joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fdea750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
imul eax, ebx
add esi, eax
mov ebx, eax
cmp ebx, esi
mov dword [esp], eax
mov dword [esp + 8], esi
jae 0x6fdea7e2
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov byte [esp + 7], bl
imul esi, ebx
add esi, ecx
lea esi, [esi]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6fdea7cc
mov ebx, dword [esp]
xor eax, eax
mov ecx, dword [edi]
shr ebx, 8
xor bl, byte [esp + 7]
lea esi, [esi]
lea edi, [edi]
mov dl, al
mov ebp, eax
xor dl, byte [esi + eax]
inc eax
shr ebp, 8
xor dl, bl
xor edx, ebp
movzx edx, dl
add ecx, edx
cmp eax, dword [esp + 0x2c]
mov dword [edi], ecx
jne 0x6fdea7b0
inc dword [esp]
mov edx, dword [esp + 0x30]
inc byte [esp + 7]
mov ebx, dword [esp]
add esi, edx
cmp ebx, dword [esp + 8]
jne 0x6fdea790
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6fecf9d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
ret
Function at 0x6ff1cc70
Capabilities:
Move file

Disassembly:
sub esp, 0x45c
mov eax, dword [esp + 0x460]
mov dword [esp + 0x450], ebx
mov ebx, 0x104
mov dword [esp + 0x454], esi
mov esi, 0xffffffff
mov dword [esp + 0x458], edi
lea edi, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, 8
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call esi
sub esp, 0x18
test eax, eax
je 0x6ff1cd42
mov eax, 0x104
mov edx, 0xffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x464]
lea ebx, [esp + 0x238]
mov ecx, 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0xfde9
call esi
sub esp, 0x18
test eax, eax
je 0x6ff1cd42
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__wunlink]
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wrename]
mov ebx, dword [esp + 0x450]
mov esi, dword [esp + 0x454]
mov edi, dword [esp + 0x458]
add esp, 0x45c
ret
mov eax, 0xffffffff
jmp 0x6ff1cd26
Function at 0x6fff5250
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [0x70ea49d8]
test ebx, ebx
je 0x6fff52c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x6fff52c0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6fff529d
mov eax, dword [ebx]
test eax, eax
je 0x6fff529d
mov edx, dword [ebx + 4]
mov dword [esp], edx
call eax
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [0x70ea49d8]
mov dword [esp], eax
call fcn.6fff4d10
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
xor ebx, ebx
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x6fff52d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [0x70ea49d8]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
test esi, esi
mov dword [ebx], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 4], eax
je 0x6fff5333
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [0x70ea49d8]
sub esp, 4
mov dword [ebx + 8], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6fff4d10
xor edi, edi
jmp 0x6fff531c
Function at 0x6fff5340
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [0x70ea49dc]
test ebx, ebx
je 0x6fff5390
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x6fff5390
mov ebp, dword [ebx + 0x10]
mov ebx, dword [ebx + 0xc]
mov eax, ebx
mov edx, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6ffefa90
test eax, eax
mov esi, eax
mov ebp, edx
mov ebx, eax
je 0x6fff537f
or byte [eax + 0x94], 1
mov dword [eax + 0x84], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x98], eax
call edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esp + 0x28], eax
call edi
mov ecx, eax
lea eax, [esi + 8]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
jne 0x6fff5430
mov dword [esp], esi
mov dword [esp + 4], ebp
call fcn.6ffef8d0
xor eax, eax
xor edx, edx
jmp 0x6fff5383
call edi
lea ecx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
sub esp, 0xc
test eax, eax
jne 0x6fff547a
mov eax, dword [esi + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x88], eax
mov eax, dword [0x70ea49dc]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6fff4d10
jmp 0x6fff5415
mov eax, dword [esp + 0x38]
mov edx, dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x28], edx
mov dword [esp], eax
call edx
sub esp, 8
test eax, eax
mov edi, eax
mov edx, dword [esp + 0x28]
je 0x6fff5452
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call edx
sub esp, 8
test eax, eax
je 0x6fff5452
mov eax, dword [ebx + 8]
mov dword [ebx + 0x9c], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push edx
mov dword [ebx + 0x88], eax
mov eax, dword [0x70ea49dc]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.6fff4d10
jmp 0x6fff537f
Function at 0x6fff9b90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x6fff9bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
xor ebx, ebx
jmp 0x6fff9bc1

Function at 0x6fff9be0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x70ea49dc]
mov dword [esp], eax
call fcn.6fff9b90
mov ebx, eax
mov dword [eax + 0x18], 5
mov eax, dword [esp + 0x30]
sub eax, 1
cmp eax, 1
jbe 0x6fff9c15
mov dword [esp], 1
call sub.msvcrt.dll_exit
test byte [ebx + 0x94], 1
jne 0x6fff9c93
mov esi, dword [0x70ea49d8]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x6fff9c5c
jmp 0x6fff9c80
mov eax, dword [esi]
test eax, eax
je 0x6fff9c3e
mov edx, dword [esi + 4]
mov dword [esp], edx
call eax
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [0x70ea49d8]
mov dword [esp], eax
call fcn.6fff4d10
mov esi, dword [0x70ea49d8]
test esi, esi
je 0x6fff9c80
call ebp
mov edi, eax
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test esi, esi
jne 0x6fff9c30
mov eax, dword [esp + 0x30]
add ebx, 0x38
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_longjmp
or esi, 0xffffffff
cmp dword [esp + 0x30], 2
jne 0x6fff9caf
cmp dword [0x70ea49e0], 0
jne 0x6fff9cb4
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov esi, dword [ebx + 0x28]
jmp 0x6fff9c9d
call fcn.6ffef300
jmp 0x6fff9ca6
Function at 0x700402e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor edx, edx
push edi
xor eax, eax
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
jmp 0x70040323
movsx ecx, byte [ebx + 0x70795060]
mov ebp, ecx
shl ebp, 8
mov dword [esp], ebp
mov ebp, 9
sub ebp, ecx
mov ecx, ebp
mov ebp, dword [esp]
shl ebx, cl
movzx ebx, bl
movzx ecx, byte [ebx + 0x70794f60]
add ebp, ecx
add eax, ebp
add edx, 1
cmp edx, edi
je 0x70040385
mov ebx, dword [esi + edx*4]
mov ecx, dword [esi + edx*4]
sar ebx, 0x1f
xor ecx, ebx
sub ecx, ebx
mov ebx, ecx
shr ebx, 9
add ebx, ecx
cmp ebx, 0xff
jbe 0x700402f5
cmp ebx, 0xffff
mov ecx, ebx
ja 0x70040390
shr ecx, 8
movsx ecx, byte [ecx + 0x70795060]
add ecx, 8
mov ebp, ecx
sub ecx, 9
shr ebx, cl
movzx ebx, bl
movzx ecx, byte [ebx + 0x70794f60]
shl ebp, 8
add ebp, ecx
add eax, ebp
cmp ebp, dword [esp + 0x20]
jl 0x70040320
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x70040320
mov eax, 0xffffffff
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, 0xffffff
ja 0x700403a7
shr ecx, 0x10
movsx ecx, byte [ecx + 0x70795060]
add ecx, 0x10
jmp 0x7004035a
shr ecx, 0x18
movsx ecx, byte [ecx + 0x70795060]
add ecx, 0x18
jmp 0x7004035a
Function at 0x70056500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
mov edi, eax
imul eax, ecx, 0xc8
push esi
push ebx
xor ebx, ebx
sub esp, 0x5c
lea esi, [edi + eax + 0x25ab0]
fld qword [esp + 0x70]
lea eax, [edi + ecx*4]
mov ecx, dword [eax + 0x1ce44]
fstp qword [esp + 0x38]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ecx
mov ebx, dword [edx + 0x4c]
fild qword [esp + 0x48]
fdivr qword [edi + 0x211a8]
fst qword [esp + 0x30]
fstp qword [esi]
mov eax, dword [eax + 0x1ce04]
imul ecx, eax, 0x3e8
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0x48]
mov dword [esi + 0x2c], ebx
mov ebx, dword [edx + 0x50]
mov dword [esi + 8], ecx
mov dword [esp + 0x18], eax
mov dword [esi + 0x28], eax
mov eax, dword [edx + 0x54]
mov dword [esp + 0x20], ebx
mov dword [esi + 0x30], ebx
mov ebx, dword [edx + 0x58]
mov edx, dword [edx + 0x5c]
mov dword [esp + 0x24], eax
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x38], ebx
mov dword [esp + 0x28], edx
mov dword [esi + 0x3c], edx
imul ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 8], 0x3e8
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.703e0860
mov ecx, dword [esp + 0x2c]
cdq
mov dword [esp + 0x18], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
or eax, dword [esp + 0x20]
mov dword [esp + 0x1c], edx
mov dword [esi + 0x14], edx
jne 0x700566f0
test ecx, ecx
lea eax, [ecx + 7]
cmovns eax, ecx
sar eax, 3
cdq
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], edx
or eax, ebx
jne 0x700566c2
test ecx, ecx
lea eax, [ecx + 7]
cmovs ecx, eax
sar ecx, 3
mov ebx, ecx
sar ebx, 0x1f
test ebp, ebp
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ebx
jle 0x7005664d
mov eax, dword [esp + 0x40]
xor edx, edx
sub eax, dword [edi + ebp*4 + 0x1ce00]
mov dword [esp + 0x4c], edx
fnstcw word [esp + 0x46]
imul eax, eax, 0x3e8
mov dword [esp + 0x48], eax
movzx eax, word [esp + 0x46]
fild qword [esp + 0x48]
fld qword [esp + 0x30]
fsub qword [esp + 0x38]
mov ah, 0xc
mov word [esp + 0x44], ax
fdivp st(1)
fldcw word [esp + 0x44]
fistp dword [esi + 0x40]
fldcw word [esp + 0x46]
mov eax, dword [edi + 0x1cd94]
fld1
mov edx, dword [edi + 0x1cd98]
fst qword [esi + 0x88]
mov dword [esi + 0x68], eax
mov dword [esi + 0x70], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x80], eax
mov eax, dword [esp + 0x18]
fst qword [esi + 0x90]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
fstp qword [esi + 0x98]
mov dword [esi + 0xa4], 0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ecx
imul ebx
mov dword [esp + 8], 0x3e8
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.703e0860
mov ebx, eax
mov ecx, eax
sar ebx, 0x1f
jmp 0x700565ff
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0x3e8
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], ecx
imul ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.703e0860
mov ecx, dword [esp + 0x20]
cdq
jmp 0x700565dd
Function at 0x700708b0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov dword [esi + 0x1fd0], 0x10
mov dword [esp], 0x70798d80
call sub.msvcrt.dll_getenv
test eax, eax
je 0x700708de
cmp byte [eax], 0
jne 0x700709a5
mov dword [esp], 0x70798d8e
mov ebx, 0xffffffff
call sub.msvcrt.dll_getenv
test eax, eax
je 0x700708fc
cmp byte [eax], 0
jne 0x70070986
xor eax, eax
mov edi, ebx
cpuid
xchg ebx, edi
xor edx, edx
test eax, eax
je 0x70070978
mov eax, 1
mov edi, ebx
cpuid
xchg ebx, edi
mov eax, edx
shr eax, 0x17
and eax, 1
mov ebp, eax
or ebp, 2
test edx, 0x2000000
cmovne eax, ebp
mov ebp, eax
or ebp, 4
and edx, 0x4000000
cmovne eax, ebp
mov edx, eax
or edx, 8
test cl, 1
cmovne eax, edx
mov edx, eax
or edx, 0x10
test ch, 2
cmovne eax, edx
mov edx, eax
or edx, 0x20
test ecx, 0x80000
cmovne eax, edx
mov edx, eax
or edx, 0x40
and ecx, 0x10000000
cmovne eax, edx
mov edx, eax
or dl, 0x80
and edi, 0x20
cmove edx, eax
and edx, ebx
mov dword [esi + 0x2c20], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov ebx, eax
jmp 0x700708fc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov edx, eax
mov dword [esi + 0x2c20], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x70079830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
movq mm7, qword [edx]
mov edi, esi
add edi, eax
movq mm2, qword [edi + eax*2]
movq mm1, qword [esi + eax*2]
movq mm6, mm1
psubusb mm1, mm2
psubusb mm2, mm6
por mm1, mm2
psubusb mm1, mm7
movq mm4, qword [esi + eax]
movq mm3, mm4
psubusb mm4, mm6
psubusb mm6, mm3
por mm4, mm6
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi]
movq mm0, mm4
psubusb mm4, mm3
psubusb mm3, mm0
por mm4, mm3
movq qword [esp], mm4
psubusb mm4, mm7
por mm1, mm4
neg eax
movq mm2, qword [esi + eax*4]
movq mm4, qword [edi + eax*4]
movq mm5, mm4
psubusb mm4, mm2
psubusb mm2, mm5
por mm4, mm2
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi + eax*2]
movq mm3, mm4
psubusb mm4, mm5
psubusb mm5, mm3
por mm4, mm5
psubusb mm4, mm7
por mm1, mm4
movq mm2, mm3
movq mm4, qword [esi + eax]
movq mm5, mm4
psubusb mm4, mm3
psubusb mm3, mm5
por mm4, mm3
movq qword [esp + 0x10], mm4
psubusb mm4, mm7
por mm1, mm4
movq mm3, qword [edi]
movq mm4, mm3
psubusb mm3, mm2
psubusb mm2, mm4
por mm2, mm3
pand mm2, qword [0x708e53d0]
psrlw mm2, 1
movq mm6, mm5
movq mm3, qword [esi]
psubusb mm5, mm3
psubusb mm3, mm6
por mm5, mm3
paddusb mm5, mm5
paddusb mm5, mm2
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
por mm1, mm5
pxor mm5, mm5
pcmpeqb mm1, mm5
mov edx, dword [ebp + 0x18]
movq mm7, qword [edx]
movq mm4, qword [esp]
psubusb mm4, mm7
movq mm3, qword [esp + 0x10]
psubusb mm3, mm7
paddb mm4, mm3
pcmpeqb mm4, mm5
pcmpeqb mm5, mm5
pxor mm4, mm5
movq mm2, qword [esi + eax*2]
movq mm7, qword [edi]
pxor mm2, qword [0x708e53e0]
pxor mm7, qword [0x708e53e0]
psubsb mm2, mm7
pand mm2, mm4
pxor mm6, qword [0x708e53e0]
pxor mm0, qword [0x708e53e0]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm1, mm2
movq mm2, mm1
paddsb mm1, qword [0x708e5410]
paddsb mm2, qword [0x708e5400]
pxor mm0, mm0
pxor mm5, mm5
punpcklbw mm0, mm2
punpckhbw mm5, mm2
psraw mm0, 0xb
psraw mm5, 0xb
packsswb mm0, mm5
movq mm2, mm0
pxor mm0, mm0
movq mm5, mm1
punpcklbw mm0, mm1
psraw mm0, 0xb
pxor mm1, mm1
punpckhbw mm1, mm5
psraw mm1, 0xb
movq mm5, mm0
packsswb mm0, mm1
paddsw mm5, qword [0x708e5420]
paddsw mm1, qword [0x708e5420]
psraw mm5, 1
psraw mm1, 1
packsswb mm5, mm1
pandn mm4, mm5
paddsb mm6, mm2
pxor mm6, qword [0x708e53e0]
movq qword [esi + eax], mm6
movq mm6, qword [esi + eax*2]
pxor mm6, qword [0x708e53e0]
paddsb mm6, mm4
pxor mm6, qword [0x708e53e0]
movq qword [esi + eax*2], mm6
psubsb mm3, mm0
pxor mm3, qword [0x708e53e0]
movq qword [esi], mm3
psubsb mm7, mm4
pxor mm7, qword [0x708e53e0]
movq qword [edi], mm7
add esi, 8
neg eax
dec ecx
jne 0x7007984b
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0x7007a41c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, 2
mov edx, dword [ebp + 0x10]
movq mm3, qword [edx]
mov edi, esi
add edi, eax
neg eax
movq mm1, qword [esi + eax*2]
movq mm0, qword [edi]
movq mm2, mm1
movq mm7, mm0
movq mm4, mm0
psubusb mm0, mm1
psubusb mm1, mm4
por mm1, mm0
pand mm1, qword [0x708e53d0]
psrlw mm1, 1
movq mm5, qword [esi + eax]
movq mm4, qword [esi]
movq mm0, mm4
movq mm6, mm5
psubusb mm5, mm4
psubusb mm4, mm6
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm1
psubusb mm5, mm3
pxor mm3, mm3
pcmpeqb mm5, mm3
pxor mm2, qword [0x708e53e0]
pxor mm7, qword [0x708e53e0]
psubsb mm2, mm7
pxor mm6, qword [0x708e53e0]
pxor mm0, qword [0x708e53e0]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm5, mm2
paddsb mm5, qword [0x708e5410]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm1, mm5
psraw mm1, 0xb
psllw mm1, 8
por mm0, mm1
psubsb mm3, mm0
pxor mm3, qword [0x708e53e0]
movq qword [esi], mm3
psubsb mm5, qword [0x708e53f0]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x708e53e0]
movq qword [esi + eax], mm6
add esi, 8
neg eax
dec ecx
jne 0x7007a42c
pop edi
pop esi
pop ebp
ret
Function at 0x7007a522
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [esi + eax*4 - 2]
mov ecx, 2
lea edi, [esi + eax]
movd mm0, dword [edi + eax*2]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm0
movd mm0, dword [esi + eax]
movd mm4, dword [esi]
punpcklbw mm4, mm0
movq mm5, mm4
punpcklwd mm4, mm6
punpckhwd mm5, mm6
neg eax
movd mm7, dword [esi + eax]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm7
movd mm1, dword [edi + eax*4]
movd mm0, dword [esi + eax*4]
punpcklbw mm0, mm1
movq mm2, mm0
punpcklwd mm0, mm6
punpckhwd mm2, mm6
movq mm1, mm0
punpckldq mm0, mm4
movq mm3, mm2
punpckhdq mm1, mm4
punpckldq mm2, mm5
punpckhdq mm3, mm5
movq mm6, mm0
movq mm7, mm3
psubusb mm7, mm6
psubusb mm6, mm3
por mm6, mm7
pand mm6, qword [0x708e53d0]
psrlw mm6, 1
movq mm5, mm1
movq mm4, mm2
psubusb mm5, mm2
psubusb mm4, mm1
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm6
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
pxor mm7, mm7
pcmpeqb mm5, mm7
movq qword [esp], mm0
movq qword [esp + 0x10], mm3
pxor mm0, qword [0x708e53e0]
pxor mm3, qword [0x708e53e0]
psubsb mm0, mm3
movq mm6, mm1
movq mm7, mm2
pxor mm6, qword [0x708e53e0]
pxor mm7, qword [0x708e53e0]
movq mm3, mm7
psubsb mm7, mm6
paddsb mm0, mm7
paddsb mm0, mm7
paddsb mm0, mm7
pand mm5, mm0
paddsb mm5, qword [0x708e5410]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm7, mm5
psraw mm7, 0xb
psllw mm7, 8
por mm0, mm7
psubsb mm3, mm0
pxor mm3, qword [0x708e53e0]
psubsb mm5, qword [0x708e53f0]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x708e53e0]
movq mm0, qword [esp]
movq mm4, qword [esp + 0x10]
movq mm1, mm0
punpcklbw mm0, mm6
punpckhbw mm1, mm6
movq mm2, mm3
punpcklbw mm2, mm4
movq mm5, mm1
punpckhbw mm3, mm4
movq mm6, mm0
punpcklwd mm0, mm2
punpckhwd mm6, mm2
movd dword [esi + eax*4], mm0
punpcklwd mm1, mm3
psrlq mm0, 0x20
punpckhwd mm5, mm3
movd dword [edi + eax*4], mm0
movd dword [esi + eax*2], mm6
psrlq mm6, 0x20
movd dword [esi], mm1
movd dword [esi + eax], mm6
neg eax
movd dword [esi + eax*2], mm5
psrlq mm1, 0x20
movd dword [edi], mm1
psrlq mm5, 0x20
movd dword [edi + eax*2], mm5
lea esi, [esi + eax*8]
dec ecx
jne 0x7007a543
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0x700abd30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 8]
cmp ecx, 3
mov dword [eax + 0x1a934], ecx
mov dword [eax + 0x1a938], 0
mov dword [eax + 0x1a940], 0
mov dword [eax + 0x1a944], 0
mov dword [eax + 0x1a948], 0
jg 0x700abd72
mov dl, 4
sub edx, ecx
movzx ecx, byte [eax + 0x23c9c]
mov ebx, dword [eax + 0x1a93c]
mov dword [eax + 0x1a93c], edx
mov byte [eax + 0x1387b], cl
movzx ecx, byte [eax + 0x23c9d]
cmp edx, ebx
mov byte [eax + 0x1387c], cl
movzx ecx, byte [eax + 0x23c9e]
mov byte [eax + 0x1387d], cl
movzx ecx, byte [eax + 0x23c9f]
mov byte [eax + 0x1387e], cl
je 0x700abdc0
mov dword [esp + 8], eax
pop ebx
jmp fcn.700a9f20
pop ebx
ret

Function at 0x700ad980
Capabilities:
Query environment variable

Disassembly:
mov edx, dword [0x70ea7ea4]
test edx, edx
je 0x700ad990
ret
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
lock add dword [0x70ea7ea0], 1
mov dword [esp], 0x18
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
sub esp, 4
lock cmpxchg dword [0x70ea7ea8], ebx
test eax, eax
je 0x700ad9dc
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [0x70ea7ea8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x70ea7ea4]
sub esp, 4
test eax, eax
je 0x700ada40
mov eax, dword [0x70ea7ea8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
lock sub dword [0x70ea7ea0], 1
jne 0x700ada39
mov eax, dword [0x70ea7ea8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x70ea7ea8]
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x70ea7ea8], 0
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
mov dword [esp], str.VPX_SIMD_CAPS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x700ada55
cmp byte [eax], 0
jne 0x700adab0
mov dword [esp], 0x7079a64e
call sub.msvcrt.dll_getenv
test eax, eax
je 0x700ada6a
cmp byte [eax], 0
jne 0x700ada90
xor eax, eax
mov edi, ebx
cpuid
xchg ebx, edi
test eax, eax
je 0x700ada81
mov eax, 1
mov edi, ebx
cpuid
xchg ebx, edi
mov dword [0x70ea7ea4], 1
jmp 0x700ad9f6
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
jmp 0x700ada6a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
jmp 0x700ada81

Function at 0x700ae560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
call fcn.70135f90
call fcn.700f5080
call fcn.700f6250
add esp, 0xc
jmp 0x700f8070
sub esp, 0x1c
mov dword [esp + 4], 0x707a2561
mov dword [esp], 0x70ea8340
call fcn.70194160
mov dword [esp + 4], 0x707a254d
mov dword [esp], 0x70ea82e0
call fcn.70194160
mov dword [esp + 4], 0x707a254b
mov dword [esp], 0x70ea82c0
call fcn.70194160
mov dword [esp + 4], 0x707a2545
mov dword [esp], 0x70ea82a0
call fcn.70194160
add esp, 0x1c
ret