joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019183
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xffffffffffffffff
push str.HTTP_1.0_404_Not_Found_r_nServer:_SNARE_1.0_r_nMIME_version:_1.0_r_nContent_type:_text_html_r_n_r_n_html__body__center__h2_Page_Not_Found__h2___center___body___html_
lea eax, [ebp - 0x204]
mov esi, ecx
push 0x200
push eax
call fcn.10021c86
lea edx, [ebp - 0x204]
add esp, 0x10
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100191bd
push 0
sub edx, ecx
lea eax, [ebp - 0x204]
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x10019e5d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x1ff
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x203]
push ebx
push eax
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x208], ebx
mov byte [ebp - 0x204], bl
call fcn.10023400
push str.SOFTWAREInterSect_AllianceAuditService_
push 0xffffffffffffffff
mov edi, 0x200
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.1001f145
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.1001f294
add esp, 0x2c
lea eax, [ebp - 0x208]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x204]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001a02e
push ebx
push ebx
lea eax, [ebp - 0x218]
mov edi, ebx
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1001a02e
mov eax, dword [ebp - 0x22c]
inc eax
push eax
call fcn.1001f0b0
mov eax, dword [ebp - 0x214]
inc eax
push eax
call fcn.1001f0b0
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x218]
inc eax
push eax
call fcn.1001f0b0
push dword [ebp - 0x228]
mov esi, eax
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x218]
push str.__s__n
push dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x21c], eax
call fcn.1002263a
add esp, 0x18
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x210]
push edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x1001a02c
test eax, eax
jne 0x1001a02c
cmp dword [ebp - 0x220], 1
jne 0x1001a002
mov eax, dword [ebp - 0x21c]
push esi
push dword [ebp - 0x210]
mov byte [eax + esi], bl
push str._s__s__n
jmp 0x1001a018
cmp dword [ebp - 0x220], 4
jne 0x1001a026
push dword [esi]
push dword [ebp - 0x210]
push str._s_d_n
push dword [ebp - 0x20c]
call fcn.1002263a
add esp, 0x10
inc edi
jmp 0x10019f93
mov bl, 1
cmp dword [ebp - 0x208], 0
je 0x1001a043
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a39d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x1001a422
push edi
lea edi, [ecx + 2]
movzx eax, byte [edi - 2]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
dec edx
je 0x1001a3fa
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1001a3fc
mov al, 0x3d
mov byte [esi + 2], al
dec edx
je 0x1001a410
movzx eax, byte [edi]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1001a412
mov al, 0x3d
mov byte [esi + 3], al
add edi, 3
add esi, 4
add ebx, 4
dec edx
jne 0x1001a3b2
pop edi
mov byte [esi], 0
lea eax, [ebx + 1]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1001a99c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x288
mov eax, 0x1008cf33
call fcn.1004606d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x290]
push 0x40
xor ebx, ebx
push ebx
push eax
call fcn.10023400
push 0x103
lea eax, [ebp - 0x223]
mov dword [ebp - 0x294], 0x44
xorps xmm0, xmm0
mov byte [ebp - 0x224], bl
push ebx
push eax
movdqu xmmword [ebp - 0x24c], xmm0
call fcn.10023400
push 0xfc
lea eax, [ebp - 0x114]
mov dword [ebp - 0x11c], 0x6c726546
push ebx
push eax
mov dword [ebp - 0x118], 0x697261
call fcn.10023400
add esp, 0x24
lea ecx, [ebp - 0x23c]
mov edx, str.NzMUda8B2nLgUR6jhvZV2mVzQ86yomNB2vT8wlLywQHvGYMo9_IYgZUAg8zYndCQzrUUOdB2n6cQzwB2vT8wldzwldzwuu
call fcn.10002295
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 0x10
jb 0x1001aa30
mov eax, dword [eax]
lea ecx, [ebp - 0x11c]
push ecx
push esi
push eax
lea eax, [ebp - 0x224]
push 0xfa
push eax
call fcn.1001b57b
add esp, 0x14
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x23c]
call fcn.10002c1a
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x294]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
neg eax
call fcn.1004601c
ret 4
Function at 0x1001aa93
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf003f
xor esi, esi
mov ebx, ecx
push esi
push esi
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x1001abec
push edi
lea ecx, [ebx + 4]
push 0xf01ff
push ecx
push eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 8
mov ebx, eax
mov dword [ebp - 0x28], esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1001abd7
cmp dword [ebp - 0x24], 1
je 0x1001abad
jmp 0x1001ab49
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1001ab4f
cmp dword [ebp - 0x24], 1
je 0x1001ab64
call edi
sub eax, dword [ebp - 0x34]
cmp eax, 0x7530
ja 0x1001ab4f
cmp dword [ebp - 0x24], 3
je 0x1001ab18
mov edi, esi
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1001aba9
jmp 0x1001ab9e
xor edi, edi
inc edi
jmp 0x1001ab51
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1001abad
cmp dword [ebp - 0x24], 1
je 0x1001aba6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x34]
cmp eax, 0x7530
ja 0x1001abad
cmp dword [ebp - 0x24], 1
jne 0x1001ab69
jmp 0x1001abad
xor edi, edi
inc edi
test edi, edi
je 0x1001abd7
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ecx
push ecx
mov ecx, dword [ebp - 0x30]
push dword [ebp - 0x2c]
test eax, eax
je 0x1001abce
push 0x65
push 4
call fcn.1000ad66
xor esi, esi
inc esi
jmp 0x1001abd7
push 0x66
push 1
call fcn.1000ad66
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x1001abe4
push ebx
call edi
push dword [ebp - 0x3c]
call edi
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e010
mov esp, ebp
pop ebp
ret
Function at 0x1006c8cf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x403c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00403c49

Function at 0x405b40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00405b57

Function at 0x405f40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00405f57

Function at 0x407d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x407e30
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x407dce
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004079c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x407da0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x407ed7
call fcn.00407de0
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x407e80
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004079c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x407e3d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x407ed7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004079c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x407ed5
jmp 0x407ed7
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x408019
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x407fb7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00407b00
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x407f89
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4080c0
call fcn.00407fc9
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x408069
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00407c30
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x408026
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4080c0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00407c30
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4080be
jmp 0x4080c0
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x409320
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x409340
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x40ebb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x40ee5c
test edx, edx
je 0x40ee5c
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x40ed70
cmp ecx, 0xc0
je 0x40ec90
cmp ecx, 0x80
jne 0x40ee64
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.0040ec76
aeskeygenassist xmm1, xmm0, 2
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 4
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 8
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0040ec70
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0040ec70
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.0040ed10
aeskeygenassist xmm1, xmm2, 2
call fcn.0040ed50
aeskeygenassist xmm1, xmm2, 4
call fcn.0040ed00
aeskeygenassist xmm1, xmm2, 8
call fcn.0040ed50
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0040ed00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0040ed50
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0040ed00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0040ed50
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.0040ee26
aeskeygenassist xmm1, xmm0, 1
call fcn.0040ee40
aeskeygenassist xmm1, xmm2, 2
call fcn.0040ee20
aeskeygenassist xmm1, xmm0, 2
call fcn.0040ee40
aeskeygenassist xmm1, xmm2, 4
call fcn.0040ee20
aeskeygenassist xmm1, xmm0, 4
call fcn.0040ee40
aeskeygenassist xmm1, xmm2, 8
call fcn.0040ee20
aeskeygenassist xmm1, xmm0, 8
call fcn.0040ee40
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0040ee20
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0040ee40
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0040ee20
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0040ee40
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0040ee20
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x40ee90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040ebb0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x40eef1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x40eec2
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x40f7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x40f818
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x40f7f0
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x40f7f8
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0040f81d

Function at 0x4111c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x411304
pushfd
cld
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
lea esi, [esp - 0x40]
and esi, 0xffffffc0
lea edi, [edx - 0x7f]
sub edi, esi
neg edi
and edi, 0x3c0
sub esi, edi
mov edi, dword [esp + 0x2c]
xchg esi, esp
add esp, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebp
call fcn.0041121f
Function at 0x4158f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], esi
test edi, edi
jg 0x41592c
jl 0x415adc
test esi, esi
je 0x415adc
mov ecx, 1
mov dword [ebp - 0x84], 0xedb88320
mov eax, ecx
nop dword [eax]
mov dword [ebp + eax*4 - 0x84], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x415940
xor esi, esi
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x415971
test al, 1
je 0x41596a
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x415964
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x415951
xor esi, esi
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x4159b0
test al, 1
je 0x4159a9
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4159a3
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x415990
nop dword [eax]
nop word [eax + eax]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x415a00
test al, 1
je 0x4159f9
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4159f3
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x4159e0
mov edx, dword [ebp - 0x108]
mov eax, edx
and eax, 1
or eax, 0
je 0x415a40
xor ecx, ecx
lea eax, [ebp - 0x104]
test ebx, ebx
je 0x415a3e
nop
test bl, 1
je 0x415a37
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x415a30
mov ebx, ecx
shrd edx, edi, 1
sar edi, 1
mov eax, edx
or eax, edi
mov dword [ebp - 0x108], edx
je 0x415ad6
xor esi, esi
nop dword [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x415a80
test al, 1
je 0x415a79
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x415a73
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x415a60
mov esi, dword [ebp - 0x108]
mov eax, esi
and eax, 1
or eax, 0
je 0x415ac0
xor ecx, ecx
lea eax, [ebp - 0x84]
test ebx, ebx
je 0x415abe
nop
test bl, 1
je 0x415ab7
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x415ab0
mov ebx, ecx
shrd esi, edi, 1
sar edi, 1
mov eax, esi
or eax, edi
mov dword [ebp - 0x108], esi
jne 0x4159d0
xor ebx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret