edx
bswap ecx
jmp 0x601b53