joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49486c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov eax, ebx
call fcn.00404a8c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x494903
xor eax, eax
push ebp
push 0x4948fc
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x20]
call fcn.0040aa80
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
je 0x4948e5
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494903
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x498808
Capabilities:
Get disk size

Disassembly:
add esp, 0xfffffff0
mov eax, 0x498888
call fcn.00409140
test al, al
je 0x498839
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x49888c
call sub.kernel32.dll_GetDiskFreeSpaceA
jmp 0x498857
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x498890
call sub.kernel32.dll_GetDiskFreeSpaceA
mov eax, dword [esp + 4]
imul dword [esp]
test eax, eax
jne 0x498867
mov eax, 0x1000
mov edx, eax
test edx, edx
jns 0x498873
add edx, 0x1ff
sar edx, 9
mov dword [0x49ff24], edx
add esp, 0x10
ret

Function at 0x49b5c8
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, edx
mov esi, eax
mov byte [ebp - 1], 0
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov eax, esi
call fcn.00404a8c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x49b6ab
xor eax, eax
push ebp
push 0x49b6a4
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x20]
call fcn.0040aa80
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
je 0x49b68d
sub bl, 1
jb 0x49b63b
je 0x49b657
dec bl
je 0x49b673
jmp 0x49b68d
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x49b68d
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x49b68d
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b6ab
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5166c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb9000]
mov dword [edi + 0xcf740], 0xa5f11c09
push edi
jmp 0x5166ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5166f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5166e0
mov eax, 1
add ebx, ebx
jne 0x516703
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x516714
jne 0x516733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x516733
dec eax
add ebx, ebx
jne 0x516720
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5166f8
add ebx, ebx
jne 0x51672f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x516785
xor ecx, ecx
sub eax, 3
jb 0x51674b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5167ba
sar eax, 1
mov ebp, eax
jmp 0x516756
add ebx, ebx
jne 0x516756
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x516724
inc ecx
add ebx, ebx
jne 0x516764
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x516724
add ebx, ebx
jne 0x516771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x516766
jne 0x516782
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x516766
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5167a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x516796
jmp 0x5166e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5167a4
add edi, ecx
jmp 0x5166e6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5167c2
cmp byte [edi], 0x11
jne 0x5167c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5167c7
lea edi, [esi + 0x10f000]
mov eax, dword [edi]
or eax, eax
je 0x51683f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1473e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x147564]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5167f4
mov ecx, edi
jns 0x516823
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x147568]
or eax, eax
je 0x516839
mov dword [ebx], eax
add ebx, 4
jmp 0x516811
call dword [esi + 0x147578]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x516870
cmp al, 0xef
ja 0x516863
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x516845
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x516852
mov ebp, dword [esi + 0x14756c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5168a4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x413f60
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41414c
sub esp, 0x18
mov eax, dword [0x9d5c50]
test eax, eax
jne 0x414135
nop
lea eax, [0x9d5c3c]
mov dword [esp], eax
call fcn.00408f90
mov eax, dword [0x9d5c40]
test eax, eax
je 0x413fa9
cmp dword [eax + 8], 0xcc
jne 0x41401f
mov eax, dword [0x9d5c34]
test eax, eax
jne 0x414001
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x9daf70]
mov dword [esp + 8], eax
call fcn.0040b2b0
mov eax, dword [esp + 0xc]
mov dword [0x9d5c34], eax
mov ecx, dword [0x9d5bf8]
mov dword [eax], ecx
mov eax, dword [0x9d5c34]
mov dword [0x9d5bf8], eax
movzx eax, byte [0x9d6380]
test al, al
jne 0x414001
xor eax, eax
jmp 0x414129
mov eax, dword [0x9d5c34]
mov ecx, dword [eax + 4]
mov dword [0x9d5c34], ecx
mov ecx, dword [0x9d5c40]
mov dword [eax + 4], ecx
mov dword [0x9d5c40], eax
mov eax, dword [0x9d5c40]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00402080
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x9d6000]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414072
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41407f
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045efc0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x9d6000]
test edx, edx
jne 0x4140ab
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4140cc
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045efc0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045efc0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045efc0
nop
lea eax, [0x9d5c3c]
mov dword [esp], eax
call fcn.00409190
nop
lea eax, [0x9d5c38]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402200
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
lea ecx, [0x8082ac]
movzx ebx, byte [ecx + ebx]
lea ebp, [0x9d6380]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jl 0x4140f6
jmp 0x414001
lea eax, [0x679f7f]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00433ba0
nop
call fcn.0045dbb0
jmp fcn.00413f60
Function at 0x425f90
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426196
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call fcn.00426a50
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
call fcn.00425680
movzx eax, byte [esp + 0xc]
test al, al
je 0x425ff4
mov ecx, dword [esp + 0x18]
mov byte [ecx + 0x3c], 1
jmp 0x425ff8
mov ecx, dword [esp + 0x18]
movzx edx, byte [esp + 0x1c]
test dl, dl
jne 0x4260d0
movzx ebx, byte [esp + 0x1d]
mov byte [ecx + 0x3a], bl
mov eax, dword [esp + 0x24]
shl eax, 0xd
shr bl, 1
test bl, bl
jne 0x42602d
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x1c], 1
mov dword [ecx + 0x34], 0
jmp 0x426058
movsx ebx, bl
lea esi, [0x80ccc0]
movzx esi, word [esi + ebx*2]
mov dword [ecx + 0x40], esi
test esi, esi
je 0x426190
xor edx, edx
div esi
mov dword [ecx + 0x1c], eax
lea edx, [0x80e6a0]
mov edx, dword [edx + ebx*4]
mov dword [ecx + 0x34], edx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x20], 0xffffffff
mov dword [ecx + 0x24], 0xffffffff
mov eax, dword [ecx + 0x1c]
mov dword [esp], eax
call fcn.004275d0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esp], eax
call fcn.00427760
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x30]
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 0x98]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00402150
nop
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
mov byte [esp + 4], 1
call fcn.004021f0
jmp 0x4260fc
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov eax, dword [ecx + 0x10]
shl eax, 0xd
add eax, dword [ecx + 0xc]
mov dword [ecx + 0x44], eax
nop
nop
lea eax, [ecx + 0x3b]
mov dword [esp], eax
mov byte [esp + 4], 2
call fcn.004021f0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.004255e0
movzx eax, byte [esp + 0x1c]
test al, al
jne 0x426187
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov eax, dword [0x9b5cdc]
mov edx, ecx
shr ecx, 0x16
mov ebx, dword [eax + ecx*4]
test byte [ebx], al
test byte [eax], al
nop
nop
mov ecx, edx
shr edx, 0x10
and edx, 0x3f
lea eax, [ebx + edx + 0x21800]
nop
mov dword [esp], eax
shr ecx, 0xd
and ecx, 7
mov eax, 1
shl eax, cl
mov byte [esp + 4], al
call fcn.004021d0
mov eax, dword [esp + 0x14]
test byte [eax], al
add eax, 0xa8
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00401fe0
call fcn.0045ec30
add esp, 0x10
ret
call fcn.00432350
nop
call fcn.0045dbb0
jmp fcn.00425f90
Function at 0x427410
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42752c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4274a5
cmp cl, 2
je 0x42744d
cmp cl, 3
jne 0x427515
mov byte [eax + 8], 1
jmp 0x427511
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c050
nop
lea eax, [0x9ba1f8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0x9ba1c4]
sub eax, dword [0x9ba1a8]
mov dword [0x9ba1c4], eax
mov eax, dword [0x9ba1b4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x9ba1b4], ecx
nop
lea eax, [0x9ba1f8]
mov dword [esp], eax
call fcn.00409190
jmp 0x427511
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413f60
nop
lea eax, [0x9ba1f8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0x9ba19c]
sub eax, dword [0x9ba180]
mov dword [0x9ba19c], eax
mov eax, dword [0x9ba18c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x9ba18c], ecx
nop
nop
lea eax, [0x9ba1f8]
mov dword [esp], eax
call fcn.00409190
add esp, 0x14
ret
lea eax, [0x676504]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433ba0
nop
call fcn.0045dbb0
jmp fcn.00427410
Function at 0x42e140
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42e373
sub esp, 0x2c
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x980]
mov edx, dword [eax + 0x978]
mov dword [eax + 0x978], 0
sub edx, ecx
shr edx, 2
mov dword [esp + 0x24], edx
movzx ecx, byte [0x9d5bba]
test cl, cl
jne 0x42e18d
xor ecx, ecx
xor ebx, ebx
jmp 0x42e1c9
xor ecx, ecx
jmp 0x42e1b3
mov dword [esp + 0x28], ecx
mov edx, dword [eax + ecx*4 + 0x980]
mov dword [esp], edx
call fcn.0041c9f0
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x42e191
add eax, 0x978
mov dword [esp], eax
call fcn.0042e030
add esp, 0x2c
ret
inc ecx
cmp ecx, edx
jge 0x42e33a
mov ebp, dword [eax + ecx*4 + 0x980]
cmp ebp, 0x1000
jb 0x42e1c8
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.00410b60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test ecx, ecx
jne 0x42e222
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e1c8
mov dword [esp + 0x20], ecx
mov ebx, dword [eax + 0x2c]
test byte [ebx], al
nop
mov ebp, edx
shr edx, 3
movzx esi, byte [ebx + edx]
and ebp, 7
mov ecx, ebp
mov edi, 1
shl edi, cl
add edx, ebx
xchg esi, eax
xchg edi, ebx
test bl, al
xchg edi, ebx
xchg esi, eax
je 0x42e262
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e1c8
mov dword [esp + 0x18], eax
nop
mov dword [esp], edx
xchg edi, eax
mov byte [esp + 4], al
xchg edi, eax
call fcn.004021d0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [0x9b5cdc]
mov ebx, ecx
shr ecx, 0x16
mov ecx, dword [edx + ecx*4]
test byte [ecx], al
test byte [edx], al
nop
nop
mov edx, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx ebp, byte [ecx + ebx + 0x21840]
lea ecx, [ecx + ebx + 0x21840]
nop
shr edx, 0xd
and edx, 7
mov ebx, ecx
mov ecx, edx
mov esi, 1
shl esi, cl
xchg ebp, eax
xchg esi, ebx
test bl, al
xchg esi, ebx
xchg ebp, eax
jne 0x42e2d5
mov dword [esp], ebx
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.004021d0
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0x3a]
test cl, 1
je 0x42e315
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x964]
mov ebp, dword [ecx + 0x968]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebp, 0
mov dword [ecx + 0x964], edx
mov dword [ecx + 0x968], ebp
mov eax, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e1c8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [edx + eax*4 + 0x980], ecx
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
jmp 0x42e1c8
lea ecx, [eax + 0x95c]
mov dword [esp], ecx
lea ecx, [eax + 0x980]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x200
call fcn.00424040
mov eax, dword [esp + 0x30]
add eax, 0x978
mov dword [esp], eax
call fcn.0042e030
add esp, 0x2c
ret
call fcn.0045c710
jmp fcn.0042e140
Function at 0x45ee70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x9d6160]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45d63b
je 0x45d68e
cmp ebx, 0x20
jbe 0x45d694
cmp ebx, 0x40
jbe 0x45d6da
jmp 0x45d77b
test ebx, ebx
je 0x45d684
add eax, 0x10
test ax, 0xff0
je 0x45d670
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6d4c80]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6d4e80]
jmp 0x45d658
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45d658
pxor xmm1, xmmword [0x9d6170]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9d6170]
pxor xmm2, xmmword [0x9d6180]
pxor xmm3, xmmword [0x9d6190]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9d6170]
pxor xmm2, xmmword [0x9d6180]
pxor xmm3, xmmword [0x9d6190]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45d7da
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x9d5bb9], 0
je 0x45ee8a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45d600
jmp fcn.004079e0
Function at 0x401af7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x47362c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [ebp - 0x118]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
call fcn.00401a73
mov ebx, eax
cmp ebx, esi
je 0x401b63
cmp dword [ebp - 0x118], esi
je 0x401b5c
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x401bfb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x401b8b
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x118]
call fcn.00401af7
mov dword [ebp - 0x124], eax
cmp eax, esi
jne 0x401c0c
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x118]
mov dword [ebp - 0x11c], 0x100
call ebx
test eax, eax
je 0x401b6b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x118], esi
je 0x401bd6
push dword [ebp - 0x118]
call ebx
mov dword [ebp - 0x118], esi
push dword [ebp - 0x120]
mov dword [ebp - 0x114], esi
call fcn.00401998
mov edi, eax
cmp dword [ebp - 0x118], esi
je 0x401bf9
push dword [ebp - 0x118]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363ed
leave
ret 4
cmp dword [ebp - 0x118], esi
je 0x401c20
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
jmp 0x401bfb
Function at 0x404ba1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x47362c]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b0]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x6c], bl
mov dword [esi], ebx
call fcn.0040ceac
mov dword [esi], eax
cmp eax, ebx
jne 0x404bf6
push str.ERROR:_ShutdownEvent_handle_is_NULL
call fcn.004154f0
pop ecx
mov dword [ebp - 0x60], 0xfffffffe
push ebx
push dword [ebp - 0x64]
call fcn.0040c684
pop ecx
pop ecx
test eax, eax
jne 0x404c18
push str.jusched_ERROR:_Could_not_open_Policy_key_for_reading
call fcn.004154f0
mov dword [ebp - 0x60], 0xfffffffd
jmp 0x404c3b
mov eax, dword [ebp - 0x64]
push dword [eax]
call fcn.00404b24
pop ecx
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x404c3c
push str.jusched_main:_ERROR_creating_registry_watch_event_notifier
call fcn.004154f0
mov dword [ebp - 0x60], 0xfffffffe
pop ecx
push str.SunJavaUpdateSchedulerMutex
push 1
push ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
cmp eax, ebx
jne 0x404cac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7ff
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.00437840
add esp, 0xc
cmp dword [ebp - 0x60], 0xb7
lea eax, [ebp - 0x5c]
jne 0x404c8c
push str.Error:_Scheduler_Mutex_already_exists_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0x404c9e
push dword [ebp - 0x60]
push str.Error:_Error_creating_scheduler_mutex:__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call fcn.004154f0
or dword [ebp - 0x60], 0xffffffff
pop ecx
cmp dword [ebp - 0x60], ebx
je 0x404ccb
push dword [edi]
push esi
call fcn.00404b73
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
pop ecx
pop ecx
lea esi, [ebp - 0x80]
mov dword [ebp - 0x7c], eax
call fcn.004126f4
mov ecx, dword [ebp + 0x7a4]
mov eax, dword [ebp - 0x60]
pop esi
xor ecx, ebp
pop ebx
call fcn.004363ed
add ebp, 0x7a8
leave
ret