joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021c7e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x10021cd4
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10021cad
call fcn.1001b6d5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x10021cc2
call fcn.1001b6d5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x10021cd4
call fcn.1001b6d5
call fcn.1000d4f8
cmp dword [eax + 0x3c], 0
je 0x10021ce9
push edi
mov ecx, ebx
call fcn.100213a1
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.10021ecf
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x10021d12
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x10021d1e
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10026fed
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.1001534e
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x10027029
call fcn.1002720a
mov dword [esi + 0xc], 1
jmp 0x1002702e
call fcn.1002720a
cmp dword [esi], 0
je 0x10027079
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x10027054
push edi
call fcn.1001042c
lea ecx, [edi + 1]
push ecx
jmp 0x10027063
push 0xff
call fcn.10009d78
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1000b2c4
pop edi
jmp 0x1002709d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x1002709d
push dword [esi]
push dword [ebp - 4]
call fcn.10017a98
pop esi
leave
ret 0xc

Function at 0x10027161
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.1002720a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x100271a9
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1001042c
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000b2c4
jmp 0x100271b4
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10017a98
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10038beb
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.1008880c
call fcn.1000d54c
cmp dword [eax + 0x14], 0
jne 0x10038c06
mov ecx, esi
pop esi
jmp fcn.10037f0f
pop esi
ret

Function at 0x10039aba
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.10004770
call fcn.1000d54c
cmp dword [eax + 0x14], 0
jne 0x10039ad5
mov ecx, esi
pop esi
jmp fcn.1003932b
pop esi
ret

Function at 0x10042a4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x10042a68
call fcn.1000d4f8
mov esi, dword [eax + 0xc]
push 0x101848b0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10042aaa
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10042aaa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x10042aaa
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.10042ab3
jmp 0x10042aac
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100f90b2
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.10154a53
pop ecx
test eax, eax
jne 0x100f90f4
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10001db0
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100f90ba
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x10161086
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10160efc

Function at 0x10162e4b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10162ac8
Function at 0x401276
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
pushal
call 0x40127c
pop ebp
sub ebp, 0x70361082
jmp 0x401336
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
and eax, 0xff
je 0x40134e
mov eax, 1
int3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov edx, dword [eax + 0x20]
lea ebx, [ebp + 0x70361f54]
mov cx, word [eax + 0x1c]
cmp cx, 0x18
je 0x40137a
cmp cx, 0x1c
jne 0x4013a1
lea ebx, [ebp + 0x70361f72]
push eax
mov al, byte [edx]
xor al, byte [ebx]
sub al, 0x55
jne 0x401385
jmp 0x401392
mov al, byte [edx]
add al, 0x20
xor al, byte [ebx]
sub al, 0x55
je 0x401392
pop eax
jmp 0x4013a1
sub cx, 2
je 0x40139e
add edx, 2
inc ebx
jmp 0x40137b
pop eax
jmp 0x4013a5
mov esi, dword [eax]
jmp 0x40135a
mov eax, dword [eax + 8]
mov dword [ebp + 0x70361f90], eax
lea ebx, [ebp + 0x70361f98]
cwde
pop ds
jo 0x401408
push dword [ebp + 0x70361f90]
call fcn.00401288
mov dword [ebp + 0x70362061], eax
cmp eax, 0
jne 0x401412
lea ebx, [ebp + 0x70361fa5]
push ebx
push dword [ebp + 0x70361f90]
call fcn.00401288
mov dword [ebp + 0x70362065], eax
xor ebx, ebx
push ebx
push ebx
lea ebx, [ebp + 0x70361f63]
push ebx
call dword [ebp + 0x70362065]
mov dword [ebp + 0x70361f90], eax
lea ebx, [ebp + 0x70361f98]
push ebx
push dword [ebp + 0x70361f90]
call fcn.00401288
mov dword [ebp + 0x70362061], eax
lea ebx, [ebp + 0x70361fb4]
push ebx
push dword [ebp + 0x70361f90]
call fcn.00401288
mov dword [ebp + 0x7036206d], eax
lea ebx, [ebp + 0x70361fc0]
push ebx
push dword [ebp + 0x70361f90]
call fcn.00401288
mov dword [ebp + 0x70362071], eax
mov ebx, esp
sub esp, 4
push ebx
mov ebx, 0x40
push ebx
mov ebx, 0x7036214f
sub ebx, 0x70361265
push ebx
call 0x40145f
call eax
add esp, 4
jmp 0x401476
lea eax, [ebp + 0x70361296]
push eax
push dword fs:[0]
mov dword fs:[0], esp
jmp 0x4015e8
mov eax, 0xffff
int3

Function at 0x401288
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
jne 0x40131d
mov edi, dword [ebp + 0xc]
mov ecx, 0x96
mov al, 0x55
repne scasb al, byte es:[edi]
mov ecx, edi
sub ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x78]
js 0x4012b5
push ebp
or byte [ebx + 0x5d03205a], cl
or byte [ebx], dh
invalid
mov edi, dword [ebx]
add edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ecx
mov ch, byte [esi]
xor ch, byte es:[edi]
sub ch, 0x55
jne 0x4012da
inc esi
inc edi
dec cl
jne 0x4012c5
add esp, 4
jmp 0x4012e4
pop ecx
add ebx, 4
inc eax
cmp eax, dword [edx + 0x18]
jne 0x4012bc
cmp eax, dword [edx + 0x18]
jne 0x4012eb
jmp 0x40131d
mov esi, dword [edx + 0x24]
add esi, dword [ebp + 8]
push edx
mov ebx, 2
xor edx, edx
mul ebx
pop edx
add eax, esi
xor ecx, ecx
mov cx, word [eax]
mov edi, dword [edx + 0x1c]
xor edx, edx
mov ebx, 4
mov eax, ecx
mul ebx
add eax, dword [ebp + 8]
add eax, edi
mov eax, dword [eax]
add eax, dword [ebp + 8]
jmp 0x40131f
xor eax, eax
add esp, 8
leave
ret 8
Function at 0x402ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov eax, dword [0x4102d0]
cmp eax, 9
je 0x402f81
cmp eax, 2
je 0x402f10
jle 0x402ef0
cmp eax, 3
je 0x402fb6
cmp eax, 4
je 0x402f1a
mov eax, dword [0x408090]
test eax, eax
jne 0x402f52
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
dec eax
jne 0x402ed8
mov edi, dword [0x408020]
test edi, edi
je 0x402ee1
mov eax, ebx
or eax, 0x100
mov dword [esp + 4], eax
jmp 0x402f1e
mov edx, dword [0x408020]
test edx, edx
jne 0x402f33
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00402a90
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
mov ecx, ebx
or ecx, 0x100
mov dword [esp + 4], ecx
call fcn.00402a90
test byte [0x4102d5], 1
jne 0x402ee1
jmp 0x402f1a
mov dword [esp + 0xc], eax
mov esi, 0x1e
mov ebx, 1
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], str.Runtime_bits:_tFailed_to_load._n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
xor eax, eax
lea edx, [ebp - 0x38]
mov ecx, 5
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov dword [esp + 4], edx
mov dword [esp], 0x1e
call 0x4020c0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0x4102d0], eax
jmp 0x402ec3
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00402a90
mov eax, dword [0x4102d4]
test eax, eax
je 0x402ef3
test ah, 1
je 0x402ee1
jmp 0x402ef3
Function at 0x403900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov eax, dword [ebp + 8]
mov dword [esp], 0xc
mov esi, dword [ebp + 0xc]
mov dword [esp + 4], eax
call 0x4020c0
test eax, eax
je 0x40393a
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp + 8]
mov word [eax + edx], 0x20
lea ebx, [ebp - 0x128]
mov edx, 0x104
xor eax, eax
mov dword [esp + 8], edx
mov edi, 0x696e69
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], esi
sub eax, 3
xor esi, esi
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x2e6a346c
mov dword [eax + ebx + 4], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov dword [ebp - 0x12c], eax
inc eax
je 0x403a79
mov eax, dword [0x408090]
test eax, eax
jne 0x403a84
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov esi, dword [ebp + 8]
mov edx, 0x7c00
sub edx, eax
mov dword [esp + 8], edx
add esi, eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], esi
mov edi, esi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov dword [ebp - 0x130], eax
mov ecx, 1
test eax, eax
mov dword [ebp - 0x134], ecx
jle 0x403a44
mov ebx, eax
nop
lea esi, [esi]
movzx ecx, byte [esi]
cmp cl, 0x23
je 0x403ab0
cmp cl, 0xd
sete al
cmp cl, 0xa
sete dl
or eax, edx
test al, 1
je 0x403aa0
cmp edi, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x134], ecx
jbe 0x403a40
cmp byte [edi - 1], 0x20
je 0x403a40
mov byte [edi], 0x20
inc edi
lea esi, [esi]
inc esi
dec ebx
jne 0x403a00
mov byte [edi], 0
mov ebx, dword [ebp - 0x130]
test ebx, ebx
jle 0x403a6b
cmp byte [edi - 1], 0x20
je 0x403a6b
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edi, dword [ebp + 8]
mov word [eax + edi], 0x20
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
call sub.msvcrt.dll__close
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov ebx, str.Loading:_t_s_n
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4039b2
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x403a40
mov byte [edi], cl
jmp 0x403a3b
xor ecx, ecx
mov dword [ebp - 0x134], ecx
jmp 0x403a40
Function at 0x403c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x815c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004058d0
mov ebx, dword [0x408028]
mov eax, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 0x814c], eax
je 0x403cb0
mov eax, dword [0x408090]
test eax, eax
jne 0x403e80
mov ebx, 0x104
lea edx, [ebp - 0x128]
xor esi, esi
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x148]
mov edi, ebx
mov dword [esp], edx
mov dword [esp + 4], esi
mov esi, ebx
call sub.msvcrt.dll_memset
cld
xor eax, eax
mov ecx, 5
rep stosd dword es:[edi], eax
mov dword [esp + 4], ebx
mov edi, 0x407166
mov dword [esp], 0x1d
call 0x4020c0
cld
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [0x408020]
seta dl
setb cl
xor ebx, ebx
cmp dl, cl
sete bl
test esi, esi
sete dl
xor eax, eax
test ebx, ebx
setne al
test edx, eax
je 0x403d60
mov eax, dword [0x408090]
test eax, eax
jne 0x403d37
xor eax, eax
add esp, 0x815c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], eax
mov edi, 0x35
mov ecx, 1
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], str.Bundled_JRE:_tCannot_use_64_bit_runtime_on_32_bit_OS._n
call sub.msvcrt.dll_fwrite
jmp 0x403d2a
mov dword [esp], 1
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
call 0x4020c0
test eax, eax
je 0x403d2a
mov edx, 0x8000
xor eax, eax
lea esi, [ebp - 0x8148]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp], esi
mov edi, dword [ebp - 0x814c]
lea edx, [ebp - 0x128]
mov dword [esp + 4], edx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
call fcn.004033a0
mov eax, dword [0x408090]
test eax, eax
jne 0x403ebc
cmp byte [ebp - 0x8148], 0x5c
je 0x403ea7
cmp byte [ebp - 0x8147], 0x3a
je 0x403ea7
mov dword [esp], 0x4081a4
mov eax, dword [ebp - 0x814c]
mov edi, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
call sub.msvcrt.dll_strncpy
mov dword [esp], 0x4081a4
call sub.msvcrt.dll_strlen
cmp byte [eax + 0x4081a3], 0x5c
je 0x403e1f
mov edx, 0x5c
mov word [eax + 0x4081a4], dx
mov dword [esp + 4], esi
mov dword [esp], 0x4081a4
call sub.msvcrt.dll_strcat
mov dword [esp], 0x4081a4
call fcn.00402840
test eax, eax
je 0x403d2a
mov dword [esp], 0x410664
cmp ebx, 1
mov esi, 0x4081a4
mov dword [esp + 4], esi
sbb ebx, ebx
and ebx, 0xffffff00
add ebx, 0x104
mov dword [0x4102d4], ebx
call sub.msvcrt.dll_strcpy
mov eax, 1
jmp 0x403d2c
mov dword [esp + 0xc], eax
mov ecx, 0x13
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], str.bundledJreSearch___n
call sub.msvcrt.dll_fwrite
jmp 0x403cb0
mov dword [esp + 4], esi
mov dword [esp], 0x4081a4
call sub.msvcrt.dll_strcpy
jmp 0x403e2f
mov dword [esp + 8], esi
mov ecx, str.Bundled_JRE:_t_s_n
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403dc7
Function at 0x10001100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000111e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x100011e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10001202
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x100012f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000131a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x10001460
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x100014bf
Function at 0x10002e40
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x10003360
test edx, edx
je 0x10003360
call fcn.10002e57
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x100033a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10002e40
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10003411
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x100033d6
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x10006b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.10006b49

Function at 0x100105a6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x120
mov esi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 1
call fcn.10145ba4
add esp, 4
mov dword [esi], eax
mov byte [eax], 0
lea edi, [ebp - 0x124]
push 0x118
push 0
push edi
call fcn.10149430
add esp, 0xc
mov dword [edi - 4], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10010606
cmp dword [ebp - 0x124], 6
mov eax, dword [esi]
setae byte [eax]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
add esp, 0x120
pop esi
pop edi
pop ebp
ret
Function at 0x100133d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov ebx, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebx + 4]
push 0x118
push 0
push eax
call fcn.10149430
add esp, 0xc
mov dword [ebx], 0x11c
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
test eax, eax
je 0x100134ca
cmp dword [ebx + 4], 6
ja 0x10013421
jne 0x1001346c
cmp dword [ebx + 8], 2
jb 0x1001346c
xor eax, eax
lea ecx, [ebp - 0x12c]
mov dword [ecx], eax
lea edx, [ebp - 0x130]
mov dword [edx], eax
lea edi, [ebp - 0x134]
mov dword [edi], eax
lea eax, [ebp - 0x138]
push eax
push edi
push edx
push ecx
call fcn.10013566
add esp, 0x10
test al, al
je 0x1001346c
mov eax, dword [ebp - 0x12c]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x130]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x134]
mov dword [ebx + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100134ca
mov edi, eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.10149430
add esp, 0xc
lea eax, [ebp - 0x128]
mov dword [eax - 4], 0x11c
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x12c]
push eax
call edi
test eax, eax
jne 0x100134ca
mov eax, dword [ebp - 0x120]
mov dword [ebx + 0xc], eax
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10013566
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1019e09e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100135b6
mov esi, eax
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100135b6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100135b6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x100135b6
mov esi, eax
add eax, 6
push 0x101784e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100135bb
xor eax, eax
pop esi
pop ebp
ret
cmp word [esi + 2], 0
je 0x100135b6
mov eax, dword [ebp + 8]
movzx ecx, word [esi + 0x32]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [esi + 0x30]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, word [esi + 0x36]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
movzx ecx, word [esi + 0x34]
mov dword [eax], ecx
mov al, 1
jmp 0x100135b8
Function at 0x10015f7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10017464

Function at 0x100171f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x818
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x810]
push 0x800
push 0xff
push edi
call fcn.10149430
add esp, 0xc
mov esi, edi
push edi
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10017288
cmp eax, 0x3ff
jb 0x1001728f
lea esi, [eax + 2]
lea ecx, [eax + eax]
add ecx, 4
mov edi, eax
xor edx, edx
dec edx
test esi, esi
cmovns edx, ecx
push edx
call fcn.10145c03
add esp, 4
mov esi, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
test eax, eax
je 0x1001734a
cmp eax, edi
ja 0x1001734a
mov word [esi + eax*2], 0
lea ecx, [esi + eax*2]
add ecx, 2
mov dword [ebp - 0x820], esi
jmp 0x100172ac
xor ebx, ebx
jmp 0x10017357
mov word [ebp + eax*2 - 0x810], 0
lea ecx, [eax*2 - 0x80e]
add ecx, ebp
mov dword [ebp - 0x820], 0
mov edx, esi
mov word [ecx], 0
xor ebx, ebx
lea edi, [ebp - 0x81c]
xor ecx, ecx
mov dword [ebp - 0x824], esi
cmp word [edx + ebx*2], 0
jne 0x1001730d
cmp ecx, ebx
je 0x1001730d
mov esi, eax
lea eax, [edx + ecx*2]
mov ecx, edi
push eax
call fcn.100349a0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
jae 0x10017310
test eax, eax
je 0x1001736e
mov edx, ecx
mov ecx, dword [ebp - 0x814]
mov dword [eax + 8], ecx
movsd xmm0, qword [ebp - 0x81c]
movsd qword [eax], xmm0
add eax, 0xc
mov dword [edx + 4], eax
jmp 0x1001732d
inc ebx
jmp 0x1001733e
push edi
call fcn.1005cfe0
cmp byte [ebp - 0x811], 0
jns 0x1001732d
push dword [ebp - 0x81c]
call fcn.10145bd4
add esp, 4
inc ebx
mov ecx, ebx
lea edi, [ebp - 0x81c]
mov eax, esi
mov edx, dword [ebp - 0x824]
cmp ebx, eax
jne 0x100172c3
mov bl, 1
mov esi, dword [ebp - 0x820]
test esi, esi
je 0x10017357
push esi
call fcn.10145c0c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
add esp, 0x818
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x23
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.10036b34
int3