joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de4d0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
mov dword [edx], eax
setne al
add esp, 0xc
movzx eax, al
ret

Function at 0x4de4f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4de530
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
setne al
add esp, 0x1c
movzx eax, al
ret

Function at 0x4de5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov ebp, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea esi, cs:[esi]
mov eax, dword [ebp]
mov ebx, dword [esp + 0xc]
mov edx, dword [ebp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], eax
or ebx, edx
or ecx, eax
mov dword [esp + 4], edx
mov edi, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [ebp]
mov esi, dword [esp]
mov edi, dword [esp + 4]
xor eax, esi
xor edi, edx
or eax, edi
jne 0x4de5f0
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ebx
mov dword [eax], ecx
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4de650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [esp + 0x20]
lea esi, cs:[esi]
mov edi, dword [esi]
mov ebp, dword [esi + 4]
mov eax, edi
mov edx, ebp
mov ebx, edi
mov ecx, ebp
mov dword [esp], edi
mov dword [esp + 4], ebp
lock cmpxchg8b qword [esi]
mov dword [esp + 4], ebp
mov ebp, eax
mov eax, dword [esp + 4]
mov dword [esp], edi
xor edi, ebp
xor eax, edx
or edi, eax
jne 0x4de660
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov dword [eax + 4], ebx
mov dword [eax], ecx
add esp, 0xc
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x52c840
Capabilities:
Hash data using sha256

Disassembly:
movdqu xmm0, xmmword [0x69ea60]
push ebp
xor eax, eax
movdqu xmm3, xmmword [0x69ea70]
movdqu xmm2, xmmword [0x69ea80]
movdqu xmm1, xmmword [0x69ea90]
mov ebp, esp
push edi
mov edx, dword [ebp + 8]
push esi
push ebx
mov ebx, dword [ebp + 0xc]
lea edi, [edx + 0x44]
lea ecx, [edx + 0x40]
mov dword [edx + 0xe4], 0
and edi, 0xfffffffc
mov dword [edx + 0x40], 0
sub ecx, edi
add ecx, 0xa8
shr ecx, 2
rep stosd dword es:[edi], eax
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm3
movups xmmword [edx + 0x20], xmm2
movups xmmword [edx + 0x30], xmm1
movzx eax, byte [ebx]
mov dword [edx + 0xe4], eax
mov eax, ebx
not eax
add eax, edx
cmp eax, 0xe
jbe 0x52c8f8
movdqu xmm4, xmmword [ebx]
mov eax, 1
pxor xmm0, xmm4
movups xmmword [edx], xmm0
movdqu xmm0, xmmword [ebx + 0x10]
pxor xmm0, xmm3
movups xmmword [edx + 0x10], xmm0
movdqu xmm0, xmmword [ebx + 0x20]
pxor xmm0, xmm2
movups xmmword [edx + 0x20], xmm0
movdqu xmm0, xmmword [ebx + 0x30]
pxor xmm0, xmm1
movups xmmword [edx + 0x30], xmm0
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
mov eax, 1
xor esi, 0xf3bcc908
xor edi, 0x6a09e667
mov dword [edx], esi
mov dword [edx + 4], edi
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
xor esi, 0x84caa73b
xor edi, 0xbb67ae85
mov dword [edx + 8], esi
mov dword [edx + 0xc], edi
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
xor esi, 0xfe94f82b
xor edi, 0x3c6ef372
mov dword [edx + 0x10], esi
mov dword [edx + 0x14], edi
mov esi, dword [ebx + 0x18]
mov edi, dword [ebx + 0x1c]
xor esi, 0x5f1d36f1
xor edi, 0xa54ff53a
mov dword [edx + 0x18], esi
mov dword [edx + 0x1c], edi
mov esi, dword [ebx + 0x20]
mov edi, dword [ebx + 0x24]
xor esi, 0xade682d1
xor edi, 0x510e527f
mov dword [edx + 0x20], esi
mov dword [edx + 0x24], edi
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x2c]
xor esi, 0x2b3e6c1f
xor edi, 0x9b05688c
mov dword [edx + 0x28], esi
mov dword [edx + 0x2c], edi
mov esi, dword [ebx + 0x30]
mov edi, dword [ebx + 0x34]
xor esi, 0xfb41bd6b
xor edi, 0x1f83d9ab
mov dword [edx + 0x30], esi
mov dword [edx + 0x34], edi
mov ecx, dword [ebx + 0x38]
mov ebx, dword [ebx + 0x3c]
xor ecx, 0x137e2179
xor ebx, 0x5be0cd19
mov dword [edx + 0x38], ecx
mov dword [edx + 0x3c], ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x52ebc0
Capabilities:
Hash data using sha256

Disassembly:
movdqu xmm0, xmmword [0x69eaa0]
push ebp
xor eax, eax
movdqu xmm1, xmmword [0x69eab0]
mov ebp, esp
push edi
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
lea edi, [edx + 0x24]
lea ecx, [edx + 0x20]
mov dword [edx + 0x74], 0
and edi, 0xfffffffc
mov dword [edx + 0x20], 0
sub ecx, edi
add ecx, 0x58
shr ecx, 2
rep stosd dword es:[edi], eax
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm1
movzx eax, byte [ebx]
mov dword [edx + 0x74], eax
mov eax, ebx
not eax
add eax, edx
cmp eax, 0xe
jbe 0x52ec40
movdqu xmm2, xmmword [ebx]
mov eax, 1
pxor xmm0, xmm2
movups xmmword [edx], xmm0
movdqu xmm0, xmmword [ebx + 0x10]
pxor xmm0, xmm1
movups xmmword [edx + 0x10], xmm0
pop ebx
pop edi
pop ebp
ret
mov eax, dword [ebx]
xor eax, 0x6a09e667
mov dword [edx], eax
mov eax, dword [ebx + 4]
xor eax, 0xbb67ae85
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
xor eax, 0x3c6ef372
mov dword [edx + 8], eax
mov eax, dword [ebx + 0xc]
xor eax, 0xa54ff53a
mov dword [edx + 0xc], eax
mov eax, dword [ebx + 0x10]
xor eax, 0x510e527f
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0x14]
xor eax, 0x9b05688c
mov dword [edx + 0x14], eax
mov eax, dword [ebx + 0x18]
xor eax, 0x1f83d9ab
mov dword [edx + 0x18], eax
mov eax, dword [ebx + 0x1c]
xor eax, 0x5be0cd19
mov dword [edx + 0x1c], eax
mov eax, 1
pop ebx
pop edi
pop ebp
ret
Function at 0x574ff0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x575010
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x5781e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5781fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x578240
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x57825e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x5782a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5782c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x578310
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x578332
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x578380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5783aa
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x578410
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x57843a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x5784a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x5784ef

Function at 0x5784fe
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5784e0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x578570
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x5785bf

Function at 0x5785ce
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5785b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x57b0a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0057ab50
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x57b109
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x57b0d2
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x5908a0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
test ebx, ebx
je 0x59092b
test esi, esi
je 0x590950
mov eax, dword [esi + 8]
test eax, eax
je 0x59092b
lea ebp, [esp + 0x14]
test edi, edi
je 0x59090f
lea ebp, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
call fcn.004c81e0
test eax, eax
je 0x5908f8
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x6b5422
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x590938
mov eax, dword [esi + 8]
mov dword [esp + 4], ebp
mov dword [esp], eax
mov dword [esp + 0x14], 0x6b5426
mov dword [esp + 0x18], ebx
call fcn.004c81e0
test eax, eax
jne 0x5908ea
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.004ccd10
test eax, eax
jne 0x5908ed
jmp 0x59090c
mov dword [esp + 0x40], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004ccd10
Function at 0x595be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x595cb0
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x595c4e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00595840
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x595c20
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x595d57
call fcn.00595c60
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x595d00
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00595840
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x595cbd
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x595d57
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00595840
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x595d55
jmp 0x595d57
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x595dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x595e99
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x595e37
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00595980
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x595e09
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x595f40
call 0x595e49
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x595ee9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00595ab0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x595ea6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x595f40
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00595ab0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x595f3e
jmp 0x595f40
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x596820
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x7c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, eax
mov edi, eax
mov dword [esp + 0x2c], edx
mov ebp, dword [esp + 0x2c]
shr edi, 0x10
mov dword [esp + 0x24], edx
mov dword [esp + 0x3c], edx
mov edx, ecx
mov ebx, edi
shr edx, 0x18
movzx edi, bl
mov dword [esp + 0x28], eax
movzx ebx, cl
shl edx, 8
mov dword [esp + 0x20], eax
or edx, edi
movzx edi, ch
mov dword [esp + 0x38], eax
mov eax, ebp
shl edx, 8
shr eax, 0x10
mov dword [esp + 0x1c], ebp
or edx, edi
mov edi, ebp
movzx eax, al
shr edi, 0x18
shl edx, 8
shl edi, 8
mov esi, edx
mov edx, ebp
movzx ebp, byte [esp + 0x1c]
or edi, eax
movzx eax, dh
or ebx, esi
shl edi, 8
mov dword [esp + 0x30], ebx
or edi, eax
mov eax, dword [esp + 0x68]
shl edi, 8
or edi, ebp
mov dword [esp + 0x34], edi
test eax, eax
je 0x596993
mov edi, dword [esp + 0x60]
mov edx, dword [esp + 0x1c]
xor ebp, ebp
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x64]
jmp 0x5968f2
add esi, 1
movzx eax, byte [edi]
xor al, byte [esp + ebx + 0x30]
add edi, 1
mov byte [esi - 1], al
mov eax, dword [esp + 0x60]
add ebx, 1
and ebx, 7
sub eax, edi
add eax, dword [esp + 0x68]
je 0x596938
test ebx, ebx
jne 0x5968d0
mov eax, dword [esp + 0x74]
add ebp, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.00595980
movq xmm0, qword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
movq qword [esp + 0x30], xmm0
jmp 0x5968d0
mov dword [esp + 0x18], ebx
mov edi, edx
test ebp, ebp
je 0x596993
mov esi, ecx
mov eax, edx
mov ebp, edi
mov edx, ecx
shr esi, 0x10
shr eax, 0x10
shr ebp, 0x18
mov ebx, esi
movzx eax, al
shr edx, 0x18
shl ebp, 8
movzx esi, bl
shl edx, 8
mov ebx, edi
or ebp, eax
or edx, esi
movzx eax, bh
movzx esi, ch
shl ebp, 8
shl edx, 8
movzx ecx, cl
or ebp, eax
or edx, esi
movzx eax, bl
shl ebp, 8
shl edx, 8
or ebp, eax
mov eax, dword [esp + 0x78]
or edx, ecx
mov dword [eax], edx
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret