joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f520
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1002edc0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f554
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1004d148]
call dword [ebp - 8]
jmp 0x1002f55a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1002f5b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1002ee00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f5e4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1004d148]
call dword [ebp - 8]
jmp 0x1002f5ee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1002f600
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1002ee20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f638
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1004d148]
call dword [ebp - 8]
jmp 0x1002f646
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002f650
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1002eea0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002f690
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1004d148]
call dword [ebp - 8]
jmp 0x1002f6ae
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1002f8a0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003c540
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.1000f760
lea ecx, [ebp - 4]
call fcn.1003c510
movzx eax, al
test eax, eax
jne 0x1003c57d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1003c450
mov eax, dword [ebp - 0x18]
jmp 0x1003c6a5
lea ecx, [ebp - 4]
call fcn.1000f830
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1003c4d0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.1000f830
push eax
push 0
push 0
call fcn.10039bd0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1003c5e3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1003c450
mov eax, dword [ebp - 0x20]
jmp 0x1003c6a5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100144f0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.10007d60
lea ecx, [ebp - 8]
call fcn.1000a0a0
movzx edx, al
test edx, edx
jne 0x1003c62c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.1000c0a0
lea ecx, [ebp - 4]
call fcn.1003c450
mov eax, dword [ebp - 0x24]
jmp 0x1003c6a5
lea ecx, [ebp - 8]
call fcn.10007dd0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.1000f830
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10039bd0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1003c687
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.1000c0a0
lea ecx, [ebp - 4]
call fcn.1003c450
mov eax, dword [ebp - 0x34]
jmp 0x1003c6a5
lea ecx, [ebp - 8]
call fcn.10011420
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.1000c0a0
lea ecx, [ebp - 4]
call fcn.1003c450
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x408ce0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x408dd3
sub esp, 0x30
movsd xmm0, qword [esp + 0x34]
movsd qword [esp], xmm0
call fcn.00408eb0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
add eax, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 8]
mov dword [esp + 0x10], esi
lea edi, [0x5a5200]
movsd xmm0, qword [edi + ebp*8]
movsd qword [esp + 0x18], xmm0
movsd xmm1, qword [edi + ecx*8]
movsd qword [esp + 0x20], xmm1
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045f1b0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x28], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
shl eax, 5
mov ecx, dword [esp + 0x10]
shr ecx, 0x1b
or ecx, eax
and ecx, 0xfffff
mov dword [esp], ecx
call fcn.0045f230
movsd xmm0, qword [esp + 0x28]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x517f14]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x3c], xmm0
add esp, 0x30
ret
call fcn.00463e70
jmp fcn.00408ce0
Function at 0x416f80
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x417169
sub esp, 0x18
mov eax, dword [0x605044]
test eax, eax
jne 0x417152
lea eax, [0x605030]
mov dword [esp], eax
call fcn.0040a780
mov eax, dword [0x605034]
test eax, eax
je 0x416fc8
cmp dword [eax + 8], 0xcc
jne 0x41703e
mov eax, dword [0x605028]
test eax, eax
jne 0x417020
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x607910]
mov dword [esp + 8], eax
call fcn.0040cd80
mov eax, dword [esp + 0xc]
mov dword [0x605028], eax
mov ecx, dword [0x604fec]
mov dword [eax], ecx
mov eax, dword [0x605028]
mov dword [0x604fec], eax
movzx eax, byte [0x605580]
test al, al
jne 0x417020
xor eax, eax
jmp 0x417146
mov eax, dword [0x605028]
mov ecx, dword [eax + 4]
mov dword [0x605028], ecx
mov ecx, dword [0x605034]
mov dword [eax + 4], ecx
mov dword [0x605034], eax
mov eax, dword [0x605034]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00402850
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x605260]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x417091
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41709e
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00465280
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x605260]
test edx, edx
jne 0x4170ca
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4170eb
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00465280
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00465280
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00465280
lea eax, [0x605030]
mov dword [esp], eax
call fcn.0040a980
lea eax, [0x60502c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402380
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
lea ecx, [0x5a125c]
movzx ebx, byte [ecx + ebx]
lea ebp, [0x605580]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jl 0x417113
jmp 0x417020
lea eax, [0x509bef]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.00416f80
Function at 0x42a820
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42a947
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00428180
mov eax, dword [esp + 4]
test eax, eax
je 0x42a930
mov dword [esp + 0xc], eax
call fcn.00449910
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
call fcn.00425ab0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00427da0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 6]
mov byte [esp + 0xb], dl
mov ebx, dword [esp + 0xc]
lea ebp, [ebx + 0x48]
mov dword [esp + 0x18], ebp
mov dword [esp], ebp
call fcn.0040a780
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x42a8b8
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42a8f9
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42a8cd
cmp byte [ebp + 6], dl
je 0x42a8d8
cmp esi, ebx
ja 0x42a8f9
jne 0x42a8b6
cmp byte [ebp + 6], dl
jbe 0x42a8b6
jmp 0x42a8f9
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a980
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00449930
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.0042a6a0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0040a980
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00449930
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x50b64a]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.0042a820

Function at 0x42ae40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42af39
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x42aec4
cmp cl, 2
je 0x42ae7d
cmp cl, 3
jne 0x42af22
mov byte [eax + 8], 1
jmp 0x42af1e
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.004303b0
lea eax, [0x5e95f8]
mov dword [esp], eax
call fcn.0040a780
lea eax, [0x5e95a8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f80
lea eax, [0x5e95f8]
mov dword [esp], eax
call fcn.0040a980
jmp 0x42af1e
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00416f80
lea eax, [0x5e95f8]
mov dword [esp], eax
call fcn.0040a780
lea eax, [0x5e9580]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f80
lea eax, [0x5e95f8]
mov dword [esp], eax
call fcn.0040a980
add esp, 0x14
ret
lea eax, [0x50694f]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00438c50
nop
call fcn.00463e70
jmp fcn.0042ae40
Function at 0x458630
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x458730
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00458f60
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4ea5a0]
mov dword [esp], ecx
call fcn.0040cb10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x5e9690]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00457b70
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00457230
add esp, 0x28
ret
call fcn.00463e70
jmp fcn.00458630
Function at 0x462fa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.004444f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x604fb1]
test cl, cl
je 0x463029
call fcn.00434db0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
jmp 0x46305f
call fcn.00434da0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
mov eax, dword [0x5debf4]
mov dword [esp], eax
lea eax, [ecx + 0x190]
mov dword [esp + 4], eax
call fcn.00404800
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x19c]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x46309b
mov eax, dword [eax + 0x1a4]
mov dword [esp + 0x30], eax
call fcn.00444580
add esp, 0x20
ret
Function at 0x465130
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x605360]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4638fb
je 0x46394e
cmp ebx, 0x20
jbe 0x463954
cmp ebx, 0x40
jbe 0x46399a
jmp 0x463a3b
test ebx, ebx
je 0x463944
add eax, 0x10
test ax, 0xff0
je 0x463930
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x518d00]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x518e00]
jmp 0x463918
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x463918
pxor xmm1, xmmword [0x605370]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x605370]
pxor xmm2, xmmword [0x605380]
pxor xmm3, xmmword [0x605390]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x605370]
pxor xmm2, xmmword [0x605380]
pxor xmm3, xmmword [0x605390]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x463a9a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x604faf], 0
je 0x46514a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4638c0
jmp fcn.00409070
Function at 0x465150
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4034ae
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409070
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00463e70
jmp 0x403470
cmp byte [0x604faf], 0
je 0x46516b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x4638c0
jmp 0x403470
Function at 0x492af0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x492b28
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x492b1f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x492b12
mov dword [esp + 0x14], edx
ret
call fcn.00463e70
jmp fcn.00492af0
Function at 0x49efb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49f152
sub esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 2
jl 0x49f087
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx]
cmp byte [ecx + 1], 0x3a
jne 0x49f00b
lea ebx, [edx - 0x30]
cmp bl, 9
jbe 0x49effb
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x49effb
lea ebx, [edx - 0x41]
cmp bl, 0x19
ja 0x49f00b
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 2
add esp, 0xc
ret
cmp eax, 5
jge 0x49f014
xor edx, edx
jmp 0x49f02b
mov byte [esp], dl
call fcn.0049ee40
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
jne 0x49f033
xor edx, edx
jmp 0x49f076
movzx eax, byte [ecx + 1]
mov byte [esp], al
call fcn.0049ee40
movzx eax, byte [esp + 4]
test al, al
jne 0x49f054
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
jmp 0x49f076
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 2]
mov byte [esp], cl
call fcn.0049ee40
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x49f09b
cmp byte [ecx + 2], 0x2e
je 0x49f09b
mov edx, 3
jmp 0x49f0be
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov ebx, dword [esp + 8]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebx, [eax - 1]
cmp edx, ebx
jge 0x49f09b
mov dword [esp + 8], edx
movzx eax, byte [ecx + edx]
mov byte [esp], al
call fcn.0049ee40
movzx eax, byte [esp + 4]
test al, al
je 0x49f0af
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
movzx edx, byte [ecx + eax + 1]
mov byte [esp], dl
call fcn.0049ee40
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
lea ebx, [edx + ecx + 1]
test al, al
jne 0x49f09b
cmp byte [ebx], 0x2e
je 0x49f09b
lea eax, [edx + 1]
jmp 0x49f11d
mov edx, dword [esp + 8]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, eax
jle 0x49f146
mov dword [esp + 8], eax
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.0049ee40
movzx eax, byte [esp + 4]
test al, al
je 0x49f112
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
call fcn.00463e70
jmp fcn.0049efb0
Function at 0x4a13d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a14ab
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4a148d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4a148d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.00480dc0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
sub ecx, dword [esp + 8]
movzx edx, byte [eax + 6]
test dl, dl
je 0x4a145f
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004a2c20
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004a11a0
jmp 0x4a1489
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004a11a0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a2c20
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a2c20
add esp, 0x10
ret
call fcn.00463e70
jmp fcn.004a13d0
Function at 0x4ad710
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ad83a
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov word [esp + 0xc], cx
call fcn.004b00f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b00f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b00f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 6]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b00f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b00f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebx, word [ebx + 0xa]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bx
call fcn.004b00f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
add esp, 0x1c
ret
call fcn.00463e70
jmp fcn.004ad710