joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c07
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42e853
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00401320
lea edi, [esi + 0x38]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
call fcn.00401b30
push str.Sheet1
mov ecx, edi
mov byte [esp + 0x1c], 1
mov dword [esi], 0x4315f0
mov word [esi + 4], 0x85
mov dword [esi + 0x18], 0xa
call fcn.00401c70
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x40], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406c00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42e9d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00401320
mov cl, byte [esp + 7]
xor eax, eax
mov word [esi + 0x30], ax
mov word [esi + 0x32], ax
mov word [esi + 0x34], ax
mov word [esi + 0x3e], ax
mov dword [esi + 0x40], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x44], cl
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 1
mov word [esi + 0x54], 0xffff
call fcn.00407370
lea ecx, [esi + 0xa4]
mov byte [esp + 0x14], 2
call fcn.004076e0
lea ecx, [esi + 0xec]
mov byte [esp + 0x14], 3
call fcn.004078e0
lea ecx, [esi + 0x134]
mov byte [esp + 0x14], 4
call fcn.00407a60
lea ecx, [esi + 0x174]
mov byte [esp + 0x14], 5
call fcn.00407da0
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x431708
mov word [esi + 4], 6
mov dword [esi + 0x18], 0x14
mov dword [esi + 0x1c], 0x18
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x406c18
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42e9d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00401320
mov cl, byte [esp + 7]
xor eax, eax
mov word [esi + 0x30], ax
mov word [esi + 0x32], ax
mov word [esi + 0x34], ax
mov word [esi + 0x3e], ax
mov dword [esi + 0x40], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x44], cl
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 1
mov word [esi + 0x54], 0xffff
call fcn.00407370
lea ecx, [esi + 0xa4]
mov byte [esp + 0x14], 2
call fcn.004076e0
lea ecx, [esi + 0xec]
mov byte [esp + 0x14], 3
call fcn.004078e0
lea ecx, [esi + 0x134]
mov byte [esp + 0x14], 4
call fcn.00407a60
lea ecx, [esi + 0x174]
mov byte [esp + 0x14], 5
call fcn.00407da0
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x431708
mov word [esi + 4], 6
mov dword [esi + 0x18], 0x14
mov dword [esi + 0x1c], 0x18
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d4e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42efa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
mov dl, byte [esp + 0x14]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [esp + 0x20]
push edi
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esp + 0xc], esi
mov byte [esi + 0x14], dl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
lea edi, [esi + 0x24]
mov dword [esp + 0x18], ebx
mov ecx, edi
call fcn.00401320
mov al, byte [esp + 0x20]
mov dword [edi + 0x34], ebx
mov byte [edi + 0x30], al
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi], 0x43162c
mov ecx, esi
mov byte [esp + 0x18], 1
call fcn.0040d9c0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x41b9a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f73b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
mov ax, word [esi + 4]
mov dword [esp + 8], edi
mov word [edi + 4], ax
mov cl, byte [esi + 8]
mov byte [edi + 8], cl
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x41b9db
xor eax, eax
jmp 0x41b9e0
mov eax, dword [esi + 0x10]
sub eax, ecx
test eax, eax
jge 0x41b9e6
xor eax, eax
push ebp
push eax
call sub.MFC42u.DLL_operatornew
mov dword [edi + 0xc], eax
mov ebp, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
add esp, 4
cmp ecx, ebp
je 0x41ba0b
test eax, eax
je 0x41ba05
mov dl, byte [ecx]
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, ebp
jne 0x41b9fd
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x18], 0
mov dword [edi + 0x18], eax
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x1c], ecx
mov dl, byte [esi + 0x20]
mov byte [edi + 0x20], dl
mov ecx, dword [esi + 0x24]
test ecx, ecx
pop ebp
jne 0x41ba37
xor eax, eax
jmp 0x41ba3f
mov eax, dword [esi + 0x28]
sub eax, ecx
sar eax, 2
test eax, eax
jge 0x41ba45
xor eax, eax
shl eax, 2
push eax
call sub.MFC42u.DLL_operatornew
mov dword [edi + 0x24], eax
mov edx, dword [esi + 0x28]
mov ecx, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edx
je 0x41ba74
push ebx
test ecx, ecx
je 0x41ba69
mov ebx, dword [eax]
mov dword [ecx], ebx
add eax, 4
add ecx, 4
cmp eax, edx
jne 0x41ba61
pop ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi], 0x431550
mov cx, word [esi + 0x30]
mov word [edi + 0x30], cx
mov dx, word [esi + 0x32]
mov word [edi + 0x32], dx
mov ax, word [esi + 0x34]
mov word [edi + 0x34], ax
mov cx, word [esi + 0x36]
mov word [edi + 0x36], cx
mov dx, word [esi + 0x38]
mov word [edi + 0x38], dx
mov ax, word [esi + 0x3a]
mov word [edi + 0x3a], ax
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x3c], ecx
mov ecx, dword [esp + 0xc]
mov dword [edi], 0x431780
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x41f950
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [esi + 0x18]
test bl, bl
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
je 0x41fae1
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
add edx, ecx
push eax
push 0x18
mov dword [esi + 0x14], edx
push ecx
lea edx, [esi + 0x30]
lea ebx, [esi + 0x20]
mov ecx, esp
push edx
mov dword [esp + 0x2c], ebx
call fcn.004263d0
push ecx
mov ecx, esp
push str.read
call fcn.004263c0
push ebx
call fcn.0041dc80
mov ecx, dword [esi + 0x18]
mov ebp, dword [esi + 0x1c]
add esp, 0x18
xor ebx, ebx
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
mov edx, ebp
dec ebp
test edx, edx
je 0x41fa82
inc ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [sym.imp.MSVCRT.dll_memmove]
mov dl, byte [esp + 0x13]
test dl, dl
je 0x41f9fa
xor edx, edx
cmp byte [edi], dl
jmp 0x41f9ff
xor edx, edx
cmp word [edi], dx
sete dl
test edx, edx
je 0x41fa26
test eax, eax
je 0x41fa1f
cmp edi, eax
je 0x41fa1f
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
mov ecx, dword [esi + 0x18]
inc ebx
lea eax, [ecx + edi]
mov edx, dword [esp + 0x14]
add edi, ecx
dec edx
mov dword [esp + 0x14], edx
jne 0x41f9ec
test eax, eax
je 0x41fa4d
cmp edi, eax
je 0x41fa4d
mov ecx, dword [esi + 0x18]
sub edi, eax
imul ecx, ebx
push edi
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
test ebx, ebx
je 0x41fa82
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov ecx, esp
push 0
call fcn.004263c0
push ecx
mov ecx, esp
push str.nulls_removed
call fcn.004263c0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0041dc80
mov eax, dword [esi + 0x1c]
add esp, 0x18
sub eax, ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x18], 1
jle 0x41fad3
mov eax, dword [esi + 4]
push eax
call fcn.0041e930
add esp, 4
test al, al
je 0x41fad3
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call fcn.0041e940
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.004263c0
push ecx
mov ecx, esp
push str.endian_swap
call fcn.004263c0
mov eax, dword [esp + 0x2c]
push eax
call fcn.0041dc80
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ecx, esi
call fcn.0041f5d0
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x420230
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [esp + 0x14]
imul eax, dword [ebp + 0x1c]
test esi, esi
mov dword [ebp + 8], eax
jne 0x42024e
mov esi, edi
mov ecx, dword [ebp + 4]
xor ebx, ebx
push ecx
call fcn.0041e930
add esp, 4
test al, al
je 0x4202c3
test edi, edi
jne 0x42028d
mov edx, dword [ebp + 0x1c]
shl edx, 1
push edx
call sub.MFC42u.DLL_operatornew
mov ecx, dword [ebp + 0x1c]
mov ebx, eax
shl ecx, 1
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov esi, ebx
mov ecx, dword [ebp + 0x1c]
push ecx
push edi
call fcn.0041e940
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.004263c0
push ecx
mov ecx, esp
push str.endian_swap
call fcn.004263c0
lea edx, [ebp + 0x20]
push edx
call fcn.0041dc80
add esp, 0x18
mov eax, dword [ebp]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
sete byte [esp + 0x18]
test ebx, ebx
je 0x4202ec
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov al, byte [esp + 0x18]
test al, al
je 0x420337
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
push eax
push 0x18
add esi, edx
push ecx
lea edx, [ebp + 0x30]
mov ecx, esp
push edx
mov dword [ebp + 0x14], esi
call fcn.004263d0
push ecx
mov ecx, esp
push str.write
call fcn.004263c0
add ebp, 0x20
push ebp
call fcn.0041dc80
mov al, byte [esp + 0x30]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, ebp
call fcn.0041f5d0
mov al, byte [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x42a1c0
Capabilities:
Resume thread
Terminate thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42fbd8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x2c]
lea ecx, [esp + 0x10]
push ecx
push edx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x42a2a1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esp + 0x10], 0x103
jne 0x42a2a1
mov eax, dword [esi + 0x2c]
push eax
call ebp
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CEvent::CEvent
mov ecx, dword [esp + 0x18]
push 0x14
push ecx
call ebx
inc edi
cmp edi, 0x64
jg 0x42a27a
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.0042e02a
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x42a20f
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esp + 0x14]
mov dword [esi + 0x2c], 0
mov dword [esp + 0x24], 0xffffffff
call fcn.0042e02a
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x42d590
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
xor esi, esi
mov edi, ecx
lea eax, [esp + 0x10]
push esi
mov ecx, dword [edi + 0x1c]
push eax
push ebx
push ebp
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42d5e9
add esi, dword [esp + 0x10]
cmp esi, ebx
je 0x42d5f3
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebx
lea edx, [esp + 0x10]
push 0
sub eax, esi
push edx
mov edx, dword [edi + 0x1c]
lea ecx, [esi + ebp]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42d5bb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 8
Function at 0x42d600
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x418
add eax, 4
push ebx
mov ebx, ecx
mov ecx, dword [eax + 0x400]
push ebp
push esi
push edi
push ecx
push eax
mov ecx, ebx
call fcn.0042d590
test eax, eax
jne 0x42d644
mov edx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
mov dword [edx + 0x408], 3
pop ebx
add esp, 0x418
ret 8
mov ebp, dword [esp + 0x430]
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov edx, dword [ebx + 0x1c]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42d683
mov eax, dword [ebx + 0x1c]
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x42d693
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp esi, edi
jae 0x42d6a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebx + 8]
sub esi, edi
cmp esi, eax
mov eax, dword [esp + 0x20]
ja 0x42d6b8
test eax, eax
je 0x42d65b
test eax, eax
jbe 0x42d7a3
mov dword [esp + 0x14], eax
jmp 0x42d6ca
mov eax, dword [esp + 0x14]
cmp eax, 0x400
mov edx, eax
jb 0x42d6d8
mov edx, 0x400
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
stosb byte es:[edi], al
mov eax, dword [ebx + 0x1c]
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x42d78a
mov eax, dword [ebp + 0x404]
lea edx, [eax + ecx]
cmp edx, 0x400
ja 0x42d78a
lea edi, [eax + ebp + 4]
mov eax, ecx
lea esi, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x404]
add edx, ecx
mov ecx, ebp
mov dword [ebp + 0x404], edx
mov edx, dword [ebp]
call dword [edx + 4]
test eax, eax
jne 0x42d772
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x14], ecx
jne 0x42d6c6
jmp 0x42d64b
mov eax, 1
pop edi
mov dword [ebp + 0x408], eax
pop esi
pop ebp
pop ebx
add esp, 0x418
ret 8
pop edi
mov dword [ebp + 0x408], 3
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret 8
pop edi
mov dword [ebp + 0x408], 2
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret 8
Function at 0x4018f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40191a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x401980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4019df
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4019d0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x401a60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x401abf
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x401ab0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x1003ce0
Capabilities:
Query environment variable

Disassembly:
sub esp, 8
mov eax, dword [0x100aa88]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jne 0x1003d33
call esi
test eax, eax
mov dword [esp + 0x10], eax
je 0x1003d17
mov eax, 1
jmp 0x1003d2a
call edi
test eax, eax
mov dword [esp + 0x10], eax
je 0x1003ed2
mov eax, 2
mov ebx, dword [esp + 0x10]
mov dword [0x100aa88], eax
cmp eax, 1
jne 0x1003dbc
test ebx, ebx
jne 0x1003d56
cmp eax, 2
jne 0x1003eb6
test ebx, ebx
jne 0x1003ddf
call edi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x1003ddb
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x1003e27
mov ecx, dword [0x100aab0]
push 0
push 0
push 0xffffffffffffffff
push esi
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1003ed2
mov ebp, dword [esp + 0x14]
mov edi, esi
add ebp, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x14], ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esi + ecx + 1]
lea esi, [esi + ecx + 1]
test al, al
jne 0x1003de7
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
lea edx, [eax + eax]
push edx
call fcn.01003480
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x1003e53
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
les ecx, [eax]
mov eax, dword [esp + 0x10]
mov esi, ebp
cmp byte [eax], 0
je 0x1003ea4

Function at 0x1003ee0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x100aa90]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x1003f16
call edi
test eax, eax
je 0x1003f06
mov eax, 1
jmp 0x1003f11
call esi
test eax, eax
je 0x1003f81
mov eax, 2
mov dword [0x100aa90], eax
cmp eax, 1
jne 0x1003f22
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x1003f8a
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
mov edi, eax
mov eax, dword [0x100aab0]
push 0
push 0xffffffffffffffff
push edi
push 1
push eax
call ebp
mov esi, eax
test esi, esi
invalid
Function at 0x1004210
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x10083b0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x1004234
add eax, 8
inc ebp
cmp eax, 0x1008440
jb 0x1004225
cmp ecx, dword [ebp*8 + 0x10083b0]
jne 0x10043db
invalid
mov eax, dword [0x100a828]
cmp eax, 1
je 0x100439d
test eax, eax
jne 0x1004260
cmp dword [0x1008084], 1
je 0x100439d
cmp ecx, 0xfc
je 0x10043db
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100429b
mov ecx, 5
mov esi, 0x1001c94
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x10042e4
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x1001c90
add ebx, ecx
push ebx
call fcn.01005ca0
add esp, 0xc
mov ecx, 6
mov esi, 0x1001c74
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1001c70
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1001c48
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x10083b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.01005c10
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x100ab00]
test eax, eax
je 0x10043ae
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x10043b8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x10083b4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
invalid
test al, 1
add byte [eax], al

Function at 0x1005937
Capabilities:
Encode data using xor

Disassembly:
ret