joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x53c074]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x18]
push 0xc8
mov esi, edx
mov dword [esp + 0x18], edi
push 0
push eax
mov dword [esp + 0x18], esi
mov ebx, ecx
call fcn.004c6150
add esp, 0xc
cmp esi, 0x88
jl 0x4eb214
mov eax, 0xf0f0f0f1
lea edi, [esp + 0x28]
mul dword [esp + 0xc]
sub edi, ebx
lea esi, [ebx + 0x80]
mov ecx, edx
shr ecx, 7
imul eax, ecx, 0xffffff78
mov dword [esp + 0x10], ecx
add dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
xor eax, eax
cmp ecx, esi
ja 0x4eb169
lea ecx, [esp + 0x98]
cmp ecx, ebx
jae 0x4eb1d0
lea ecx, [esi - 0x60]
nop dword [eax]
movups xmm0, xmmword [esp + eax*8 + 0x18]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ecx - 0x60]
pxor xmm1, xmm0
movups xmmword [esp + eax*8 + 0x18], xmm1
movups xmm0, xmmword [esp + eax*8 + 0x28]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [esp + eax*8 + 0x28], xmm1
add eax, 8
movups xmm1, xmmword [ecx + edi - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx + edi - 0x50], xmm1
movups xmm0, xmmword [edi + ecx - 0x40]
movups xmm1, xmmword [ecx - 0x30]
pxor xmm1, xmm0
movups xmmword [edi + ecx - 0x40], xmm1
cmp eax, 0x10
jl 0x4eb170
cmp eax, 0x11
jge 0x4eb1e6
nop dword [eax + eax]
mov ecx, dword [esi + eax*8 - 0x80]
xor dword [esp + eax*8 + 0x18], ecx
mov ecx, dword [esi + eax*8 - 0x7c]
xor dword [esp + eax*8 + 0x1c], ecx
inc eax
cmp eax, 0x11
jl 0x4eb1d0
lea ecx, [esp + 0x18]
call fcn.004eb320
add ebx, 0x88
add esi, 0x88
sub edi, 0x88
sub dword [esp + 0x10], 1
jne 0x4eb154
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
push esi
lea eax, [esp + 0xe4]
push ebx
push eax
call fcn.004c5650
add esp, 0xc
mov byte [esp + esi + 0xe0], 1
mov eax, esi
not eax
add eax, 0x88
push eax
lea eax, [esp + 0xe5]
add eax, esi
push 0
push eax
call fcn.004c6150
or byte [esp + 0x173], 0x80
add esp, 0xc
xor ecx, ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + ecx*8 + 0x18]
movups xmm1, xmmword [esp + ecx*8 + 0xe0]
pxor xmm1, xmm0
movups xmmword [esp + ecx*8 + 0x18], xmm1
movups xmm0, xmmword [esp + ecx*8 + 0x28]
movups xmm1, xmmword [esp + ecx*8 + 0xf0]
pxor xmm1, xmm0
movups xmmword [esp + ecx*8 + 0x28], xmm1
movups xmm0, xmmword [esp + ecx*8 + 0x38]
movups xmm1, xmmword [esp + ecx*8 + 0x100]
pxor xmm1, xmm0
movups xmmword [esp + ecx*8 + 0x38], xmm1
movups xmm0, xmmword [esp + ecx*8 + 0x48]
movups xmm1, xmmword [esp + ecx*8 + 0x110]
pxor xmm1, xmm0
movups xmmword [esp + ecx*8 + 0x48], xmm1
add ecx, 8
cmp ecx, 0x10
jl 0x4eb260
cmp ecx, 0x11
jge 0x4eb2f1
shl ecx, 3
nop dword [eax + eax]
mov eax, dword [esp + ecx + 0xe0]
xor dword [esp + ecx + 0x18], eax
mov eax, dword [esp + ecx + 0xe4]
xor dword [esp + ecx + 0x1c], eax
add ecx, 8
cmp ecx, 0x88
jl 0x4eb2d0
lea ecx, [esp + 0x18]
call fcn.004eb320
push 0xc8
mov eax, ecx
push eax
push edi
call fcn.004c5650
mov ecx, dword [esp + 0x180]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c3717
mov esp, ebp
pop ebp
ret
Function at 0x4ee760
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
jne 0x4ee781
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x4ee781
mov al, 1
jmp 0x4ee783
xor al, al
mov byte [esi + 0x20], al
test al, al
je 0x4ee7c2
mov edi, dword [ebx + 4]
mov eax, dword [ebx]
sub edi, eax
sar edi, 2
cmp edi, 1
jne 0x4ee79d
xor edx, edx
jmp 0x4ee7a8
call fcn.004cb9c4
xor edx, edx
div edi
mov eax, dword [ebx]
mov edi, dword [eax + edx*4]
lea edx, [esi + 0x823]
add edi, 0x18
push 0x2d
mov ecx, dword [edi]
lea ecx, [ecx + 8]
call fcn.004b61c0
jmp 0x4ee7fb
mov edi, dword [ecx + 4]
mov eax, dword [ecx]
sub edi, eax
sar edi, 2
cmp edi, 1
jne 0x4ee7d5
xor edx, edx
jmp 0x4ee7e3
call fcn.004cb9c4
xor edx, edx
div edi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edi, dword [eax + edx*4]
lea edx, [esi + 0x823]
add edi, 0x18
push 0x10
mov ecx, dword [edi]
lea ecx, [ecx + 4]
call fcn.004b6130
mov ebx, dword [edi]
add esp, 4
cmp dword [esi + 0x1208], 2
je 0x4ee813
mov dword [esi + 0x1208], 2
movzx eax, word [esi + 0x1200]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x44
mov word [ebx + 2], ax
call fcn.004c3728
mov ecx, dword [esi + 0x1230]
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [eax], ecx
push 0xa8
call fcn.004c3728
mov edi, dword [0x5459f4]
add esp, 4
mov ecx, dword [esi + 0x1230]
mov dword [esi + 0x12b0], eax
mov dword [eax], ecx
test edi, edi
jne 0x4ee877
call fcn.004ab930
test eax, eax
jne 0x4ee877
mov dword [0x5459f4], 0x5459f8
mov edi, 0x5459f8
mov edx, dword [esi + 0x12b0]
lea eax, [edi + 8]
mov dword [edx + 4], edi
lea ecx, [edx + 0x10]
mov dword [edx + 8], 0xc
mov dword [edx + 0x2c], 8
mov dword [ecx], eax
mov eax, dword [edi + 0xc]
mov dword [edx + 0x14], eax
mov dword [eax], ecx
mov dword [edi + 0xc], ecx
mov dword [edx + 0x18], 0xffffffff
mov dword [edx + 0x30], 0
mov dword [edx + 0x40], 0
mov dword [edx + 0x8c], 0
mov dword [edx + 0x88], 0
mov dword [edx + 0x48], 0xe
mov dword [edx + 0x64], 0
mov dword [edx + 0x80], 0
mov dword [edx + 0x84], 0xffffffff
mov dword [edx + 0x44], edx
mov dword [edx + 0x98], 0
mov dword [edx + 0x90], 0xffffffff
mov dword [edx + 0x3c], 0
mov dword [edx + 0xa4], 0
mov dword [edx + 0xa0], 0
mov dword [edx + 0x9c], 0
mov dword [edx + 0x94], 0
mov edi, dword [esi + 0x12b0]
mov eax, dword [edi + 0x90]
cmp eax, 0xffffffff
je 0x4ee96a
push 4
lea ecx, [ebp + 8]
mov dword [ebp + 8], 1
push ecx
push 1
push 6
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4ee96a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x4ee971
or dword [edi + 0x2c], 0x1000000
mov edx, dword [esi + 0x12b0]
cmp dword [edx + 8], 0xc
jne 0x4ee9a4
movzx eax, word [ebx]
cmp eax, 2
jne 0x4ee98c
mov eax, 0x10
jmp 0x4ee996
cmp eax, 0x17
jne 0x4ee9a4
mov eax, 0x1c
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push ebx
call fcn.004b50e0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4f39e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
push esi
push edi
cmp eax, 3
ja case.default.0x4f3a08
jmp dword [eax*4 + 0x4f3b58]
mov esi, 0x200000
jmp 0x4f3a2d
mov esi, 0x100000
jmp 0x4f3a2d
mov esi, 0x400000
jmp 0x4f3a2d
mov esi, 0x40000
jmp 0x4f3a2d
xor esi, esi
imul esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
add esi, 0x1fffff
mov dword [edi + 4], 0
and esi, 0xffe00000
mov eax, esi
mov dword [edi + 0xc], esi
shr eax, 0x15
cmp byte [0x53ca65], 0
mov dword [edi + 8], eax
jne 0x4f3a6d
push 0x1000
push esi
call fcn.004cd528
add esp, 8
mov dword [edi], eax
jmp 0x4f3a94
push 4
push 0x20003000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi], eax
test eax, eax
je 0x4f3a8b
mov eax, dword [edi + 8]
mov dword [edi + 4], eax
jmp 0x4f3a94
xor dl, dl
mov ecx, edi
call fcn.0050c2b0
cmp dword [ebx + 0xc], 0
mov dword [ebp - 8], 0
jbe 0x4f3b4c
mov ecx, dword [ebp - 4]
call fcn.0040a270
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
nop word [eax + eax]
push 0x1000
push 0x140
call fcn.004cd528
mov ecx, dword [edi]
add esp, 8
add ecx, dword [ebp - 4]
mov esi, eax
push 0x40
push 0x3000
push 0x4000
push 0
mov dword [esi + 0xe0], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x110], eax
add eax, 0x2000
mov dword [esi + 0x114], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x118], 0x11
mov dword [esi + 0x120], 0xffffffff
mov dword [esi + 0x124], 0xffffffff
movups xmm0, xmmword [esi + 0x118]
movups xmmword [esi + 0x128], xmm0
mov dword [ecx + eax*4], esi
inc eax
mov ecx, dword [ebp - 0x10]
add dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0xc]
jb 0x4f3ac0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4f6490
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, edx
mov dword [ebp - 4], eax
push esi
push edi
movups xmm6, xmmword [eax]
mov edi, ecx
pshufd xmm0, xmm6, 0x55
movd ecx, xmm0
pshufd xmm0, xmm6, 0xff
movups xmm5, xmmword [edi]
mov eax, ecx
pslldq xmm5, 4
shr eax, 0x10
movaps xmm4, xmm5
movzx eax, al
pxor xmm4, xmmword [edi]
pslldq xmm5, 4
movzx esi, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
movzx eax, cl
movd ecx, xmm0
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movd xmm2, esi
movzx edx, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
mov eax, esi
mov ecx, edx
ror eax, 8
ror ecx, 8
xor eax, 8
xor ecx, 8
movd xmm0, edx
punpckldq xmm2, xmm0
movd xmm1, eax
movd xmm3, ecx
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movaps xmm1, xmm5
pxor xmm1, xmm4
pslldq xmm5, 4
pshufd xmm0, xmm2, 0xff
pxor xmm1, xmm5
pxor xmm0, xmm1
movups xmmword [edi], xmm0
call fcn.004f6280
movaps xmm2, xmm6
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm6
movaps xmm0, xmm2
mov eax, dword [ebp - 4]
pxor xmm0, xmm1
pslldq xmm2, 4
pxor xmm0, xmm2
pxor xmm0, xmm3
pop edi
movups xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4f6660
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, edx
mov dword [ebp - 4], eax
push esi
push edi
movups xmm6, xmmword [eax]
mov edi, ecx
pshufd xmm0, xmm6, 0x55
movd ecx, xmm0
pshufd xmm0, xmm6, 0xff
movups xmm5, xmmword [edi]
mov eax, ecx
pslldq xmm5, 4
shr eax, 0x10
movaps xmm4, xmm5
movzx eax, al
pxor xmm4, xmmword [edi]
pslldq xmm5, 4
movzx esi, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
movzx eax, cl
movd ecx, xmm0
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movd xmm2, esi
movzx edx, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
mov eax, esi
mov ecx, edx
ror eax, 8
ror ecx, 8
xor eax, 4
xor ecx, 4
movd xmm0, edx
punpckldq xmm2, xmm0
movd xmm1, eax
movd xmm3, ecx
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movaps xmm1, xmm5
pxor xmm1, xmm4
pslldq xmm5, 4
pshufd xmm0, xmm2, 0xff
pxor xmm1, xmm5
pxor xmm0, xmm1
movups xmmword [edi], xmm0
call fcn.004f6280
movaps xmm2, xmm6
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm6
movaps xmm0, xmm2
mov eax, dword [ebp - 4]
pxor xmm0, xmm1
pslldq xmm2, 4
pxor xmm0, xmm2
pxor xmm0, xmm3
pop edi
movups xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4f67c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm2, xmmword [ecx]
movups xmm3, xmmword [edx]
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmmword [ecx]
movaps xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
movaps xmm2, xmm3
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm4, xmm0
pslldq xmm2, 4
movaps xmm0, xmm2
movups xmmword [ecx], xmm4
pslldq xmm2, 4
pxor xmm0, xmm3
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm4, 0
pxor xmm1, xmm2
pshufd xmm0, xmm0, 0xaa
pxor xmm1, xmm0
movups xmmword [edx], xmm1
ret
Function at 0x4f6830
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, edx
mov dword [ebp - 4], eax
push esi
push edi
movups xmm6, xmmword [eax]
mov edi, ecx
pshufd xmm0, xmm6, 0x55
movd ecx, xmm0
pshufd xmm0, xmm6, 0xff
movups xmm5, xmmword [edi]
mov eax, ecx
pslldq xmm5, 4
shr eax, 0x10
movaps xmm4, xmm5
movzx eax, al
pxor xmm4, xmmword [edi]
pslldq xmm5, 4
movzx esi, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
movzx eax, cl
movd ecx, xmm0
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movd xmm2, esi
movzx edx, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
mov eax, esi
mov ecx, edx
ror eax, 8
ror ecx, 8
xor eax, 2
xor ecx, 2
movd xmm0, edx
punpckldq xmm2, xmm0
movd xmm1, eax
movd xmm3, ecx
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movaps xmm1, xmm5
pxor xmm1, xmm4
pslldq xmm5, 4
pshufd xmm0, xmm2, 0xff
pxor xmm1, xmm5
pxor xmm0, xmm1
movups xmmword [edi], xmm0
call fcn.004f6280
movaps xmm2, xmm6
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm6
movaps xmm0, xmm2
mov eax, dword [ebp - 4]
pxor xmm0, xmm1
pslldq xmm2, 4
pxor xmm0, xmm2
pxor xmm0, xmm3
pop edi
movups xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4f6a00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, edx
mov dword [ebp - 4], eax
push esi
push edi
movups xmm6, xmmword [eax]
mov edi, ecx
pshufd xmm0, xmm6, 0x55
movd ecx, xmm0
pshufd xmm0, xmm6, 0xff
movups xmm5, xmmword [edi]
mov eax, ecx
pslldq xmm5, 4
shr eax, 0x10
movaps xmm4, xmm5
movzx eax, al
pxor xmm4, xmmword [edi]
pslldq xmm5, 4
movzx esi, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
movzx eax, cl
movd ecx, xmm0
shl esi, 8
movzx eax, byte [eax + str.cw]
or esi, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movd xmm2, esi
movzx edx, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
mov eax, esi
mov ecx, edx
ror eax, 8
ror ecx, 8
xor eax, 1
xor ecx, 1
movd xmm0, edx
punpckldq xmm2, xmm0
movd xmm1, eax
movd xmm3, ecx
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movaps xmm1, xmm5
pxor xmm1, xmm4
pslldq xmm5, 4
pshufd xmm0, xmm2, 0xff
pxor xmm1, xmm5
pxor xmm0, xmm1
movups xmmword [edi], xmm0
call fcn.004f6280
movaps xmm2, xmm6
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm6
movaps xmm0, xmm2
mov eax, dword [ebp - 4]
pxor xmm0, xmm1
pslldq xmm2, 4
pxor xmm0, xmm2
pxor xmm0, xmm3
pop edi
movups xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x5043d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
movzx eax, byte [esi + 2]
mov ecx, dword [edi + eax*4]
movzx eax, byte [esi + 1]
lea ebx, [edi + eax*4]
movzx eax, byte [esi]
jmp dword [eax*4 + 0x506334]
Function at 0x509ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ca47
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x53c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [edi], vtable.Worker.0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [0x5459f0]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
mov dword [edi + 8], eax
mov eax, dword [esi + 8]
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov eax, dword [esi + 0x10]
mov dword [edi + 0x40], eax
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp eax, 1
jle 0x509c6f
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
and eax, edx
cmp eax, 0xffffffff
je 0x509c6f
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov ebx, eax
test edx, edx
jne 0x509bad
cmp ebx, 0x40
jb 0x509c56
cmp dword [0x545724], 0
jne 0x509c41
push 0x24
call fcn.004c3728
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
push 0x304
mov dword [0x545724], esi
call fcn.004c3728
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp + 8], esi
mov dword [esi], vtable.BasicLog.0
call fcn.00401f80
mov ecx, dword [eax + 4]
cmp dword [eax + 8], ecx
je 0x509c2f
mov dword [ecx], esi
add dword [eax + 4], 4
jmp 0x509c3b
lea edx, [ebp + 8]
push edx
push ecx
mov ecx, eax
call fcn.00405630
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push str.Unable_to_set_affinity._Windows_supports_only_affinity_up_to_63.
push 0
push dword [0x545724]
call fcn.004eca30
add esp, 0xc
xor ecx, ecx
xor eax, eax
bts ecx, ebx
cmp ebx, 0x20
cmovae eax, ecx
xor ecx, eax
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
call dword [eax + 8]
cmp eax, 0xffffffff
je 0x509cb4
dec eax
mov ecx, 0xfffffff1
cmp eax, 4
ja case.default.0x509c87
jmp dword [eax*4 + 0x509ccc]
or ecx, 0xffffffff
jmp case.default.0x509c87
xor ecx, ecx
jmp case.default.0x509c87
mov ecx, 1
jmp case.default.0x509c87
mov ecx, 2
jmp case.default.0x509c87
mov ecx, 0xf
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50c010
Capabilities:
Manipulate user privileges

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ce47
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [0x53c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
xor edi, edi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x50c1d6
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 1
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x50c094
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push 1
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x50c1d6
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push 0xf0fff
lea eax, [ebp - 0x44]
movq qword [ebp - 0x34], xmm0
push eax
xor esi, esi
push esi
movups xmmword [ebp - 0x44], xmm0
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x50c1b9
mov dword [ebp - 0x24], 0x2c002a
mov eax, dword [ebp - 0x24]
push 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push dword [edi]
mov dword [ebp - 0x28], 0x530a4c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
jne 0x50c1b0
cmp dword [0x545724], esi
jne 0x50c196
push 0x24
call fcn.004c3728
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
push 0x304
mov dword [0x545724], esi
call fcn.004c3728
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], esi
mov dword [esi], vtable.BasicLog.0
call fcn.00401f80
mov ecx, dword [eax + 4]
cmp dword [eax + 8], ecx
je 0x50c18a
mov dword [ecx], esi
add dword [eax + 4], 4
jmp 0x50c196
lea edx, [ebp - 0x20]
push edx
push ecx
mov ecx, eax
call fcn.00405630
push str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
push 2
push dword [0x545724]
call fcn.004eca30
add esp, 0xc
mov esi, 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_LsaClose]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x50ec90
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
ret
Function at 0x515c10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x80
lea esi, [ecx + 0x24]
push 0
push esi
call fcn.004c6150
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x515c51
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x515c34
sub ecx, edi
pop edi
je 0x515c51
push 0x7f
push edx
push esi
call fcn.004cbac0
add esp, 0xc
pop esi
pop ebp
ret 4
push 0x7f
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
pop esi
pop ebp
ret 4