joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577a90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0054378c
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x577af5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x577af5
lea edx, [esp]
push edx
call dword [0x5eb620]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005273c3
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.005273c3
add esp, 0x108
ret
jmp 0x577a90

Function at 0x577b10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0054378c
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x577af5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x577af5
lea edx, [esp]
push edx
call dword [0x5eb620]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005273c3
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.005273c3
add esp, 0x108
ret
jmp 0x577a90

Function at 0x57e490
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebp, dword [esi + 0x34]
mov ebx, dword [ebp]
push edi
mov edi, dword [ebx + 0x228]
test edi, edi
jne 0x57e4ae
mov edi, dword [esi + 0x30]
lea eax, [esp + 0x10]
push eax
call fcn.00558b00
lea ecx, [esi + 0x20]
mov esi, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], esi
mov esi, dword [ecx + 4]
mov dword [edx + 4], esi
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [edx + 8], esi
mov dword [edx + 0xc], ecx
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.00558b40
mov ecx, eax
mov eax, edx
mov dword [esp + 0x44], eax
mov eax, edi
cdq
add esp, 0x20
mov edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x24]
mov esi, edx
sbb esi, ecx
cmp dword [ebx + 0x218], 0
je 0x57e580
lea edx, [esp + 0x10]
push edx
call fcn.00558b00
lea ecx, [ebp + 0x188]
mov ebp, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], ebp
mov ebp, dword [ecx + 4]
mov dword [edx + 4], ebp
mov ebp, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [edx + 8], ebp
mov dword [edx + 0xc], ecx
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.00558b40
mov ecx, eax
mov eax, dword [ebx + 0x218]
mov ebp, edx
cdq
add esp, 0x20
sub eax, ecx
sbb edx, ebp
cmp esi, edx
jl 0x57e580
jg 0x57e584
cmp edi, eax
jae 0x57e584
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x57f6e0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x57f712
push 0x2e
push esi
call fcn.005284e0
add esp, 8
test eax, eax
je 0x57f710
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x57f880
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x30]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x57f92a
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
mov eax, ebp
mov byte [esp + 0x14], 8
mov byte [esp + 0x15], 2
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.0057f7f0
mov ecx, esi
push 8
push ecx
call fcn.00582840
mov ecx, dword [esp + 0x10]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x57f93c
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005273c3
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.005273c3
add esp, 0x24
ret
Function at 0x57fac0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x57fad0
sub eax, edx
mov esi, eax
je 0x57fae9
lea eax, [esi + esi]
push eax
call dword [0x5eb614]
jmp 0x57faf4
push 0x59b313
call dword [0x5eb620]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x57fb07
pop edi
pop esi
lea eax, [ebx + 0x1b]
pop ebx
add esp, 0xc
ret
mov ecx, ebx
call fcn.005815a0
push 0xf0000000
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, dword [esp + 0x24]
test eax, eax
je 0x57fb90
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x57fb83
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esi + esi]
push ecx
push ebx
push edx
mov dword [esp + 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [edi + 0x10], eax
push ebx
mov byte [edi + 0x14], al
call dword [0x5eb618]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x57fea0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x57fed1
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
ret

Function at 0x57fee0
Capabilities:
Hash data via wincrypt

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
ret
Function at 0x582150
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret

Function at 0x582890
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5eb614]
mov edi, eax
add esp, 4
test edi, edi
jne 0x5828b5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x5828fc
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x582900
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x58295e
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x582923
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x5829a1
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x59a4ec
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x59a4ed
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x582970
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x584cc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x584cf9
call fcn.0052fb43
mov dword [eax], esi
call fcn.0052fb30
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00527d64
add esp, 0x14
push 0x16
pop eax
jmp 0x584d4e
test dword [ebp + 0xc], 0xfffffff9
jne 0x584cd5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x584d26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0052fb56
pop ecx
call fcn.0052fb30
mov eax, dword [eax]
jmp 0x584d4e
test al, 0x10
jne 0x584d4c
test al, 1
je 0x584d4c
test byte [ebp + 0xc], 2
je 0x584d4c
call fcn.0052fb43
mov dword [eax], 5
call fcn.0052fb30
mov dword [eax], 0xd
jmp 0x584d1d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4099e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, esi
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x4099fc
mov eax, dword [esi]
xor ecx, ecx
push ecx
push ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jne 0x409a47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x409a3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x409a2f
movzx eax, ax
or eax, 0x80070000
push eax
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.00401910
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040cde8
add esp, 4
push ebx
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x409a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x409a81
movzx eax, ax
or eax, 0x80070000
push eax
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.00401910
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409aa0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.00404920
push ebx
call fcn.0040cde3
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044ad0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4c]
shl eax, 2
push eax
push 0
push dword [esi + 0x50]
call fcn.10057f10
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi + 0xb8], 0
test edx, edx
je 0x10044b07
mov ecx, dword [esi + 0x50]
mov eax, dword [edx]
mov dword [ecx + 0x20], eax
mov eax, dword [edx + 4]
mov dword [ecx + 0x24], eax
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0xf8]
mov eax, dword [eax + 0x38]
cmp eax, ecx
je 0x10044b28
push dword [esi + 0xf4]
push eax
push ecx
call fcn.100581a0
add esp, 0xc
mov ecx, dword [esi + 0xf8]
movzx eax, byte [esi + 0x110]
push edi
mov byte [ecx], al
mov ecx, dword [esi + 0xf8]
movzx eax, byte [esi + 0x114]
mov byte [ecx + 1], al
mov eax, 0x6a09e667
mov edi, dword [esi + 0xf8]
mov edx, dword [esi + 0x50]
test edi, edi
je 0x10044b61
mov eax, dword [edi]
xor eax, 0x6a09e667
test edx, edx
je 0x10044b67
mov dword [edx], eax
add edx, 4
lea ecx, [edi + 4]
test edi, edi
mov eax, 0xbb67ae85
cmove ecx, edi
pop edi
test ecx, ecx
je 0x10044b83
mov eax, dword [ecx]
xor eax, 0xbb67ae85
test edx, edx
je 0x10044b89
mov dword [edx], eax
add edx, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
mov ecx, 0x3c6ef372
test eax, eax
je 0x10044ba5
mov ecx, dword [eax]
xor ecx, 0x3c6ef372
test edx, edx
je 0x10044bab
mov dword [edx], ecx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
cmove ecx, eax
mov eax, 0xa54ff53a
test ecx, ecx
je 0x10044bc6
mov eax, dword [ecx]
xor eax, 0xa54ff53a
test edx, edx
je 0x10044bcc
mov dword [edx], eax
add edx, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
mov ecx, 0x510e527f
test eax, eax
je 0x10044be8
mov ecx, dword [eax]
xor ecx, 0x510e527f
test edx, edx
je 0x10044bee
mov dword [edx], ecx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
cmove ecx, eax
mov eax, 0x9b05688c
test ecx, ecx
je 0x10044c09
mov eax, dword [ecx]
xor eax, 0x9b05688c
test edx, edx
je 0x10044c0f
mov dword [edx], eax
add edx, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
mov ecx, 0x1f83d9ab
test eax, eax
je 0x10044c2b
mov ecx, dword [eax]
xor ecx, 0x1f83d9ab
test edx, edx
je 0x10044c31
mov dword [edx], ecx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
cmove ecx, eax
mov eax, 0x5be0cd19
test ecx, ecx
je 0x10044c4c
mov eax, dword [ecx]
xor eax, 0x5be0cd19
test edx, edx
je 0x10044c52
mov dword [edx], eax
cmp dword [esi + 0x114], 0
je 0x10044c6c
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
push 0x40
push dword [esi + 0x10c]
call dword [eax + 0x10]
pop esi
ret 8
Function at 0x100476f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100728c5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100e1008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
xorps xmm0, xmm0
mov dword [ebp - 0x34], esi
push 0x40
lea ecx, [ebp - 0x28]
movups xmmword [ebp - 0x28], xmm0
call fcn.1003bfc0
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edi, eax
mov dword [ebp - 0x18], 0x37
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], 0x3f
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x100750ec]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x100750fc]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [0x1007510c]
mov dword [edi + 0x30], eax
mov ax, word [0x10075110]
mov word [edi + 0x34], ax
mov al, byte [0x10075112]
mov byte [edi + 0x36], al
mov byte [edi + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
movups xmmword [esi + 0x10], xmm0
push 0x40
mov byte [ebp - 4], 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xf
call fcn.1003bfc0
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], 0x37
mov dword [esi + 0x24], 0x3f
movups xmm0, xmmword [edi]
push 0x40
push edi
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [edi + 0x30]
movq qword [eax + 0x30], xmm0
mov dword [esi], vtable.CryptoPP::NotImplemented.0
call fcn.1003c57a
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c32e
mov esp, ebp
pop ebp
ret
Function at 0x100534d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x18
test eax, eax
je 0x10053667
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
push edi
cmp eax, 4
jb 0x10053513
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x100534f8
mov dword [esp + 0x34], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
test eax, eax
je 0x10053663
cmp eax, 8
jb 0x10053648
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x10053545
cmp edi, ebx
jae 0x10053648
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x10053556
cmp edi, edx
jae 0x10053648
cmp eax, 0x40
jb 0x100535fc
mov edi, eax
mov ecx, eax
and edi, 0x3f
mov eax, esi
sub eax, ebx
mov dword [esp + 0x24], edi
sub ecx, edi
mov dword [esp + 0x10], eax
mov edi, edx
mov dword [esp + 0x20], ecx
sub edi, ebx
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x10]
mov eax, edx
sub eax, esi
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x20]
nop
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [edx + ebp]
lea eax, [eax + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [eax - 0x60], xmm1
movups xmm1, xmmword [edi + ecx - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x30]
movups xmmword [ebx + ecx - 0x40], xmm1
mov ebx, dword [esp + 0x1c]
movups xmm1, xmmword [ebx + eax - 0x40]
mov ebx, dword [esp + 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x20]
movups xmmword [eax - 0x40], xmm1
movups xmm1, xmmword [edx + ebp + 0x30]
add ebp, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
cmp ebp, dword [esp + 0x20]
jb 0x10053590
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x14]
jb 0x10053644
jmp 0x10053600
mov edi, edx
sub edi, ebx
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x20], eax
mov eax, esi
sub eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
nop word [eax + eax]
movq xmm1, qword [ecx + edi]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
pxor xmm1, xmm0
movq qword [ecx + edx - 8], xmm1
cmp ebp, dword [esp + 0x20]
jb 0x10053620
mov edx, dword [esp + 0x18]
cmp ebp, eax
jae 0x10053663
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [edi + esi - 1], cl
sub eax, 1
jne 0x10053651
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x10066cd1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10066d6e
push ebx
push esi
call fcn.10066c9a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10066be3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10066d1b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10066d6d
push edi
push eax
call fcn.10065799
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10066d3b
call fcn.100657e7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10066d6c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10066be3
add esp, 0x20
test eax, eax
jne 0x10066d5a
push edi
call fcn.100657e7
jmp 0x10066d62
push ebx
call fcn.100657e7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100670a9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10079f08
push 0x10079f00
push str.FlsAlloc
push 0x1e
call fcn.10066fc7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100670dd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10074130]
call esi
jmp 0x100670e3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10067127
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10079f18
push 0x10079f10
push str.FlsGetValue
push 0x20
call fcn.10066fc7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006715e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10074130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]