joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413f60
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41414c
sub esp, 0x18
mov eax, dword [0xe99310]
test eax, eax
jne 0x414135
nop
lea eax, [0xe992fc]
mov dword [esp], eax
call fcn.00408f90
mov eax, dword [0xe99300]
test eax, eax
je 0x413fa9
cmp dword [eax + 8], 0xcc
jne 0x41401f
mov eax, dword [0xe992f4]
test eax, eax
jne 0x414001
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xe9e630]
mov dword [esp + 8], eax
call fcn.0040b2b0
mov eax, dword [esp + 0xc]
mov dword [0xe992f4], eax
mov ecx, dword [0xe992b8]
mov dword [eax], ecx
mov eax, dword [0xe992f4]
mov dword [0xe992b8], eax
movzx eax, byte [0xe99a40]
test al, al
jne 0x414001
xor eax, eax
jmp 0x414129
mov eax, dword [0xe992f4]
mov ecx, dword [eax + 4]
mov dword [0xe992f4], ecx
mov ecx, dword [0xe99300]
mov dword [eax + 4], ecx
mov dword [0xe99300], eax
mov eax, dword [0xe99300]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00402080
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xe996c0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414072
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41407f
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045efc0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xe996c0]
test edx, edx
jne 0x4140ab
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4140cc
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045efc0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045efc0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045efc0
nop
lea eax, [0xe992fc]
mov dword [esp], eax
call fcn.00409190
nop
lea eax, [0xe992f8]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402200
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
lea ecx, [0x8082ac]
movzx ebx, byte [ecx + ebx]
lea ebp, [0xe99a40]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jl 0x4140f6
jmp 0x414001
lea eax, [0x679f7f]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00433ba0
nop
call fcn.0045dbb0
jmp fcn.00413f60
Function at 0x425f90
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426196
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call fcn.00426a50
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
call fcn.00425680
movzx eax, byte [esp + 0xc]
test al, al
je 0x425ff4
mov ecx, dword [esp + 0x18]
mov byte [ecx + 0x3c], 1
jmp 0x425ff8
mov ecx, dword [esp + 0x18]
movzx edx, byte [esp + 0x1c]
test dl, dl
jne 0x4260d0
movzx ebx, byte [esp + 0x1d]
mov byte [ecx + 0x3a], bl
mov eax, dword [esp + 0x24]
shl eax, 0xd
shr bl, 1
test bl, bl
jne 0x42602d
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x1c], 1
mov dword [ecx + 0x34], 0
jmp 0x426058
movsx ebx, bl
lea esi, [0x80ccc0]
movzx esi, word [esi + ebx*2]
mov dword [ecx + 0x40], esi
test esi, esi
je 0x426190
xor edx, edx
div esi
mov dword [ecx + 0x1c], eax
lea edx, [0x80e6a0]
mov edx, dword [edx + ebx*4]
mov dword [ecx + 0x34], edx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x20], 0xffffffff
mov dword [ecx + 0x24], 0xffffffff
mov eax, dword [ecx + 0x1c]
mov dword [esp], eax
call fcn.004275d0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esp], eax
call fcn.00427760
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x30]
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 0x98]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00402150
nop
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
mov byte [esp + 4], 1
call fcn.004021f0
jmp 0x4260fc
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov eax, dword [ecx + 0x10]
shl eax, 0xd
add eax, dword [ecx + 0xc]
mov dword [ecx + 0x44], eax
nop
nop
lea eax, [ecx + 0x3b]
mov dword [esp], eax
mov byte [esp + 4], 2
call fcn.004021f0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.004255e0
movzx eax, byte [esp + 0x1c]
test al, al
jne 0x426187
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov eax, dword [0xe7939c]
mov edx, ecx
shr ecx, 0x16
mov ebx, dword [eax + ecx*4]
test byte [ebx], al
test byte [eax], al
nop
nop
mov ecx, edx
shr edx, 0x10
and edx, 0x3f
lea eax, [ebx + edx + 0x21800]
nop
mov dword [esp], eax
shr ecx, 0xd
and ecx, 7
mov eax, 1
shl eax, cl
mov byte [esp + 4], al
call fcn.004021d0
mov eax, dword [esp + 0x14]
test byte [eax], al
add eax, 0xa8
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00401fe0
call fcn.0045ec30
add esp, 0x10
ret
call fcn.00432350
nop
call fcn.0045dbb0
jmp fcn.00425f90
Function at 0x426e20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426f90
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00424cf0
mov eax, dword [esp + 4]
test eax, eax
je 0x426f79
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00422b60
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00408f90
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x426eb7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x426f1d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x426ecc
cmp byte [ebp + 6], dl
je 0x426ed7
cmp esi, ebx
ja 0x426f1d
jne 0x426eb5
cmp byte [ebp + 6], dl
jbe 0x426eb5
jmp 0x426f1d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409190
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426f14
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426f14
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00426d40
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409190
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426f70
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426f70
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x67c0e6]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433ba0
nop
call fcn.0045dbb0
jmp fcn.00426e20
Function at 0x427410
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42752c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4274a5
cmp cl, 2
je 0x42744d
cmp cl, 3
jne 0x427515
mov byte [eax + 8], 1
jmp 0x427511
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c050
nop
lea eax, [0xe7d8b8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0xe7d884]
sub eax, dword [0xe7d868]
mov dword [0xe7d884], eax
mov eax, dword [0xe7d874]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xe7d874], ecx
nop
lea eax, [0xe7d8b8]
mov dword [esp], eax
call fcn.00409190
jmp 0x427511
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413f60
nop
lea eax, [0xe7d8b8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0xe7d85c]
sub eax, dword [0xe7d840]
mov dword [0xe7d85c], eax
mov eax, dword [0xe7d84c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xe7d84c], ecx
nop
nop
lea eax, [0xe7d8b8]
mov dword [esp], eax
call fcn.00409190
add esp, 0x14
ret
lea eax, [0x676504]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433ba0
nop
call fcn.0045dbb0
jmp fcn.00427410
Function at 0x42e140
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42e373
sub esp, 0x2c
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x980]
mov edx, dword [eax + 0x978]
mov dword [eax + 0x978], 0
sub edx, ecx
shr edx, 2
mov dword [esp + 0x24], edx
movzx ecx, byte [0xe9927a]
test cl, cl
jne 0x42e18d
xor ecx, ecx
xor ebx, ebx
jmp 0x42e1c9
xor ecx, ecx
jmp 0x42e1b3
mov dword [esp + 0x28], ecx
mov edx, dword [eax + ecx*4 + 0x980]
mov dword [esp], edx
call fcn.0041c9f0
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x42e191
add eax, 0x978
mov dword [esp], eax
call fcn.0042e030
add esp, 0x2c
ret
inc ecx
cmp ecx, edx
jge 0x42e33a
mov ebp, dword [eax + ecx*4 + 0x980]
cmp ebp, 0x1000
jb 0x42e1c8
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.00410b60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test ecx, ecx
jne 0x42e222
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e1c8
mov dword [esp + 0x20], ecx
mov ebx, dword [eax + 0x2c]
test byte [ebx], al
nop
mov ebp, edx
shr edx, 3
movzx esi, byte [ebx + edx]
and ebp, 7
mov ecx, ebp
mov edi, 1
shl edi, cl
add edx, ebx
xchg esi, eax
xchg edi, ebx
test bl, al
xchg edi, ebx
xchg esi, eax
je 0x42e262
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e1c8
mov dword [esp + 0x18], eax
nop
mov dword [esp], edx
xchg edi, eax
mov byte [esp + 4], al
xchg edi, eax
call fcn.004021d0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [0xe7939c]
mov ebx, ecx
shr ecx, 0x16
mov ecx, dword [edx + ecx*4]
test byte [ecx], al
test byte [edx], al
nop
nop
mov edx, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx ebp, byte [ecx + ebx + 0x21840]
lea ecx, [ecx + ebx + 0x21840]
nop
shr edx, 0xd
and edx, 7
mov ebx, ecx
mov ecx, edx
mov esi, 1
shl esi, cl
xchg ebp, eax
xchg esi, ebx
test bl, al
xchg esi, ebx
xchg ebp, eax
jne 0x42e2d5
mov dword [esp], ebx
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.004021d0
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0x3a]
test cl, 1
je 0x42e315
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x964]
mov ebp, dword [ecx + 0x968]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebp, 0
mov dword [ecx + 0x964], edx
mov dword [ecx + 0x968], ebp
mov eax, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e1c8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [edx + eax*4 + 0x980], ecx
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
jmp 0x42e1c8
lea ecx, [eax + 0x95c]
mov dword [esp], ecx
lea ecx, [eax + 0x980]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x200
call fcn.00424040
mov eax, dword [esp + 0x30]
add eax, 0x978
mov dword [esp], eax
call fcn.0042e030
add esp, 0x2c
ret
call fcn.0045c710
jmp fcn.0042e140
Function at 0x44dd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44de96
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx edx, byte [eax]
test edx, edx
jne 0x44ddae
movzx ebx, byte [esp + 0x24]
test bl, bl
jne 0x44ddae
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
add esp, 0xc
ret
test edx, 0x80
je 0x44ddc1
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x44de76
mov ecx, 1
mov ebx, edx
and edx, 1
neg edx
shr ebx, 1
xor edx, ebx
mov ebx, dword [esp + 0x20]
add dword [ebx], edx
mov edx, dword [esp + 0x18]
sub edx, ecx
mov ebx, edx
neg edx
sar edx, 0x1f
and edx, ecx
mov ebp, dword [esp + 0x14]
sub ebp, ecx
lea esi, [eax + edx]
movzx eax, byte [eax + edx]
test eax, 0x80
je 0x44de06
mov dword [esp + 8], ebp
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x44de3f
mov ecx, 1
mov edx, dword [esp + 0x1c]
add dword [edx], eax
sub ebx, ecx
mov eax, ebx
neg ebx
sar ebx, 0x1f
and ebx, ecx
lea edx, [esi + ebx]
mov dword [esp + 0x28], edx
sub ebp, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], 1
add esp, 0xc
ret
lea edx, [ecx + 7]
mov ecx, ebp
mov ebp, dword [esp + 8]
mov dword [esp + 4], ecx
movzx edi, byte [eax + esi]
xchg edi, eax
mov byte [esp + 3], al
xchg edi, eax
inc eax
and edi, 0x7f
mov ecx, edx
shl edi, cl
mov ebp, dword [esp + 4]
or ebp, edi
movzx edi, byte [esp + 3]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44de36
mov ecx, eax
mov eax, ebp
mov ebp, dword [esp + 8]
jmp 0x44de0b
lea ebx, [ecx + 7]
mov ecx, esi
movzx ebp, byte [ecx + eax]
lea esi, [ecx + 1]
mov edi, ebp
and ebp, 0x7f
mov ecx, ebx
shl ebp, cl
or edx, ebp
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44de71
mov ecx, esi
jmp 0x44ddc6
call fcn.0045dbb0
jmp fcn.0044dd60
Function at 0x451e10
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x451f10
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00452680
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x63a8a0]
mov dword [esp], ecx
call fcn.0040af90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0xe7d950]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00451720
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00450d00
add esp, 0x28
ret
call fcn.0045dbb0
jmp fcn.00451e10
Function at 0x455300
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45539f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f0b7
lea ecx, [0x4553b0]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045daa0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045dbb0
jmp fcn.00455300
Function at 0x45ee70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xe99820]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45d63b
je 0x45d68e
cmp ebx, 0x20
jbe 0x45d694
cmp ebx, 0x40
jbe 0x45d6da
jmp 0x45d77b
test ebx, ebx
je 0x45d684
add eax, 0x10
test ax, 0xff0
je 0x45d670
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6d4c80]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6d4e80]
jmp 0x45d658
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45d658
pxor xmm1, xmmword [0xe99830]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xe99830]
pxor xmm2, xmmword [0xe99840]
pxor xmm3, xmmword [0xe99850]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xe99830]
pxor xmm2, xmmword [0xe99840]
pxor xmm3, xmmword [0xe99850]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45d7da
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xe99279], 0
je 0x45ee8a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45d600
jmp fcn.004079e0
Function at 0x45ee90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402a1e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004079e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045dbb0
jmp 0x4029e0
cmp byte [0xe99279], 0
je 0x45eeab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45d600
jmp 0x4029e0
Function at 0x49dd50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49dedd
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.0045f0bb
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x49dd81
xor edx, edx
jmp 0x49ddac
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x67a161]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x49ddb7
mov edx, 1
jmp 0x49ddeb
cmp ecx, 0x23
je 0x49ddc0
xor edx, edx
jmp 0x49ddeb
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x67e918]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x49de45
lea edi, [esp + 0x3c]
call fcn.0045f0bb
mov ecx, dword [0xe6d54c]
lea edx, [0x6d3790]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.004a8ac0
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.0045f59e
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x49debc
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.0045f0bb
mov ecx, dword [0xe6d550]
mov edx, dword [0xe6d54c]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.0049def0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.0045f59e
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045f59e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045f59e
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.0045dbb0
jmp fcn.0049dd50