joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439df0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x439fa7
sub esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0x1001]
cmp ecx, 3
jbe 0x439e23
cmp eax, 0x1009
jne 0x439eff
mov ecx, eax
and eax, 0xffffefff
mov edx, dword [esp + 0x1c]
cmp edx, eax
jne 0x439e58
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ebx, [eax + 0x48]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00401c70
movzx eax, byte [esp + 0xc]
test al, al
je 0x439e58
add esp, 0x10
ret
call fcn.00437330
lea eax, [0x703eb1]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.00437f60
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437ee0
lea eax, [0x6f505f]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f5056]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00437de0
call fcn.00437550
call fcn.004373a0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00439760
lea eax, [0x707db1]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00435820
call fcn.00437330
lea eax, [0x7053f5]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00437f60
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437ee0
lea eax, [0x6f505f]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f5056]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00437de0
call fcn.00437550
call fcn.004373a0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00439760
lea eax, [0x708775]
mov dword [esp], eax
mov dword [esp + 4], 0x37
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00439df0
Function at 0x43eec0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43efbd
sub esp, 0xc
mov eax, dword [esp + 0x10]
test byte [eax], al
nop
lea ecx, [eax + 0x48]
mov dword [esp], ecx
call fcn.00401c50
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x43ef9a
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 1
call fcn.0043a0a0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x4c]
nop
nop
xor edx, edx
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
nop
xor ecx, ecx
mov dword [eax + 0x4c], ecx
nop
lea eax, [0x905c98]
mov dword [esp], eax
call fcn.00409600
nop
nop
mov eax, dword [esp + 0x10]
mov dword [eax + 0x58], 0
mov ecx, dword [0x905cd4]
test ecx, ecx
je 0x43ef69
mov edx, eax
mov dword [ecx + 0x58], eax
jmp 0x43ef74
nop
mov ecx, eax
mov dword [0x905cd0], eax
mov edx, ecx
nop
mov dword [0x905cd4], edx
inc dword [0x905cd8]
nop
nop
lea eax, [0x905c98]
mov dword [esp], eax
call fcn.00409800
call fcn.0043e5b0
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00439760
lea eax, [0x6f6513]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0043eec0
Function at 0x43f150
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x43f2f6
sub esp, 0x18
movzx eax, byte [0x90f8e8]
test al, al
je 0x43f185
mov byte [esp], 0x14
mov dword [esp + 4], 0
call fcn.00456950
mov eax, dword [esp + 0x1c]
test byte [eax], al
nop
lea ecx, [eax + 0x48]
mov dword [esp], ecx
call fcn.00401c50
mov eax, dword [esp + 4]
and eax, 0xffffefff
cmp eax, 2
jne 0x43f2d3
mov eax, dword [esp + 0x1c]
mov byte [eax + 0x64], 0x19
movzx ecx, byte [eax + 0x68]
test cl, cl
je 0x43f1e1
mov ecx, dword [eax + 0x20]
mov dword [esp], ecx
call fcn.004515a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
test eax, eax
je 0x43f2bd
movzx edx, byte [eax + 0x25]
test dl, 2
jne 0x43f241
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 0x1009
call fcn.0043a400
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x4c]
nop
nop
xor edx, edx
mov dword [ecx + 0x18], edx
mov eax, dword [eax + 0x18]
nop
xor ecx, ecx
mov dword [eax + 0x4c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0x1009
mov dword [esp + 8], 9
call fcn.00439df0
call fcn.0043e5b0
add esp, 0x18
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00451c80
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
call fcn.00437330
lea eax, [0x70333f]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00437f60
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00437f60
lea eax, [0x6f8b44]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00437f60
call fcn.004373a0
lea eax, str.preempt_SPWRITErecord_overflowrecovery_failedrecv_rststream_runtime_error:_runtime.gopanicruntime:_frame_runtime:_max__runtime:_min__runtimer:_bad_pscan_missed_a_gserver_finishedserver_sig_algsssh:_short_readstartm:_m_has_pstopm_holding_punexpected_typeunknown_Go_typeunknown_networkunknown_versionwindowAdjustMsgwrite_error:__v__Mobile_Safari__already__errno_mheap.sweepgen_not_in_ranges:_n_untyped_locals__s__s_HTTP_1.1_r_n_______:______http2.Transport__not_a_function._Reason_was:__v.WithValue_type_0123456789ABCDEF0123456789abcdef2384185791015625:_value_of_type_AddDllDirectory
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00435820
lea eax, [0x6fab5a]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00435820
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00439760
lea eax, [0x6f6513]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435820
nop
call fcn.0045fc00
jmp fcn.0043f150
Function at 0x43f7b0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 8
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx], eax
je 0x43f7f8
cmp dword [ecx + 0x2c], eax
je 0x43f7f8
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x30], 0
mov dword [eax + 0x2c], 0
mov eax, dword [eax + 0x28]
test eax, eax
je 0x43f7f4
call fcn.00439170
add esp, 8
ret
lea eax, [0x6fed26]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00435820
nop
int3

Function at 0x43f810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.0043f7b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0043a0a0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x43f883
cmp dword [eax + 4], ecx
jae 0x43f8b1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x43f9e0]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.00461030
mov eax, dword [esp + 0xc]
movzx ecx, byte [0x90f8e8]
test cl, cl
je 0x43f8de
lea eax, [0x711ec8]
mov dword [esp], eax
call fcn.00461030
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043f7b0
lea eax, [0x905d1c]
mov dword [esp], eax
call fcn.00401c50
mov eax, dword [esp + 4]
test eax, eax
je 0x43f916
lea eax, [0x711d94]
mov dword [esp], eax
call fcn.00461030
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043f7b0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x1178]
test ecx, ecx
je 0x43f952
lea eax, [0x711e80]
mov dword [esp], eax
call fcn.00461030
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043f7b0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x160], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.00401e60
mov eax, dword [0x905d10]
test eax, eax
je 0x43f9c3
lea eax, [0x711d90]
mov dword [esp], eax
call fcn.00461030
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0043f7b0
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
Function at 0x442110
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
test edx, edx
jne 0x442224
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x2c]
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x442163
mov ebp, dword [edx + 4]
test ebp, ebp
jne 0x44215b
nop
mov ebx, edx
mov dword [ecx + 0x54], edx
mov eax, dword [eax + 0x18]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 4], 1
add esp, 0x18
ret
test ebx, ebx
je 0x44221b
mov ecx, dword [ebx + 0x60]
mov ebx, dword [ebx + 0x64]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
call fcn.00437330
lea eax, [0x6f6813]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6f3c06]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00437f60
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00437d60
lea eax, [0x6f618f]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00437c00
call fcn.00437550
call fcn.004373a0
lea eax, [0x6fb629]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00435820
xor ebx, ebx
xor ecx, ecx
jmp 0x442169
lea eax, [0x6fa4a5]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00435820
nop
int3
Function at 0x442240
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4423a8
sub esp, 0x1c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
test edx, edx
je 0x442391
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
nop
mov ebx, dword [edx + 0x2c]
mov dword [esp + 8], ebx
cmp ebx, ecx
jne 0x4422cd
cmp dword [edx + 4], 1
jne 0x4422cd
movzx ecx, byte [0x90f8e8]
test cl, cl
je 0x4422ad
mov dword [esp + 0x10], eax
mov dword [esp], edx
call fcn.00456360
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x54], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 4], 0
mov dword [esp + 0x20], edx
add esp, 0x1c
ret
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
call fcn.00437330
lea eax, [0x6f6723]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00437ee0
lea eax, [0x6f43e7]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00437f60
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437ee0
lea eax, [0x6f43ff]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f5b29]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00437c00
call fcn.00437550
call fcn.004373a0
lea eax, [0x6fd118]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435820
lea eax, [0x6fabc3]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00442240
Function at 0x447d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x447efe
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401da0
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x9073e0]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00401c50
mov eax, dword [esp + 4]
test eax, eax
je 0x447ee3
mov eax, dword [esp + 0x1c]
lea ecx, [0x9073e0]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00409600
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00401c50
mov eax, dword [esp + 4]
test eax, eax
je 0x447ed1
mov eax, dword [esp + 0x1c]
lea ecx, [0x9073e0]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.00448310
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x447df4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401da0
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409800
mov eax, dword [esp + 0x24]
test eax, eax
je 0x447ecd
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x447e51
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.0045ddc0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x447ee7
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x447e8b
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00447f10
movzx eax, byte [esp + 4]
test al, al
je 0x447e87
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x447e8b
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.00447980
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x447ecd
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x447ecd
lea eax, [0x711df8]
mov dword [esp], eax
call fcn.00460fd0
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409800
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x6fd84f]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00447d00
Function at 0x44ec80
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44ed49
sub esp, 0x10
lea eax, [0x6d5580]
mov dword [esp + 8], eax
lea eax, [0x92b378]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x44ed32
lea ecx, [0x92b5a0]
lea edx, [0x8d3ce0]
jmp 0x44ecce
mov edx, dword [edx + 0x110]
test edx, edx
je 0x44ece4
cmp dword [edx + 0x98], ecx
ja 0x44ecc8
cmp dword [edx + 0x80], ecx
jbe 0x44ecc8
jmp 0x44ece6
xor edx, edx
test edx, edx
je 0x44ed1c
mov ecx, dword [eax]
lea ebx, [ecx + 7]
and ebx, 0xfffffff8
neg ebx
mov ebp, dword [eax + 4]
mov eax, dword [eax + 0x14]
sub eax, dword [edx + 0x94]
mov dword [0x92b5a0], ebx
mov dword [0x92b5a4], ecx
mov dword [0x92b5a8], ebp
mov dword [0x92b5ac], eax
add esp, 0x10
ret
lea eax, [0x70529d]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00435820
lea eax, [0x7093fb]
mov dword [esp], eax
mov dword [esp + 4], 0x3d
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0044ec80
Function at 0x4523b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452533
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45252b
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45240c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45240c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45241f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x452500
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x4524f2
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x4524eb
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x452476
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x4524bf
mov eax, 1
cmp eax, ecx
ja 0x4524ad
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00462600
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x4524e6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x4524b2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x45247b
call fcn.004625a0
xor eax, eax
call fcn.00462590
call fcn.00462600
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x452526
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x4524f7
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x452424
call fcn.004625a0
xor eax, eax
call fcn.00462590
nop
call fcn.00461140
jmp fcn.004523b0
Function at 0x459c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x459caf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004627a7
lea ecx, [0x459cc0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00461030
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00461140
jmp fcn.00459c10
Function at 0x462410
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x92b6e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x460bcb
je 0x460c1e
cmp ebx, 0x20
jbe 0x460c24
cmp ebx, 0x40
jbe 0x460c6a
jmp 0x460d0b
test ebx, ebx
je 0x460c14
add eax, 0x10
test ax, 0xff0
je 0x460c00
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x772f60]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x773060]
jmp 0x460be8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x460be8
pxor xmm1, xmmword [0x92b6f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x92b6f0]
pxor xmm2, xmmword [0x92b700]
pxor xmm3, xmmword [0x92b710]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x92b6f0]
pxor xmm2, xmmword [0x92b700]
pxor xmm3, xmmword [0x92b710]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x460d6a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x92b23f], 0
je 0x46242a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x460b90
jmp fcn.00407fc0