joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4debc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x4dec08
call fcn.004ccac5
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4dec08
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4dec15
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x4dec51
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x4dec34
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x4dec3d
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x4dec4f
test di, di
jne 0x4dec4f
test dx, dx
je 0x4dec51
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4dec56
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x4dec81
cmp dword [esi + 0x80], 0
jne 0x4dec81
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.004ccac5
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4decb1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4decb1
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.004def18
jmp 0x4decb3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4decba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.004ccac5
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4decfa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4decfa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004ded02
jmp 0x4decfc
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x4defed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x65ac38
call fcn.005fe9fe
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.004ccac5
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x4df04c
call fcn.004ccac5
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4df060
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x4df05c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x4df068
or eax, 0xffffffff
jmp 0x4df1ba
mov ecx, edi
call fcn.004df5f7
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.004d2f0a
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x4df0f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x4df0f4
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4df0f4
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.004ccbcf
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4df0f1
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x66aac0]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x4df0f1
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004d1678
test eax, eax
je 0x4df0f1
push 0
mov ecx, esi
call fcn.004d144b
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.004d2bd7
push ebx
call fcn.004d42a4
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.004def90
test eax, eax
jne 0x4df13d
cmp dword [edi + 0x9c], eax
jne 0x4df13d
call fcn.004ccac5
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.004d42a4
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.004def90
and dword [edi + 0x9c], 0
jmp 0x4df168
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x4df17c
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.004d144b
test esi, esi
je 0x4df189
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x4df19f
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x4df19f
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x66aac0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.004df5ae
mov eax, dword [edi + 0x68]
call fcn.005fe963
ret
Function at 0x4e0e7a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x4e0ed0
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4e0ea9
call fcn.004db817
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4e0ebe
call fcn.004db817
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4e0ed0
call fcn.004db817
call fcn.004ccac5
cmp dword [eax + 0x3c], 0
je 0x4e0ee5
push esi
mov ecx, ebx
call fcn.004e05a0
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.004e10cb
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4e0f0e
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4e0f1a
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4e574c
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x4e5892
mov ecx, 0x708124
call fcn.004cc453
mov esi, eax
test esi, esi
je 0x4e5887
xor eax, eax
cmp word [esi + 8], ax
jne 0x4e5851
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x4e580d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x4e57d3
push str.MS_UI_Gothic
call fcn.004e58d0
pop ecx
test eax, eax
je 0x4e57d3
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x4e57ee
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4e580d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4e5813
push ebx
push edi
push eax
call fcn.004e52be
add esp, 0xc
jmp 0x4e5813
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 1
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.004cb731
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x4e588c
mov eax, dword [edi]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.004cd35d
mov ax, word [ebx]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
jmp 0x4e5854
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x4e5862
push edi
call fcn.00631510
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.0044322a
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.004ca28a
call fcn.004ca2a4
int3
Function at 0x4f5b61
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x168], esi
test eax, eax
je 0x4f5bcb
push 0x208
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, esi
test eax, eax
je 0x4f5bb0
lea eax, [ebp - 0x158]
push eax
jmp 0x4f5bb5
push 0x6a4db8
call fcn.004029f8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005fe955
leave
ret 8
call fcn.004ca28a
int3
Function at 0x4fefa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x4fefb9
call fcn.004ccac5
mov esi, dword [eax + 0xc]
push 0x6a62fc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4feffb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4feffb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4feffb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004ff004
jmp 0x4feffd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x59ba79
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
push 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x59baa6
or dword [esi + 0x3c], 1
or dword [esi + 0x38], 2
jmp 0x59babb
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x59babb
or dword [esi + 0x3c], 2
or dword [esi + 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], edx
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004d42a4
jmp 0x59bb8c
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.004d42a4
cmp eax, edi
jne 0x59bb96
push 1
push 0x209
push 0x200
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x59bb28
push 1
push 0x109
push 0x100
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x59bb6c
mov eax, dword [ebp - 0x1c]
cmp eax, 0x202
je 0x59bb96
cmp eax, 0x205
je 0x59bb96
cmp eax, 0x201
je 0x59bb96
cmp eax, 0x204
je 0x59bb96
cmp eax, 0x100
jne 0x59bb54
cmp dword [ebp - 0x18], 0x1b
je 0x59bb96
push dword [ebp - 8]
lea eax, [esi + 0x24]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
sbb edx, dword [ebp - 4]
test edx, edx
jb 0x59bb8c
ja 0x59bb85
cmp eax, dword [0x741e68]
jbe 0x59bb8c
mov dword [esi + 0x34], 1
cmp dword [esi + 0x34], 0
je 0x59badd
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x59c139
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x663439
call fcn.005fe9c8
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004cba60
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x67cb68
call fcn.004d9438
cmp eax, 0xffffffff
jne 0x59c214
push 0
push 0x68ab04
lea ecx, [ebp - 0x278]
call fcn.004d9438
cmp eax, 0xffffffff
jne 0x59c214
push 0
push 0x67e61c
lea ecx, [ebp - 0x278]
call fcn.004d9438
cmp eax, 0xffffffff
jne 0x59c214
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004cba60
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x59c1e3
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x66aac0]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.00442b67
jmp 0x59c24d
lea eax, [ebp - 0x114]
push eax
call fcn.00631510
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.0044322a
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00442b67
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x59c23a
mov edi, dword [ebp - 0x274]
jmp 0x59c24d
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x66aac0]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00442b67
mov eax, edi
call fcn.005fe977
ret

Function at 0x5a2a03
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7083cc], 0
push esi
push edi
je 0x5a2a8a
cmp dword [0x708708], 0xfffffffe
jne 0x5a2a77
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x5a2a8a
mov edi, 0x741e94
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x741eac], 0
jne 0x5a2a8e
push 0
push 0
push 0x5a2a94
call fcn.0063ee05
add esp, 0xc
mov dword [0x741eac], eax
test eax, eax
je 0x5a2a67
cmp eax, 0xffffffff
je 0x5a2a67
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x708708], esi
jmp 0x5a2a6e
and dword [0x741eac], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x5a2a8a
mov eax, dword [ebp + 8]
mov dword [0x708708], eax
inc eax
neg eax
sbb eax, eax
and dword [0x741eac], eax
pop edi
pop esi
pop ebp
ret
call fcn.004ca28a
int3
Function at 0x5b5fdc
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.006415a2
pop ecx
test eax, eax
jne 0x5b601e
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00445d6d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5b5fe4
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x5ffb44
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5ffb83
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5ffb83
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5ffb83
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5ffb83
cmp dword [ecx + 0x74], 0xe
jbe 0x5ffb83
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x601b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x601b80
push ebx
push ebx
push ebx
push 2
call fcn.00603da0
pop esi
xor al, al
pop ebx
pop ebp
ret 8
push edi
call fcn.006012e0
push 2
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.00637e4f
push ebx
call fcn.006384ae
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.00637e4f
add esp, 0x1c
test edi, edi
jg 0x601bd2
push 0
push 0
push 0
push 0xc
mov ecx, esi
call fcn.00603da0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
lea eax, [edi + 1]
push eax
call fcn.004ca21f
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.00637a2b
add esp, 0x14
cmp eax, 1
je 0x601c16
push edi
call fcn.004ca228
add esp, 4
mov ecx, esi
push 0
push 0
push 0
push 2
call fcn.00603da0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x601c3f
mov dl, byte [eax]
cmp dl, 0xd
jne 0x601c36
inc eax
mov byte [ecx], 0xa
inc ecx
cmp byte [eax], 0xa
jne 0x601c3a
jmp 0x601c39
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x601c23
push dword [ebp + 0xc]
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push edi
call dword [eax + 8]
push edi
call fcn.004ca228
add esp, 4
xor eax, eax
cmp byte [esi + 0x2c], al
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x607700
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
xor dl, dl
push ebx
mov ebx, dword [esp + 0x10]
mov eax, 0
test bl, 3
push ebp
sete al
push esi
test eax, eax
mov eax, dword [esp + 0x1c]
push edi
mov dword [esp + 0x14], eax
je 0x607857
test al, 3
mov eax, 0
sete al
test eax, eax
je 0x607853
mov edx, ecx
mov dword [esp + 0x10], 0
shr edx, 2
xor esi, esi
test edx, edx
je 0x60780a
mov ebp, dword [esp + 0x20]
cmp edx, 8
jb 0x6077d1
mov edi, edx
lea eax, [ebp + 0x10]
mov ecx, ebx
and edi, 0xfffffff8
sub ecx, ebp
xorps xmm3, xmm3
mov dword [esp + 0x14], ecx
xorps xmm2, xmm2
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edi
jb 0x607780
mov ebp, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edx
jae 0x60780e
mov ebx, dword [esp + 0x1c]
lea edi, [esi*4]
add edi, ebp
sub ebx, ebp
mov ebp, dword [esp + 0x10]
sub edx, esi
add esi, edx
nop dword [eax]
mov eax, dword [edi + ebx]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebp, eax
sub edx, 1
jne 0x6077f0
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], ebp
jmp 0x607812
xor ebp, ebp
jmp 0x607812
mov ebp, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x607828
pop edi
xor eax, eax
test ebp, ebp
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
jmp 0x607857
mov eax, dword [esp + 0x20]
xor edi, edi
test ecx, ecx
je 0x607914
cmp ecx, 0x20
jb 0x6078f5
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x607890
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x607914
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
mov al, byte [esi + ebx]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x607904
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x61a940
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x743904], 0
jne 0x61a94e
call fcn.00623af0
cmp byte [0x74390d], 0
je 0x61a96c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00624130
add esp, 0x10
ret
jmp fcn.00618c70
Function at 0x624950
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push edi
push eax
push esi
movups xmm0, xmmword [eax + edi - 0x10]
movaps xmmword [esp + 0x2c], xmm0
call fcn.006269d0
movaps xmm1, xmmword [esp + 0x2c]
mov edx, edi
shr edx, 2
add esp, 0xc
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 3
xor ecx, dword [esi]
lea edi, [esi + edx*4]
lea eax, [edx + 7]
mov dword [esp + 0xc], 0x6c8bd4
shl eax, 4
xor ecx, 1
add eax, esi
mov dword [edi], ecx
mov dword [esp + 0x10], eax
lea eax, [edx*4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
lea eax, [edx*4 + 8]
mov dword [eax + esi], ecx
lea edx, [edx*4 + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xc]
xor eax, ecx
mov dword [esp + 0x1c], edx
mov dword [edx + esi], eax
lea eax, [edi + 0x10]
cmp eax, dword [esp + 0x10]
je 0x624aae
mov edx, dword [esp + 0x14]
mov eax, dword [ebp + 0xc]
cmp eax, 0x18
jne 0x624a18
mov eax, dword [esi + 0x24]
xor eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor ecx, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
pinsrd xmm1, ecx, 3
jmp 0x624a5d
cmp eax, 0x20
jne 0x624a56
pinsrd xmm1, dword [esi + 0x2c], 3
mov eax, dword [esi + 0x14]
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 2
xor ecx, dword [esi + 0x10]
xor eax, ecx
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x18]
xor ecx, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x1c]
xor eax, ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pinsrd xmm1, eax, 3
jmp 0x624a5d
pinsrd xmm1, dword [esi + 0x1c], 3
mov ecx, dword [esp + 0xc]
mov esi, edi
aeskeygenassist xmm0, xmm1, 0
pextrd eax, xmm0, 3
lea edi, [edx + esi]
xor eax, dword [ecx]
add ecx, 4
xor eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
xor eax, dword [edi]
mov dword [edi + 4], eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x18]
mov dword [eax + esi], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ecx + esi], eax
lea eax, [edx + 0x10]
add eax, esi
cmp eax, dword [esp + 0x10]
jne 0x6249f7
pop edi
pop esi
mov esp, ebp
pop ebp
ret