joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439b42
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x439ba0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439bc2
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x439c20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439c4a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x439cb0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439cda
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x439d40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x439d9f
Function at 0x439dae
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439d90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x439e20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x439e7f

Function at 0x439e8e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x439e70
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x43c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43ca20
test edx, edx
je 0x43ca20
call fcn.0043c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043d469

Function at 0x448140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44819b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44819b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x448188
cmp esi, edx
jae 0x44819b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x448176
cmp esi, edx
jae 0x44819b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x44afb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1570
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x44b014
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x44b025
push 0x48
push esi
call fcn.005ce06a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44b580
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1691
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
mov dword [ebp - 0x10], 0
call fcn.00482dd0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [esi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push dword [ebp + 0x10]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00483920
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00485480
mov edi, eax
push 0x14
mov byte [ebp - 4], 3
call fcn.005cdde9
mov ecx, dword [ebp + 8]
mov ebx, eax
add esp, 4
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
mov dword [ebx + 4], str.DecodingLookupArray
mov word [ebx + 8], 1
mov dword [ebx + 0xc], 0
mov dword [ebx], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [ebx + 0x10], ecx
mov byte [ebp - 4], 4
mov eax, dword [edi + 4]
mov dword [edi + 4], 0
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x44b67a
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 4]
mov dword [ebp + 8], 0
test ecx, ecx
je 0x44b691
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 4], ebx
mov byte [edi + 8], 1
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00485400
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x44b6bd
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 2
push eax
push str.Log2Base
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], vtable.CryptoPP::NameValuePairs.0
call fcn.00470f70
push eax
mov ecx, esi
call fcn.004892e0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x44b6f2
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44b710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1570
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x44b767
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x44b778
push 0x3c
push esi
call fcn.005ce06a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44d930
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x44d952
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x7e]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x44d940
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x457a10
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2910
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
call fcn.00457b70
mov edi, eax
cmp byte [edi + 9], 0
je 0x457a8a
xor ebx, ebx
nop dword [eax + eax]
mov eax, 0x3521cfb3
lea esi, [ebx + edi]
mul ebx
mov eax, ebx
mov cl, bl
sub eax, edx
inc ebx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul eax, eax, 0x35
sub cl, al
add cl, 0x31
xor byte [esi], cl
cmp ebx, 0xa
jl 0x457a60
push edi
lea ecx, [ebp - 0x40]
call fcn.0046e7c0
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, eax
push 2
call fcn.0046e590
push eax
lea ecx, [ebp - 0x120]
call fcn.0046caa0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0046e6f0
lea eax, [ebp - 0x28]
push eax
call fcn.00457ba0
mov edi, eax
cmp byte [edi + 0xa], 0
je 0x457afa
xor ecx, ecx
nop
mov eax, 0x3521cfb3
lea esi, [ecx + edi]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov dl, cl
shr eax, 5
inc ecx
movsx eax, al
imul eax, eax, 0x35
sub dl, al
add dl, 0x31
xor byte [esi], dl
cmp ecx, 0xb
jl 0x457ad0
push edi
lea ecx, [ebp - 0x70]
call fcn.0046e7c0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.0046e590
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00470da0
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.00471700
push 0x470d20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x58]
call fcn.0046e6f0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0046e6f0
lea ecx, [ebp - 0x120]
call fcn.0046ca70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x458210
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x130], 0x128
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4582b4
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x4582b4
mov eax, edi
lea ecx, [ebp - 0x10c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x458290
test dl, dl
je 0x45828c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x458290
add ecx, 2
add eax, 2
test dl, dl
jne 0x458270
xor eax, eax
jmp 0x458295
sbb eax, eax
or eax, 1
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x458264
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cdcb6
mov esp, ebp
pop ebp
ret

Function at 0x45c690
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
mov dword [ebp - 0x74], str..NiGgEr
mov dword [ebp - 0x70], str..KsDumper
nop dword [eax + eax]
push 0
push 0x80
push 3
push 0
push 1
push bind
push dword [ebp + esi*4 - 0x74]
call edi
cmp eax, 0xffffffff
jne 0x45c6f3
inc esi
cmp esi, 2
jl 0x45c6c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005cdcb6
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x64a5a0]
lea ecx, [ebp - 0x6c]
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0xc], 0x89918ddc
movaps xmm0, xmmword [0x64a5b0]
movups xmmword [ebp - 0x5c], xmm0
mov word [ebp - 8], 0x100
movaps xmm0, xmmword [0x64a590]
movups xmmword [ebp - 0x4c], xmm0
movaps xmm0, xmmword [0x64a560]
movups xmmword [ebp - 0x3c], xmm0
movaps xmm0, xmmword [0x64a570]
movups xmmword [ebp - 0x2c], xmm0
movaps xmm0, xmmword [0x64a580]
movups xmmword [ebp - 0x1c], xmm0
call fcn.0045c760
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x45c760
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x65], 0
je 0x45c782
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x7e]
inc eax
xor byte [edx], cl
cmp eax, 0x64
jb 0x45c770
mov byte [esi + 0x65], 0
mov eax, esi
pop esi
ret
Function at 0x45c790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2b2d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
push 0x647c38
push 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0046ff50
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0x3c
cmova eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], str.cmd.exe
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45c839
or esi, 0xffffffff
jmp 0x45c85d
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x45c893
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45c889
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45c889
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005ce06a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x460e90
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2eed
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
push ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00471bc0
push ecx
push edi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00471bc0
push ecx
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00460ce0
add esp, 4
lea ecx, [ebp - 0x44]
call fcn.0045fa30
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.0045fa30
push esi
lea eax, [ebp - 0x2c]
push str.start_____
push eax
call fcn.00470da0
add esp, 0xc
push 0x647a08
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
call fcn.00470d50
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0046e6f0
lea ecx, [ebp - 0x5c]
call fcn.0046e590
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.An_error_occurred:
call fcn.00470b00
mov ecx, dword [ebp - 0x60]
mov esi, eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edx, eax
mov ecx, esi
call fcn.00470b00
push 0x470d20
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 0x460f88
ret
Function at 0x4629b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 0x24], ecx
call fcn.0049afe0
mov esi, eax
test esi, esi
je 0x462b19
mov cx, word [0x649db4]
mov word [ebp - 0x20], cx
mov cl, byte [0x649db6]
push ebx
mov byte [ebp - 0x1e], cl
xor ebx, ebx
nop dword [eax]
mov eax, 0x3521cfb3
mov cl, bl
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul eax, eax, 0x35
sub cl, al
add cl, 0x31
xor byte [ebp + ebx - 0x20], cl
inc ebx
cmp ebx, 3
jl 0x4629f0
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], 0
pop ebx
movups xmmword [ebp - 0x1c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462a35
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00472730
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ecx, dword [ebp - 8]
add esp, 8
mov edi, eax
cmp ecx, 0xf
jbe 0x462a99
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x462a8f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x462a8f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005ce06a
add esp, 8
push dword [ebp - 0x24]
mov dword [ebp - 0xc], 0
push 0x2712
push esi
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.0049eeb0
push 0
push 0x40
push esi
call fcn.0049eeb0
push 0
push 0x51
push esi
call fcn.0049eeb0
push 0
push 0x4e2b
push esi
call fcn.0049eeb0
push edi
push 0x2711
push esi
call fcn.0049eeb0
push 0
push 0x2b
push esi
call fcn.0049eeb0
add esp, 0x48
push 0x461e90
push 0x4e58
push esi
call fcn.0049eeb0
push esi
call fcn.0049b080
push esi
call fcn.0049afb0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005cdcb6
mov esp, ebp
pop ebp
ret