joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fc00
Capabilities:
Access peb ldr_data
Get common file path
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1007f306
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x38]
push 0x200
push eax
mov dword [esp + 0x248], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0x250]
mov eax, dword [esp + 0x24c]
mov edx, dword [ecx]
mov ecx, dword [eax]
push edx
lea edx, [esp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s_s_s
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFile::CFile
mov ebp, dword [esp + 0x254]
push 0x1009cff4
mov ecx, ebp
mov byte [esp + 0x244], 1
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0xc]
push 0
push 0x8000
push ecx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x1000fd68
lea edx, [esp + 0x10]
push 4
push edx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFile::Read
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x1000fcf9
xor edi, edi
lea eax, [esp + 0x14]
push 4
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFile::Read
mov eax, dword [esp + 0x14]
mov ecx, ebp
sub eax, edi
push eax
push esi
mov dword [esp + 0x1c], eax
call sub.MFC42.DLL_CString::Insert
mov eax, dword [esp + 0x10]
inc esi
add edi, 3
cmp esi, eax
jl 0x1000fcca
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFile::Close
push 0
push 0
push 0
push 0xf
push 0xc
push 0x7d1
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_COleDateTime::SetDateTime
push 0
push 0x35
push 8
push 0x1e
push 0xc
push 0x76b
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_COleDateTime::SetDateTime
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call sub.MFC42.DLL_CString::CString_3
call fcn.1000f6f0
add esp, 8
lea ecx, [esp + 0x24]
mov byte [esp + 0x240], 0
call fcn.1007e00c
lea ecx, [esp + 0xc]
mov dword [esp + 0x240], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x238]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x238
ret
Function at 0x10011d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007f5d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100896e8]
or edi, 0xffffffff
xor ebx, ebx
cmp eax, edi
mov dword [esp + 0x30], ebx
jne 0x10011db2
call sym.AdjustBase.dll_int___cdecl_InitAuthorization_void_
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push ebx
push str.Mode
push str.SoftRegister
mov ecx, eax
call sub.MFC42.DLL_CWinApp::GetProfileIntA
mov esi, eax
mov eax, dword [0x100896e8]
cmp esi, eax
jne 0x10011f22
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x14]
push ecx
call fcn.100104a0
add esp, 8
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x10]
push esi
push eax
call sym.AdjustBase.dll_class_CString___cdecl_GetAuthorizationNumber_int__class_CString_
add esp, 0xc
mov byte [esp + 0x30], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x100896f0]
mov edx, dword [0x100896f4]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x100896f8]
mov dword [esp + 0x20], ecx
mov ecx, dword [0x100896e8]
mov dword [esp + 0x1c], edx
mov edx, dword [0x100896fc]
and eax, 3
cmp ecx, ebx
mov dword [esp + 0x24], edx
jne 0x10011e83
mov ecx, dword [0x1009d044]
xor eax, eax
cmp ecx, ebx
sete al
jmp 0x10011ee5
cmp ecx, 1
jne 0x10011ea0
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_3
call fcn.10010c00
jmp 0x10011ee2
cmp ecx, 2
jne 0x10011ec1
cmp dword [esp + eax*4 + 0x18], ebx
jne 0x10011f15
cmp dword [0x1009d074], ebx
jne 0x10011f15
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
jmp 0x10011ed8
cmp ecx, 3
jne 0x10011f15
cmp dword [esp + eax*4 + 0x18], ebx
jne 0x10011f15
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_3
call fcn.1000f0b0
add esp, 4
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], edi
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], edi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
Function at 0x10012500
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push eax
push 1
push 2
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
je 0x1001251e
xor al, al
ret
lea edx, [esp + 4]
push 2
push edx
call fcn.10012600
mov ecx, dword [esp + 0x10]
add esp, 8
mov dword [ecx], eax
mov al, 1
ret

Function at 0x10012540
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push eax
push 1
push 2
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
je 0x1001255e
xor al, al
ret
lea edx, [esp + 4]
push 2
push edx
call fcn.10012600
mov ecx, dword [esp + 0x10]
add esp, 8
mov word [ecx], ax
mov al, 1
ret

Function at 0x10012580
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push eax
push 1
push 4
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
je 0x1001259e
xor al, al
ret
lea edx, [esp + 4]
push 4
push edx
call fcn.10012600
mov ecx, dword [esp + 0x10]
add esp, 8
mov dword [ecx], eax
mov al, 1
ret

Function at 0x100125c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push eax
push 1
push 4
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
sete al
ret

Function at 0x100125e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push eax
push 1
push 8
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
sete al
ret
Function at 0x100150d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x44]
push ebp
push esi
cmp ebx, 0x10
push edi
je 0x100152b4
cmp ebx, 0x20
je 0x100152b4
jae 0x10015277
mov esi, dword [esp + 0x4c]
push ebx
lea eax, [esp + 0x24]
push esi
push eax
call fcn.10018fa0
mov ebp, dword [esp + 0x54]
add esp, 0xc
test ebp, ebp
push 0x10
push esi
push 0
jne 0x100151af
mov ebp, dword [esp + 0x50]
push 0
push ebp
call fcn.100152e0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10015145
lea ecx, [esp + 0x20]
push ebx
push ecx
push esi
call fcn.10018fa0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push 0x10
lea edx, [esp + 0x14]
push esi
push edx
call fcn.10018fa0
mov edi, ebx
add esp, 0xc
xor eax, eax
and edi, 0xf
jbe 0x10015171
mov cl, byte [esi + eax + 0x10]
mov dl, byte [esp + eax + 0x10]
xor dl, cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, edi
jb 0x1001515e
lea edx, [esp + 0x10]
push 0x10
push edx
push 0
push 0
push ebp
call fcn.100152e0
mov ebp, eax
add esp, 0x14
test ebp, ebp
je 0x100151a4
lea eax, [esp + 0x20]
push ebx
push eax
push esi
call fcn.10018fa0
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push edi
lea ecx, [esi + 0x10]
push esi
push ecx
jmp 0x10015258
mov eax, dword [esp + 0x50]
push ebp
push eax
call fcn.100152e0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x100151dc
lea ecx, [esp + 0x20]
push ebx
push ecx
push esi
call fcn.10018fa0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov edi, ebx
xor eax, eax
and edi, 0xf
jbe 0x100151f6
mov dl, byte [eax + esi + 0x10]
mov bl, byte [eax + esi]
xor bl, dl
mov byte [eax + esi], bl
inc eax
cmp eax, edi
jb 0x100151e5
lea ebx, [esi + 0x10]
push edi
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.10018fa0
mov ecx, 0x10
lea edx, [edi + esi]
sub ecx, edi
lea eax, [esp + edi + 0x1c]
push ecx
push edx
push eax
call fcn.10018fa0
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x28]
push 0x10
push ecx
push 0
push ebp
push edx
call fcn.100152e0
mov ebp, eax
add esp, 0x2c
test ebp, ebp
je 0x10015255
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x20]
push eax
push ecx
push esi
call fcn.10018fa0
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push edi
push esi
push ebx
call fcn.10018fa0
lea edx, [esp + 0x1c]
push 0x10
push edx
push esi
call fcn.10018fa0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov eax, dword [esp + 0x48]
push ebx
test eax, eax
jne 0x1001529a
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
push eax
push ecx
call fcn.10015380
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
push edx
push eax
call fcn.10015860
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push ebx
push ecx
push 0
push edx
push eax
call fcn.100152e0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x10018660
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1008d010]
test eax, eax
je 0x1001867e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100aed30], eax
mov dword [0x1008d010], 0
mov eax, dword [0x100aed30]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x100186f2
push 8
call fcn.10018f40
mov esi, eax
add esp, 4
test esi, esi
jne 0x100186a3
pop esi
ret
push 0x5000
call fcn.10018f40
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x100186c4
push esi
call fcn.10018f70
add esp, 4
xor eax, eax
pop esi
ret
mov dword [esi], 0x5000
mov ecx, dword [0x100aed30]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100186f2
mov edx, dword [esi + 4]
push edx
call fcn.10018f70
push esi
call fcn.10018f70
add esp, 8
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x10020bd0
Capabilities:
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
je 0x10032cfe
jne 0x10020bdf
std
cmpsd dword [esi], dword es:[edi]
mov word [ebx - 0x14f595fa], cs
mov eax, dword [esi]
push 0xa
jmp 0x10020be4
push eax
call fcn.1003c459
add esp, 8
shr bl, 0x40
pop edi
pop esi
pop ebp
mov cl, cl
js 0x10032cf9
jns 0x10020c03
arpl word [edi + 0x20f0890f], bp
add dword [eax], eax
jns 0x10032cf9
mov eax, dword [ebp - 0x2c]
ja 0x1004712b
jbe 0x10020c1a
imul ebp, edi, 0xfa61001
xchg byte [ebx], cl
add al, byte gs:[eax]
jbe 0x1004712b
xor al, 0x84
ret
lea esi, [esi]
ret
add ecx, 0
jae 0x10032d09
call 0x100530d7
push 0x10051e62
ret
xchg dx, bx
xchg bx, dx
mov edi, dword [ebp + 8]
cmp eax, 0x10000
jle 0x1004714c
mov ebx, ebx
jg 0x10047147
pushfd
cpuid
ret
mov eax, 0xffff
lea edx, [ebp - 0x20]
push esi
jmp 0x10047152
push edx
xchg bh, ch
xchg ch, bh
push eax
mov si, si
push edi
lea eax, [ebp - 0x10]
push 6
push eax
jmp 0x10038ff4

Function at 0x10021427
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
shl ebx, 0x20
mov ecx, dword [ebp + 0x10]
jmp 0x100567e2
invalid
add eax, ebp
js 0x1002d1da
mov cl, cl
jns 0x10026c75
mov word [edi], es
cmp edi, dword [ebx]
xchg byte [edi], cl
mov dword [edi + 0x65], ebx
add byte [eax], al
jns 0x1002d1da
xor eax, 0xff595148
imul dword [eax + 0x58]
and al, 0x40
pushfd
jmp 0x10026c87
push ebx
xchg di, bp
xchg bp, di
call dword [0x1008e788]
mov esi, eax
mov eax, dword [0x1008e1ec]
test eax, eax
jb 0x10026481
je 0x1002e416
jne 0x10026cb0
or ecx, dword [edi]
mov byte [0x4f880fc3], al
ja 0x10026cb5
js 0x1002e405
add byte [ecx + 3], bh
jns 0x10026cbb
sbb al, 0xff
pop esp
jns 0x1002e405
fmul dword [edi]
xchg dx, cx
xchg cx, dx
shr ebx, 0x40
shl ax, 0x20
mov ebx, dword [esi + 4]
push 0x1002364c
ret
jmp 0x1002e406
push edi
call fcn.1003a292
add esp, 4
xchg dh, cl
std
jmp dword [0xffff]
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
shl bh, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jb 0x10026c64
jne 0x10056818
je 0x10056810
test byte [edi], 0xd9
jae 0x10056797
xchg dh, bh
xchg bh, dh
pop ebp
ret
inc byte [esi - 0x683ca209]
push ds
mov esi, esi
mov eax, dword [ebp + 0x10]
shr ch, 0x40
pop ebp
ret
Function at 0x1002b3b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov edx, edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jb 0x1002dfe3
jne 0x1002b3eb
je 0x1002b3e7
cpuid
add bl, 0x5d
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop ebp
jne 0x1002a8c7
je 0x1002b3fa
arpl word [esp + eax - 0xb387bf1], bx
invalid
je 0x1002a8c7
Function at 0x1002c548
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
xchg ecx, eax
xchg ecx, eax
js 0x1003ac1c
jns 0x1002c555
sbb al, 0xff
and al, 0xf
mov ecx, eax
out 0, al
add byte [0xe7c16647], al
jns 0x1003ac1c
add eax, 0xe7c16647
and byte [eax + 0xbb86], cl
add byte [ecx + 0x66], dl
xchg ecx, ecx
xchg ecx, ecx
pop ecx
mov word [esi + 0xbc], di
call fcn.1004b761
mov cl, cl
jno 0x1004446a
mov di, di
jo 0x1002c58a
xchg ebp, eax
sbb al, 0xf
jo 0x1004446a
xchg esp, eax
mov ebx, 0xffff1002
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
fcom dword [esp + eax]
adc byte [ebp - 0x43], bh
add al, 0x10
push ds
add eax, 0x5010
add byte [eax], dl
add byte [eax], al
std
stosb byte es:[edi], al
add eax, 0xf10710
add byte [eax], bh
add byte [eax], al
add al, bl
adc al, 4
adc byte [edi], bh
mov dl, 3
adc byte [ebp + 0x4c10052a], ah
add byte [eax], al
add byte [ecx], dl
sti
add al, 0x10
wait
ficom dword [ecx + ebp + 0x401005]
add byte [eax], al
cmp al, 0
add byte [eax], al
out 0x3d, al
add al, 0x10
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
popfd
wait
add dl, byte [eax]
cmp byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
fcom dword [esp + eax]
adc byte [esi + esi*8 + 5], bh
adc byte [ebx + 0x6410052e], ch
mov byte [edx], 0x10
jmp 0x1002c627
or eax, 0x401004
add byte [eax], al
inc eax
add byte [eax], al
add byte [edx + ecx*2], bl
add dl, byte [eax]
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [esi], cl
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [edx - 0x2f], dh
add al, 0x10
movsd dword es:[edi], dword [esi]
sub al, byte [0x4c10]
add byte [ecx], dl
sti
add al, 0x10
sar dword [ecx + 0xb], 0x64
add al, 0x10
sbb dword [ebx], eax
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
adc dword [edx + eax], ebp
adc byte [ecx], al
add byte [eax], al
inc ecx
add byte [eax], al
add byte [ebp + 0x4c10052a], ah
add byte [eax], al
add byte [ecx], dl
sti
add al, 0x10
iretd
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
jb 0x10041446
je 0x1004f0af
jne 0x1003ac3b
cmc
xchg ecx, eax
cmp edi, dword [ecx]
and dword ds:[esi - 0x79], 0xffffffe9
xchg cx, bp
xchg bp, cx
lea ecx, [eax + 1]
mov al, byte [ebp + 0xc]
shr eax, 0x40
push ebx
mov bl, al
jno 0x10056e5a
jo 0x1003ac57
mov bx, 0x800f
std
rol dword [ecx], 0
jo 0x10056e5a
ficomp dword [edi - 0x76]
dec ebp
cmp al, 0x8b
pop esi
add al, 0xe9
in eax, 0
add al, bl
pushal
add ah, ch
jmp 0x1005e66e
shl bx, 0x20
mov edx, edx
mov bh, bl
mov edx, ecx
mov eax, ebx
push edi
mov edi, dword [ebp + 8]
shl eax, 0x10
jmp 0x1004f095
mov ebx, dword [ebp + 0x4c]
mov eax, dword [esi + 4]
mov bp, bp
mov edx, dword [esi + 8]
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
mov word [ebx + edx], ax
jmp dword [esi]
Function at 0x10039dd8
Capabilities:
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
mov ebp, ebp
shl eax, cl
ja 0x1004bfd2
jbe 0x10039dec
sti
jge 0x10039e66
cmp dword [edi], ecx
xchg al, ah
and dword [ecx], eax
add byte [edx + 0x40ecc052], al
jbe 0x1004bfd2
test edi, 0xa3e2ab1b
Function at 0x10040b1c
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
mov edi, edx
cdq
and edx, 3
jb 0x10029bba
add eax, edx
sar ebx, 2
sar eax, 2
sub edi, ebx
add eax, esi
ja 0x10050824
Function at 0x1004bbc4
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
jmp dword [esi]
push ebp
mov ebp, esp
push ebx
push esi
push 0x1008eb44
jno 0x1004d4c9
jo 0x1004bbda
inc edx
inc edx
jo 0x1004d4c9
and eax, 0xf1ffeb40
shl ebx, 0x20
call fcn.10057996
add esp, 0xc
push 0x1002ddb0
ret
xor esi, esi
jb 0x1004f594
call fcn.1005b8d1
add esp, 4
add ch, 0
test eax, eax
jb 0x1004f5c0
jle 0x10039445
jg 0x1004d4f2
xor ebp, dword [ebp + 0xa]
shr bx, 0x40
push 0x1005745b
ret
pop ecx
cmpsd dword [esi], dword es:[edi]
mov eax, dword [ebp + 0x4c]
mov edx, dword [esi + 4]
shr cl, 0x40
mov ebx, dword [esi + 8]
mov eax, dword [eax + edx]
lea esi, [esi + 0xc]
add dword [ebp + ebx], eax
js 0x10037197
jns 0x1004f5ba
jns 0x10037197
xor al, 0x6f

Function at 0x1004cba2
Capabilities:
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
add word [ebp + ebx], ax
shr edx, 0x40
jmp dword [esi]
xor eax, 0x20e4c0ef
mov eax, dword [esi + 4]
jmp loc.1005e0d6
mov ecx, eax
and ecx, 0xfffffff8
jb 0x10050389
cmp ecx, 0x7fff8
jbe 0x1004cb69
xchg dl, al
xchg al, dl
ja 0x1004cb57
cpuid
invalid
mov edx, dword [esi]
push 0
jmp 0x1004cb5c
push edx
jmp fcn.1003f8c2
stc
jb 0x1004cb6e
adc al, 0x58
jb 0x10057d39
fmul dword [0x8b04468b]
pop esi
or byte [edx - 0x72fffabc], cl
jbe 0x1004cb8f
add byte [ebp + ebx], al
jmp dword [esi]
sub dword [esi + 0x70fffefd], 0x22a18904
std
jo 0x1003c942
and eax, 0x38570c5
adc byte [edx], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebx + 0x710052e], ch
int3
xor al, 0x30
test al, 7
jb 0x10047f70
je 0x100293e0
jne 0x10057d4b
add dl, byte [eax + 5]
or byte [eax], al
add byte [eax], al
add eax, 8

Function at 0x10052ecb
Capabilities:
Packed with generic packer

Disassembly:
mov dl, dl
jmp 0x1002c770
js 0x1002c76d
jns 0x10052ed7
cpuid
ret
jns 0x1002c76d
ficomp dword [eax]
Function at 0x10053542
Capabilities:
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
jno 0x1003ae6d
jo 0x10026e47
hlt
jo 0x1003ae6d
lea esi, [esi + 0xc]
jne 0x1002e9c0
mov word [esi + 0xbc], dx
mov cl, cl
mov ecx, ecx
shl bl, 0x20
shl bp, 0x20
call fcn.10053c19
mov dx, dx
xchg bp, ax
xchg bp, ax
mov cl, byte [ebp + 0xb]
xchg dh, dl
mov di, di
lea ebp, [ebp]
xchg dl, dh
shr dl, 0x40
js 0x1003f89d
jns 0x1003a534
or al, 0x40
pop ss
dec ebp
mov esi, 0x63890f4c
push ebx
add byte [eax], al
jns 0x1003f89d
xor byte [ecx], 0xf
mov bh, bh
enter 0, 0xffffffffffffffc0
in al, dx
inc eax
xchg bp, si
xchg si, bp
jns 0x1003a551
cpuid
nop
ret
jns 0x10046e41
invalid
call fcn.1001ff17
mov dl, byte [ebp + 0xc]
mov di, di
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
mov ax, word [ebp + 0x10]
push ecx
push 0x10022d5b
ret
xchg cl, dl
shr cl, 0x40
xchg dl, cl
jmp 0x1003f8a5
push esi
ja 0x10053516
xchg di, bx
xchg bx, di
push ebx
pop ebx
jbe 0x1003f8ba
xor eax, 0x860fdb31
push esi
cmp al, 1
add byte [0x315de8ee], al
invalid
pop ebp
invalid
jbe 0x10053516
add eax, 0x315de8ee
invalid
jno 0x1003f47d
mov bh, bh
jo 0x1003fcc5
push ss
fdiv dword [ecx - 0x7ff04c45]
mov dl, 0xf7
invalid
jo 0x1003f47d
invalid
jmp 0x10046e42
push eax
call fcn.10054a38
fldcw word [ecx + 0x558bd288]
sbb byte [esi + 0x66], bl
mov ebp, ebp
push 0x1002cca9
ret
mov byte [esi + 0xba], bl
shl edx, 0x20
mov byte [esi + 0xbb], cl
mov word [esi + 0xbc], di
jno 0x1003fcb6
shl dx, 0x20
jo 0x1005353a
std
mov ah, 0xf
xor byte [esi - 0x39], 0xfe
invalid
jo 0x1003fcb6
fidiv dword [edx - 0x73]
and al, 4
mov ebx, ebx
push eax
push esi
shl cx, 0x20
xchg edi, eax
xchg edi, eax
shl bx, 0x20
jne 0x10026e39
je 0x10053560
int1
sub ebx, ebp
je 0x10026e39
xor al, 0xed
adc dword [edx + eax], ebp
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [ebx], cl
add al, 0x10
pop es
daa
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add eax, 0x401002f7
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add eax, 0x411002f7
add byte [eax], al
add byte [eax], al
add byte [eax], al
movsd dword es:[edi], dword [esi]
sub al, byte [0x4c10]
add byte [ecx], dl
sti
add al, 0x10
adc al, byte [eax]

Function at 0x10054036
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
push 0x1002eb6e
ret
pop edi
pop esi
inc eax
pop ebx
pop ebp
mov edx, edx
ret
add esp, 4
add ah, 0xc5
cmp esi, esi
test ebp, 0x9dbb016b
sub ah, 0xc5
cmp eax, 8
shl ecx, 0x20
mov al, al
jno 0x1002e743
jo 0x1005405f
invalid
jo 0x1002e743
add eax, 0xff006ae0
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameA
test eax, eax
jb 0x1004fd63
jne 0x1005408d
mov edx, edx
je 0x10054086
test byte [ebx + ebp*2 - 0x54], dh
xlatb
pop edi
pop esi
pop ebx
pop ebp
ret
mov cl, byte [eax + esi]
cmp cl, 0x5c
je 0x10037e00
mov ah, ah
jne 0x1005409f
inc eax
cdq
cmp cl, 0x3a
call fcn.100385b7
xor al, 0xa4
Function at 0x1005581f
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
adc edx, dword [ebx]
adc edx, dword [ebx]
adc edx, dword [ebx]
adc edx, dword [ebx]
adc edx, dword [edx]
adc edx, dword [ebx]
adc ecx, dword [ecx]
push ebp
mov ebp, esp
jne 0x10035c21
je 0x1005582c
add al, 0xf2
je 0x10035c21
add eax, 0x4640b1f
adc byte [edi], cl
daa
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
movsd dword es:[edi], dword [esi]
sub al, byte [0x5010]
add byte [edx + ecx*2], bl
add dl, byte [eax]
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
popal
add byte [eax + 0x40], al
add byte [ecx], ah
add byte [eax], al
push ss
add byte [eax], al
add byte [edx - 0x2f], dh
add al, 0x10
jae 0x10055811
add eax, 0xc10
add byte [eax], bh
add byte [eax], al
add byte [ebp + 0x4c10052a], ah
add byte [eax], al
add byte [0x3c1002f7], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0x401002f7
add byte [eax], al
add byte [eax + eax], bh
add byte [eax], al
adc ebx, edi
add al, 0x10
aam 0xe5