joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b610
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test edi, edi
je 0x4132a6
mov bl, 0x41
xor esi, esi
mov eax, 1
mov ecx, esi
shl eax, cl
test edi, eax
je 0x41329a
movsx ax, bl
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 1
mov word [ebp - 0x44], ax
xor eax, eax
mov word [ebp - 0x42], ax
push 0x47d774
lea edx, [ebp - 0x44]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
call fcn.004123f0
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x41325e
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00405c10
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
call fcn.004036e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41329a
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00405c10
inc bl
inc esi
cmp bl, 0x5a
jle 0x413202
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x414590
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b85b
mov eax, dword fs:[0]
push eax
mov eax, 0x4028
call fcn.00449df0
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x401c]
mov dword [ebp - 0x4014], 0xffffffff
push eax
push ecx
push 0
push 1
push 2
mov dword [ebp - 0x4018], 0x4000
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x41475b
push 0x4000
lea eax, [ebp - 0x4010]
push 0
push eax
call fcn.0044bde0
add esp, 0xc
mov dword [ebp - 0x4014], 0xffffffff
lea eax, [ebp - 0x4018]
mov dword [ebp - 0x4018], 0x4000
push eax
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4014]
push eax
push dword [ebp - 0x401c]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x41474f
xor edi, edi
cmp dword [ebp - 0x4014], edi
jbe 0x4145f2
lea esi, [ebp - 0x3ffc]
cmp dword [esi - 0xc], 3
jne 0x414727
mov edx, dword [esi]
xor eax, eax
mov dword [ebp - 0x4020], 7
mov dword [ebp - 0x4024], 0
mov word [ebp - 0x4034], ax
cmp word [edx], ax
je 0x41469f
mov eax, edx
lea ebx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414690
sub eax, ebx
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x4034]
call fcn.0040e1e0
lea ecx, [ebp - 0x4034]
mov dword [ebp - 4], 0
call fcn.00414280
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x4020]
cmp eax, 8
jb 0x41470a
mov ecx, dword [ebp - 0x4034]
inc eax
cmp eax, 0x7fffffff
ja 0x41474a
add eax, eax
cmp eax, 0x1000
jb 0x414701
test cl, 0x1f
jne 0x41474a
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41474a
sub ecx, eax
cmp ecx, 4
jb 0x41474a
cmp ecx, 0x23
ja 0x41474a
mov ecx, eax
push ecx
call fcn.00448f45
add esp, 4
xor eax, eax
mov dword [ebp - 0x4020], 7
mov dword [ebp - 0x4024], 0
mov word [ebp - 0x4034], ax
test byte [esi - 8], 2
je 0x414735
lea ecx, [esi - 0x14]
call fcn.00414590
inc edi
add esi, 0x20
cmp edi, dword [ebp - 0x4014]
jb 0x414655
jmp 0x4145f2
call fcn.00450abf
push dword [ebp - 0x401c]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x414aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b928
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x414ae8
mov eax, dword [ecx]
jmp 0x414aea
mov eax, ecx
push 0xffffffffffffffff
xor esi, esi
push esi
push edx
mov word [eax], si
call fcn.00405e70
lea ecx, [ebp - 0x2c]
call fcn.00414950
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00414780
test al, al
jne 0x414b67
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push esi
cmovae eax, dword [ebp - 0x2c]
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x414b67
cmp dword [0x49a674], 0x10
lea eax, [ebp - 0x14]
push 0
push eax
push dword [0x49a604]
mov ecx, 0x49a660
cmovae ecx, dword [0x49a660]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x414b7c
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00405c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret

Function at 0x414da0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, eax
push eax
push ecx
push 1
push 0
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x414e10
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00405c10
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x415590
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], ecx
push eax
push 0
push 8
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415608
call esi
cmp eax, 0x3f0
jne 0x4155f2
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x415608
xor eax, eax
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x4155f2
call esi
cmp eax, 0x7a
jne 0x4155f2
mov esi, dword [ebp - 0x10]
mov eax, esi
call fcn.00449580
mov edi, esp
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x4155f2
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push 2
push dword [ebp - 0x14]
call ebx
test eax, eax
je 0x4155f2
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4155f2
xor ebx, ebx
xor esi, esi
cmp dword [edi], ebx
jbe 0x4156b7
add edi, 4
push dword [ebp - 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41569e
mov eax, dword [ebp - 0x1c]
inc esi
add edi, 8
cmp esi, dword [eax]
jb 0x415682
jmp 0x4156b7
cmp dword [ebp - 0x20], ebx
je 0x4156b2
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + esi*8 + 8]
shr ebx, 2
and ebx, 1
jmp 0x4156b7
mov ebx, 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x4177d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bb68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x417915
cmp byte [edi + 0x3e], 0
je 0x417915
push 0xffff
call fcn.00415fc0
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
sete al
test al, al
je 0x417834
xor al, al
jmp 0x417917
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmp ecx, 0x10
lea edx, [ebp - 0x28]
mov ecx, dword [edi + 0x38]
cmovae esi, ebx
cmovae edx, ebx
add eax, esi
push eax
push edx
lea eax, [edi + 0x40]
push eax
mov eax, dword [ecx]
call dword [eax + 0x20]
sub eax, 0
je 0x4178a6
sub eax, 1
je 0x4178aa
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x4178fd
xor bl, bl
jmp 0x4178ff
mov byte [edi + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ebx
sub esi, eax
je 0x4178df
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ebx
push 1
push eax
call fcn.004571cb
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x4178a2
cmp byte [edi + 0x3e], 0
je 0x4178fd
test esi, esi
jne 0x417867
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00406070
jmp 0x417864
mov bl, 1
cmp ecx, 0x10
jb 0x417911
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00405c70
mov al, bl
jmp 0x417917
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x417c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bb68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x417db0
cmp byte [edi + 0x3d], 0
je 0x417db0
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x417cb9
xor al, al
jmp 0x417db2
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
nop
mov eax, dword [edi + 0x38]
lea ebx, [ebp - 0x28]
cmp ecx, 0x10
lea esi, [ebp - 0x28]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x417d15
mov dword [ebp - 0x2c], esi
xor eax, eax
jmp 0x417d36
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [ebp - 0x30]
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub eax, 0
je 0x417d49
sub eax, 1
je 0x417d4d
sub eax, 2
je 0x417d9a
xor bl, bl
jmp 0x417d9c
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edx
sub esi, eax
je 0x417d7c
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004571cb
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov edx, dword [ebp - 0x28]
cmp esi, eax
jne 0x417d45
cmp byte [edi + 0x3d], 0
je 0x417d9a
test esi, esi
jne 0x417cf0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00406070
jmp 0x417ce9
mov bl, 1
cmp ecx, 0x10
jb 0x417dac
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00405c70
mov al, bl
jmp 0x417db2
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x418170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a8f6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x49611c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00448c8d
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043009c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], edi
cmp esi, 4
jb 0x41aa20
mov eax, dword [ebp - 8]
sub ebx, edx
sub eax, edx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, 4
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
nop dword [eax]
mov eax, dword [edx + edi]
add ecx, 4
xor eax, dword [edi]
mov dword [ebx + edi], eax
add edi, 4
mov eax, dword [ebp - 0x14]
add eax, edi
cmp eax, esi
jbe 0x41aa00
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x10], eax
cmp ecx, esi
jae 0x41ab12
cmp eax, 0x20
jb 0x41aae9
lea eax, [ecx + ebx]
add edx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
add eax, esi
cmp dword [ebp - 4], eax
ja 0x41aa58
lea eax, [esi - 1]
add eax, ebx
cmp eax, edx
jae 0x41aae9
lea eax, [ecx + edi]
mov dword [ebp - 0x14], eax
lea eax, [esi - 1]
add eax, edi
cmp dword [ebp - 4], eax
ja 0x41aa72
lea eax, [esi - 1]
add eax, ebx
cmp eax, dword [ebp - 0x14]
jae 0x41aae9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], esi
and eax, 0x1f
sub dword [ebp - 4], eax
mov esi, edi
sub esi, dword [ebp + 8]
lea eax, [ebx + 0x10]
mov dword [ebp - 0x10], esi
add eax, ecx
mov esi, ebx
mov dword [ebp - 0x14], eax
sub esi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
sub esi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
mov esi, eax
mov eax, dword [ebp - 0x1c]
nop dword [eax + eax]
movups xmm0, xmmword [edx]
add ecx, 0x20
lea edx, [edx + 0x20]
lea esi, [esi + 0x20]
movups xmm1, xmmword [edx + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx + edi - 0x20], xmm1
movups xmm1, xmmword [eax + esi - 0x20]
movups xmm0, xmmword [edx - 0x10]
pxor xmm1, xmm0
movups xmmword [esi - 0x20], xmm1
cmp ecx, dword [ebp - 4]
jb 0x41aab0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp ecx, esi
jae 0x41ab12
sub edi, dword [ebp + 8]
add eax, ecx
sub ebx, dword [ebp + 8]
sub esi, ecx
nop word [eax + eax]
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + ebx - 1], cl
sub esi, 1
jne 0x41ab00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x49611c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], edx
push edi
mov edi, ecx
cmp esi, 0x400
jbe 0x41b2ff
mov eax, 0xffffffca
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
push 0x30
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0044bde0
mov eax, dword [edi + 0x10]
add esp, 0xc
cmp eax, dword [edi + 0x1c]
jg 0x41b31e
cmp dword [edi + 0x14], 0
je 0x41b336
push 0
push 0
xor edx, edx
mov ecx, edi
call fcn.0041b0e0
add esp, 8
test eax, eax
jne 0x41b48d
test esi, esi
je 0x41b462
lea edx, [edi + 0x28]
mov dword [esp + 0x14], edx
mov eax, 3
nop word [eax + eax]
mov ecx, dword [edi + eax*4]
bswap ecx
add ecx, 1
bswap ecx
mov dword [edi + eax*4], ecx
jne 0x41b366
test eax, eax
je 0x41b366
dec eax
jmp 0x41b350
mov ecx, edx
call fcn.0041e2c0
mov edx, dword [edi + 0x24]
mov esi, eax
lea eax, [edi + 0x20]
cmp esi, edx
je 0x41b399
mov ecx, dword [eax]
add edx, 2
inc ecx
shl ecx, 4
push ecx
lea ecx, [eax + edx*4]
lea eax, [eax + esi*4]
push ecx
add eax, 8
push eax
call fcn.00449ea0
add esp, 0xc
mov dword [edi + 0x24], esi
cmp dword [0x49a634], 0
jne 0x41b3d9
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [0x49a624], eax
mov eax, ecx
mov dword [0x49a628], esi
mov dword [0x49a62c], ecx
mov dword [0x49a630], edx
mov dword [0x49a638], eax
mov dword [0x49a634], 1
jmp 0x41b3de
mov eax, dword [0x49a638]
lea ecx, [edi + 0x20]
test eax, 0x2000000
je 0x41b41c
mov eax, dword [ecx + 4]
movups xmm0, xmmword [edi]
lea eax, [ecx + eax*4]
mov ecx, dword [ecx]
movaps xmm1, xmmword [eax + 8]
add eax, 0x18
pxor xmm1, xmm0
sub ecx, 1
je 0x41b410
aesenc xmm1, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x41b403
aesenclast xmm1, xmmword [eax]
movups xmmword [esp + 0x48], xmm1
jmp 0x41b431
lea eax, [esp + 0x48]
mov edx, edi
push eax
call fcn.0041f480
mov edx, eax
add esp, 4
test edx, edx
jne 0x41b476
mov esi, dword [ebp + 8]
mov eax, 0x10
cmp esi, 0x10
cmova esi, eax
lea eax, [esp + 0x48]
push esi
push eax
push dword [esp + 0x18]
call fcn.0044b7f0
add dword [esp + 0x1c], esi
add esp, 0xc
sub dword [ebp + 8], esi
mov edx, dword [esp + 0x14]
jne 0x41b345
lea edx, [esp + 0x18]
mov ecx, edi
call fcn.0041b010
mov edx, eax
test edx, edx
jne 0x41b476
inc dword [edi + 0x10]
mov ecx, 0x40
lea eax, [esp + 0x18]
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x41b480
mov eax, edx
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x41ce40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x60], eax
call fcn.0041d7e0
mov edi, eax
test edi, edi
jne 0x41ce80
pop edi
mov eax, 0xffffbf80
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448a58
mov esp, ebp
pop ebp
ret
push ebx
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
push ecx
mov edx, edi
movq qword [ebp - 0x5c], xmm0
lea ecx, [ebp - 0x5c]
call fcn.0041d960
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41cfa0
movzx edi, byte [edi + 4]
push 0x40
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x50], edi
push eax
call fcn.0044bde0
mov eax, dword [ebp - 0x4c]
add esp, 0xc
mov dword [ebp - 0x48], ebx
test eax, eax
je 0x41cfa0
nop dword [eax]
cmp eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x5c]
cmovb edi, eax
call fcn.0041db00
mov ebx, eax
test ebx, ebx
jne 0x41cfa0
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x5c]
call fcn.0041dc80
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41cfa0
push 4
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x5c]
call fcn.0041dc80
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41cfa0
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.0041dd20
mov ebx, eax
test ebx, ebx
jne 0x41cfa0
xor ecx, ecx
test edi, edi
je 0x41cf8c
cmp edi, 0x20
jb 0x41cf7c
lea edx, [esi - 1]
lea eax, [ebp + edi - 0x45]
add edx, edi
cmp esi, eax
ja 0x41cf4d
lea eax, [ebp - 0x44]
cmp edx, eax
jae 0x41cf7c
mov eax, edi
and eax, 0xffffffe0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebp + ecx - 0x44]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 0x34]
add ecx, 0x20
pxor xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
add esi, 0x20
cmp ecx, eax
jb 0x41cf52
cmp ecx, edi
jae 0x41cf8c
mov al, byte [ebp + ecx - 0x44]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, edi
jb 0x41cf80
mov eax, dword [ebp - 0x4c]
inc byte [ebp - 0x45]
sub eax, edi
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
jne 0x41ced0
mov ecx, 0x40
lea eax, [ebp - 0x44]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x41cfb0
lea ecx, [ebp - 0x5c]
call fcn.0041d880
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x41df90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
mov edx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 8], eax
mov eax, esi
mov dword [ebp - 0x14], edx
sub ecx, eax
push edi
mov edx, 4
mov dword [ebp - 4], ecx
xor edi, edi
sub ebx, eax
sub edx, eax
nop word [eax + eax]
mov eax, dword [ebx + esi]
lea esi, [esi + 4]
xor eax, dword [esi - 4]
add edi, 4
mov dword [ecx + esi - 4], eax
lea eax, [edx + esi]
cmp eax, 0x10
jbe 0x41dfc0
mov edx, 0x10
mov eax, edx
sub eax, edi
mov dword [ebp - 0x18], eax
cmp edi, edx
jae 0x41e0a2
cmp eax, 0x20
jb 0x41e082
mov eax, dword [ebp - 0x14]
lea esi, [edi + eax]
lea ecx, [eax + 0xf]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
lea ecx, [edi + eax]
add eax, 0xf
cmp esi, eax
ja 0x41e016
cmp dword [ebp - 0xc], ecx
jae 0x41e07d
mov esi, dword [ebp - 8]
lea eax, [esi + 0xf]
cmp dword [ebp - 0x10], eax
ja 0x41e029
lea eax, [edi + esi]
cmp dword [ebp - 0xc], eax
jae 0x41e07d
mov eax, dword [ebp - 0x18]
and eax, 0x1f
sub edx, eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x18], edx
sub esi, dword [ebp - 0x14]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
movups xmm0, xmmword [ecx]
add edi, 0x20
lea ecx, [ecx + 0x20]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx + esi - 0x20], xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [ecx - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, dword [ebp - 0x18]
jb 0x41e046
mov edx, 0x10
jmp 0x41e084
mov esi, dword [ebp - 4]
jmp 0x41e084
mov esi, ecx
cmp edi, 0x10
jae 0x41e0a2
mov eax, dword [ebp + 8]
add eax, edi
sub edx, edi
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x41e090
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret