joyce8/EMBER2024-capa huggingface dataset:
Function at 0x549790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5511e2
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x5497cd
call fcn.004101b0
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x549920
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x549920
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x549916
mov edx, dword [ebp - 0x20]
movzx eax, word [edx]
cmp eax, 0xfeff
jne 0x54984e
mov ecx, dword [ebp - 0x20]
add ecx, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
sub edx, 2
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004dcb1e
add esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x54990d
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
push edx
push 0
mov eax, dword [ebp - 0x24]
push eax
call fcn.0050bed0
add esp, 0xc
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
add eax, 1
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0050e000
add esp, 0x10
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x30]
call fcn.00406150
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
call fcn.00405840
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00530380
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004061c0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.004dcb13
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00403bc0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x54b660
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552c04
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5b3940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
movzx eax, word [0x5c0190]
test eax, eax
jne 0x54b6ad
mov dword [ebp - 0x14], 0x104
lea ecx, [ebp - 0x14]
push ecx
push 0x5c0190
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.NETWORK_SERVICE
push 0x5c0190
call fcn.0050be35
add esp, 8
test eax, eax
jne 0x54b711
lea edx, [ebp - 0x18]
push edx
call fcn.005386d0
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push str.WebShareSettings_
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004015d0
add esp, 0xc
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407f90
mov eax, dword [ebp + 8]
jmp 0x54b786
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0054b470
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 1
push str.Settings_
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004015d0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00407f90
lea ecx, [ebp - 0x10]
call fcn.00405840
push eax
call fcn.00538500
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401800
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407f90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x5501b1
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x5501ec
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x5501d3
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x5501e4
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x5501ee
inc edi
add eax, 0x28
cmp edi, esi
jb 0x5501c9
xor eax, eax
pop edi
pop esi
ret
Function at 0x4092b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4093d6
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.004094b0
mov eax, dword [esp + 0xc]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 8]
shl ebx, 5
shr edi, 0x1b
or edi, ebx
lea ebx, [0x5af1e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x4093c9
cmp ecx, 0x21
jae 0x4093bd
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00462820
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x24], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004628a0
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x51f3d8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00468a10
mov eax, ecx
mov ecx, 0x21
call fcn.00468ac0
nop
call fcn.00467570
jmp fcn.004092b0
Function at 0x417ac0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417ce1
sub esp, 0x18
mov eax, dword [0x611304]
test eax, eax
jne 0x417cca
lea eax, [0x6112f0]
mov dword [esp], eax
call fcn.0040ae80
mov eax, dword [0x6112f4]
test eax, eax
je 0x417b08
cmp dword [eax + 8], 0xcc
jne 0x417b7e
mov edx, dword [0x6112e8]
test edx, edx
jne 0x417b60
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x613bd0]
mov dword [esp + 8], eax
call fcn.0040d560
mov eax, dword [esp + 0xc]
mov dword [0x6112e8], eax
mov ecx, dword [0x6112ac]
mov dword [eax], ecx
mov eax, dword [0x6112e8]
mov dword [0x6112ac], eax
movzx eax, byte [0x611840]
test al, al
jne 0x417b60
xor eax, eax
jmp 0x417c76
mov edx, dword [0x6112e8]
mov ebx, dword [edx + 4]
mov dword [0x6112e8], ebx
mov ebx, dword [0x6112f4]
mov dword [edx + 4], ebx
mov dword [0x6112f4], edx
mov edx, dword [0x6112f4]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x417c5e
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402910
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x611520]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x417bdc
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x417be9
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00468980
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x611520]
test edx, edx
jne 0x417c15
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x417c36
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00468980
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00468980
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00468980
lea eax, [0x6112f0]
mov dword [esp], eax
call fcn.0040b080
lea eax, [0x6112ec]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402440
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00468a10
lea esi, [0x611840]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x417b60
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x417cc0
lea edx, [0x5ab25c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x417c68
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00468a00
mov ecx, 5
call fcn.00468a00
lea eax, [0x510e35]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043b160
nop
call fcn.00467570
jmp fcn.00417ac0
Function at 0x42bac0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42bbe7
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00429130
mov eax, dword [esp + 4]
test eax, eax
je 0x42bbd0
mov dword [esp + 0xc], eax
call fcn.0044c230
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
call fcn.004268f0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00428cd0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 6]
mov byte [esp + 0xb], dl
mov ebx, dword [esp + 0xc]
lea ebp, [ebx + 0x48]
mov dword [esp + 0x18], ebp
mov dword [esp], ebp
call fcn.0040ae80
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x42bb58
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42bb99
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42bb6d
cmp byte [ebp + 6], dl
je 0x42bb78
cmp esi, ebx
ja 0x42bb99
jne 0x42bb56
cmp byte [ebp + 6], dl
jbe 0x42bb56
jmp 0x42bb99
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040b080
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044c250
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.0042b8d0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040b080
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044c250
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x51288f]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.0043b160
nop
call fcn.00467570
jmp fcn.0042bac0

Function at 0x42c0e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42c1d9
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x42c164
cmp cl, 2
je 0x42c11d
cmp cl, 3
jne 0x42c1c2
mov byte [eax + 8], 1
jmp 0x42c1be
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00431b70
lea eax, [0x5f58b8]
mov dword [esp], eax
call fcn.0040ae80
lea eax, [0x5f5868]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418b20
lea eax, [0x5f58b8]
mov dword [esp], eax
call fcn.0040b080
jmp 0x42c1be
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00417ac0
lea eax, [0x5f58b8]
mov dword [esp], eax
call fcn.0040ae80
lea eax, [0x5f5840]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418b20
lea eax, [0x5f58b8]
mov dword [esp], eax
call fcn.0040b080
add esp, 0x14
ret
lea eax, [0x50dba4]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043b160
nop
call fcn.00467570
jmp fcn.0042c0e0
Function at 0x45b9e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bae0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.0045c320
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4f1640]
mov dword [esp], ecx
call fcn.0040d2f0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x5f5950]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.0045aef0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0045a510
add esp, 0x28
ret
call fcn.00467570
jmp fcn.0045b9e0
Function at 0x466680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00446c60
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x611271]
test cl, cl
je 0x466709
call fcn.004368b0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00454960
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
jmp 0x46673f
call fcn.004368a0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00454960
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
mov eax, dword [0x5eaeb4]
mov dword [esp], eax
lea eax, [ecx + 0x190]
mov dword [esp + 4], eax
call fcn.00404930
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x19c]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x46677b
mov eax, dword [eax + 0x1a4]
mov dword [esp + 0x30], eax
call fcn.00446cf0
add esp, 0x20
ret
Function at 0x468830
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x611620]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x466ffb
je 0x46704e
cmp ebx, 0x20
jbe 0x467054
cmp ebx, 0x40
jbe 0x46709a
jmp 0x46713b
test ebx, ebx
je 0x467044
add eax, 0x10
test ax, 0xff0
je 0x467030
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x5201c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x5202c0]
jmp 0x467018
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x467018
pxor xmm1, xmmword [0x611630]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x611630]
pxor xmm2, xmmword [0x611640]
pxor xmm3, xmmword [0x611650]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x611630]
pxor xmm2, xmmword [0x611640]
pxor xmm3, xmmword [0x611650]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46719a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x61126f], 0
je 0x46884a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x466fc0
jmp fcn.00409670
Function at 0x468850
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4035de
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409670
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00467570
jmp 0x4035a0
cmp byte [0x61126f], 0
je 0x46886b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x466fc0
jmp 0x4035a0
Function at 0x4b4970
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b4acf
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00468b57
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4b49aa
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4b49d3
lea eax, [0x4f3ac0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044f8e0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00468b57
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call fcn.004b31a0
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x46], cx
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x38]
cmp ebx, edx
jae 0x4b4a79
mov dword [esp + 0x24], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xc
lea eax, [0x4f3ac0]
mov dword [esp + 0x10], eax
call fcn.0044f980
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], ebp
lea eax, [ebp + ecx]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00469250
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00469016
add esp, 0x5c
ret
call fcn.00467570
jmp fcn.004b4970
Function at 0x40a0b9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
push edi
xor edi, edi
cmp edx, dword [ebp + 0xc]
cmova esi, eax
test esi, esi
je 0x40a0e9
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x40a0d4
jmp 0x40a0eb
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x40d79a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40d7bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d878
jmp 0x40d873
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40d7dd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40d7df
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40d867
jg 0x40d7f2
test esi, esi
je 0x40d867
test ecx, ecx
jl 0x40d834
jg 0x40d7fc
test eax, eax
je 0x40d834
cmp ebx, ecx
jg 0x40d80e
jl 0x40d806
cmp esi, eax
jae 0x40d80e
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0055f020
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40d83a
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40d867
jg 0x40d844
test esi, esi
je 0x40d867
cmp dword [edi + 0x4c], 0
je 0x40d867
mov ecx, edi
call fcn.0040c9c7
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.00568dfa
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc