joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x402bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404840], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047c0], 0x30
mov dword [0x4047c4], 2
mov dword [0x4047cc], 0
mov dword [0x4047d0], 0
mov dword [0x4047c8], 0x402f50
jmp 0x402c23
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4047d4], eax
mov dword [0x4047e0], 0xf
mov dword [0x4047e8], 0x404767
mov dword [0x404104], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4047d8], eax
mov dword [0x4047ec], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4047dc], eax
push 0x4047c0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.litform
push str.ndcls
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404838], eax
xor eax, eax
jmp 0x402cc2
push eax
push dword [0x404838]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404838]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x4047f0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402d08
push 0x4047f0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4047f0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402cdb
mov eax, dword [0x4047f8]
jmp 0x402d15
call 0x4022b2
ret
Function at 0x402594
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025a2
call dword [0x40c004]
or eax, eax
je 0x4025a3
ret
mov al, 1
jmp fcn.00402614

Function at 0x4025ac
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025ba
call dword [0x40c008]
or eax, eax
jne 0x4025bb
ret
mov al, 2
jmp fcn.00402614

Function at 0x4025c4
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025fc
test edx, edx
je 0x4025e6
push eax
mov eax, ecx
call dword [0x40c00c]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402614
mov dword [eax], edx
mov eax, ecx
call dword [0x40c008]
or eax, eax
jne 0x4025df
ret
mov al, 1
jmp fcn.00402614
test edx, edx
je 0x402610
push eax
mov eax, edx
call dword [0x40c004]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40d02c], 0x8088405
inc edx
mov dword [0x40d02c], edx
mul edx
mov eax, edx
ret

Function at 0x403780
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402614
cmp eax, edx
je 0x4037f0
cmp word [eax], 8
jb 0x4037a5
push eax
push edx
cmp word [eax], 0x100
je 0x40379b
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4037a3
add eax, 8
call fcn.00403198
pop edx
pop eax
cmp word [edx], 8
jae 0x4037bc
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037dc
mov edx, dword [edx + 8]
or edx, edx
je 0x4037d3
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037d3
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403744
ret

Function at 0x4045a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040458c
add esp, 0x104
pop ebx
ret

Function at 0x40565c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405695
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40569e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4056a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4056c9
mov al, byte [esp]
jmp 0x4056cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x397c42f3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x4304d8
mov ecx, 0x2df35811
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x409700
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4097e9
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.004098d0
mov eax, dword [esp + 0xc]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebx, dword [esp + 8]
shl edx, 5
shr ebx, 0x1b
or ebx, edx
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
lea edx, [0x4b0e20]
movsd xmm0, qword [edx + ecx*8]
movsd qword [esp + 0x14], xmm0
add ecx, 1
movsd xmm1, qword [edx + ecx*8]
subsd xmm1, xmm0
movsd qword [esp + 0x24], xmm1
add eax, 0xfffffc01
mov ecx, 0xffffffff
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.004633d0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00463450
movsd xmm0, qword [esp + 0x1c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm1, qword [esp + 8]
movsd xmm2, qword [esp + 0x24]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4e4290]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
call fcn.004688b0
jmp fcn.00409700
Function at 0x419ac0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x419ca6
sub esp, 0x18
mov eax, dword [0x57ad04]
test eax, eax
jne 0x419c8f
lea eax, [0x57acf4]
mov dword [esp], eax
call fcn.0040b450
mov eax, dword [0x57acf8]
test eax, eax
je 0x419b06
cmp dword [eax + 8], 0xcc
jne 0x419b7c
mov eax, dword [0x57acfc]
test eax, eax
jne 0x419b5e
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x57f490]
mov dword [esp + 8], eax
call fcn.0040db20
mov eax, dword [esp + 0xc]
mov dword [0x57acfc], eax
mov ecx, dword [0x57ad00]
mov dword [eax], ecx
mov eax, dword [0x57acfc]
mov dword [0x57ad00], eax
movzx eax, byte [0x57b160]
test al, al
jne 0x419b5e
xor eax, eax
jmp 0x419c83
mov eax, dword [0x57acfc]
mov ecx, dword [eax + 4]
mov dword [0x57acfc], ecx
mov ecx, dword [0x57acf8]
mov dword [eax + 4], ecx
mov dword [0x57acf8], eax
mov eax, dword [0x57acf8]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00403ad0
mov eax, dword [0x57aed0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x419bbb
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x419bd1
call fcn.00469ce0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x57aed0]
test eax, eax
jne 0x419bf5
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x419c23
call fcn.00469d20
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
lea eax, [0x57acf4]
mov dword [esp], eax
call fcn.0040b650
lea eax, [0x57acf0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00403600
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov ebx, ecx
sub ecx, edx
lea edx, [0x4b0248]
movzx ecx, byte [edx + ecx]
lea ebp, [0x57b160]
mov byte [ebp + ebx], cl
lea eax, [ebx + 1]
cmp eax, 0x80
jl 0x419c57
jmp 0x419b5e
lea eax, [0x4d8da8]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043c250
nop
call fcn.004688b0
jmp fcn.00419ac0
Function at 0x427130
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42720a
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + edx*8]
mov dword [esp], ecx
call fcn.00427560
movzx eax, word [esp + 4]
movzx ecx, byte [esp + 0xc]
movzx edx, word [esp + 6]
mov ebx, dword [esp + 8]
mov word [esp + 0x10], ax
mov word [esp + 0x12], dx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], cl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004278b0
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.00427790
movzx eax, byte [esp + 4]
test al, al
jne 0x4271ca
cmp word [esp + 0x10], 0x1f0
jbe 0x4271ca
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.004277c0
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov ecx, dword [esp + 0x24]
lea eax, [eax + ecx*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.004275d0
add esp, 0x1c
ret
call fcn.004688b0
jmp fcn.00427130
Function at 0x427220
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x427360
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
lea ecx, [ecx + edx*8]
mov dword [esp], ecx
call fcn.00427560
movzx eax, word [esp + 4]
mov ecx, dword [esp + 8]
movzx edx, byte [esp + 0xc]
movzx ebx, word [esp + 6]
mov word [esp + 0x14], ax
mov word [esp + 0x16], bx
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004279a0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.004275d0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0042e620
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
lea edx, [ebx + edx - 1]
shl edx, 0xd
add edx, dword [esp + 4]
mov dword [esp + 0x10], edx
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00434c50
movzx eax, byte [esp + 8]
test al, al
je 0x427318
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x28], eax
jmp 0x42731c
mov ecx, dword [esp + 0x28]
lea eax, [ecx + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp], eax
call fcn.00434eb0
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00434c50
movzx eax, byte [esp + 8]
test al, al
je 0x42735c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00434e60
add esp, 0x24
ret
call fcn.004688b0
jmp fcn.00427220
Function at 0x42e010
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42e149
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42e0ec
cmp cl, 1
je 0x42e090
cmp cl, 2
jne 0x42e132
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00433a50
lea eax, [0x55f2e0]
mov dword [esp], eax
call fcn.0040b450
lea eax, [0x55f268]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0041ab50
lea eax, [0x55f2e0]
mov dword [esp], eax
call fcn.0040b650
jmp 0x42e12e
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00419ac0
lea eax, [0x55f2e0]
mov dword [esp], eax
call fcn.0040b450
lea eax, [0x55f240]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0041ab50
lea eax, [0x55f2e0]
mov dword [esp], eax
call fcn.0040b650
jmp 0x42e12e
cmp cl, 3
jne 0x42e0f7
mov byte [eax + 8], 1
jmp 0x42e12e
cmp cl, 4
jne 0x42e132
lea eax, [0x55f2e0]
mov dword [esp], eax
call fcn.0040b450
lea eax, [0x55f2b8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0041ab50
lea eax, [0x55f2e0]
mov dword [esp], eax
call fcn.0040b650
add esp, 0x14
ret
lea eax, [0x4d6020]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043c250
nop
call fcn.004688b0
jmp fcn.0042e010
Function at 0x4343e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4344a1
sub esp, 0x2c
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x43440e
mov byte [esp], 6
call fcn.00440be0
movzx ecx, byte [esp + 0x3c]
mov dword [esp + 4], 0
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x434422
test cl, cl
jmp 0x43448e
mov ebx, dword [0x57adc8]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
lea ebp, [esp + 0x30]
lea edi, [esp + 8]
xor eax, eax
call fcn.00469da7
lea ecx, [0x4344b0]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
movzx ecx, byte [esp + 0x3c]
mov byte [esp + 0x24], cl
lea edx, [esp + 4]
mov dword [esp + 0x28], edx
lea edx, [esp + 8]
mov dword [esp], edx
call fcn.004687c0
movzx ecx, byte [esp + 0x3c]
test cl, cl
je 0x434495
call fcn.00440d10
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
add esp, 0x2c
ret
call fcn.004688b0
jmp fcn.004343e0
Function at 0x45ccb0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45cdb3
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.0045d5c0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4c1dc0]
mov dword [esp], ecx
call fcn.0040d8c0
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x55f39c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call fcn.0045c1d0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0045b780
add esp, 0x28
ret
call fcn.004688b0
jmp fcn.0045ccb0

Function at 0x460300
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46039b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x57adc8]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00469da7
lea ecx, [0x4603b0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004687c0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004688b0
jmp fcn.00460300
Function at 0x466ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x57adc8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x466c1d
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
call fcn.0040b450
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x466c06
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.00436c90
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.00437390
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.00437390
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x466b8f
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.00459390
mov eax, dword [0x57aed0]
test eax, eax
jne 0x466b76
mov eax, dword [esp + 0x20]
jmp 0x466b84
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.00469cd0
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x466bc6
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.00459390
mov eax, dword [0x57aed0]
test eax, eax
jne 0x466bb1
mov eax, dword [esp + 0x20]
jmp 0x466bbf
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.00469cd0
mov dword [edi], ecx
mov dword [eax + 0x78], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040b650
mov eax, dword [esp + 0x14]
test eax, eax
je 0x466bea
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004371d0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x466c02
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004371d0
add esp, 0x1c
ret
lea eax, [0x4dc16d]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0043c250
nop
call fcn.004688b0
jmp fcn.00466ac0
Function at 0x469b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x57afc0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46830b
je 0x46835e
cmp ebx, 0x20
jbe 0x468364
cmp ebx, 0x40
jbe 0x4683aa
jmp 0x46844b
test ebx, ebx
je 0x468354
add eax, 0x10
test ax, 0xff0
je 0x468340
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4e4a40]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4e4b40]
jmp 0x468328
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x468328
pxor xmm1, xmmword [0x57afd0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x57afd0]
pxor xmm2, xmmword [0x57afe0]
pxor xmm3, xmmword [0x57aff0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x57afd0]
pxor xmm2, xmmword [0x57afe0]
pxor xmm3, xmmword [0x57aff0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4684aa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x57aca7], 0
je 0x469b7a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4682d0
jmp fcn.00409a90