joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415670
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41587e
sub esp, 0x18
mov eax, dword [0x5caf14]
test eax, eax
jne 0x415867
nop
nop
lea eax, [0x5caf04]
mov dword [esp], eax
call fcn.004099a0
mov eax, dword [0x5caf08]
test eax, eax
je 0x4156b8
cmp dword [eax + 8], 0xcc
jne 0x41572e
mov edx, dword [0x5caf0c]
test edx, edx
jne 0x415710
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5cf6b0]
mov dword [esp + 8], eax
call fcn.0040be90
mov eax, dword [esp + 0xc]
mov dword [0x5caf0c], eax
mov ecx, dword [0x5caf10]
mov dword [eax], ecx
mov eax, dword [0x5caf0c]
mov dword [0x5caf10], eax
movzx eax, byte [0x5cb380]
test al, al
jne 0x415710
xor eax, eax
jmp 0x415838
mov edx, dword [0x5caf0c]
mov ebx, dword [edx + 4]
mov dword [0x5caf0c], ebx
mov ebx, dword [0x5caf08]
mov dword [edx + 4], ebx
mov dword [0x5caf08], edx
mov edx, dword [0x5caf08]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x415817
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402a90
mov eax, dword [0x5cb0f0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x415778
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x41578e
call fcn.004631d0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x5cb0f0]
test eax, eax
jne 0x4157b2
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x4157e0
call fcn.00463210
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x5caf04]
mov dword [esp], eax
call fcn.00409ba0
nop
lea eax, [0x5caf00]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402c10
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00463230
lea edx, [0x5832c4]
movzx ebx, byte [edx + eax]
lea ebp, [0x5cb380]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x415710
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x415821
mov ecx, 5
call fcn.00463220
lea eax, [0x4e40df]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00436dd0
nop
call fcn.00461dc0
jmp fcn.00415670
Function at 0x423350
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423453
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42344d
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004237a0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00423880
movzx eax, byte [esp + 0x18]
test al, 2
je 0x423401
cmp word [esp + 0x10], 0x1f0
jbe 0x423401
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x423405
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x423405
nop
jmp 0x423405
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x423448
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00423810
add esp, 0x1c
ret
call fcn.00463230
call fcn.00463230
nop
call fcn.00461dc0
jmp fcn.00423350
Function at 0x423460
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x423594
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x42358e
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.004237a0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00423970
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x423587
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00423810
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42354a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.0042fb30
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x423583
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.004029d0
add esp, 0x20
ret
mov eax, edx
call fcn.00463230
call fcn.00463230
nop
call fcn.00461dc0
jmp fcn.00423460
Function at 0x429000
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x429144
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00426e60
mov eax, dword [esp + 4]
test eax, eax
je 0x42912d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x5caff0]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call fcn.00424a80
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call fcn.004099a0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x429097
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x4290c2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x4290ac
cmp byte [ebp + 6], bl
je 0x4290b7
cmp esi, edx
ja 0x4290be
jne 0x429095
cmp byte [ebp + 6], bl
jbe 0x429095
jmp 0x4290be
mov ebx, 1
jmp 0x4290c4
xor ebx, ebx
jmp 0x4290c4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x4290e2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call fcn.00428f00
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409ba0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x5caff0]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x42911d
movzx eax, byte [ebx + 0x65]
test al, al
je 0x42911d
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x4e5dc7]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00436dd0
nop
call fcn.00461dc0
jmp fcn.00429000
Function at 0x4295d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x429740
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x4296d0
cmp cl, 1
je 0x429662
cmp cl, 2
jne 0x429729
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042eb40
nop
nop
lea eax, [0x5af500]
mov dword [esp], eax
call fcn.004099a0
mov eax, dword [0x5af4a4]
sub eax, dword [0x5af488]
nop
mov dword [0x5af4a4], eax
mov eax, dword [0x5af494]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5af494], ecx
nop
lea eax, [0x5af500]
mov dword [esp], eax
call fcn.00409ba0
jmp 0x429725
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415670
nop
nop
lea eax, [0x5af500]
mov dword [esp], eax
call fcn.004099a0
mov eax, dword [0x5af47c]
sub eax, dword [0x5af460]
nop
mov dword [0x5af47c], eax
mov eax, dword [0x5af46c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5af46c], ecx
nop
lea eax, [0x5af500]
mov dword [esp], eax
call fcn.00409ba0
jmp 0x429725
cmp cl, 3
jne 0x4296db
mov byte [eax + 8], 1
jmp 0x429725
cmp cl, 4
jne 0x429729
nop
nop
lea eax, [0x5af500]
mov dword [esp], eax
call fcn.004099a0
mov eax, dword [0x5af4f4]
sub eax, dword [0x5af4d8]
nop
mov dword [0x5af4f4], eax
mov eax, dword [0x5af4e4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5af4e4], ecx
nop
nop
lea eax, [0x5af500]
mov dword [esp], eax
call fcn.00409ba0
add esp, 0x14
ret
lea eax, [0x4e117e]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00436dd0
nop
call fcn.00461dc0
jmp fcn.004295d0
Function at 0x4519e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x451b5a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x451b50
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x451a3a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x451a3a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x451a4d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x451b27
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x451b1b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x451b12
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x451aa0
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x451ae3
mov eax, 1
cmp eax, ecx
ja 0x451ad7
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00463290
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x451b0d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x451adc
mov ecx, dword [esp + 0xc]
jmp 0x451aa5
call fcn.00463230
xor eax, eax
mov ecx, eax
call fcn.00463220
call fcn.00463290
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x451b4b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x451b20
mov ecx, dword [esp + 0x18]
jmp 0x451a52
call fcn.00463230
xor eax, eax
mov ecx, eax
call fcn.00463220
nop
call fcn.00461dc0
jmp fcn.004519e0
Function at 0x455b50
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x455c53
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00456280
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4c9b60]
mov dword [esp], ecx
call fcn.0040bb40
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x5af5bc]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call fcn.00455460
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004548b0
add esp, 0x28
ret
call fcn.00461dc0
jmp fcn.00455b50

Function at 0x458e50
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458eeb
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x5caff0]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00463407
lea ecx, [0x458f00]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00461cd0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00461dc0
jmp fcn.00458e50
Function at 0x45fe30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ff90
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.004099a0
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45ff79
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.004312a0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.00431980
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.00431980
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x45ff00
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.00452550
mov eax, dword [0x5cb0f0]
test eax, eax
jne 0x45fee7
mov eax, dword [esp + 0x20]
jmp 0x45fef5
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.004631c0
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45ff37
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.00452550
mov eax, dword [0x5cb0f0]
test eax, eax
jne 0x45ff22
mov eax, dword [esp + 0x20]
jmp 0x45ff30
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.004631c0
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409ba0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45ff5d
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00431760
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45ff75
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00431760
add esp, 0x1c
ret
lea eax, [0x4e7b56]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00436dd0
nop
call fcn.00461dc0
jmp fcn.0045fe30
Function at 0x463070
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5cb1e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4617fb
je 0x46184e
cmp ebx, 0x20
jbe 0x461854
cmp ebx, 0x40
jbe 0x46189a
jmp 0x46193b
test ebx, ebx
je 0x461844
add eax, 0x10
test ax, 0xff0
je 0x461830
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x506ae0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x506be0]
jmp 0x461818
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x461818
pxor xmm1, xmmword [0x5cb1f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5cb1f0]
pxor xmm2, xmmword [0x5cb200]
pxor xmm3, xmmword [0x5cb210]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5cb1f0]
pxor xmm2, xmmword [0x5cb200]
pxor xmm3, xmmword [0x5cb210]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46199a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5caec6], 0
je 0x46308a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4617c0
jmp fcn.00408200
Function at 0x463090
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40321c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408200
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00461dc0
jmp 0x4031e0
cmp byte [0x5caec6], 0
je 0x4630ab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4617c0
jmp 0x4031e0

Function at 0x463fa0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x463fba
mov ecx, 0x14
jmp 0x463fc3
shl ecx, 2
add ecx, 0xe10
mov dword [0x5caff0], ecx
ret
Function at 0x47f340
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47f3e6
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x47f399
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x47f3d0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00461dc0
jmp fcn.0047f340
Function at 0x4957b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49599a
sub esp, 0x48
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 0xa]
mov edx, dword [0x59e880]
movzx ebx, word [eax + 0xc]
movzx ebp, word [eax + 8]
movzx esi, word [eax + 2]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
call fcn.00492290
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.004638ee
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.004638ee
call fcn.00491290
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call fcn.0045c400
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x495887
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x4958a1
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x495918
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4958ee
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x4958ea
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x4958e3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x4958f0
mov ebx, 0x1d
jmp 0x49590e
mov ebp, eax
jmp 0x4958f0
mov ebp, eax
cmp ebp, 0xd
jae 0x49598d
lea eax, [ebp - 1]
lea edx, [0x5836c0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x495983
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x495918
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x49594a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x495952
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call fcn.00463220
mov eax, ebp
mov ecx, 0xd
call fcn.00463220
nop
call fcn.00461dc0
jmp fcn.004957b0