joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005060
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edx, edi
jne 0x1000507e
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], esi
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [esi + eax*8]
mov esi, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.10005670
dec dword [ebx + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x1000510e
nop dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x1000511d
mov edx, esi
mov esi, dword [esi]
call fcn.10005670
dec dword [ebx + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x100050f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x1000513d
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x10005140
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1000512a
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, edi
je 0x1000512a
nop word [eax + eax]
movzx eax, byte [esi + 8]
mov edx, esi
xor eax, 0x811c9dc5
mov edi, esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
mov esi, dword [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
call fcn.10005670
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
je 0x100051ca
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov edi, esi
cmp esi, eax
je 0x100051f3
mov edx, esi
mov esi, dword [esi]
call fcn.10005670
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
jne 0x100051b0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, edi
jne 0x10005150
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100057c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100057f1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10005210
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100058fc
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10005881
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100058f2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100058bb
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100058b3
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100058ef
cmp edi, edx
je 0x100058cc
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10005905
cmp edi, edx
jne 0x100058c0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x10005830
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100058ef
Function at 0x10005cb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov edx, ebx
push esi
push edi
mov edi, 0x811c9dc5
xor esi, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10005cc5
sub edx, ecx
je 0x10005cef
movsx eax, byte [esi + ebx]
mov ecx, ebx
xor eax, edi
imul edi, eax, 0x1000193
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005ce2
sub ecx, edx
cmp esi, ecx
jb 0x10005cd0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015e70
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [0x10072ff0]
cmp eax, 0xffffffff
je 0x10015e88
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
ret 4
push str.Bad_thread_local
call fcn.1002cf60
add esp, 4
xor eax, eax
ret 4

Function at 0x10017e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x10017f20
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
cmp dword [ebp + 0xc], 1
jne 0x10017eb7
cmp byte [0x1006c264], 0
jne 0x10017eb7
push 0
push 0
push dword [ebp + 8]
push 0x10017ec0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10017eb7
push eax
mov byte [0x1006c264], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1001e250
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10068010]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x1006c840]
lea edx, [ebp - 8]
push esi
push edx
lea edx, [ebp - 0xc]
mov eax, dword [ecx]
push edx
push 0x1006c810
push 0x1006c5fc
call dword [eax + 0x58]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x1001e2c2
cmp byte [0x10068054], 0
mov ecx, dword [0x1006c840]
sete al
mov byte [0x10068054], al
test al, al
mov eax, dword [ecx]
je 0x1001e2ac
call dword [eax + 0x48]
jmp 0x1001e2af
call dword [eax + 0x4c]
mov ecx, dword [0x1006c844]
movzx eax, byte [0x10068054]
push eax
mov edx, dword [ecx]
call dword [edx + 0x1c]
push 1
call esi
and al, 1
push 1
mov byte [0x1006c815], al
call esi
test ax, ax
push 0xa0
setne byte [0x1006c814]
call esi
push 0x52
call esi
mov ecx, dword [0x10069e14]
mov edx, dword [0x10069e18]
pop esi
cmp ecx, edx
je 0x1001e30a
push ecx
call fcn.10004b90
mov eax, dword [0x10069e14]
add esp, 4
mov dword [0x10069e18], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016e69
mov esp, ebp
pop ebp
ret
Function at 0x1002d740
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039250
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10068010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.CThread.0
test eax, eax
je 0x1002d835
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1002d830
cmp dword [ebp - 0x14], 0x103
jne 0x1002d830
push str.Illegal_termination_of_worker_thread__Threads_must_negotiate_an_end_to_the_thread_before_the_CThread_object_is_destroyed._n
call fcn.1002ce20
push 0x679
push str.D:coding_projectskBoomSDKhl2_src_tier0_threadtools.cpp
push str.Illegal_termination_of_worker_thread__Threads_must_negotiate_an_end_to_the_thread_before_the_CThread_object_is_destroyed.___s___s__n
call fcn.1002d050
mov eax, dword [0x10072ff0]
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002d823
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x1002d830
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1002d830
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1002d830
cmp dword [ebp - 0x14], 0x103
jne 0x1002d830
mov eax, dword [0x10072ff0]
cmp eax, 0xffffffff
je 0x1002d80f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
je 0x1002d87a
jmp 0x1002d81c
push str.Bad_thread_local
call fcn.1002cf60
add esp, 4
push str.Only_thread_can_stop_self:_Use_a_higher_level_protocol
jmp 0x1002d828
push str.Bad_thread_local
call fcn.1002cf60
add esp, 4
push dword [esi + 0x24]
call edi
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1002d845
cmp byte [esi + 0x3c], 0
je 0x1002d845
push eax
call edi
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1002d855
cmp byte [esi + 0x34], 0
je 0x1002d855
push eax
call edi
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10016e69
mov esp, ebp
pop ebp
ret
test byte [esi + 0x68], 1
mov dword [esi + 0x40], 0
jne 0x1002d8ab
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
push ecx
call fcn.10015e70
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
mov dword [esi + 0x24], 0
call fcn.1002d3a0
push 0x10065dc4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1002e800
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [0x10068010]
xor eax, esp
mov dword [esp + 0x64], eax
push 0x40
lea eax, [esp + 0x24]
mov dword [esp + 8], ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov dword [esp + 0xc], 0x67452301
lea edx, [esp + 8]
mov dword [esp + 0x10], 0xefcdab89
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.1002e070
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
add esp, 4
add ecx, eax
sub edx, eax
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x1002e8b2
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.1002e180
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x1002e8c1
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.1002e180
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
xor ecx, esp
call fcn.10016e69
mov esp, ebp
pop ebp
ret
Function at 0x10032000
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x10077528]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x100320f1
mov eax, dword [0x10077520]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10032045
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10032028
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100320f1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10032260
mov ecx, dword [0x10077528]
add esp, 4
cmp esi, ecx
jae 0x100320a5
imul edi, esi, 0x2c
mov eax, dword [0x10077520]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1003209a
mov edx, ebx
mov ecx, esi
call fcn.10032100
mov dword [ebp - 4], eax
test eax, eax
jne 0x100320a2
mov ecx, dword [0x10077528]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10032071
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100320f1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x100320e2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100320d6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x100320b5
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10072f44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10068010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10077520]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
mov dword [ebp - 0x14], edi
lea eax, [eax*2 + 5]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x1003216f
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016e69
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10032190
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x100321b1
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100321b1
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x100321ab
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x100321b1
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.10016e69
mov esp, ebp
pop ebp
ret
Function at 0x10032260
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10068010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003235a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10032353
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10032339
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10032339
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10032339
mov edx, dword [esi]
test edx, edx
jne 0x10032302
push 0x200
push edx
push dword [0x10072f44]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10032353
jmp 0x1003232d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003232d
shl eax, 3
push eax
push edx
push 0
push dword [0x10072f44]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10032353
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100322c1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1003239f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1003239f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10032399
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.100324b0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10032366
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10016e69
mov esp, ebp
pop ebp
ret
Function at 0x4011c7
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x4012c3
mov ebx, 0x800
cmp dword [esi + 0x820], ebx
jne 0x401260
lea eax, [esi + 0x28]
mov dword [esp + 0xc], 0x80
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
bswap ecx
mov dword [eax - 4], ecx
bswap edx
mov dword [eax - 8], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
bswap ecx
mov dword [eax + 4], ecx
bswap edx
mov dword [eax], edx
add dword [esi + 0x10], 1
mov ecx, dword [esi + 0x10]
adc dword [esi + 0x14], 0
or ecx, dword [esi + 0x14]
jne 0x401230
add dword [esi + 0x18], 1
adc dword [esi + 0x1c], ecx
add eax, 0x10
dec dword [esp + 0xc]
jne 0x4011fa
push ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esi + 0x20]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4012cc
and dword [esi + 0x820], 0
push 0x10
pop ecx
cmp dword [ebp + 0xc], ecx
jb 0x4012a3
mov eax, dword [esi + 0x820]
cmp eax, 0x7f0
jae 0x4012a3
mov edx, dword [eax + esi + 0x20]
xor dword [edi], edx
mov eax, dword [eax + esi + 0x24]
xor dword [edi + 4], eax
mov eax, dword [esi + 0x820]
mov edx, dword [eax + esi + 0x28]
xor dword [edi + 8], edx
mov eax, dword [eax + esi + 0x2c]
xor dword [edi + 0xc], eax
add dword [esi + 0x820], ecx
add edi, ecx
sub dword [ebp + 0xc], ecx
jmp 0x4012b9
mov eax, dword [esi + 0x820]
mov al, byte [eax + esi + 0x20]
xor byte [edi], al
inc dword [esi + 0x820]
inc edi
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
jne 0x4011e7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
push 0x414f50
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], vtable.xwnmqigmmwptq.0
call fcn.0040ab7e
int3

Function at 0x4012ee
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp method.wesioyitxu.virtual_12
Function at 0x4014c9
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x120], edx
cmp edx, 0x10
je 0x401646
cmp edx, 0x18
je 0x4015ac
cmp edx, 0x20
jne 0x4016ab
movdqu xmm0, xmmword [ecx]
movdqa xmmword [eax + 0x30], xmm0
movdqu xmm2, xmmword [ecx + 0x10]
movdqa xmmword [eax + 0x40], xmm2
xor ecx, ecx
add eax, 0x60
movzx edx, byte [ecx + 0x413890]
movdqa xmm1, xmm0
pslldq xmm1, 4
pxor xmm0, xmm1
movdqa xmm1, xmm0
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm3, xmm1
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm1
pxor xmm3, xmm0
movd xmm0, edx
pshufd xmm0, xmm0, 0
pxor xmm0, xmm3
movdqa xmmword [eax - 0x10], xmm0
cmp ecx, 6
je 0x4016ab
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm1
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm2
aeskeygenassist xmm2, xmm0, 0
pshufd xmm2, xmm2, 0xaa
pxor xmm2, xmm1
movdqa xmmword [eax], xmm2
inc ecx
add eax, 0x20
cmp ecx, 7
jb 0x401508
jmp 0x4016ab
movdqu xmm0, xmmword [ecx]
movdqa xmmword [eax + 0x30], xmm0
movdqu xmm2, xmmword [ecx + 8]
psrldq xmm2, 8
movdqa xmmword [eax + 0x40], xmm2
xor ecx, ecx
add eax, 0x58
movzx edx, byte [ecx + 0x413890]
movdqa xmm1, xmm0
pslldq xmm1, 4
pxor xmm0, xmm1
movdqa xmm1, xmm0
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm3, xmm1
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0
pshufd xmm0, xmm0, 0x55
pxor xmm3, xmm1
pxor xmm3, xmm0
movd xmm0, edx
pshufd xmm0, xmm0, 0
pxor xmm0, xmm3
movdqu xmmword [eax - 0x10], xmm0
cmp ecx, 7
je 0x4016ab
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm2
pshufd xmm2, xmm0, 0xff
pxor xmm2, xmm1
movq qword [eax], xmm2
inc ecx
add eax, 0x18
cmp ecx, 8
jb 0x4015c9
jmp 0x4016ab
movdqu xmm0, xmmword [ecx]
movdqa xmmword [eax + 0x30], xmm0
xor ecx, ecx
add eax, 0x40
movzx edx, byte [ecx + 0x413890]
movdqa xmm1, xmm0
aeskeygenassist xmm2, xmm0, 0
pslldq xmm1, 4
pxor xmm0, xmm1
movdqa xmm1, xmm0
pslldq xmm0, 4
pxor xmm1, xmm0
movdqa xmm3, xmm1
pslldq xmm1, 4
pshufd xmm0, xmm2, 0xff
pxor xmm3, xmm1
pxor xmm3, xmm0
movd xmm0, edx
pshufd xmm0, xmm0, 0
pxor xmm0, xmm3
movdqa xmmword [eax], xmm0
inc ecx
add eax, 0x10
cmp ecx, 0xa
jb 0x401654
pop ebp
ret 4
Function at 0x4019b2
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp method.ssphl.virtual_12