joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47acb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00456fe0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00457060
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00457060
lea ecx, [esi + 0xc]
call fcn.0046bf35
lea ecx, [esi + 0x10]
call fcn.0046bf35
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004598a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004598a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004598a0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046bfaa
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046bfaa
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4580d8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47aed8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4580e8
call fcn.00458600
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4581cb
cmp byte [edi], 0
je 0x4581cb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45810d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00456e00
test eax, eax
jne 0x45812d
push 0x49d50c
lea ecx, [esi + 0x38]
call fcn.0046c0e7
jmp 0x4581cb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00456e50
test eax, eax
jne 0x45815c
mov ecx, esi
call fcn.00456f50
push edi
add esi, 0x38
push 0x49d4e8
push esi
call fcn.00469a0f
add esp, 0xc
jmp 0x4581cb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00458e90
test eax, eax
je 0x4581c4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004582a0
test eax, eax
jne 0x4581e0
push edi
lea eax, [esi + 0x38]
push 0x49d4c4
push eax
call fcn.00469a0f
add esp, 0xc
mov ecx, esi
call fcn.00458600
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x458288
mov ecx, dword [0x49daec]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00469a0f
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00456f00
test eax, eax
jne 0x45824a
push 0x49d4a8
lea ecx, [esi + 0x38]
call fcn.0046c0e7
jmp 0x45825a
push 0xfa
mov ecx, esi
call fcn.00458e90
test eax, eax
jne 0x458277
mov ecx, esi
call fcn.00458600
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0046bfaa
jmp 0x4581cb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0046bfaa
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x46e351
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46e389
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046c405
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046c3dd
jmp 0x46e395
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46fa3f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46fa81
call fcn.004757f7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46fa81
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46fa78
xor eax, eax
jmp 0x46fa89
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046fa8f
pop edi
pop esi
pop ebx
ret 4

Function at 0x475d27
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475d55
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475d73
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475c8d
jmp 0x475d73
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475d73
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00475c8d
test edi, edi
mov eax, edi
jne 0x475d5d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x44d138
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44d164
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d189
call fcn.0040b114
xor eax, eax
push ebp
push 0x44d1c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x44d1a9
call fcn.0040b114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d1c7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x451000
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4510cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4510e0
mov dl, 4
mov eax, ebx
call fcn.004511c4
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x4510b6
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x4510a8
test byte [ebx + 0x20], 8
jne 0x451065
cmp word [ebx + 0x1004a], 0
je 0x451065
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x4510b6
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x451088
call fcn.00402d98
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4510b6
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.004510f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4510d3
lea eax, [ebp - 4]
call fcn.00403b64
ret

Function at 0x45126c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x4512a8
mov dl, 8
mov eax, ebx
call fcn.004511c4
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x45129a
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x456114
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x45619d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040272c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403d1c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408930
mov edx, dword [ebp - 4]
mov eax, 0x4561b4
call fcn.004040d0
dec eax
jle 0x45617b
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
mov eax, ebx
call fcn.00402744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4561a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b88
ret
Function at 0x4562c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45642c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d698]
call fcn.00402e28
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.0040272c
mov esi, eax
test ebx, ebx
jbe 0x45635d
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403d1c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408b04
cmp dword [ebp - 0x10], 0
je 0x45634f
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00403d1c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x456313
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x456411
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x456402
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00408930
mov edx, dword [ebp - 0xc]
mov eax, 0x456444
call fcn.004040d0
test eax, eax
je 0x4563cf
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x4563fc
mov edx, dword [ebp - 0xc]
mov eax, 0x456460
call fcn.004040d0
test eax, eax
je 0x4563fc
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x456387
mov eax, esi
call fcn.00402744
mov eax, dword [ebp - 4]
call fcn.00402e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456433
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b88
ret

Function at 0x4565c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x456679
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x456690
call fcn.00456ac0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0044a1f4
cmp dword [ebp - 4], 0
je 0x45665e
mov eax, dword [ebp - 4]
call fcn.00408e74
test al, al
je 0x45665e
xor eax, eax
push ebp
push 0x456654
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
lea eax, [ebp - 0xc]
mov ecx, 0x4566a4
mov edx, dword [ebp - 4]
call fcn.00403e30
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
call sub.KERNEL32.DLL_WinExec
push 0
push 0
push 0x10
mov eax, dword [0x45bba0]
mov eax, dword [eax]
call fcn.0042f34c
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45665e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456680
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403b88
ret
Function at 0x456924
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f98
xor eax, eax
push ebp
push 0x4569bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408f78
mov eax, dword [ebp - 8]
call fcn.00403fa8
mov esi, eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call sub.advapi32.dll_CreateServiceA
push eax
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4569c3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b88
ret

Function at 0x456e2c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456f13
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x456edd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b64
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x456e9f
pop dword fs:[0]
add esp, 8
jmp 0x456ef2
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x456ec7
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.004092a4
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.00403dec
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x456ea6
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456ee7
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456f1a
lea eax, [ebp - 0x204]
call fcn.00403b64
lea eax, [ebp - 8]
call fcn.00403b64
ret

Function at 0x457ec4
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x457eda
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret
Function at 0x10001bd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
pop ebp
ret
Function at 0x10017b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.10017b8a
Function at 0x1002bf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002bfd8
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x1002bfd0
cmp eax, ebx
jb 0x1002c052
cmp eax, dword [ebp + 0x10]
ja 0x1002c063
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x1002bfd2
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x1002bfc0
jmp 0x1002c02f
ja 0x1002bfd8
cmp edx, edi
mov ebx, eax
jne 0x1002bf92
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x1002c033
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x1002c010
mov esi, edi
sub ecx, ebx
jns 0x1002c027
jmp 0x1002c035
cmp edi, edx
je 0x1002c03c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x1002c035
xor al, 1
cmp esi, edx
jne 0x1002bff0
jmp 0x1002c035
xor eax, eax
jmp 0x1002c035
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101dab38
push 0x2b
push str.called__Option::unwrap____on_a__None__valueassertion_failed:__buf.is_empty__
call fcn.10026890
add esp, 0xc
ud2
push 0x101dab48
push eax
push ebx
call fcn.1002a1f0
add esp, 0xc
ud2
push 0x101dab48
push dword [ebp + 0x10]
push eax
call fcn.1002a190
add esp, 0xc
ud2
Function at 0x1002f6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xffffffc0
sub esp, 0x240
mov edi, dword [0x103564a0]
mov esi, dword [0x1035648c]
mov dword [esp + 0x40], 0
mov dword [esp + 4], 0
mov dword [esp + 0x80], 0
movzx eax, byte [edi]
mov eax, dword [esi]
test eax, eax
jne 0x1002f70d
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1002f90e
mov dword [esi], eax
push 0x40c
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1002f90e
mov dword [eax + 0x408], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x80], eax
movaps xmm1, xmmword [esp + 0xa0]
movaps xmm2, xmmword [esp + 0x90]
movaps xmm0, xmmword [esp + 0xb0]
mov eax, dword [esp + 0x78]
movaps xmmword [esp + 0x160], xmm1
movaps xmm1, xmmword [esp + 0x80]
movaps xmmword [esp + 0x150], xmm2
movaps xmm2, xmmword [esp + 0x70]
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x140], xmm1
movaps xmm1, xmmword [esp + 0x60]
movaps xmmword [esp + 0x130], xmm2
movaps xmm2, xmmword [esp + 0x40]
movaps xmmword [esp + 0x120], xmm1
movaps xmm1, xmmword [esp + 0x50]
movaps xmmword [esp + 0x100], xmm2
movsd xmm2, qword [esp + 0x68]
movaps xmmword [esp + 0x110], xmm1
movsd xmm1, qword [esp + 0x70]
mov dword [esp + 0x180], 0
movsd qword [esp + 0x1ac], xmm2
movsd xmm2, qword [esp + 0x58]
mov dword [esp + 0x1bc], eax
mov eax, dword [esp + 0x3c]
movsd qword [esp + 0x1b4], xmm1
movsd xmm1, qword [esp + 0x60]
movsd qword [esp + 0x19c], xmm2
movsd xmm2, qword [esp + 0x40]
movsd qword [esp + 0x1a4], xmm1
movsd xmm1, qword [esp + 0x50]
movsd qword [esp + 0x184], xmm2
movsd xmm2, qword [esp + 0x2c]
movsd qword [esp + 0x194], xmm1
movsd xmm1, qword [esp + 0x48]
movsd qword [esp + 0x18c], xmm1
movsd xmm1, qword [esp + 0x34]
mov dword [esp + 0x1c0], 0
movsd qword [esp + 0x1ec], xmm2
movsd xmm2, qword [esp + 0x1c]
mov dword [esp + 0x1fc], eax
movsd qword [esp + 0x1f4], xmm1
movsd xmm1, qword [esp + 0x24]
movsd qword [esp + 0x1dc], xmm2
movsd xmm2, qword [esp + 4]
movsd qword [esp + 0x1e4], xmm1
movsd xmm1, qword [esp + 0x14]
movsd qword [esp + 0x1c4], xmm2
movsd qword [esp + 0x1d4], xmm1
movsd xmm1, qword [esp + 0xc]
movsd qword [esp + 0x1cc], xmm1
mov dword [esp + 0xc0], 1
mov dword [esp + 0xc4], 1
movzx eax, byte [edi]
mov eax, dword [esi]
test eax, eax
jne 0x1002f8d3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1002f91f
mov dword [esi], eax
push 0x180
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1002f91f
mov esi, eax
and esi, 0xffffffc0
mov dword [esi + 0x3c], eax
add esi, 0x40
lea eax, [esp + 0xc0]
push 0x140
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x40c
push 4
call fcn.1001a7e0
add esp, 8
jmp 0x1002f92e
push 0x140
push 0x40
call fcn.1001a7e0
add esp, 8
ud2
Function at 0x10030640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x101d400c]
test eax, eax
je 0x1003066a
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10030682
cmp dword [eax + 4], 0
mov edi, eax
je 0x10030682
add edi, 8
jmp 0x10030789
push 0x101d400c
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x1003065a
mov eax, dword [0x101d400c]
test eax, eax
je 0x1003076b
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10030787
mov esi, eax
test eax, eax
jne 0x100306fe
mov eax, dword [0x103564a0]
mov esi, dword [0x1035648c]
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x100306c8
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x100307a8
mov dword [esi], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100307a8
mov dword [eax], 0x101d400c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x101d400c]
test eax, eax
je 0x10030796
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10030713
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
jne 0x1003072d
movzx eax, byte [0x1038a050]
test al, al
je 0x1003078f
lea eax, [0x1038a04c]
push eax
call fcn.1002f980
add esp, 4
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x10030789
mov eax, dword [ecx + 0x414]
lea edx, [eax - 1]
mov dword [ecx + 0x414], edx
cmp dword [ecx + 0x410], 0
jne 0x10030789
cmp eax, 1
jne 0x10030789
push ecx
call fcn.10030330
add esp, 4
jmp 0x10030789
push 0x101d400c
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x1003069f
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
call fcn.100305b0
jmp 0x1003071e
push 0x101d400c
call fcn.10160f60
add esp, 4
jmp 0x100306f7
push 0xc
push 4
call fcn.1001a7e0
add esp, 8
ud2
Function at 0x100308c0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
movzx edi, byte [esi + 0x68]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
lea edx, [esi + 0x28]
shld ecx, eax, 9
shl eax, 9
lea ebx, [edi*8]
mov byte [esi + edi + 0x28], pe_nt_image_headers32
or ebx, eax
mov eax, edi
xor eax, 0x3f
je 0x10030918
mov dword [esp + 0x10], ecx
lea ecx, [edi + edx + 1]
push eax
push 0
push ecx
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
xor edi, 0x38
bswap ebx
bswap ecx
cmp edi, 8
jae 0x10030965
push 1
push edx
push esi
mov edi, ecx
call fcn.1011a7c0
add esp, 0xc
xorps xmm0, xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x2c]
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], edi
push 1
push eax
jmp 0x1003096e
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ebx
push 1
push edx
push esi
call fcn.1011a7c0
add esp, 0xc
movups xmm1, xmmword [esi + 0x10]
movdqu xmm0, xmmword [esi]
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x68], 0
mov eax, dword [0x103564a0]
mov esi, dword [0x1035648c]
movdqa xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm1
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x100309f1
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10030a6c
mov dword [esi], eax
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10030a6c
movdqa xmm2, xmmword [esp]
pxor xmm0, xmm0
movdqa xmm3, xmmword [esp + 0x10]
mov edx, 0x20
movdqa xmm1, xmm2
punpcklbw xmm2, xmm0
punpckhbw xmm1, xmm0
pshuflw xmm2, xmm2, 0x1b
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm2, xmm2, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm2, xmm1
movdqa xmm1, xmm3
punpcklbw xmm3, xmm0
punpckhbw xmm1, xmm0
pshuflw xmm0, xmm3, 0x1b
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm0, xmm1
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x20
push 1
call fcn.1001a7e0
add esp, 8
ud2
Function at 0x10031550
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [edx + 0x10]
mov edi, dword [edx]
mov eax, dword [edx + 0x14]
mov ebx, dword [edx + 4]
add edi, esi
adc ebx, eax
add esi, 1
movd xmm0, edi
adc eax, 0
mov dword [edx + 0x10], esi
movd xmm1, ebx
mov dword [edx + 0x14], eax
punpckldq xmm0, xmm1
mov eax, dword [ebp + 8]
movdqu xmm2, xmmword [edx + 8]
punpcklqdq xmm0, xmm2
pxor xmm0, xmmword [ecx]
aesenc xmm0, xmmword [ecx + 0x10]
aesenc xmm0, xmmword [ecx + 0x20]
aesenc xmm0, xmmword [ecx + 0x30]
aesenc xmm0, xmmword [ecx + 0x40]
aesenc xmm0, xmmword [ecx + 0x50]
aesenc xmm0, xmmword [ecx + 0x60]
aesenc xmm0, xmmword [ecx + 0x70]
aesenc xmm0, xmmword [ecx + 0x80]
aesenc xmm0, xmmword [ecx + 0x90]
aesenc xmm0, xmmword [ecx + 0xa0]
aesenc xmm0, xmmword [ecx + 0xb0]
aesenc xmm0, xmmword [ecx + 0xc0]
aesenc xmm0, xmmword [ecx + 0xd0]
aesenclast xmm0, xmmword [ecx + 0xe0]
movdqu xmmword [eax], xmm0
pop esi
pop edi
pop ebx
pop ebp
ret