joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ef140
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax]
test esi, esi
js 0x5ef18d
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
sete cl
test eax, eax
sete dl
or dl, cl
jne 0x5ef197
nop dword [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp]
inc ebp
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
inc esi
and esi, 0xf
je 0x5ef199
cmp eax, 1
mov eax, ecx
jne 0x5ef170
jmp 0x5ef199
mov ecx, 0xffffffff
jmp 0x5ef2d2
mov ecx, eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x5ef26a
mov dword [esp], ecx
push edx
push edi
push edi
call eax
add esp, 0xc
cmp esi, 0xf
ja 0x5ef1f7
mov eax, dword [edi + esi]
xor eax, dword [ebp + esi]
mov dword [ebx + esi], eax
cmp esi, 0xb
ja 0x5ef1f7
mov eax, dword [edi + esi + 4]
xor eax, dword [ebp + esi + 4]
mov dword [ebx + esi + 4], eax
cmp esi, 7
ja 0x5ef1f7
mov eax, dword [edi + esi + 8]
xor eax, dword [ebp + esi + 8]
mov dword [ebx + esi + 8], eax
cmp esi, 3
ja 0x5ef1f7
mov eax, dword [edi + esi + 0xc]
xor eax, dword [ebp + esi + 0xc]
mov dword [ebx + esi + 0xc], eax
mov ecx, dword [esp]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
xor esi, esi
cmp ecx, 0x10
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
jb 0x5ef26a
nop word cs:[eax + eax]
push edx
push edi
push edi
mov edi, ecx
call dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov ecx, edi
mov edi, dword [esp + 0x34]
add esp, 0xc
mov eax, dword [edi]
xor eax, dword [ebp]
mov dword [ebx], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
xor eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
xor eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x30]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
cmp ecx, 0xf
ja 0x5ef220
test ecx, ecx
je 0x5ef28c
push edx
push edi
push edi
mov edi, ecx
call eax
mov edx, edi
add esp, 0xc
test dl, 1
jne 0x5ef290
mov eax, edx
mov edi, dword [esp + 0x28]
cmp edx, 1
jne 0x5ef2b0
jmp 0x5ef2d2
mov ecx, esi
jmp 0x5ef2d2
mov edi, dword [esp + 0x28]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
lea eax, [edx - 1]
mov byte [ebx + esi], cl
inc esi
mov ecx, esi
cmp edx, 1
je 0x5ef2d2
nop word [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
mov byte [ebx + esi], cl
movzx edx, byte [edi + esi + 1]
xor dl, byte [ebp + esi + 1]
lea ecx, [esi + 2]
mov byte [ebx + esi + 1], dl
mov esi, ecx
add eax, 0xfffffffe
jne 0x5ef2b0
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x613bb0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x18]
jne 0x613c30
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx]
mov dh, dl
and dh, 0xfe
cmp dh, 0x6a
jne 0x613c30
cmp dl, 0x6b
jne 0x613c62
cmp eax, 4
jl 0x613c9f
lea edx, [ecx + eax]
add edx, 0xfffffffe
add eax, 0xfffffffd
add ecx, 2
xor esi, esi
nop dword [eax]
movzx edi, byte [ecx - 1]
cmp edi, 0xbb
jne 0x613c83
inc esi
inc ecx
cmp eax, esi
jne 0x613bf0
xor eax, eax
cmp byte [edx + eax], 0xcc
je 0x613c6e
call fcn.005b5b10
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x8b
jmp 0x613c50
call fcn.005b5b10
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x89
push 4
call fcn.005b5d00
add esp, 0xc
mov eax, 0xffffffff
pop esi
pop edi
ret
inc ecx
add eax, 0xfffffffe
mov edx, ecx
cmp byte [edx + eax], 0xcc
jne 0x613c0e
push eax
push edx
push dword [esp + 0x14]
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, esi
add esp, 0xc
pop esi
pop edi
ret
cmp edi, 0xba
jne 0x613cad
test esi, esi
je 0x613c9f
sub eax, esi
mov edx, ecx
cmp byte [edx + eax], 0xcc
jne 0x613c0e
jmp 0x613c6e
call fcn.005b5b10
push str.RSA_padding_check_X931
push 0x56
jmp 0x613cb9
call fcn.005b5b10
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x8a
jmp 0x613c50

Function at 0x61cb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x61cb3d
mov eax, dword [eax]
test eax, eax
je 0x61cb3d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x61cb3d
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x61cbf2
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
test ebx, ebx
je 0x61cb8a
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add esi, eax
add esi, 0xb
jmp 0x61cb8d
add esi, 6
add esi, 2
push 0x166
push str.crypto_ui_ui_lib.c
push esi
call fcn.005db3a0
add esp, 0xc
test eax, eax
je 0x61cbf2
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.005dd240
add esp, 0xc
push esi
push ebp
push edi
call fcn.005dd2a0
add esp, 0xc
test ebx, ebx
je 0x61cbe1
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.005dd2a0
add esp, 0xc
push esi
push ebx
push edi
call fcn.005dd2a0
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.005dd2a0
add esp, 0xc
jmp 0x61cbf4
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x63fdb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
cmp ebx, 2
jb 0x63fe28
mov dword [esp], ecx
mov eax, ebx
shr ebx, 1
lea esi, [edx + eax]
xor edi, edi
cmp ebx, 1
je 0x63fe0b
and ebx, 0xfffffffe
mov eax, dword [esp + 0x18]
lea ebp, [eax - 1]
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [edx + edi]
mov ah, byte [edx + ebp]
mov byte [edx + edi], ah
mov byte [edx + ebp], al
movzx eax, byte [edx + edi + 1]
mov ecx, edi
xor ecx, 0xfffffffe
mov ah, byte [esi + ecx]
mov byte [edx + edi + 1], ah
mov byte [esi + ecx], al
add edi, 2
add ebp, 0xfffffffe
cmp ebx, edi
jne 0x63fde0
mov ebx, dword [esp + 0x18]
test bl, 2
mov ecx, dword [esp]
je 0x63fe28
movzx eax, byte [edx + edi]
mov ebp, edi
not ebp
mov ah, byte [esi + ebp]
mov byte [edx + edi], ah
mov byte [esi + ebp], al
push ecx
push ebx
push edx
call fcn.005887f0
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x64ee20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov edi, dword [esp + 0x60]
mov ebp, dword [esp + 0x5c]
mov esi, edi
and esi, 0xf
je 0x64ef51
lea eax, [esi + 0x10]
sub edi, eax
mov dword [esp], ecx
je 0x64ee64
mov eax, dword [ecx + 0x70]
push edi
push edx
push ebp
push ecx
mov ebx, edx
call dword [eax + 4]
add esp, 0x10
test eax, eax
je 0x64ef4d
add ebx, edi
add ebp, edi
mov ecx, dword [esp]
mov edx, ebx
mov dword [esp + 4], edx
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [esp + 0x38], xmm0
lea eax, [edx + esi]
movups xmm0, xmmword [edx + esi]
movups xmmword [esp + 0x28], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x20], xmm0
mov ebx, ecx
mov ecx, dword [ecx + 0x70]
lea edx, [esp + 0x18]
push 0x10
push eax
push edx
push ebx
call dword [ecx + 4]
add esp, 0x10
test eax, eax
mov edi, dword [esp + 0x60]
je 0x64ef4d
add ebx, 0x20
lea eax, [esp + 8]
push esi
push dword [esp + 8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea eax, [esp + esi]
add eax, 8
lea ecx, [esp + esi]
add ecx, 0x18
mov edx, 0x10
sub edx, esi
push edx
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
cmp esi, 8
jb 0x64ef10
mov ecx, edi
and ecx, 7
mov eax, esi
sub eax, ecx
xor edx, edx
nop dword [eax]
movsd xmm0, qword [esp + edx + 8]
movsd xmm1, qword [esp + edx + 0x18]
xorps xmm1, xmm0
movlps qword [ebp + edx + 0x10], xmm1
add edx, 8
cmp eax, edx
jne 0x64eef0
test ecx, ecx
je 0x64ef22
nop
movzx ecx, byte [esp + eax + 0x18]
xor cl, byte [esp + eax + 8]
mov byte [ebp + eax + 0x10], cl
inc eax
cmp esi, eax
jne 0x64ef10
movups xmm0, xmmword [esp + 0x38]
movups xmmword [ebx], xmm0
mov ecx, dword [esp]
mov eax, dword [ecx + 0x70]
push 0x10
lea edx, [esp + 0xc]
push edx
push ebp
push ecx
call dword [eax + 4]
add esp, 0x10
test eax, eax
je 0x64ef4d
movups xmm0, xmmword [esp + 0x28]
movups xmmword [ebx], xmm0
jmp 0x64ef63
xor edi, edi
jmp 0x64ef63
mov eax, dword [ecx + 0x70]
push edi
push edx
push ebp
push ecx
call dword [eax + 4]
add esp, 0x10
test eax, eax
cmove edi, eax
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x651a30
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
xorps xmm0, xmm0
movsd qword [eax + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0xd0], xmm0
movups xmmword [eax + 0xc0], xmm0
movups xmmword [eax + 0xb0], xmm0
movups xmmword [eax + 0xa0], xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x70], xmm0
movups xmmword [eax + 0x60], xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmm0, xmmword [0x99c220]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x99c230]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x99c240]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [0x99c250]
movups xmmword [eax + 0x30], xmm0
movzx edx, byte [ecx]
mov dword [eax + 0xe4], edx
mov edx, 0xf3bcc908
xor edx, dword [ecx]
mov esi, 0x6a09e667
xor esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov dword [eax], edx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov esi, 0xbb67ae85
xor esi, dword [ecx + 0xc]
mov dword [eax + 0xc], esi
mov dword [eax + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov esi, 0x3c6ef372
xor esi, dword [ecx + 0x14]
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov esi, 0xa54ff53a
xor esi, dword [ecx + 0x1c]
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov esi, 0x510e527f
xor esi, dword [ecx + 0x24]
mov dword [eax + 0x24], esi
mov dword [eax + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov esi, 0x9b05688c
xor esi, dword [ecx + 0x2c]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov esi, 0x1f83d9ab
xor esi, dword [ecx + 0x34]
mov dword [eax + 0x34], esi
mov dword [eax + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov esi, 0x5be0cd19
xor esi, dword [ecx + 0x3c]
mov dword [eax + 0x3c], esi
mov dword [eax + 0x38], edx
mov eax, 1
pop esi
ret
Function at 0x651b70
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
xorps xmm0, xmm0
movsd qword [esi + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0xd0], xmm0
movups xmmword [esi + 0xc0], xmm0
movups xmmword [esi + 0xb0], xmm0
movups xmmword [esi + 0xa0], xmm0
movups xmmword [esi + 0x90], xmm0
movups xmmword [esi + 0x80], xmm0
movups xmmword [esi + 0x70], xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmm1, xmmword [0x99c220]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0x99c230]
movups xmmword [esi + 0x10], xmm1
movups xmm1, xmmword [0x99c240]
movups xmmword [esi + 0x20], xmm1
movups xmm1, xmmword [0x99c250]
movups xmmword [esi + 0x30], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0xe4], edx
mov ebx, dword [ecx]
mov edx, 0x6a09e667
xor edx, dword [ecx + 4]
movzx edi, bh
xor ebx, 0xf3bcc908
mov dword [esi + 4], edx
mov dword [esi], ebx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov ebx, 0xbb67ae85
xor ebx, dword [ecx + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov ebx, 0x3c6ef372
xor ebx, dword [ecx + 0x14]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov ebx, 0xa54ff53a
xor ebx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov ebx, 0x510e527f
xor ebx, dword [ecx + 0x24]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov ebx, 0x9b05688c
xor ebx, dword [ecx + 0x2c]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov ebx, 0x1f83d9ab
xor ebx, dword [ecx + 0x34]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov ebx, 0x5be0cd19
xor ebx, dword [ecx + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], edx
movups xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x70], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x80], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x90], xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esi + 0xa0], xmm0
movups xmm0, xmmword [esp + 0x50]
movups xmmword [esi + 0xb0], xmm0
movups xmm0, xmmword [esp + 0x60]
movups xmmword [esi + 0xc0], xmm0
movups xmm0, xmmword [esp + 0x70]
movups xmmword [esi + 0xd0], xmm0
mov dword [esi + 0xe0], pe_nt_image_headers32
push pe_nt_image_headers32
push ebx
call fcn.005e8480
add esp, 8
mov eax, 1
add esp, 0x80
pop esi
pop edi
pop ebx
ret
Function at 0x656790
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
xorps xmm0, xmm0
movsd qword [ecx + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x60], xmm0
movups xmmword [ecx + 0x50], xmm0
movups xmmword [ecx + 0x40], xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [0x99c260]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x99c270]
movups xmmword [ecx + 0x10], xmm0
movzx edx, byte [eax]
mov dword [ecx + 0x74], edx
mov edx, 0x6a09e667
xor edx, dword [eax]
mov dword [ecx], edx
mov edx, 0xbb67ae85
xor edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [eax + 0x14]
mov dword [ecx + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [eax + 0x18]
mov dword [ecx + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [eax + 0x1c]
mov dword [ecx + 0x1c], edx
mov eax, 1
ret

Function at 0x656830
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
xorps xmm0, xmm0
movsd qword [esi + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmm1, xmmword [0x99c260]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0x99c270]
movups xmmword [esi + 0x10], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0x74], edx
mov edx, dword [ecx]
movzx edi, dh
xor edx, 0x6a09e667
mov dword [esi], edx
mov edx, 0xbb67ae85
xor edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [ecx + 8]
mov dword [esi + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [ecx + 0xc]
mov dword [esi + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [ecx + 0x10]
mov dword [esi + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [ecx + 0x14]
mov dword [esi + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [ecx + 0x18]
mov dword [esi + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], edx
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x40], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x50], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0x40
push 0x40
push ebx
call fcn.005e8480
add esp, 8
mov eax, 1
add esp, 0x40
pop esi
pop edi
pop ebx
ret
Function at 0x66cb30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x66cd3e
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x820
mov dword [esp + 8], edx
mov edi, dword [ecx + 0x44]
mov eax, dword [ecx + 0x54]
mov ebx, eax
shl eax, 0xa
mov dword [esp + 0x14], eax
add eax, edi
add eax, 0xfffffc00
lea edx, [esp + 0x18]
push 0x400
push eax
push edx
mov esi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 4], eax
cmp eax, 2
jb 0x66cc97
mov edx, ebx
shl edx, 0xb
mov esi, dword [esp + 4]
imul esi, ebx
shl esi, 0xa
add esi, edi
lea eax, [esp + 0x18]
cmp eax, esi
lea esi, [edi + edx - 0x400]
setb cl
lea eax, [esp + 0x418]
cmp esi, eax
setb ch
and ch, cl
shr ebx, 0x15
and ebx, 1
or bl, ch
mov dword [esp + 0x10], ebx
lea ecx, [edi + edx]
add ecx, 0xfffffc30
add edx, edi
add edx, 0xfffffc08
mov edi, 1
jmp 0x66cbf3
inc edi
mov eax, dword [esp + 0x14]
add ecx, eax
add edx, eax
cmp edi, dword [esp + 4]
je 0x66cc97
cmp byte [esp + 0x10], 0
je 0x66cc30
xor esi, esi
nop dword [eax]
mov eax, dword [edx + esi*8 - 8]
mov ebx, dword [edx + esi*8 - 4]
xor dword [esp + esi*8 + 0x18], eax
xor dword [esp + esi*8 + 0x1c], ebx
mov eax, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [esp + esi*8 + 0x24], ebx
xor dword [esp + esi*8 + 0x20], eax
add esi, 2
cmp esi, 0x80
jne 0x66cc00
jmp 0x66cbe0
xor esi, esi
nop word cs:[eax + eax]
movups xmm0, xmmword [ecx + esi*8 - 0x30]
movups xmm1, xmmword [ecx + esi*8 - 0x20]
movups xmm2, xmmword [esp + esi*8 + 0x18]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x28]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x18], xmm2
movups xmmword [esp + esi*8 + 0x28], xmm0
movups xmm0, xmmword [ecx + esi*8 - 0x10]
movups xmm1, xmmword [ecx + esi*8]
movups xmm2, xmmword [esp + esi*8 + 0x38]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x48]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x38], xmm2
movups xmmword [esp + esi*8 + 0x48], xmm0
add esi, 8
cmp esi, 0x80
jne 0x66cc40
jmp 0x66cbe0
xor eax, eax
nop dword [eax]
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x420], edx
mov dword [esp + eax*8 + 0x41c], ecx
inc eax
cmp eax, 0x80
jne 0x66cca0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 0x5c]
lea esi, [esp + 0x41c]
mov edx, dword [esp + 8]
push 0x400
push esi
push dword [edi + 4]
call fcn.0066cd40
add esp, 0xc
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.005e8480
add esp, 8
push 0x400
push esi
call fcn.005e8480
add esp, 8
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x4c]
shl ecx, 0xa
cmp dword [edi + 0x40], 0
je 0x66cd23
push 0x310
push str.providers_implementations_kdfs_argon2.c
push ecx
push eax
call fcn.005dc920
jmp 0x66cd34
push 0x313
push str.providers_implementations_kdfs_argon2.c
push ecx
push eax
call fcn.005db780
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x687a20
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x14]
push 1
push ebx
call fcn.006053c0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.00605690
add esp, 8
test eax, eax
je 0x687aa9
mov edi, eax
sub esp, 0x14
movaps xmm0, xmmword [0x9a8eb0]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x687a84
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x687a86
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00605720
add esp, 0xc
push ebx
call fcn.00605390
add esp, 4
test eax, eax
jne 0x687b2a
push 1
push ebx
call fcn.006053c0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.00605690
add esp, 8
test eax, eax
je 0x687b21
mov edi, eax
mov eax, esp
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x687b00
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x687b02
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00605720
add esp, 0xc
push ebx
call fcn.00605390
add esp, 4
test eax, eax
jne 0x687b2a
push ebx
call fcn.00605390
add esp, 4
add esp, 4
pop esi
pop edi
pop ebx
ret