joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48183c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.00404f2c
mov eax, dword [ebp + 0xc]
call fcn.00404f2c
mov eax, dword [ebp + 8]
call fcn.00404f2c
xor eax, eax
push ebp
push 0x481a5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, 0x481a70
call fcn.00404ed4
je 0x48199f
call fcn.00481754
test al, al
je 0x4818f8
push 5
push 0
push 0x481a84
push dword [ebp + 0xc]
push 0x481a84
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00404e40
mov eax, dword [ebp - 0x44]
call fcn.00404f3c
push eax
push 0x481a84
push dword [ebp - 4]
push 0x481a84
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00404e40
mov eax, dword [ebp - 0x48]
call fcn.00404f3c
push eax
push 0x481a88
push ebx
call sub.shell32.dll_ShellExecuteA
jmp 0x481a2a
push 0x40
push 0x481a90
push 0x481a98
push 0
call sub.user32.dll_MessageBoxA_1
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403504
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0x500
mov eax, 0x481ae4
mov dword [ebp - 0x34], eax
push 0x481a84
push dword [ebp - 4]
push 0x481a84
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00404e40
mov eax, dword [ebp - 0x4c]
call fcn.00404f3c
mov dword [ebp - 0x30], eax
push 0x481a84
push dword [ebp + 0xc]
push 0x481a84
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00404e40
mov eax, dword [ebp - 0x50]
call fcn.00404f3c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x481a2a
call fcn.0040e5e8
jmp 0x481a2a
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403504
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0x500
mov eax, 0x481ae4
mov dword [ebp - 0x34], eax
push 0x481a84
push dword [ebp - 4]
push 0x481a84
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00404e40
mov eax, dword [ebp - 0x54]
call fcn.00404f3c
mov dword [ebp - 0x30], eax
push 0x481a84
push dword [ebp + 0xc]
push 0x481a84
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00404e40
mov eax, dword [ebp - 0x58]
call fcn.00404f3c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x481a2a
call fcn.0040e5e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481a61
lea eax, [ebp - 0x58]
mov edx, 6
call fcn.00404ad0
lea eax, [ebp - 4]
call fcn.00404aac
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404ad0
ret
Function at 0x481aec
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor edx, edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x9c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x481cca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x94
call fcn.00403504
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, ebx
mov edx, 0x481ce0
call fcn.00404b00
cmp dword [ebp - 0x84], 2
jne 0x481bc3
mov eax, dword [ebp - 0x90]
sub eax, 3
je 0x481b70
dec eax
je 0x481b7e
dec eax
je 0x481b8c
jmp 0x481b98
mov eax, ebx
mov edx, 0x481cf4
call fcn.00404b00
jmp 0x481b98
mov eax, ebx
mov edx, 0x481d04
call fcn.00404b00
jmp 0x481b98
mov eax, ebx
mov edx, 0x481d14
call fcn.00404b00
cmp dword [ebp - 0x90], 5
jne 0x481cac
cmp dword [ebp - 0x8c], 1
jne 0x481cac
mov eax, ebx
mov edx, 0x481d24
call fcn.00404b00
jmp 0x481cac
cmp dword [ebp - 0x90], 4
jne 0x481c2c
cmp dword [ebp - 0x8c], 0
jne 0x481c2c
mov eax, ebx
mov edx, 0x481d34
call fcn.00404b00
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00404d1c
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00408cac
mov eax, dword [ebp - 0x98]
mov edx, 0x481d44
call fcn.00404ed4
jne 0x481cac
mov eax, ebx
mov edx, 0x481d50
call fcn.00404b00
jmp 0x481cac
cmp dword [ebp - 0x90], 4
jne 0x481c8e
cmp dword [ebp - 0x8c], 0xa
jne 0x481c8e
mov eax, ebx
mov edx, 0x481d64
call fcn.00404b00
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00404d1c
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00408cac
mov eax, dword [ebp - 0xa0]
mov edx, 0x481d74
call fcn.00404ed4
jne 0x481cac
mov eax, ebx
mov edx, 0x481d80
call fcn.00404b00
jmp 0x481cac
cmp dword [ebp - 0x90], 4
jne 0x481cac
cmp dword [ebp - 0x8c], 0x5a
jne 0x481cac
mov eax, ebx
mov edx, 0x481d90
call fcn.00404b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481cd1
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.00404ad0
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4aeea0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7e000]
push edi
jmp 0x4aeeba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4aeec1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aeeb0
mov eax, 1
add ebx, ebx
jne 0x4aeed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4aeee4
jne 0x4aef03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aef03
dec eax
add ebx, ebx
jne 0x4aeef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4aeec8
add ebx, ebx
jne 0x4aeeff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4aef55
xor ecx, ecx
sub eax, 3
jb 0x4aef1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4aef8a
sar eax, 1
mov ebp, eax
jmp 0x4aef26
add ebx, ebx
jne 0x4aef26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aeef4
inc ecx
add ebx, ebx
jne 0x4aef34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aeef4
add ebx, ebx
jne 0x4aef41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4aef36
jne 0x4aef52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4aef36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4aef74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4aef66
jmp 0x4aeeb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4aef74
add edi, ecx
jmp 0x4aeeb6
pop esi
mov edi, esi
mov ecx, 0x28ed
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4aef92
cmp byte [edi], 0x1b
jne 0x4aef92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4aef97
lea edi, [esi + 0xab000]
mov eax, dword [edi]
or eax, eax
je 0x4af00f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd7538]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd7650]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4aefc4
mov ecx, edi
jns 0x4aeff3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd7654]
or eax, eax
je 0x4af009
mov dword [ebx], eax
add ebx, 4
jmp 0x4aefe1
call dword [esi + 0xd7664]
mov ebp, dword [esi + 0xd7658]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4af043
sub esp, 0xffffff80
jmp 0x44be98
Function at 0x42a0f0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x42a110
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x42d360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d37e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x42d3c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d3de
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x42d420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d442
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x42d4a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d4c2
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x42d520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d54a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x42d5b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d5da
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x42d640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x42d69f

Function at 0x42d6ae
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d690
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x42d720
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x42d77f

Function at 0x42d78e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x42d770
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x42fe00
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x430320
test edx, edx
je 0x430320
call fcn.0042fe17
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x430360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0042fe00
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x4303d1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x430396
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x443100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
call fcn.0044dab0
mov esi, eax
test esi, esi
je 0x4432fc
call fcn.0044da50
cmp byte [esi], 0
mov ecx, esi
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x11], 0xb
je 0x443136
nop word [eax + eax]
inc ecx
cmp byte [ecx], 0
jne 0x443130
push ecx
push esi
lea ecx, [ebp - 0x1c]
call fcn.004409b0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0045cc50
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.0045d030
cmp byte [ebp - 0x4d], 0
jge 0x44316d
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x44316d
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0x59], 0
jge 0x443183
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x443183
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0x65], 0
jge 0x443199
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x443199
push eax
call fcn.0044d750
add esp, 4
test byte [ebp - 0x11], 0x80
je 0x4431af
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4431af
push eax
call fcn.0044d750
add esp, 4
lea eax, [ebp - 1]
push eax
push 0x5ff7d0
lea ecx, [ebp - 0x10]
call fcn.0043f570
cmp byte [ebp - 0x41], 0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x1c], 0
cmovl ecx, dword [ebp - 0x4c]
mov byte [ebp - 0x11], 0xb
mov eax, ecx
cmp byte [ecx], 0
je 0x4431e6
nop word [eax + eax]
inc eax
cmp byte [eax], 0
jne 0x4431e0
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004409b0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00460c00
mov esi, eax
add esp, 8
mov al, byte [esi + 0xb]
test al, al
jns 0x443215
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov esi, ecx
lea eax, [ecx + edx*2]
jmp 0x443222
movzx eax, al
mov ecx, 5
sub ecx, eax
lea eax, [esi + ecx*2]
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00440e20
test byte [ebp - 0x1d], 0x80
je 0x443242
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x443242
push eax
call fcn.0044d750
add esp, 4
test byte [ebp - 0x11], 0x80
je 0x443258
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x443258
push eax
call fcn.0044d750
add esp, 4
mov eax, 0x5ff7d0
nop dword [eax]
add eax, 2
cmp word [eax], 0
jne 0x443260
sub eax, 0x5ff7d0
lea ecx, [ebp - 0x10]
sar eax, 1
lea eax, [eax*2 + 0x5ff7d0]
push eax
push 0x5ff7d0
call fcn.00440e20
test byte [ebp - 5], 0x80
lea eax, [ebp - 0x10]
push 5
cmovne eax, dword [ebp - 0x10]
push 0
push 0
push eax
push 0x5ff7d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test byte [ebp - 5], 0x80
je 0x4432ba
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4432ba
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0x29], 0
jge 0x4432d0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4432d0
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0x35], 0
jge 0x4432e6
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4432e6
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0x41], 0
jge 0x4432fc
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4432fc
push eax
call fcn.0044d750
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x445810
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44586a
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44586a
cmp dword [ebp - 8], 1
jne 0x44586a
cmp dword [ebp - 0xc], eax
seta bl
jmp 0x44586c
xor bl, bl
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44587f
cmp ecx, 0xffffffff
je 0x44587f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x447540
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, 0x3ff
mov ecx, 0x68c024
and ax, di
xor edx, edx
movzx esi, ax
nop dword [eax]
mov ax, word [ecx]
and ax, di
cmp ax, si
je 0x447614
add ecx, 0x18
inc edx
cmp ecx, 0x68c1ec
jl 0x447560
mov esi, dword [ebp + 8]
push ebx
mov ebx, 0x600264
mov byte [esi], 0
mov byte [esi + 0xb], 0xb
nop dword [eax + eax]
inc ebx
cmp byte [ebx], 0
jne 0x447590
sub ebx, 0x600264
cmp ebx, 0xb
jbe 0x4475cb
push 0
push 0
push 0
push 0
lea eax, [ebx + 1]
push 0
push eax
call fcn.0049f9b0
mov dword [esi], eax
add esp, 0x18
mov eax, ebx
mov dword [esi + 4], ebx
or eax, 0x80000000
mov dword [esi + 8], eax
shr eax, 0x18
jmp 0x4475d2
mov al, 0xb
sub al, bl
mov byte [esi + 0xb], al
test al, al
jns 0x4475da
mov eax, dword [esi]
jmp 0x4475dc
mov eax, esi
push ebx
push 0x600264
push eax
call fcn.005d67e0
mov al, byte [esi + 0xb]
add esp, 0xc
pop ebx
test al, al
jns 0x447601
mov eax, dword [esi + 4]
add eax, dword [esi]
pop edi
mov byte [eax], 0
mov eax, esi
pop esi
pop ebp
ret
movzx ecx, al
mov eax, esi
sub eax, ecx
add eax, 0xb
pop edi
mov byte [eax], 0
mov eax, esi
pop esi
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [edx + edx*2]
mov eax, dword [eax*8 + 0x68c020]
mov ecx, eax
mov byte [esi], 0
mov byte [esi + 0xb], 0xb
cmp byte [eax], 0
je 0x447636
nop
inc ecx
cmp byte [ecx], 0
jne 0x447630
push ecx
push eax
mov ecx, esi
call fcn.004409b0
pop edi
mov eax, esi
pop esi
pop ebp
ret