joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62130bd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, edx
mov byte [esp + 0x10], al
mov eax, dword [0x6222e02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.621d84f0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.621a6ee0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x62130c78
mov eax, dword [esp + 0x18]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp], edx
mov ecx, eax
call fcn.6212a10c
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.62129ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.621a7a60
sub esp, 4
add dword [esp + 0x18], 1
jmp 0x62130c1c
mov dword [esp + 0x2c], str.dwsmaklthrtter
mov dword [esp + 0x24], 0x621f2ec0
mov dword [esp + 0x30], 0x621f2f38
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x30]
je 0x62130d80
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.621d9074
test al, al
je 0x62130d76
cmp byte [esp + 0x10], 0
je 0x62130d41
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.621ab530
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 3
mov ecx, eax
call fcn.621ab530
sub esp, 8
mov eax, dword [esp + 0x34]
add eax, 4
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov ecx, eax
call fcn.62130a40
sub esp, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
mov ecx, eax
call fcn.62130b18
sub esp, 4
test al, al
je 0x62130d41
mov eax, 1
jmp 0x62130d46
mov eax, 0
test al, al
je 0x62130d6d
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 4
mov ecx, eax
call fcn.621ab530
sub esp, 8
mov ebx, dword [esp + 0x40]
jmp 0x62130da1
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 4]
jmp 0x62130da1
add dword [esp + 0x24], 8
jmp 0x62130c90
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.621ab530
sub esp, 8
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.621a7640
mov eax, ebx
mov ebx, dword [esp + 0x5c]
sub ebx, dword [0x6222e02c]
je 0x62130dbf
call fcn.621015c0
add esp, 0x68
pop ebx
ret 0xc
Function at 0x62130f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [0x6222e02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.621d84f0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.621a6ee0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x62130fcd
mov eax, dword [esp + 0x14]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.62129ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.621a7a60
sub esp, 4
add dword [esp + 0x14], 1
jmp 0x62130f85
mov dword [esp + 0x38], 0x621e7280
mov dword [esp + 0x30], 0x621e7280
mov dword [esp + 0x3c], 0x621e7480
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x3c]
je 0x6213107b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.621d9074
test al, al
je 0x62131071
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.62169900
mov eax, dword [esp + 0x40]
sub eax, 0x621e7280
sar eax, 2
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.62129f20
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x2f]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 1
mov ecx, eax
call fcn.621a6e40
sub esp, 0xc
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.62169930
jmp 0x62131086
add dword [esp + 0x30], 4
jmp 0x62130fe5
mov eax, dword [esp + 0x1c]
mov ecx, eax
call fcn.621a6ee0
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.621a7640
mov eax, dword [esp + 0x5c]
sub eax, dword [0x6222e02c]
je 0x621310a2
call fcn.621015c0
mov eax, dword [esp + 0x1c]
add esp, 0x6c
ret 0xc
Function at 0x40adf0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40afbe
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40ae1b
mov eax, 0x7000000
jmp 0x40ae23
test eax, eax
je 0x40af99
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.004592c0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x54b5e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40afb1
cmp ecx, 0x21
jae 0x40afa5
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00454fd0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004550a0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4e2b58]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4e2bd0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40af74
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4e2c10]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004593a0
mov eax, ecx
mov ecx, 0x21
call fcn.00459440
nop
call fcn.00457f00
jmp fcn.0040adf0
Function at 0x412ca0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412eb4
sub esp, 0x18
mov eax, dword [0x583148]
test eax, eax
jne 0x412e9d
nop
lea eax, [0x583130]
mov dword [esp], eax
call fcn.00408c20
mov eax, dword [0x583134]
test eax, eax
je 0x412ce9
cmp dword [eax + 8], 0xcc
jne 0x412d5f
mov edx, dword [0x583128]
test edx, edx
jne 0x412d41
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x584ad8]
mov dword [esp + 8], eax
call fcn.0040afd0
mov eax, dword [esp + 0xc]
mov dword [0x583128], eax
mov ecx, dword [0x5830e4]
mov dword [eax], ecx
mov eax, dword [0x583128]
mov dword [0x5830e4], eax
movzx eax, byte [0x583540]
test al, al
jne 0x412d41
xor eax, eax
jmp 0x412e49
mov edx, dword [0x583128]
mov ebx, dword [edx + 4]
mov dword [0x583128], ebx
mov ebx, dword [0x583134]
mov dword [edx + 4], ebx
mov dword [0x583134], edx
mov edx, dword [0x583134]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x412e31
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5832c0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x412dbd
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x412dca
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00459310
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5832c0]
test edx, edx
jne 0x412df6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x412e17
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00459310
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00459310
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00459310
mov byte [0x5830a7], 1
nop
lea eax, [0x583130]
mov dword [esp], eax
call fcn.00408e20
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004593a0
lea esi, [0x583540]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x412d41
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x412e93
lea edx, [0x5472ec]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x412e3b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00459390
mov ecx, 5
call fcn.00459390
lea eax, [0x4bd792]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004320d0
nop
call fcn.00457f00
jmp fcn.00412ca0
Function at 0x424530
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4246a0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00422590
mov eax, dword [esp + 4]
test eax, eax
je 0x424689
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004205b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00408c20
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x4245c7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42462d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x4245dc
cmp byte [ebp + 6], dl
je 0x4245e7
cmp esi, ebx
ja 0x42462d
jne 0x4245c5
cmp byte [ebp + 6], dl
jbe 0x4245c5
jmp 0x42462d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408e20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x424624
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x424624
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00424430
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408e20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x424680
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x424680
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4bedaf]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004320d0
nop
call fcn.00457f00
jmp fcn.00424530
Function at 0x424b10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424c2c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x424ba5
cmp cl, 2
je 0x424b4d
cmp cl, 3
jne 0x424c15
mov byte [eax + 8], 1
jmp 0x424c11
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042a060
nop
lea eax, [0x56771c]
mov dword [esp], eax
call fcn.00408c20
nop
mov eax, dword [0x5676e8]
sub eax, dword [0x5676cc]
mov dword [0x5676e8], eax
mov eax, dword [0x5676d8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5676d8], ecx
nop
lea eax, [0x56771c]
mov dword [esp], eax
call fcn.00408e20
jmp 0x424c11
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00412ca0
nop
lea eax, [0x56771c]
mov dword [esp], eax
call fcn.00408c20
nop
mov eax, dword [0x5676c0]
sub eax, dword [0x5676a4]
mov dword [0x5676c0], eax
mov eax, dword [0x5676b0]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5676b0], ecx
nop
nop
lea eax, [0x56771c]
mov dword [esp], eax
call fcn.00408e20
add esp, 0x14
ret
lea eax, [0x4ba7bf]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004320d0
nop
call fcn.00457f00
jmp fcn.00424b10
Function at 0x4591c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x583380]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45798b
je 0x4579de
cmp ebx, 0x20
jbe 0x4579e4
cmp ebx, 0x40
jbe 0x457a2a
jmp 0x457acb
test ebx, ebx
je 0x4579d4
add eax, 0x10
test ax, 0xff0
je 0x4579c0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4e3180]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4e3280]
jmp 0x4579a8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4579a8
pxor xmm1, xmmword [0x583390]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x583390]
pxor xmm2, xmmword [0x5833a0]
pxor xmm3, xmmword [0x5833b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x583390]
pxor xmm2, xmmword [0x5833a0]
pxor xmm3, xmmword [0x5833b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x457b2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5830af], 0
je 0x4591da
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x457950
jmp fcn.004077e0
Function at 0x4591e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40227e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004077e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00457f00
jmp 0x402240
cmp byte [0x5830af], 0
je 0x4591fb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x457950
jmp 0x402240
Function at 0x4737d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4738fa
sub esp, 0xc
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x473853
mov edx, dword [esp + 0x1c]
cmp edx, ecx
jb 0x4738f4
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
cmp edx, ebx
je 0x47382a
nop
mov ebp, ebx
lea esi, [edx + ecx - 1]
cmp esi, ebx
jb 0x473828
mov ebx, edx
lea esi, [ebp + ecx - 1]
cmp esi, edx
jae 0x4738dc
mov edx, ebx
mov ebx, ebp
jmp 0x47382a
mov ebx, ebp
mov ebp, dword [esp + 0x10]
movzx esi, byte [ebp + 0x400]
movzx edi, byte [ebp + 0x401]
lea eax, [ecx - 1]
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jbe 0x4738d5
mov ebx, dword [esp + 0x14]
xor eax, eax
jmp 0x473873
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
mov byte [edx + eax], bl
inc eax
mov ebx, dword [esp + 0x20]
movzx esi, byte [esp + 0xb]
movzx edi, byte [esp + 0xa]
mov edx, ebx
mov ebx, dword [esp + 0x14]
cmp ecx, eax
jle 0x4738bc
movzx edx, byte [edx + eax]
mov byte [esp + 9], dl
inc esi
xchg esi, eax
mov byte [esp + 0xb], al
xchg esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
mov ebx, dword [ebp + esi*4]
add edi, ebx
xchg edi, eax
mov byte [esp + 0xa], al
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov edx, dword [ebp + edi*4]
mov dword [ebp + esi*4], edx
mov dword [ebp + edi*4], ebx
add edx, ebx
movzx edx, dl
movzx ebx, byte [esp + 9]
xor ebx, dword [ebp + edx*4]
cmp ecx, eax
ja 0x473857
jmp 0x4738d0
xchg esi, eax
mov byte [ebp + 0x400], al
xchg esi, eax
xchg edi, eax
mov byte [ebp + 0x401], al
xchg edi, eax
add esp, 0xc
ret
call fcn.00459390
mov ecx, ebx
call fcn.00459390
lea eax, [0x4aaa00]
mov dword [esp], eax
lea eax, [0x4e2c30]
mov dword [esp + 4], eax
call fcn.004319a0
call fcn.004593d0
nop
call fcn.00457f00
jmp fcn.004737d0
Function at 0x4a0210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x48]
cmp eax, dword [ecx + 8]
jbe 0x4a0401
sub esp, 0xc8
mov dword [esp + 0x36], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x36], 0x65646974
mov dword [esp + 0x3a], 0x61707962
mov word [esp + 0x3e], 0x7373
lea eax, [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 8], eax
call fcn.00447830
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0xd0]
xor ebx, ebx
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x4a0338
movzx edx, byte [esp + ecx + 0x36]
lea ebx, [esp + 0x32]
mov dword [esp], ebx
mov dword [esp + 8], 0
xor eax, edx
movzx eax, al
mov dword [esp + 4], eax
call fcn.00447b00
mov dword [esp], 0
mov eax, dword [esp + 0xc0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
call fcn.00447370
mov eax, dword [esp + 0x2c]
lea ebx, [eax + 1]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
lea ecx, [eax + 1]
mov edx, eax
mov eax, 0xcccccccd
mov edi, edx
imul ecx
lea eax, [edx + edi + 1]
sar eax, 3
lea eax, [eax + eax*4]
shl eax, 1
sub edi, eax
inc edi
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0xc4]
mov eax, edx
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0x28]
shr ecx, 1
cmp ebx, ecx
jge 0x4a03cf
mov dword [esp + 0x20], ebp
mov ecx, ebx
shl ebx, 1
lea ebp, [ebx + 2]
cmp edx, ebp
jb 0x4a03f9
cmp ebx, ebp
ja 0x4a03f0
mov dword [esp + 0xc0], esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], edi
mov dword [esp], 0
sub edx, ebx
mov ebx, edx
neg edx
shl ecx, 3
sar edx, 0x1f
and ecx, edx
add ecx, eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
mov dword [esp + 0xc], ebx
call fcn.00447970
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 0
call fcn.00461420
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0xa
jb 0x4a02a8
jmp 0x4a03e4
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], ebp
add esp, 0xc8
ret
mov eax, ecx
mov ecx, 0xa
call fcn.00459390
mov eax, ebx
mov ecx, ebp
call fcn.004593f0
mov ecx, ebp
call fcn.004593d0
nop
call fcn.00457f00
jmp fcn.004a0210

Function at 0x43b64f
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov esi, dword [esp]
add esp, 4
or eax, eax
call fcn.0043b68c
add eax, edx
sub eax, 0x1616f822
sub eax, eax
xor dword [ecx], esi
inc edx
mov edx, eax
and edx, edx
inc ecx
add eax, edx
inc edx
cmp ecx, edi
jne fcn.0043b64f
sub eax, 1
or edx, edx
ret
Function at 0x6c6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x6c638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x6ef074
push ecx
mov edi, eax
call fcn.006da198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6c63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.006da02e
push esi
call fcn.006d9fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x6c9850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x6c98ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x6f4720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6c98ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.006da1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x6c98ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x6f4720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6c992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.006db082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x6c9957
mov word [eax], si
add eax, 2
push eax
call fcn.006db030
add esp, 4
jmp 0x6c9959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x6c98ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x6c98b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x6c9ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret