joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5250
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test dl, dl
je 0x4c537b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
jne 0x4c53b2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.004049b0
test eax, eax
jle 0x4c5285
mov ebx, 3
jmp 0x4c5287
xor ebx, ebx
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x4c5297
call fcn.0040d6d8
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00404bb0
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00404bb0
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00404bb0
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x70], esi
test esi, esi
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004c4d38
xor eax, eax
push ebp
push 0x4c5356
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
call fcn.00404bb0
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00404bb0
push eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x60]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.00404bb0
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
push eax
call sub.wininet.dll_InternetConnectA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], ebx
test ebx, ebx
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004c4d38
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c53b2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
test eax, eax
je 0x4c538b
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x74], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
test eax, eax
je 0x4c53a3
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x70], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x131fb7d7
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.131fb856
jae 0x131fb7e3
xor ecx, ecx
call fcn.131fb856
jae 0x131fb80d
xor eax, eax
call fcn.131fb856
jae 0x131fb81e
mov al, 0x10
call fcn.131fb856
adc al, al
jae 0x131fb7ff
jne 0x131fb84b
stosb byte es:[edi], al
jmp 0x131fb7e4
call fcn.131fb862
dec ecx
loop 0x131fb82a
mov eax, ebp
call fcn.131fb860
jmp 0x131fb84c
lodsb al, byte [esi]
shr eax, 1
je 0x131fb872
adc ecx, 2
mov ebp, eax
jmp 0x131fb84c
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.131fb860
cmp eax, 0x7d00
jae 0x131fb84a
cmp eax, 0x500
jae 0x131fb84b
cmp eax, 0x7f
ja 0x131fb84c
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x131fb7e4
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x818030]
jne 0x40107a
repz ret
jmp fcn.00401c61

Function at 0x408bbd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004049ab
and dword [ebp - 4], 0
cmp dword [0x81a850], 0
mov ebx, eax
jne 0x408c6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408d1f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408d1f
push eax
call fcn.00404939
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81a850], eax
call esi
push eax
call fcn.00404939
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81a854], eax
call esi
push eax
call fcn.00404939
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81a858], eax
call esi
push eax
call fcn.00404939
pop ecx
mov dword [0x81a860], eax
test eax, eax
je 0x408c6e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404939
pop ecx
mov dword [0x81a85c], eax
mov eax, dword [0x81a85c]
cmp eax, ebx
je 0x408cc6
cmp dword [0x81a860], ebx
je 0x408cc6
push eax
call fcn.004049b4
push dword [0x81a860]
mov esi, eax
call fcn.004049b4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408cc6
test edi, edi
je 0x408cc6
call esi
test eax, eax
je 0x408cbd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408cbd
test byte [ebp - 0xc], 1
jne 0x408cc6
or dword [ebp + 0x10], 0x200000
jmp 0x408cff
mov eax, dword [0x81a854]
cmp eax, ebx
je 0x408cff
push eax
call fcn.004049b4
pop ecx
test eax, eax
je 0x408cff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408cff
mov eax, dword [0x81a858]
cmp eax, ebx
je 0x408cff
push eax
call fcn.004049b4
pop ecx
test eax, eax
je 0x408cff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81a850]
call fcn.004049b4
pop ecx
test eax, eax
je 0x408d1f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408d21
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x40402a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x403fbd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00403700
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x403f83
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4040f3
call fcn.00403fcf
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x40408a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00403b20
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40403b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4040f3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00403b20
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4040ee
jmp 0x4040f3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x404ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x404bba
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x404b4d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00404180
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x404b13
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x404c83
call fcn.00404b5f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x404c1a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00404630
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x404bcb
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x404c83
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00404630
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x404c7e
jmp 0x404c83
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405270
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x405290
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4090e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4090fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x409140
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40915e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x4091a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4091c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x409220
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x409242
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x4092a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4092ca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x409330
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40935a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x4093c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40941f

Function at 0x4094a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4094ff
Function at 0x41f780
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, str.br.dll.enc
xor ebx, ebx
call fcn.0041ffd0
mov edi, eax
mov edx, edi
mov dword [ebp - 0x18], edi
lea eax, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x41f7a0
sub edx, eax
xor eax, eax
add edx, 3
setb al
neg eax
or eax, edx
push eax
push 1
call fcn.004ba678
push 0x559898
push edi
mov esi, eax
push 0x55989c
push esi
mov dword [ebp - 0x10], esi
call fcn.004ba5bc
add esp, 0x18
mov ecx, str.logo.png
call fcn.0041ffd0
mov edi, eax
mov edx, edi
mov dword [ebp - 0x14], edi
lea eax, [edx + 1]
lea ebx, [ebx]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x41f7f0
sub edx, eax
xor eax, eax
add edx, 3
setb al
neg eax
or eax, edx
push eax
push 1
call fcn.004ba678
push 0x559898
push edi
push 0x55989c
push eax
mov dword [ebp - 4], eax
call fcn.004ba5bc
add esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call esi
push dword [ebp - 4]
mov edi, eax
call esi
mov ecx, eax
cmp edi, 0xffffffff
je 0x41f8f9
xor eax, eax
cmp ecx, 0xffffffff
setne al
sub esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
lea eax, [ebp - 0xc]
push eax
je 0x41f86b
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.004200b0
lea edx, [ebp - 8]
mov ecx, eax
call fcn.0041faa0
jmp 0x41f880
mov ecx, dword [ebp - 0x14]
call fcn.004200b0
lea edx, [ebp - 8]
mov ecx, eax
call fcn.0041faa0
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov edx, dword [ebp - 8]
mov ecx, esi
push dword [ebp - 0xc]
call fcn.0041fc30
add esp, 4
test eax, eax
jne 0x41f89f
lea ebx, [eax + 1]
jmp 0x41f8d6
mov ecx, eax
call fcn.00420ae0
push 1
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41f8bb
lea ebx, [eax + 1]
jmp 0x41f8d6
cmp dword [ebp - 0x1c], ebx
je 0x41f8d6
push 1
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
mov ecx, 1
cmove ebx, ecx
push dword [ebp - 8]
call fcn.004ba640
push dword [ebp - 0xc]
call fcn.004ba640
add esp, 8
test ebx, ebx
je 0x41f8fc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
push edi
call esi
mov esi, dword [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.004ba640
push esi
call fcn.004ba640
push dword [ebp - 0x14]
call fcn.004ba640
push dword [ebp - 4]
call fcn.004ba640
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
push 0x55a940
push ebx
call fcn.004bde1a
mov edi, eax
add esp, 8
test edi, edi
jne 0x41f956
xor esi, esi
jmp 0x41f992
push 2
push 0
push edi
call fcn.004be12f
push edi
call fcn.004be542
push 0
push 0
push edi
mov esi, eax
call fcn.004be12f
push esi
push 1
call fcn.004ba678
push edi
push esi
push 1
push eax
mov dword [ebp - 4], eax
call fcn.004bdff4
push edi
mov esi, eax
call fcn.004bd940
add esp, 0x38
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, esi
push dword [ebp - 8]
call fcn.0041fcb0
add esp, 8
test eax, eax
je 0x41f9ba
mov ecx, eax
call fcn.00420a10
test eax, eax
je 0x41f9ba
push ebx
call eax
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41faa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
call fcn.0041ffd0
push 0x55a940
push eax
call fcn.004bde1a
mov edi, eax
add esp, 8
test edi, edi
jne 0x41fac6
xor esi, esi
jmp 0x41fb02
push 2
push 0
push edi
call fcn.004be12f
push edi
call fcn.004be542
push 0
push 0
push edi
mov esi, eax
call fcn.004be12f
push esi
push 1
call fcn.004ba678
push edi
push esi
push 1
push eax
mov dword [ebp - 4], eax
call fcn.004bdff4
push edi
mov esi, eax
call fcn.004bd940
add esp, 0x38
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.0041fa30
push 0x20
push 1
mov edi, eax
call fcn.004ba678
add esp, 8
mov esi, eax
xor ecx, ecx
mov edi, edi
test ecx, ecx
jne 0x41fb2a
movzx edx, byte [edi + 0x1f]
jmp 0x41fb2d
movzx edx, byte [edi]
mov al, byte [ecx + edi]
xor al, dl
mov byte [esi + ecx], al
lea eax, [ecx + 1]
test eax, eax
jne 0x41fb42
movzx edx, byte [edi + 0x1f]
jmp 0x41fb45
movzx edx, byte [edi]
mov al, byte [edi + ecx + 1]
xor al, dl
mov byte [esi + ecx + 1], al
lea eax, [ecx + 2]
test eax, eax
jne 0x41fb5c
movzx edx, byte [edi + 0x1f]
jmp 0x41fb5f
movzx edx, byte [edi]
mov al, byte [edi + ecx + 2]
xor al, dl
mov byte [esi + ecx + 2], al
lea eax, [ecx + 3]
test eax, eax
jne 0x41fb76
movzx edx, byte [edi + 0x1f]
jmp 0x41fb79
movzx edx, byte [edi]
mov al, byte [edi + ecx + 3]
xor al, dl
mov byte [esi + ecx + 3], al
add ecx, 4
cmp ecx, 0x20
jb 0x41fb20
push 0x10
push 1
mov dword [ebx], esi
call fcn.004ba678
add esp, 8
mov ebx, eax
xor ecx, ecx
lea ecx, [ecx]
test ecx, ecx
jne 0x41fbaa
movzx edx, byte [esi + 0xf]
jmp 0x41fbad
movzx edx, byte [esi]
mov al, byte [ecx + esi]
xor al, dl
mov byte [ecx + ebx], al
lea eax, [ecx + 1]
test eax, eax
jne 0x41fbc2
movzx edx, byte [esi + 0xf]
jmp 0x41fbc5
movzx edx, byte [esi]
mov al, byte [esi + ecx + 1]
xor al, dl
mov byte [ebx + ecx + 1], al
lea eax, [ecx + 2]
test eax, eax
jne 0x41fbdc
movzx edx, byte [esi + 0xf]
jmp 0x41fbdf
movzx edx, byte [esi]
mov al, byte [esi + ecx + 2]
xor al, dl
mov byte [ebx + ecx + 2], al
lea eax, [ecx + 3]
test eax, eax
jne 0x41fbf6
movzx edx, byte [esi + 0xf]
jmp 0x41fbf9
movzx edx, byte [esi]
mov al, byte [esi + ecx + 3]
xor al, dl
mov byte [ebx + ecx + 3], al
add ecx, 4
cmp ecx, 0x10
jb 0x41fba0
mov eax, dword [ebp + 8]
push edi
mov dword [eax], ebx
call fcn.004ba640
push dword [ebp - 4]
call fcn.004ba640
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41fc30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x55a940
push ecx
mov dword [ebp - 4], edx
call fcn.004bde1a
mov edi, eax
add esp, 8
test edi, edi
jne 0x41fc55
mov ebx, dword [ebp - 4]
xor esi, esi
jmp 0x41fc90
push 2
push 0
push edi
call fcn.004be12f
push edi
call fcn.004be542
push 0
push 0
push edi
mov esi, eax
call fcn.004be12f
push esi
push 1
call fcn.004ba678
push edi
push esi
mov ebx, eax
push 1
push ebx
call fcn.004bdff4
push edi
mov esi, eax
call fcn.004bd940
add esp, 0x38
push dword [ebp + 8]
mov edx, esi
mov ecx, ebx
push dword [ebp - 4]
call fcn.0041fcb0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret