joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417784
Capabilities:
Terminate process

Disassembly:
push 0x404050
call fcn.00417806
pop ecx
pop edx
test ax, ax
jne 0x41776a
lea ecx, [esp + 0x10]
jo 0x41763d
jno 0x41763d
call 0x4081ddfb
add byte [ecx + 0x71037029], cl
add eax, ebp
mov edx, 0x404067
mov dword [ecx], ebp
jo 0x417649
jno 0x417649
call 0x472977b7
add dword [eax], eax
add byte [ecx + 0x66], bl
test eax, eax
push 1
call fcn.00417796
pop ecx
test ax, ax
jnp 0x417659
jp 0x417659
call 0x151fb6c
add byte [eax], al
jne 0x41776f
jl 0x417664
jge 0x417664
call 0x5a17cc
add byte [eax], al
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0x10]
mov edx, 0x4040d8
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
jno 0x417683
jo 0x417683
call 0x3bf7d10
mov dword [esi], eax
jle 0x41768a
jg 0x41768a
call 0x629a6f8
add dword [eax], eax
add byte [ecx + 0x79], bl
add edi, dword [eax + 1]
push 0x30
call fcn.00417796
pop ecx
jns 0x417697
js 0x417697
call 0x1bf7a1a
jg 0x41769c
jle 0x41769c
call 0x44120f08
add al, ch
into
int1
add dword [eax], eax
push 0x43d098
call 0x436874
jge 0x4176ab
jl 0x4176ab
call 0x9c4f759f
rol byte [ebx], 1
lock dec byte [0x43d09c]
je 0x417779
jnp 0x4176bd
jp 0x4176bd
call 0x865db44
add byte [eax + 3], dh
and dword [esp + 8], 0
jo 0x4176c7
jno 0x4176c7
call 0x1065db4e
add byte [ebx + eax + 0x7d], bh
add eax, ebp
and dword [esp + 0x10], 0
jl 0x4176d1
jge 0x4176d1
call 0x4ab773f
push 0
push 4
push esi
push ebx
call sub.ntdll.dll_RtlWaitOnAddress
jg 0x4176e1
jle 0x4176e1
call 0x1b77a5c
ja 0x4176e6
jbe 0x4176e6
call 0xf8c551d5
add dword [edi], ecx
test dword [ebp + 0x7e000000], ecx
add edi, dword [edi + 1]
call 0x44120b9b
add byte [ebx + ecx*4 + 0xd], ah
sub al, 0
add byte [eax], al
mov edx, 0x404069
mov eax, dword [ecx + eax*4]
lea ecx, [esp + 0x10]
mov dword [eax + 0x210], 2
js 0x41771d
jmp 0x4176c2
jns 0x41771d
call 0x5a1885
add byte [eax], al
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
call 0x417732
add al, ch
mov dword [ecx], eax
jne 0x41773a
je 0x41773a
call 0x56299aa8
add byte [eax], al
add byte [ecx + 0x66], bl
test eax, eax
push 0x23
call fcn.00417796
pop ecx
test ax, ax
jbe 0x41774a
ja 0x41774a
call 0x3b2a9c2
je 0x41777e
jno 0x417751
jo 0x417751
call fcn.0041ac3d
add byte [edx + 3], bh
call 0x41778a
jp 0x41775b
jnp 0x41775b
call 0x1ba7ad7
js 0x417760
jns 0x417760
call 0x1bb7adf
jnp 0x417765
jp 0x417765
call fcn.00419851
add byte [ebp + 3], bh
call 0x41778a
jge 0x41776f
jl 0x41776f
call 0x1b97aec
jns 0x417774
js 0x417774
call fcn.00418960
add byte [ebx + 3], dh
call 0x41778a
jae 0x41777e
jb 0x41777e
call fcn.0041796a
add byte [eax], al
call fcn.00417871
add byte [esi + 3], dh
call 0x417784
add al, ch
call 0x41778a
jbe 0x41778f
ja 0x41778f
call 0x6d297afd
lock add dword [eax], eax
push 3
call 0x436802
Function at 0x41778a
Capabilities:
Terminate process

Disassembly:
push 0x404050
call fcn.00417806
pop ecx
pop edx
test ax, ax
jne 0x41776a
lea ecx, [esp + 0x10]
jo 0x41763d
jno 0x41763d
call 0x4081ddfb
add byte [ecx + 0x71037029], cl
add eax, ebp
mov edx, 0x404067
mov dword [ecx], ebp
jo 0x417649
jno 0x417649
call 0x472977b7
add dword [eax], eax
add byte [ecx + 0x66], bl
test eax, eax
push 1
call fcn.00417796
pop ecx
test ax, ax
jnp 0x417659
jp 0x417659
call 0x151fb6c
add byte [eax], al
jne 0x41776f
jl 0x417664
jge 0x417664
call 0x5a17cc
add byte [eax], al
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0x10]
mov edx, 0x4040d8
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
jno 0x417683
jo 0x417683
call 0x3bf7d10
mov dword [esi], eax
jle 0x41768a
jg 0x41768a
call 0x629a6f8
add dword [eax], eax
add byte [ecx + 0x79], bl
add edi, dword [eax + 1]
push 0x30
call fcn.00417796
pop ecx
jns 0x417697
js 0x417697
call 0x1bf7a1a
jg 0x41769c
jle 0x41769c
call 0x44120f08
add al, ch
into
int1
add dword [eax], eax
push 0x43d098
call 0x436874
jge 0x4176ab
jl 0x4176ab
call 0x9c4f759f
rol byte [ebx], 1
lock dec byte [0x43d09c]
je 0x417779
jnp 0x4176bd
jp 0x4176bd
call 0x865db44
add byte [eax + 3], dh
and dword [esp + 8], 0
jo 0x4176c7
jno 0x4176c7
call 0x1065db4e
add byte [ebx + eax + 0x7d], bh
add eax, ebp
and dword [esp + 0x10], 0
jl 0x4176d1
jge 0x4176d1
call 0x4ab773f
push 0
push 4
push esi
push ebx
call sub.ntdll.dll_RtlWaitOnAddress
jg 0x4176e1
jle 0x4176e1
call 0x1b77a5c
ja 0x4176e6
jbe 0x4176e6
call 0xf8c551d5
add dword [edi], ecx
test dword [ebp + 0x7e000000], ecx
add edi, dword [edi + 1]
call 0x44120b9b
add byte [ebx + ecx*4 + 0xd], ah
sub al, 0
add byte [eax], al
mov edx, 0x404069
mov eax, dword [ecx + eax*4]
lea ecx, [esp + 0x10]
mov dword [eax + 0x210], 2
js 0x41771d
jmp 0x4176c2
jns 0x41771d
call 0x5a1885
add byte [eax], al
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
call 0x417732
add al, ch
mov dword [ecx], eax
jne 0x41773a
je 0x41773a
call 0x56299aa8
add byte [eax], al
add byte [ecx + 0x66], bl
test eax, eax
push 0x23
call fcn.00417796
pop ecx
test ax, ax
jbe 0x41774a
ja 0x41774a
call 0x3b2a9c2
je 0x41777e
jno 0x417751
jo 0x417751
call fcn.0041ac3d
add byte [edx + 3], bh
call 0x41778a
jp 0x41775b
jnp 0x41775b
call 0x1ba7ad7
js 0x417760
jns 0x417760
call 0x1bb7adf
jnp 0x417765
jp 0x417765
call fcn.00419851
add byte [ebp + 3], bh
call 0x41778a
jge 0x41776f
jl 0x41776f
call 0x1b97aec
jns 0x417774
js 0x417774
call fcn.00418960
add byte [ebx + 3], dh
call 0x41778a
jae 0x41777e
jb 0x41777e
call fcn.0041796a
add byte [eax], al
call fcn.00417871
add byte [esi + 3], dh
call 0x417784
add al, ch
call 0x41778a
jbe 0x41778f
ja 0x41778f
call 0x6d297afd
lock add dword [eax], eax
push 3
call 0x436802
Function at 0x4198d6
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x4c]
movzx ebx, byte [esp + 0x50]
mov dword [esp], ecx
jbe 0x4198ee
ja 0x4198ee
call 0x7ccca37d
and al, 0x48
mov ecx, dword [edx]
mov edi, dword [esp + 0x48]
movzx ebp, byte [eax + 1]
and ebx, 1
mov dword [esp + 4], ecx
mov ecx, edi
jle 0x419906
jg 0x419906
call 0x1b69c7e
je 0x41990b
jne 0x41990b
call 0x1bc9c89
jp 0x419910
jnp 0x419910
call 0x1b39c87
jae 0x419915
jb 0x419915
call 0x1ba9c91
js 0x41991a
jns 0x41991a
call 0xea649f
adc al, byte [eax]
or ebx, 0x1200a8
call fcn.00419ca6
lea ecx, [edx + edx]
lea esi, [esp + 0xc]
mov word [esi], cx
mov word [esi + 2], cx
mov dword [esi + 4], edi
lea edi, [esp + 0x1c]
mov ecx, eax
mov dword [edi], 0x18
jg 0x419947
jle 0x419947
call 0xffcc9533
push dword [ecx]
leave
call 0x412447
xor ecx, ecx
test al, 1
lea eax, [esp + 8]
cmove ecx, dword [esp + 4]
shl ebp, 0x15
or ebp, 0x4021
mov dword [edi + 4], ecx
and dword [edi + 0xc], 0
mov dword [edi + 8], esi
and dword [edi + 0x10], 0
and dword [edi + 0x14], 0
ja 0x419979
jbe 0x419979
call 0x1465e60a
lea ecx, [esp + 0x14]
push 0
push 0
push ebp
push 1
push 3
push 0
push 0
push ecx
push edi
push ebx
push eax
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x4199c0
test eax, eax
je 0x4199cb
cmp eax, 0xc000003a
je 0x4199f5
cmp eax, 0xc0000103
je 0x419a00
mov cx, 0xe
cmp eax, 0xc0000034
jne 0x419a09
call 0x4199bd
add al, ch
jmp 0x4199fa
jg 0x4199c5
jle 0x4199c5
call 0x4b532f
mov cx, 9
jmp 0x419a09
jnp 0x4199d0
jp 0x4199d0
call 0x865de5f
mov eax, dword [esp + 8]
jno 0x4199d9
jo 0x4199d9
call 0x1b79d54
ja 0x4199de
jbe 0x4199de
call 0x1b89d58
jbe 0x4199e3
ja 0x4199e3
call fcn.00419bcf
add byte [eax], al
call 0x8965a679
add dword [ecx - 0x1436ce38], ecx
sub edi, dword [edi + 3]
call 0x4199e9
add al, ch
mov ecx, dword [esp]
mov dword [ecx], eax
mov eax, ecx
xor ecx, ecx
jmp 0x419a20
jg 0x4199fa
jle 0x4199fa
call 0x4a5364
mov cx, 8
jmp 0x419a09
jbe 0x419a05
ja 0x419a05
call 0x5b536f
mov cx, 0x19
jae 0x419a0e
jb 0x419a0e
call 0x1b19d83
jno 0x419a13
jo 0x419a13
call 0x1b39d8a
jae 0x419a18
jb 0x419a18
call 0x1bc9d96
jp 0x419a1d
jnp 0x419a1d
call 0x7d659eac
add edi, dword [ecx + eax - 0x18]
mov eax, dword [esp]
jge 0x419a25
jl 0x419a25
call 0x48a238f
mov word [eax + 4], cx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419bcf
Capabilities:
Create process on windows

Disassembly:
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x419bdc
xor eax, eax
jmp 0x419bfd
jge 0x419be1
jl 0x419be1
call 0x20dd6cd
add byte [edi], cl
mov bh, 0xc0
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
lea ecx, [eax - 0xbc]
cmp ecx, 0xf
jae 0x419c06
mov ax, 0x6d
ja 0x419bfd
jbe 0x419bfd
call 0x1b29f71
jo 0x419c02
jno 0x419c02
call 0xc39cfb64
pop esi
pop edi
pop ebx
ret
lea ecx, [eax - 2]
cmp ecx, 2
jb 0x419c36
cmp eax, 5
je 0x419c3c
cmp eax, 0xb
je 0x419bf4
cmp eax, 0x7b
je 0x419c47
cmp eax, 0xce
je 0x419c52
cmp eax, 0xd8
je 0x419bf4
je 0x419c30
jne 0x419c30
call 0x50549a
mov ax, 0xe
jmp 0x419bfd
mov ax, 8
jmp 0x419bfd
ja 0x419c41
jbe 0x419c41
call 0x4b54ab
mov ax, 9
jmp 0x419bfd
jno 0x419c4c
jo 0x419c4c
call 0xb254b6
mov ax, 0x70
jmp 0x419bfd
jp 0x419c57
jnp 0x419c57
call 0x4d54c1
mov ax, 0xb
jmp 0x419bfd
Function at 0x427e9e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
call 0x24c6a6b2
rol byte [eax], 0
add byte [edi], cl
sub dword [esp + 0xb0], eax
movaps xmm0, xmmword [esp + 0xd0]
movaps xmmword [esp + 0xa0], xmm0
movaps xmm0, xmmword [esp + 0xe0]
movaps xmmword [esp + 0x90], xmm0
movaps xmm0, xmmword [esp + 0xf0]
movaps xmmword [esp + 0x80], xmm0
movaps xmm0, xmmword [esp + 0x100]
movaps xmmword [esp + 0x70], xmm0
movaps xmm0, xmmword [esp + 0x110]
movaps xmmword [esp + 0x60], xmm0
movaps xmm0, xmmword [esp + 0x120]
movaps xmmword [esp + 0x50], xmm0
movaps xmm0, xmmword [esp + 0x130]
movaps xmmword [esp + 0x40], xmm0
movdqa xmm4, xmmword [esp + 0x140]
movdqa xmm5, xmmword [esp + 0x150]
movdqa xmm6, xmmword [esp + 0x160]
movaps xmm0, xmmword [esp + 0x170]
movaps xmmword [esp + 0x10], xmm0
movaps xmm0, xmmword [esp + 0x180]
movaps xmmword [esp], xmm0
movaps xmm0, xmmword [esp + 0x190]
movaps xmmword [esp + 0x30], xmm0
movdqa xmm0, xmmword [esp + 0x1a0]
movdqa xmmword [esp + 0x20], xmm0

Function at 0x4281ea
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
call fcn.004281ea
add al, ch
call 0x1f8691fe
add al, 0xf
sub dword [esp + ebx + 0x160], eax
call 0x1f8691fe
add al, 0xf
sub dword [esp + ebx + 0x160], eax
inc eax
add ebx, 0x10
cmp eax, esi
jbe 0x4281e4
jne 0x428205
je 0x428205
call 0xf34eff94
movq mm0, qword [edi]
mov edi, dword [ebp + 0xc]
movdqu xmm0, xmmword [edi]
pshufb xmm0, xmmword [0x439a30]
movdqa xmmword [esp], xmm0
test ecx, ecx
Function at 0x428a7d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
jp 0x428908
call 0x84525291
mov bh, 1
add byte [eax], al
test ecx, ecx
je 0x428ac7
jns 0x428915
js 0x428915
call 0x24c6b128
nop
add byte [eax], al
add byte [edi], cl
sub dword [esp + 0x80], eax
movaps xmm0, xmmword [esp + 0x90]
movaps xmmword [esp + 0x80], xmm0
movaps xmm0, xmmword [esp + 0xa0]
movaps xmmword [esp + 0x70], xmm0
movaps xmm0, xmmword [esp + 0xb0]
movaps xmmword [esp + 0x60], xmm0
movaps xmm0, xmmword [esp + 0xc0]
movaps xmmword [esp + 0x50], xmm0
movaps xmm0, xmmword [esp + 0xd0]
movaps xmmword [esp + 0x40], xmm0
movdqa xmm5, xmmword [esp + 0xe0]
movdqa xmm6, xmmword [esp + 0xf0]
movdqa xmm7, xmmword [esp + 0x100]
movdqa xmm0, xmmword [esp + 0x110]
movdqa xmm1, xmmword [esp + 0x120]
movdqa xmm2, xmmword [esp + 0x130]
movaps xmm3, xmmword [esp + 0x140]
movaps xmmword [esp + 0x10], xmm3
movaps xmm3, xmmword [esp + 0x150]
movaps xmmword [esp], xmm3
movaps xmm3, xmmword [esp + 0x160]
movaps xmmword [esp + 0x30], xmm3
movdqa xmm3, xmmword [esp + 0x170]
movdqa xmmword [esp + 0x20], xmm3
jle 0x4289c9
jg 0x4289c9
call 0x1ab199c0
movdqu xmm3, xmmword [edx]
pxor xmm3, xmm4
pxor xmm3, xmmword [esp + 0x80]
je 0x4289df
jne 0x4289df
call 0xdc7a9949
pop esp
and al, 0x70
aesenc xmm3, xmmword [esp + 0x70]
je 0x4289eb
jne 0x4289eb
call 0xdc7a9955
pop esp
and al, 0x60
aesenc xmm3, xmmword [esp + 0x60]
aesenc xmm3, xmmword [esp + 0x50]
jbe 0x4289fe
ja 0x4289fe
call 0x1c08d81
jg 0x428a03
jle 0x428a03
call 0xdc7a996d
pop esp
and al, 0x40
aesenc xmm3, xmmword [esp + 0x40]
jae 0x428a0f
jb 0x428a0f
call 0xdc7a9979
fnstsw word [ebx + 3]
aesenc xmm3, xmm5
jnp 0x428a19
jp 0x428a19
call 0xdc7a9983
fisub word [esi + 0xf]
cmp ah, bl
fucompi st(0)
add dword [eax], eax
add byte [eax], al
aesenc xmm3, xmm6
aesenc xmm3, xmm7
call 0x428a29
add al, ch
jo 0x428a2f
jno 0x428a2f
call 0xdc7a9999
fdiv dword [ebx + eax + 0x75]
add eax, ebp
aesenc xmm3, xmm0
je 0x428a39
jne 0x428a39
call 0xdc7a99a3
fld dword [ebx + 0x11740cfe]
aesenc xmm3, xmm1
cmp esi, 0xc
je 0x428a54
cmp esi, 0xa
jne 0x428a77
jp 0x428a4d
jnp 0x428a4d
call 0xdd7a99b7
invalid
aesenclast xmm3, xmm2
jmp 0x428ab2
aesenc xmm3, xmm2
jno 0x428a5e
jo 0x428a5e
call 0x1ba8ddb
jns 0x428a63
js 0x428a63
call 0xdc7a99cd
pop esp
and al, 0x10
aesenc xmm3, xmmword [esp + 0x10]
jbe 0x428a6f
ja 0x428a6f
call 0xdd7a99d9
sbb al, 0x24
aesenclast xmm3, xmmword [esp]
jmp 0x428ab2
call 0x428a7d
add al, ch
aesenc xmm3, xmm2
jo 0x428a88
jno 0x428a88
call 0xdc7a99f2
pop esp
and al, 0x10
aesenc xmm3, xmmword [esp + 0x10]
aesenc xmm3, xmmword [esp]
jne 0x428a9a
je 0x428a9a
call 0x1ba8e17
jns 0x428a9f
js 0x428a9f
call 0xdc7a9a09
pop esp
and al, 0x30
aesenc xmm3, xmmword [esp + 0x30]
jno 0x428aab
jo 0x428aab
call 0xdd7a9a15
pop esp
and al, 0x20
aesenclast xmm3, xmmword [esp + 0x20]
movdqa xmm4, xmm3
jl 0x428abb
jge 0x428abb
call 0x83534d42
sal eax, 0xf
test ebp, edi
invalid
add edx, 0x10
add ecx, 0xfffffff0
jne 0x4289c4
jb 0x428acc
jae 0x428acc
call 0xf34ed05b
movq qword [eax], mm4
mov eax, dword [ebp + 0xc]
movdqu xmmword [eax], xmm4
jge 0x428ad8
jl 0x428ad8
call 0x5f36f069
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42aa59
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
jl 0x42a9a5
jge 0x42a9a5
call 0x1ab1b99c
movdqu xmm3, xmmword [edx]
pxor xmm3, xmm4
pxor xmm3, xmmword [esp + 0x80]
jnp 0x42a9bb
jp 0x42a9bb
call 0xdc7ab925
pop esp
and al, 0x70
aesenc xmm3, xmmword [esp + 0x70]
jge 0x42a9c7
jl 0x42a9c7
call 0xdc7ab931
pop esp
and al, 0x60
aesenc xmm3, xmmword [esp + 0x60]
aesenc xmm3, xmmword [esp + 0x50]
js 0x42a9da
jns 0x42a9da
call 0x1bcad59
jnp 0x42a9df
jp 0x42a9df
call 0xdc7ab949
pop esp
and al, 0x40
aesenc xmm3, xmmword [esp + 0x40]
jle 0x42a9eb
jg 0x42a9eb
call 0xdc7ab955
fnstsw word [edi + 3]
aesenc xmm3, xmm5
jg 0x42a9f5
jle 0x42a9f5
call 0xdc7ab95f
fisub word [esi + 0xf]
cmp ah, bl
fucompi st(0)
add dword [eax], eax
add byte [eax], al
aesenc xmm3, xmm6
aesenc xmm3, xmm7
call 0x42aa05
add al, ch
jne 0x42aa0b
je 0x42aa0b
call 0xdc7ab975
fdivr dword [eax + 3]
aesenc xmm3, xmm0
js 0x42aa15
jns 0x42aa15
call 0xdc7ab97f
fld dword [ebx + 0x11740cfe]
aesenc xmm3, xmm1
cmp esi, 0xc
je 0x42aa30
cmp esi, 0xa
jne 0x42aa53
jl 0x42aa29
jge 0x42aa29
call 0xdd7ab993
invalid
aesenclast xmm3, xmm2
jmp 0x42aa8e
aesenc xmm3, xmm2
js 0x42aa3a
jns 0x42aa3a
call 0x1bfadba
jl 0x42aa3f
jge 0x42aa3f
call 0xdc7ab9a9
pop esp
and al, 0x10
aesenc xmm3, xmmword [esp + 0x10]
jp 0x42aa4b
jnp 0x42aa4b
call 0xdd7ab9b5
sbb al, 0x24
aesenclast xmm3, xmmword [esp]
jmp 0x42aa8e
call fcn.0042aa59
add al, ch
call 0xdc7ab9c4
fidivr dword [ecx + 3]
call 0xdc7ab9c4
fidivr dword [ecx + 3]
js 0x42aa64
call 0xdc7ab9ce
pop esp
and al, 0x10
aesenc xmm3, xmmword [esp + 0x10]
aesenc xmm3, xmmword [esp]
jp 0x42aa76
jnp 0x42aa76
call 0x1b7adee
je 0x42aa7b
jne 0x42aa7b
call 0xdc7ab9e5
pop esp
and al, 0x30
aesenc xmm3, xmmword [esp + 0x30]
ja 0x42aa87
jbe 0x42aa87
call 0xdd7ab9f1
pop esp
and al, 0x20
aesenclast xmm3, xmmword [esp + 0x20]
movdqa xmm4, xmm3
jo 0x42aa97
jno 0x42aa97
call 0x1ac1ba8e
movdqu xmmword [edx], xmm3
add edx, 0x10
add ecx, 0xfffffff0
jne 0x42a9a0
jge 0x42aaac
jl 0x42aaac
call 0xf34ef03b
movq qword [eax], mm4
mov eax, dword [ebp + 0xc]
movdqu xmmword [eax], xmm4
call 0x42aab9
add al, ch
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ae7e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push esi
mov esi, dword [esp + 8]
je 0x42ae88
jne 0x42ae88
call 0xf63ad0f
test byte [edx + eax - 0x17d0000], ch
sbb byte [edi], cl
test byte [ecx], dl
push es
cmp esi, 0x20
je 0x42b13d
cmp esi, 0x18
je 0x42b4ab
add byte [eax], al
jb 0x42b142
jae 0x42b142
call 0xab1c139
movdqu xmm1, xmmword [edx]
movdqu xmm2, xmmword [edx + 0x10]
movdqa xmmword [ecx], xmm1
movdqa xmmword [ecx + 0x10], xmm2
jb 0x42b159
jae 0x42b159
call 0xdf7cc0c3
ret 0x6601
aeskeygenassist xmm0, xmm2, 1
pshufd xmm3, xmm0, 0xff
movdqa xmm4, xmm1
pslldq xmm4, 4
movdqa xmm5, xmm1
pslldq xmm5, 8
jg 0x42b4b0
jle 0x42b4b0
call 0xab1c4a7
movdqu xmm1, xmmword [edx]
movdqu xmm0, xmmword [edx + 8]
pshufd xmm2, xmm0, 0x4e
movdqa xmmword [ecx], xmm1
jle 0x42b4c7
jg 0x42b4c7
call 0xdf7cc431
ret 0x6601
aeskeygenassist xmm0, xmm2, 1
pshufd xmm3, xmm0, 0x55
movdqa xmm4, xmm1
pslldq xmm4, 4
movdqa xmm5, xmm1
pslldq xmm5, 8
movdqa xmm0, xmm1
pslldq xmm0, 0xc
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm1
pxor xmm0, xmm3
pshufd xmm3, xmm0, 0xff
movdqa xmm1, xmm2
pslldq xmm1, 4
pxor xmm1, xmm2
pxor xmm1, xmm3
punpcklqdq xmm2, xmm0
movdqa xmmword [ecx + 0x10], xmm2
movq qword [ecx + 0x10], mm2
Function at 0x10002a70
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0xc3
push 0x17e27d1
mov dword [esi + 8], 0x19f78c0
mov dword [esi + 0xc], 0x19b24b0
mov dword [esi + 4], 0xa3004a4
mov dword [esi + 0x10], 0x1c32b10
mov dword [esi + 0x14], 0x1c32b14
mov dword [esi + 0x18], 0x1c32b18
mov dword [esi + 0x28], 0xa300a94
mov dword [esi + 0x2c], 0x17db926
call fcn.100145e0
push 5
push 0x90
push 0x12bcd03
call fcn.100145a0
push 0x10002f80
push 0x12bcd03
push 0xe8
call fcn.10014620
add esp, 0x20
mov dword [esi + 0x30], 0x420c0000
mov dword [esi + 0x34], 2
push 0
push 0
push 0
push 0x10002ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [esi + 0x78], 1
pop esi
ret

Function at 0x10003e70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
sub esi, 1
push edi
mov edi, dword [esp + 0xc]
js 0x10003f37
movzx ecx, byte [edi]
lea edi, [edi + 1]
shl ecx, 8
xor eax, ecx
lea ecx, [eax + eax]
mov edx, ecx
xor edx, 0x10213465
and eax, 0x8000
cmove edx, ecx
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x10213465
and edx, 0x8000
cmove ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x10213465
and ecx, 0x8000
cmove edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x10213465
and edx, 0x8000
cmove ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x10213465
and ecx, 0x8000
cmove edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x10213465
and edx, 0x8000
cmove ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x10213465
and ecx, 0x8000
cmove edx, eax
lea ecx, [edx + edx]
mov eax, ecx
xor eax, 0x10213465
and edx, 0x8000
cmove eax, ecx
sub esi, 1
jns 0x10003e85
pop edi
pop esi
ret

Function at 0x10003f40
Capabilities:
Read file on windows

Disassembly:
push ebx
push 0x10067800
push ecx
call fcn.1004ce8f
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10003f57
pop ebx
ret
push esi
push edi
push 2
push 0
push ebx
call fcn.1004d4a3
push ebx
call fcn.1004db02
push 0
push 0
push ebx
mov esi, eax
call fcn.1004d4a3
push esi
call fcn.10045ee9
push ebx
push esi
mov edi, eax
push 1
push edi
call fcn.1004d07f
push esi
push edi
call fcn.10003e70
push ebx
mov esi, eax
call fcn.1004cda8
push edi
call fcn.10045ef2
add esp, 0x40
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100130f0
Capabilities:
Create thread

Disassembly:
push ecx
push str.MutexExample
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
test eax, eax
jne 0x10013117
push eax
push str.Mutex_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ecx
ret
push 1
lea eax, [esp + 0xb]
push eax
push 0x1c324e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10013010
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp byte [esp + 3], 0x32
mov dword [0x10098920], eax
je 0x1001316e
push 0
push 0
push 0
push 0x10012fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ecx
ret

Function at 0x100132b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x100132df
push edi
mov edi, dword [esp + 0xc]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [edx + 0x1008b574]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x100132c0
pop edi
pop esi
ret

Function at 0x100132f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x1008b880]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x34]
sub esi, 1
mov dword [esp + 4], 0xfecd11ab
mov dword [esp + 8], 0xa3c52318
mov dword [esp + 0xc], 0xccc133ca
mov dword [esp + 0x10], 0xf3216766
mov dword [esp + 0x14], 0x35151232
mov dword [esp + 0x18], 0x1dfeff29
mov dword [esp + 0x1c], 0x41cdef44
mov dword [esp + 0x20], 0x4d4e3c26
js 0x10013380
push ebx
mov bl, byte [ecx + esi]
lea edx, [ecx + esi]
push edi
mov edi, dword [esp + 0x38]
sub edi, ecx
nop word [eax + eax]
mov cl, byte [edx - 1]
lea eax, [edi + edx]
and eax, 0x1f
lea edx, [edx - 1]
mov al, byte [esp + eax + 0xc]
xor al, cl
xor al, bl
sub esi, 1
mov byte [edx + 1], al
mov bl, cl
jns 0x10013360
pop edi
pop ebx
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.10045eb8
add esp, 0x24
ret

Function at 0x10013390
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x1008b880]
xor eax, esp
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xfecd11ab
mov dword [esp + 4], 0xa3c52318
mov dword [esp + 8], 0xccc133ca
mov dword [esp + 0xc], 0xf3216766
mov dword [esp + 0x10], 0x35151232
mov dword [esp + 0x14], 0x1dfeff29
mov dword [esp + 0x18], 0x41cdef44
mov dword [esp + 0x1c], 0x4d4e3c26
test edx, edx
jle 0x10013409
push esi
mov esi, dword [esp + 0x30]
sub esi, ecx
lea eax, [esi + ecx]
and eax, 0x1f
lea ecx, [ecx + 1]
mov al, byte [esp + eax + 4]
xor al, byte [ecx - 2]
xor byte [ecx - 1], al
sub edx, 1
jne 0x100133f0
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10045eb8
add esp, 0x24
ret