joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4258c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4259d0
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x42594b
cmp cl, 2
jne 0x4259b9
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042a6d0
nop
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a670
nop
mov eax, dword [0x7db0d4]
sub eax, dword [0x7db0bc]
mov dword [0x7db0d4], eax
mov eax, dword [0x7db0c8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7db0c8], ecx
nop
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a880
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415900
nop
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a670
nop
mov eax, dword [0x7db0b0]
sub eax, dword [0x7db098]
mov dword [0x7db0b0], eax
mov eax, dword [0x7db0a4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7db0a4], ecx
nop
lea eax, [0x7db0e0]
mov dword [esp], eax
call fcn.0040a880
jmp 0x425947
lea eax, [0x67d46b]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00432350
nop
call fcn.0045b380
jmp fcn.004258c0
Function at 0x4312b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x4313f2
lea ebx, [esp + 0x24]
cmp dword [edx + 8], ebx
jne 0x4313ee
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], edx
lea edi, [ecx + 0x14]
mov dword [esp + 0x14], edi
movzx ebx, byte [edx + 6]
test bl, bl
jne 0x4313a8
mov ebx, dword [edx]
test ebx, ebx
jne 0x431368
mov ebx, dword [edx + 0x10]
mov ebp, dword [0x7e34e0]
test ebp, ebp
jne 0x431354
mov dword [edx + 0x10], 0
mov dword [esp + 0x10], ebx
test byte [ecx], al
mov ebp, dword [0x7e34e0]
mov eax, dword [edx + 0x18]
test ebp, ebp
jne 0x43134d
mov dword [ecx + 0x14], eax
mov dword [esp], edx
call fcn.00431040
mov eax, dword [esp + 0x10]
test byte [eax], al
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.0045c530
add esp, 0x20
ret
call fcn.0045c920
jmp 0x431323
lea ebp, [edx + 0x10]
mov eax, edi
mov edi, ebp
mov esi, eax
xor eax, eax
call fcn.0045c920
mov edi, esi
jmp 0x43130d
cmp ebx, 4
jne 0x43137f
lea ebx, [edx + 0x28]
test byte [ebx], al
mov ebx, dword [edx + 0x28]
nop
mov dword [esp + 0x24], ebx
jmp 0x4312f9
nop
lea eax, [esp + 0x24]
mov dword [esp], eax
lea ecx, [edx + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.0045d2c0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
jmp 0x4312f9
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.004317c0
movzx eax, byte [esp + 8]
test al, al
je 0x4313f6
mov ecx, dword [esp + 0xc]
test byte [ecx], al
mov edx, dword [0x7e34e0]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
test edx, edx
jne 0x4313e3
mov dword [ecx + 0x14], eax
mov dword [esp], ebx
call fcn.00431040
add esp, 0x20
ret
mov edi, dword [esp + 0x14]
call fcn.0045c920
jmp 0x4313d7
add esp, 0x20
ret
add esp, 0x20
ret
lea eax, [0x688104]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00432350
nop
int3
Function at 0x43b160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.0043b120
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.00436470
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
jbe 0x43b339
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x456e20]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.0045b260
movzx eax, byte [0x7db128]
test al, al
jne 0x43b312
lea eax, [0x7cd9ac]
mov dword [esp], eax
call fcn.00402770
mov eax, dword [esp + 4]
test eax, eax
jne 0x43b2eb
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x13f0]
test ecx, ecx
jne 0x43b2c0
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x160], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.00402940
mov eax, dword [0x7cd9a0]
test eax, eax
jne 0x43b29c
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
lea eax, [0x6928ec]
mov dword [esp], eax
call fcn.0045b260
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0043b120
jmp 0x43b28e
lea eax, [0x6929f0]
mov dword [esp], eax
call fcn.0045b260
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043b120
mov eax, dword [esp + 0xc]
jmp 0x43b23f
lea eax, [0x6928f0]
mov dword [esp], eax
call fcn.0045b260
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043b120
jmp 0x43b225
lea eax, [0x692a40]
mov dword [esp], eax
call fcn.0045b260
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0043b120
jmp 0x43b20b
cmp dword [eax + 4], ecx
jb 0x43b1d2
jmp 0x43b1fc
Function at 0x442660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44286e
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00402880
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x7d0980]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00402770
mov eax, dword [esp + 4]
test eax, eax
je 0x442853
mov eax, dword [esp + 0x1c]
lea ecx, [0x7d0980]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.0040a670
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00402770
mov eax, dword [esp + 4]
test eax, eax
je 0x442841
mov eax, dword [esp + 0x1c]
lea ecx, [0x7d0980]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.00442cc0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
jne 0x442828
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0040a880
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4427c0
mov ecx, dword [eax + 0x14]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x10]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
jne 0x4427fc
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x442857
movzx ecx, byte [esp + 0x38]
test cl, cl
jne 0x4427d4
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.004422e0
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x4427c0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
je 0x4427c4
add esp, 0x30
ret
lea eax, [0x692954]
mov dword [esp], eax
call fcn.0045b200
jmp 0x4427c0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00442880
movzx eax, byte [esp + 4]
test al, al
je 0x4427f6
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x44278c
mov eax, dword [esp + 0x24]
jmp 0x44278c
mov eax, dword [esp + 0x14]
sub eax, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x18]
sbb eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.00457fa0
mov eax, dword [esp + 0x24]
jmp 0x442778
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00402880
jmp 0x442744
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0040a880
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x681c45]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00432350
nop
call fcn.0045b380
jmp fcn.00442660
Function at 0x44df60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e101
sub esp, 0x48
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x78]
add ebx, 1
mov edx, dword [edx + 0x54]
mov ebp, dword [ecx + 0x7c]
mov dword [ecx + 0x78], ebx
adc ebp, 0
mov dword [ecx + 0x7c], ebp
mov ebx, edx
mov ebp, dword [edx + 0xb70]
cmp ecx, ebp
jne 0x44e035
mov dword [esp + 0x44], ecx
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0045cbba
mov ecx, dword [esp + 0x44]
mov ebx, dword [ecx + 0x50]
mov ebp, dword [ecx + 0x54]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov ebx, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
mov eax, dword [edx + 0xb74]
cmp eax, 3
jae 0x44e0f6
lea ecx, [0x7e3194]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
mov byte [esp], 0x29
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0044cfd0
add esp, 0x48
ret
cmp dword [ecx + 0x80], ebx
jne 0x44e086
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp], 0x26
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.0044cfd0
jmp 0x44e031
mov dword [ecx + 0x80], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x54]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov byte [esp], 0xe
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0044cfd0
jmp 0x44e031
mov ecx, 3
call fcn.0045c9a0
nop
call fcn.0045b380
jmp fcn.0044df60
Function at 0x44e300
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e415
sub esp, 0x2c
mov ecx, dword [esp + 0x30]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x34]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x44e40e
mov edx, dword [0x7db13c]
cmp ebx, edx
setl dl
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp dword [0x7db138], ecx
xchg esi, ebx
seta bl
xchg esi, ebx
and ebp, esi
or edx, ebp
test dl, dl
je 0x44e40e
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 0x4c]
mov ebx, dword [edx + 0x78]
add ebx, 1
mov ebp, dword [edx + 0x7c]
mov dword [edx + 0x78], ebx
adc ebp, 0
mov dword [edx + 0x7c], ebp
mov ebx, dword [edx + 0x18]
mov ebx, dword [ebx + 0x54]
mov dword [edx + 0x80], ebx
lea edi, [esp + 0x14]
mov ebx, eax
xor eax, eax
call fcn.0045cbba
mov ecx, dword [edx + 0x50]
mov ebp, dword [edx + 0x54]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
mov ecx, dword [edx + 0x78]
mov edx, dword [edx + 0x7c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x30]
shr ecx, 6
mov edx, ebx
shl ebx, 0x1a
or ecx, ebx
mov dword [esp + 0x24], ecx
shr edx, 6
mov dword [esp + 0x28], edx
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0044cfd0
add esp, 0x2c
ret
mov eax, ebx
jmp 0x44e36a
call fcn.0045b380
jmp fcn.0044e300
Function at 0x450be0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x450c7f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045cbb7
lea ecx, [0x457570]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045b260
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045b380
jmp fcn.00450be0
Function at 0x45c7b0
Capabilities:
Encrypt data using aes via x86 extensions
Hash data using murmur3

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x7e35c0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45ae2b
je 0x45ae7a
cmp ebx, 0x20
jbe 0x45ae80
cmp ebx, 0x40
jbe 0x45aebe
jmp 0x45af4f
test ebx, ebx
je 0x45ae70
add eax, 0x10
test ax, 0xff0
je 0x45ae5c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6ced60]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6cee60]
jmp 0x45ae48
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45ae48
pxor xmm1, xmmword [0x7e35d0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e35d0]
pxor xmm2, xmmword [0x7e35e0]
pxor xmm3, xmmword [0x7e35f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e35d0]
pxor xmm2, xmmword [0x7e35e0]
pxor xmm3, xmmword [0x7e35f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45afae
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7e31d9], 0
je 0x45c7ca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45adf0
jmp fcn.00408f90
Function at 0x45c7d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40332e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408f90
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045b380
jmp 0x4032f0
cmp byte [0x7e31d9], 0
je 0x45c7eb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45adf0
jmp 0x4032f0

Function at 0x45c7f0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4091cc
mov eax, dword [0x7e34d0]
mov ecx, dword [esp + 4]
mov ecx, dword [ecx]
mov edx, dword [esp + 8]
lea eax, [edx + eax*4]
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.0045b380
jmp 0x409170
cmp byte [0x7e31d9], 0
je 0x45c82b
mov eax, dword [esp + 4]
movd xmm0, dword [esp + 8]
pinsrd xmm0, dword [eax], 1
aesenc xmm0, xmmword [0x7e35c0]
aesenc xmm0, xmmword [0x7e35d0]
aesenc xmm0, xmmword [0x7e35e0]
movd dword [esp + 0xc], xmm0
ret
jmp 0x409170

Function at 0x45c830
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409250
mov eax, dword [0x7e34d0]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 8]
lea eax, [ebx + eax*8]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.0045b380
jmp 0x4091e0
cmp byte [0x7e31d9], 0
je 0x45c86b
mov eax, dword [esp + 4]
movq xmm0, qword [eax]
pinsrd xmm0, dword [esp + 8], 2
aesenc xmm0, xmmword [0x7e35c0]
aesenc xmm0, xmmword [0x7e35d0]
aesenc xmm0, xmmword [0x7e35e0]
movd dword [esp + 0xc], xmm0
ret
jmp 0x4091e0

Function at 0x45d610
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0045c730
call fcn.00436db0
ret
Function at 0x45d730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x21c
mov dword [esp], esp
mov dword [esp + 4], 0x21c
call fcn.0045d0e0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0045d0e0
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x484740
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x484778
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x48476f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ebx, ecx
jl 0x484762
mov dword [esp + 0x14], edx
ret
call fcn.0045b380
jmp fcn.00484740
Function at 0x4a3a40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a3c59
sub esp, 0x48
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 2]
movzx edx, word [eax + 8]
movzx ebx, word [eax + 0xa]
movzx ebp, word [eax + 0xc]
mov esi, dword [esp + 0x4c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
mov ecx, dword [0x61bf60]
mov dword [esp + 0x1c], ecx
call fcn.004a02b0
lea esi, [esp + 0x20]
lea edi, [esp + 0x34]
call fcn.0045d09e
mov edi, esp
lea esi, [esp + 0x34]
call fcn.0045d09e
call fcn.0049e160
mov eax, dword [esp + 0x14]
add eax, 0x15180
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.004541e0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x4a3c3b
lea edx, [ecx + 7]
movzx ebp, word [ebx + 6]
lea esi, [ebp - 1]
cmp esi, 4
jge 0x4a3bb7
lea ecx, [ebp + ebp*2]
lea ecx, [ebp + ecx*2]
lea ecx, [edx + ecx - 6]
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
test ebx, 0x80000000
je 0x4a3bad
shl ebx, 1
mov ebp, edx
shr edx, 0x1f
or edx, ebx
shl ebp, 1
mov ebx, edx
shl edx, 1
shr ebp, 0x1f
or edx, ebp
mov ebp, edx
add edx, 0xd7b17f80
shr ebx, 0x1f
add ebp, 0xd7b17f80
adc ebx, 0xd
lea eax, [ecx - 1]
mov ecx, 0x15180
mov ebp, edx
mov esi, eax
mul ecx
mov ecx, eax
add eax, ebp
mov edi, eax
add eax, 0x886e0900
mov dword [esp + 0x54], eax
sar esi, 0x1f
imul esi, esi, 0x15180
add edx, esi
add ecx, ebp
adc edx, ebx
add edi, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
jmp 0x4a3b70
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4a3c35
mov ebx, dword [esp + 0x4c]
test ebx, 3
jne 0x4a3c2f
mov ecx, eax
mov eax, 0x51eb851f
mov ebp, edx
imul ebx
mov esi, ebx
sar ebx, 0x1f
mov edi, edx
sar edx, 5
sub edx, ebx
imul edx, edx, 0x64
cmp esi, edx
je 0x4a3c02
mov eax, 0x1d
lea ecx, [ebp + 0x1d]
cmp ecx, eax
jle 0x4a3b38
lea ecx, [ebp + 0x16]
jmp 0x4a3b38
sar edi, 7
sub edi, ebx
imul edx, edi, 0x190
cmp esi, edx
je 0x4a3bea
cmp ecx, 0xd
jae 0x4a3c4c
lea edx, [0x5ea180]
mov ebx, dword [edx + ecx*4]
lea eax, [ecx - 1]
cmp eax, 0xd
jae 0x4a3c42
sub ebx, dword [edx + ecx*4 - 4]
mov eax, ebx
jmp 0x4a3bef
mov ecx, eax
mov ebp, edx
jmp 0x4a3c11
mov ecx, eax
mov ebp, edx
jmp 0x4a3c11
mov edx, ecx
jmp 0x4a3b1c
mov ecx, 0xd
call fcn.0045c9a0
mov eax, ecx
mov ecx, 0xd
call fcn.0045c9a0
nop
call fcn.0045b380
jmp fcn.004a3a40