joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10089430
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x10089634
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10089634
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.100644e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x10089609
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100895f8
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x100895c2
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100895ba
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.100644e0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.10089650
add esp, 0x18
test eax, eax
je 0x100895ba
cmp byte [ebp - 0x68], 0
je 0x1008957c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x100895ba
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x100895a9
mov al, byte [esi + ecx]
test al, al
je 0x100895a9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10089590
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x100894d0
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x10089634
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.1008a620
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.1003c985
mov esp, ebp
pop ebp
ret
Function at 0x10089770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100898ef
cmp dword [ebp + 0xc], 0x20
jb 0x100898ef
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.100644e0
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x100a8aec
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x100898ef
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10089800
sub ecx, edx
cmp ecx, 0x40
jne 0x100898ef
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x1008983c
mov al, byte [esi + ecx]
test al, al
je 0x1008983c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10089826
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x10089879
mov al, byte [esi + ecx]
test al, al
je 0x10089879
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10089860
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.100644e0
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10089900
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x100898ef
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.1008a620
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.1003c985
mov esp, ebp
pop ebp
ret
Function at 0x1008a1c0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.1003cc20
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x1008a32d
cmp dword [ebp + 0xc], 0
je 0x1008a32d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.10048720
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1008a310
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.100644e0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1008a305
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.100644e0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.1008b320
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.1008a620
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1008a31a
inc esi
cmp esi, 0x10
jl 0x1008a200
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret
Function at 0x1008a340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x1008a428
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100644e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x1008a428
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008a397
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x1008a428
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1008a3c0
mov eax, dword [0x1009d968]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1008a3d5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1008a3f0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003c985
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c985
mov esp, ebp
pop ebp
ret
Function at 0x1008a440
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x100b736c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.100644e0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.10089900
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1008a4aa
mov al, byte [edi + ecx]
test al, al
je 0x1008a4aa
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1008a491
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x1008a4cb
inc eax
sub ecx, 1
jne 0x1008a4c0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x1008a520
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x1008a515
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x1008a514
mov bl, byte [edi + ecx]
test bl, bl
je 0x1008a514
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1008a500
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.100644e0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x100a8aec
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x1008a5da
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1008a5a4
test cl, cl
je 0x1008a5a0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1008a5a4
add eax, 2
add esi, 2
test cl, cl
jne 0x1008a584
xor eax, eax
jmp 0x1008a5a9
sbb eax, eax
or eax, 1
test eax, eax
je 0x1008a5da
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008a5b6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008a5e3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x100a8aec
push str.SoftwareComMaster
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003c985
mov esp, ebp
pop ebp
ret
Function at 0x401120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9e70
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4f9590]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f9590]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
mov esi, ecx
push 0x24
xor ebx, ebx
mov ebp, 0xf
push str.AlgorithmParametersBase:_parameter__
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00404be0
push edi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x84], ebx
call fcn.00404fe0
push str.__not_used
push eax
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0x90], 1
call fcn.00404fe0
add esp, 0x18
mov edi, eax
mov ecx, esi
mov byte [esp + 0x78], 2
call fcn.00493978
mov byte [esp + 0x78], 3
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 6
push ebx
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.004053c0
mov edi, 0x10
cmp dword [esp + 0x48], edi
jb 0x401200
mov eax, dword [esp + 0x34]
push eax
call fcn.0049377b
add esp, 4
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp dword [esp + 0x64], edi
jb 0x40121f
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0049377b
add esp, 4
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
cmp dword [esp + 0x2c], edi
jb 0x40123e
mov edx, dword [esp + 0x18]
push edx
call fcn.0049377b
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004944f9
add esp, 0x68
ret 4
Function at 0x407620
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x407630
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x512ff0], edx
mov dword [esi*8 + 0x512ff4], eax
inc esi
cmp esi, 0x100
jl 0x407630
mov dword [0x5137f8], edi
mov dword [0x5137fc], edi
mov dword [0x5137f0], edi
mov dword [0x5137f4], edi
pop edi
pop esi
mov byte [0x513804], 1
pop ebx
ret

Function at 0x4076b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x4e1950]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x5127f0], edx
mov dword [eax*8 + 0x5127f4], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x4076c0
pop edi
pop esi
pop ebp
mov byte [0x513805], 1
pop ebx
add esp, 0x10
ret
Function at 0x408d50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [eax]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm1, xmmword [edi]
lea edx, [esi - 1]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x408da7
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
movdqa xmm1, xmmword [ecx]
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx + 0x10]
add ecx, 0x20
dec edx
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x408d82
movdqa xmm0, xmmword [eax]
add esi, esi
movdqa xmm1, xmmword [edi + esi*8 - 0x10]
lea ecx, [edi + esi*8]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408de0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x408e84
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
dec ebx
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x408e40
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
add ebx, ebx
movdqa xmm0, xmmword [edi + ebx*8]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409f90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ca3f0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4f9590]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4f9590]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push 1
push 0x4fb3f4
mov dword [esp + 0x28], edx
xor edx, edx
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esi + 0x80]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004944f9
mov esp, ebp
pop ebp
ret 8
Function at 0x40aba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ca0f6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4f9590]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x4f9590]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea esi, [edi + 0x10]
mov ecx, 0x100
mov dword [esp + 0x20], edi
mov dword [edi + 0xc], 0xffffffff
mov dword [edi], vtable.CryptoPP::MessageQueue.0
mov dword [edi + 4], vtable.CryptoPP::MessageQueue.1.0
call fcn.00409a10
mov dword [esp + 0x48], 2
xor ebx, ebx
lea esi, [edi + 0x38]
push 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], ebx
call fcn.00493ffa
add esp, 4
cmp eax, ebx
je 0x40ace0
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esp + 0x14]
push ecx
push esi
mov byte [esp + 0x50], 3
call fcn.0040b0d0
mov byte [esp + 0x48], 4
lea esi, [edi + 0x50]
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esi], ebx
call fcn.00493ffa
add esp, 4
cmp eax, ebx
je 0x40acb7
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x50], 5
call fcn.0040b4a0
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004944f9
add esp, 0x40
ret
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], ebx
call fcn.00493a11
push 0x4f366c
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.00493e75
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.00493a11
push 0x4f366c
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], vtable.std::bad_alloc.0
call fcn.00493e75
int3
Function at 0x40da62
Capabilities:
Get user security identifier

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp edi, ebx
je 0x40db12
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40db12
push 0xff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], bl
call fcn.00493f80
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 0x100
mov dword [ebp - 0x7c], 8
call esi
cmp dword [ebp - 0x78], ebx
je 0x40db0d
push dword [ebp - 0x78]
call fcn.00491462
pop ecx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
push edi
push ebx
mov dword [ebp - 0x74], eax
call esi
test eax, eax
jne 0x40db0d
push dword [ebp - 0x74]
call fcn.0049377b
pop ecx
mov dword [ebp - 0x74], ebx
mov eax, dword [ebp - 0x74]
jmp 0x40db14
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop esi
xor ecx, ebp
pop ebx
call fcn.004944f9
add ebp, 0x94
leave
ret

Function at 0x40dbd2
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, 0x104
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x110], ecx
test eax, eax
jne 0x40dc14
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x40dc25
push ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00494620
add esp, 0xc
mov ecx, edi
lea edi, [ebp - 0x10c]
call fcn.0040da62
mov edi, eax
test edi, edi
je 0x40dc56
push dword [esi + 0x24]
call fcn.0049377b
pop ecx
push 0
mov dword [esi + 0x24], edi
push edi
add esi, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
inc eax
jmp 0x40dc58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004944f9
leave
ret 8