joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426a70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4756a9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x498070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x426aca
mov eax, dword [edi]
jmp 0x426acc
mov eax, edi
mov byte [eax], 0
mov dword [ebp - 4], 0
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x426c50
nop word [eax + eax]
mov al, byte [edx]
dec ebx
mov byte [ebp + esi - 0x14], al
inc edx
mov ah, byte [ebp - 0x12]
inc esi
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xe], ah
mov byte [ebp + 0xb], ch
mov byte [ebp - 0xd], cl
cmp esi, 3
jne 0x426b87
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
mov cl, ch
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
nop word [eax + eax]
cmp dword [0x49e28c], 0x10
mov eax, 0x49e278
movzx ecx, byte [ebp + esi - 0x18]
cmovae eax, dword [0x49e278]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
push 1
call fcn.00404590
inc esi
cmp esi, 4
jl 0x426b50
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ch, byte [ebp + 0xb]
mov cl, byte [ebp - 0xd]
test ebx, ebx
jne 0x426af0
mov dword [ebp + 8], esi
test esi, esi
je 0x426c50
mov eax, esi
cmp esi, 3
jge 0x426bc1
cmp eax, 3
jae 0x426bbc
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x426ba4
mov dl, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x426bc4
call fcn.00436dbe
mov dl, byte [ebp - 0xe]
mov al, cl
xor ebx, ebx
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x426c2e
mov esi, eax
cmp dword [0x49e28c], 0x10
mov eax, 0x49e278
movzx ecx, byte [ebp + ebx - 0x18]
cmovae eax, dword [0x49e278]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
push 1
call fcn.00404590
inc ebx
cmp ebx, esi
jl 0x426c00
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x426c50
mov ebx, 3
sub ebx, esi
nop word [eax + eax]
push 0x3d
push 1
mov ecx, edi
call fcn.00404590
sub ebx, 1
jne 0x426c40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426ea0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4756a9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x498070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x426ef9
test al, 3
jne 0x426ef2
cmp byte [ebx + eax - 1], 0x3d
jne 0x426ef9
mov edx, 1
jmp 0x426efb
xor edx, edx
lea edi, [eax + 3]
mov dword [esi + 0x10], 0
shr edi, 2
sub edi, edx
mov dword [esi + 0x14], 0
shl edi, 2
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], edi
mov dword [esi + 0x10], 0
jb 0x426f32
mov eax, dword [esi]
jmp 0x426f34
mov eax, esi
mov ecx, edi
mov byte [eax], 0
shr ecx, 2
push 0
lea eax, [edx + ecx*2]
add eax, ecx
mov ecx, esi
push eax
call fcn.00404770
xor edx, edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test edi, edi
je 0x426fef
dec edi
inc ebx
shr edi, 2
inc edi
mov dword [ebp - 0x10], edi
nop dword [eax]
movzx eax, byte [ebx - 1]
mov ecx, dword [eax*4 + 0x4877f8]
movzx eax, byte [ebx]
shl ecx, 6
or ecx, dword [eax*4 + 0x4877f8]
movzx eax, byte [ebx + 1]
shl ecx, 6
or ecx, dword [eax*4 + 0x4877f8]
movzx eax, byte [ebx + 2]
shl ecx, 6
or ecx, dword [eax*4 + 0x4877f8]
cmp dword [esi + 0x14], 0x10
jb 0x426fae
mov edi, dword [esi]
jmp 0x426fb0
mov edi, esi
mov eax, ecx
sar eax, 0x10
mov byte [edi + edx], al
cmp dword [esi + 0x14], 0x10
jb 0x426fc2
mov edi, dword [esi]
jmp 0x426fc4
mov edi, esi
mov eax, ecx
sar eax, 8
mov byte [edi + edx + 1], al
cmp dword [esi + 0x14], 0x10
jb 0x426fd7
mov eax, dword [esi]
jmp 0x426fd9
mov eax, esi
mov byte [eax + edx + 2], cl
add ebx, 4
add edx, 3
sub dword [ebp - 0x10], 1
jne 0x426f70
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0
je 0x42705d
movzx eax, byte [edi + ebx]
movzx ecx, byte [edi + ebx + 1]
mov ebx, dword [esi + 0x10]
mov edx, dword [eax*4 + 0x4877f8]
shl edx, 6
or edx, dword [ecx*4 + 0x4877f8]
shl edx, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x42701f
mov ecx, dword [esi]
jmp 0x427021
mov ecx, esi
mov eax, edx
sar eax, 0x10
mov byte [ecx + ebx - 1], al
lea eax, [edi + 2]
cmp dword [ebp + 8], eax
jbe 0x42705d
mov eax, dword [ebp - 0x18]
mov al, byte [edi + eax + 2]
cmp al, 0x3d
je 0x42705d
movzx eax, al
mov ecx, esi
sar edx, 8
mov eax, dword [eax*4 + 0x4877f8]
shl eax, 6
sar eax, 8
or al, dl
movzx eax, al
push eax
call fcn.00422240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475812
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x427488
mov eax, dword [esi]
jmp 0x42748a
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
lea eax, [edi + 0xc]
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x11c], ecx
jb 0x4274ad
mov eax, dword [eax]
lea ecx, [ebp - 0x11c]
push ecx
push 0x20019
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x427533
push 0x104
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0044f9d0
lea eax, [edi + 0xe4]
mov dword [ebp - 0x118], 0x104
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4274f8
mov eax, dword [eax]
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x427533
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
shr ecx, 1
dec ecx
push ecx
push eax
mov ecx, esi
call fcn.00413840
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret 4

Function at 0x427a20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4218
call fcn.00437650
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x4000
lea eax, [ebp - 0x420c]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.0044f9d0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x427a5d
mov eax, dword [esi]
jmp 0x427a5f
mov eax, esi
lea ecx, [ebp - 0x4210]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x427b2b
cmp eax, 0x3fff
ja 0x427b2b
cmp dword [esi + 0x14], 8
jb 0x427a88
mov esi, dword [esi]
lea ecx, [ebp - 0x420c]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x427b2b
lea eax, [ebp - 0x4214]
push eax
lea eax, [ebp - 0x4218]
push eax
push 0x48979c
lea eax, [ebp - 0x420c]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x427b2b
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044f9d0
mov ecx, dword [ebp - 0x4218]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.004082b0
add esp, 0x28
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00402d60
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x428f30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x16c]
mov ebx, edx
push 0
push eax
mov esi, ecx
call fcn.0044f9d0
push esi
push 0x48b1b0
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x1d0], 0
push 0x104
push eax
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1cc], 0x67452301
mov dword [ebp - 0x1c8], 0xefcdab89
mov dword [ebp - 0x1c4], 0x98badcfe
mov dword [ebp - 0x1c0], 0x10325476
call fcn.00428510
lea ecx, [ebp - 0x16c]
add esp, 0x1c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x428fc0
sub ecx, edx
lea edx, [ebp - 0x16c]
push ecx
lea ecx, [ebp - 0x1d4]
call fcn.00428d60
lea ecx, [ebp - 0x1d4]
call fcn.00428e20
lea ecx, [ebp - 0x1d4]
call fcn.00428e20
movups xmm0, xmmword [ebp - 0x17c]
push 0x40
lea eax, [ebp - 0x64]
push 0
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.0044f9d0
add esp, 0x10
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0x20]
xorps xmm0, xmm0
push eax
push str._02x
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push 8
push eax
call fcn.00428510
lea ecx, [ebp - 0x64]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x429037
sub ecx, edx
lea eax, [ebp - 0x10]
mov edx, 0x40
lea edi, [eax + 1]
sub edx, ecx
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429050
sub eax, edi
cmp edx, eax
cmovl eax, edx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push 0x40
push eax
call fcn.004615f7
inc esi
add esp, 0x10
cmp esi, 0x10
jl 0x429010
test ebx, ebx
je 0x4290aa
push 0x104
push 0
push ebx
call fcn.0044f9d0
lea eax, [ebp - 0x64]
push eax
push 0x48b1b0
push 0x103
push ebx
call fcn.00428510
push 0x104
push ebx
call fcn.0046177e
add esp, 0x24
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x4294a0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d10
call fcn.00437650
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x2d10], eax
test eax, eax
je 0x429600
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.00428590
add esp, 0x10
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4295e3
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2d00], 0
lea eax, [ebp - 0x2cfc]
movq qword [ebp - 0x2d0c], xmm0
push 0
push eax
mov dword [ebp - 0x2d04], 0
mov dword [ebp - 0x2d0c], 0
mov dword [ebp - 0x2d08], 0
call fcn.0044f9d0
add esp, 0xc
lea eax, [ebp - 0x2d00]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d0c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4295d8
push 0x3e8
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.0044f9d0
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x5ec]
add esp, 0xc
push eax
push ecx
lea ecx, [ebp - 0x2cfc]
call fcn.00429fc0
mov ecx, dword [ebp - 0x2d10]
lea eax, [ebp - 0x5ec]
add esp, 8
mov edx, 0x64
push eax
call fcn.00428390
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4295ed
inc esi
cmp esi, 0x10
jl 0x4294d0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x4298c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x4f4], ebx
test ebx, ebx
je 0x429ab7
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0044f9d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x4ec]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x429a88
push edi
xor edi, edi
mov dword [ebp - 0x4e0], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x2d4]
push eax
push edi
push dword [ebp - 0x4ec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x429a79
lea eax, [ebp - 0x4f0]
push eax
push 1
push 0
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x4ec]
call esi
test eax, eax
jne 0x429a43
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x4e8], 1
push eax
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4e4], 0x208
push eax
lea eax, [ebp - 0x4e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x4f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429a3b
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0044f9d0
add esp, 8
lea edx, [ebp - 0xcc]
lea ecx, [ebp - 0x4dc]
call fcn.004297a0
add esp, 4
test eax, eax
je 0x429a3b
cmp byte [ebp - 0x68], 0
je 0x4299ff
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x429a3b
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x429a2a
mov al, byte [esi + ecx]
test al, al
je 0x429a2a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x429a11
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x4f0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4e0], 0x104
push eax
lea eax, [ebp - 0x2d4]
inc edi
push eax
push edi
push dword [ebp - 0x4ec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x429954
push dword [ebp - 0x4ec]
call ebx
mov ebx, dword [ebp - 0x4f4]
pop edi
cmp byte [ebp - 0x68], 0
pop esi
je 0x429ab7
lea eax, [ebp - 0x68]
mov edx, 0x64
push eax
mov ecx, ebx
call fcn.00428390
xor ecx, ecx
test eax, eax
pop ebx
setns cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x42d320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4732f6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x498070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x50]
xor al, al
mov ecx, dword [esi + 0x4c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0044ec7d
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0044ec7d
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42d381
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x42d392
push 0x60
push esi
call fcn.004368d3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42e020
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
push esi
mov dword [ebp - 0x14], edx
push edi
nop
movzx edi, byte [edx + 0x487d38]
mov eax, edi
mov dword [ebp - 8], edi
shr eax, 5
mov esi, edi
mov edx, eax
shr esi, 6
mov ebx, eax
lea ecx, [edi + edi]
xor ecx, edi
and eax, 1
mov dword [ebp - 0x10], eax
and ebx, 2
shr edi, 7
and edx, 4
mov dword [ebp - 0xc], edx
mov edx, esi
lea eax, [ecx + ecx]
and esi, 1
xor eax, dword [ebp - 8]
and edx, 2
shl eax, 0x19
mov dword [ebp - 4], eax
imul eax, edi, 0x1b000000
shl ecx, 2
xor ecx, dword [ebp - 8]
shl ecx, 8
xor dword [ebp - 4], eax
imul eax, dword [ebp - 0x10], 0x1b000000
xor dword [ebp - 4], eax
imul eax, ebx, 0x1b000000
xor dword [ebp - 4], eax
imul eax, esi, 0x1b000000
xor dword [ebp - 4], eax
imul eax, edx, 0x1b000000
xor dword [ebp - 4], eax
imul eax, dword [ebp - 0xc], 0x1b000000
xor dword [ebp - 4], eax
imul eax, dword [ebp - 0x10], 0x11b00
xor ecx, eax
imul eax, ebx, 0x11b00
xor ecx, eax
imul eax, esi, 0x11b00
xor ecx, eax
imul eax, edx, 0x11b00
mov edx, dword [ebp - 4]
xor ecx, eax
imul eax, dword [ebp - 0xc], 0x11b00
xor ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
lea ecx, [eax*8]
xor ecx, eax
imul eax, dword [ebp - 0x10], 0x11b0000
shl ecx, 0x10
xor ecx, eax
imul eax, ebx, 0x11b0000
xor ecx, eax
imul eax, dword [ebp - 0xc], 0x11b0000
xor ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
lea ecx, [eax*4]
xor ecx, eax
imul eax, edi, 0x11b
add ecx, ecx
xor ecx, eax
imul eax, dword [ebp - 0x10], 0x11b
xor ecx, eax
imul eax, ebx, 0x11b
mov ebx, dword [ebp - 8]
xor ecx, eax
imul eax, dword [ebp - 0xc], 0x11b
xor ecx, eax
xor eax, eax
xor ecx, ebx
or ebx, edx
or ecx, edx
mov edx, dword [ebp - 0x14]
or eax, ebx
mov dword [edx*8 + 0x49e2c8], eax
mov dword [edx*8 + 0x49e2cc], ecx
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x100
jl 0x42e030
pop edi
pop esi
mov byte [0x49cd12], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4391f2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x200
mov edi, eax
lea eax, [ebp - 0x204]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
mov dword [ebp - 0x208], 0
push 0
lea eax, [ebp - 0x208]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
call esi
jmp 0x401057
Function at 0x7f7b28
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007f7c78
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7f7b4e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f7b3a
add dl, dl
jne 0x7f7b59
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f7bac
xor eax, eax
add dl, dl
jne 0x7f7b66
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f7c4d
add dl, dl
jne 0x7f7b75
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f7b80
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f7b8b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f7b96
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7f7ba2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7f7b45
mov eax, 1
add dl, dl
jne 0x7f7bba
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f7bc5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f7bb1
sub eax, ebx
mov ebx, 1
jne 0x7f7bf8
mov ecx, 1
add dl, dl
jne 0x7f7bde
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7f7be9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f7bd5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f7b45
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7f7c0f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7f7c1a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f7c06
cmp eax, 0x7d00
jae 0x7f7c3d
cmp eax, 0x500
jb 0x7f7c38
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f7b45
cmp eax, 0x7f
ja 0x7f7c40
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f7b45
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7f7c6e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7f7b45
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401690
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x403608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov esi, ecx
call fcn.004018a0
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x38]
lea ecx, [esp + 8]
push eax
push str..COM_d
push ecx
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::Format
mov edi, dword [esp + 0x5c]
add esp, 0xc
mov edx, edi
mov eax, dword [esp + 8]
neg edx
sbb edx, edx
push 0
and edx, 0x40000000
push edx
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x401714
push 0
call fcn.00401490
add esp, 4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40173a
mov ecx, esi
call fcn.004018a0
push 0
call fcn.00401490
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esi + 8], edi
push ecx
mov ecx, esi
mov dword [esp + 0x10], 0x1c
call fcn.00401c90
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], edx
cmp eax, 4
mov dl, 2
mov cl, 1
ja case.default.0x401766
jmp dword [eax*4 + 0x401868]
mov byte [esp + 0x1f], dl
jmp case.default.0x401766
mov byte [esp + 0x1f], 3
jmp case.default.0x401766
mov byte [esp + 0x1f], 0
jmp case.default.0x401766
mov byte [esp + 0x1f], cl
jmp case.default.0x401766
mov byte [esp + 0x1f], 4
mov al, byte [esp + 0x44]
mov byte [esp + 0x1e], al
mov eax, dword [esp + 0x48]
sub eax, 0
je 0x4017af
dec eax
je 0x4017a9
dec eax
jne 0x4017b4
mov byte [esp + 0x20], dl
jmp 0x4017b4
mov byte [esp + 0x20], cl
jmp 0x4017b4
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x4c]
and al, 0xbf
cmp ecx, 5
mov dword [esp + 0x14], eax
ja case.default.0x4017c7
jmp dword [ecx*4 + 0x40187c]
and eax, 0xfffffcf3
mov dword [esp + 0x14], eax
jmp case.default.0x4017c7
and eax, 0xffffecf7
or eax, 0x2004
mov dword [esp + 0x14], eax
jmp case.default.0x4017c7
and eax, 0xfffffce7
or al, 0x24
mov dword [esp + 0x14], eax
jmp case.default.0x4017c7
and eax, 0xffffecfb
or eax, 0x2008
mov dword [esp + 0x14], eax
jmp case.default.0x4017c7
and eax, 0xfffffceb
or al, 0x28
mov dword [esp + 0x14], eax
jmp case.default.0x4017c7
and al, 0xf3
or ah, 3
mov dword [esp + 0x14], eax
mov eax, 0x64
mov byte [esp + 0x21], 0x11
mov byte [esp + 0x22], 0x13
mov word [esp + 0x1c], ax
mov word [esp + 0x1a], ax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00401cb0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00403362
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x1c

Function at 0x401950
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401981
push eax
call fcn.00401490
add esp, 4
mov eax, dword [esp]
pop ecx
ret 8