joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cf445
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5cf4e2
push ebx
push esi
call fcn.005cf40e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005cb37b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5cf48f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5cf4e1
push edi
push eax
call fcn.005c6517
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5cf4af
call fcn.005c64dd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5cf4e0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005cb37b
add esp, 0x20
test eax, eax
jne 0x5cf4ce
push edi
call fcn.005c64dd
jmp 0x5cf4d6
push ebx
call fcn.005c64dd
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5cf4e5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5cf4f6
pop esi
ret
push ebx
push edi
push esi
call fcn.005cf40e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.005c6517
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5cf51e
push ebx
push esi
push edi
call fcn.005a4460
add esp, 0xc
push 0
call fcn.005c64dd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x5cfc6a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cf791

Function at 0x5d3b80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5d3bad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5d3bad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10145bf9
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000108e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10145c95
jmp 0x10145d6a
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.1014595c
lea ecx, [0x10146d01]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x54], edx
mov dword [esp + 0x8c], 0x11f400
mov dword [0x101af17c], 0x15a6
mov edx, dword [0x101af168]
mov dword [esp + 0x68], edx
mov edx, dword [0x101af16c]
mov dword [esp + 0x60], edx
mov edx, dword [0x101af170]
mov dword [esp + 0x70], edx
mov edx, dword [0x101af174]
mov dword [esp + 0x50], edx
mov edx, dword [0x101af178]
mov dword [esp + 0x78], edx
mov dword [0x101af180], 0x109b
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10145d3a
lea eax, [esp + 0x38]
mov ecx, dword [0x101af17c]
add ecx, 0xffffefd3
mov dword [0x101af17c], ecx
mov dword [esp + 0x18], eax
call fcn.101460ae
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
je 0x10145c1d
jmp 0x10145d62
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10145d3a
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], ecx
mov dword [0x101af17c], 0xfffff682
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x7c], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.10146787
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101af17c]
add ecx, 0xffffe5c3
mov dword [0x101af180], ecx
mov dword [esp + 0x14], eax
jmp 0x10145d62
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10145cca
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10145cde
jmp 0x10145cca
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10145de9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101468b7
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10145e25
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101af180], 0x370c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x101af17c], 0x1fed
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10145e97
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
jmp 0x10145eed
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
jb 0x10145e7b
jmp 0x10145e97
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101af17c], 0x1415
mov dword [ebp - 0x34], edi
jmp 0x10145e97
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
je 0x10145f3e
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x52]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x10145eed
mov al, byte [ebp - 0x52]
test al, 1
jne 0x10145ec8
jmp 0x10145ea2
Function at 0x10145f4a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x101af180]
add edi, 0x53c
mov dword [0x101af180], edi
mov dword [0x101af188], 0
mov byte [0x101af18c], 0
mov dword [0x101af184], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10146058
xor eax, eax
mov dword [0x101af17c], 0x182
mov dword [0x101af184], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101af190], 0
mov edi, dword [0x101af188]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101af190], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x101af188], edx
mov dword [0x101af17c], 0x918
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101af18c], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x101af17c], 0x16c8
mov cl, byte [0x101af18c]
mov esi, dword [0x101af188]
mov byte [ebx + esi], cl
mov esi, dword [0x101af184]
add esi, 1
mov dword [0x101af184], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x10145fb5
jmp 0x1014609c
mov eax, dword [ebp - 0x1c]
mov dword [0x101af180], 0x1e35
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101af180]
add eax, 0x325
mov dword [0x101af180], eax
mov eax, dword [0x101af184]
add eax, 1
mov dword [0x101af184], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10146058
jmp 0x10145f9c
mov dword [0x101af17c], 0x26c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101460ae
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10146140
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x10146192
jmp 0x1014610c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x1014616f
xor eax, eax
mov dword [0x101af17c], 0x982
mov dword [ebp - 0x20], eax
jmp 0x101461c0
mov eax, dword [0x101af17c]
add eax, 0xfffff36e
mov dword [0x101af17c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x101460da
jmp 0x1014610c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edx
je 0x101460fa
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
jl 0x10146140
jmp 0x101460fa
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1014610c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10146120
jmp 0x1014610c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1014610c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1014610c
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
Function at 0x1014651e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101af184], 0
mov dword [0x101af188], 0
mov dword [0x101af194], 0
mov dword [0x101af17c], 0x53e
cmp eax, 0
sete bl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
xor eax, eax
mov cl, byte [ebp - 0x1d]
test cl, 1
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jne 0x1014667c
jmp 0x101465a6
mov eax, dword [0x101af184]
mov ecx, dword [0x101af188]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov edi, eax
add edi, 1
add ecx, 1
mov dword [0x101af180], 0xb88
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101af184], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x38]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x101af188], edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x101af18c], cl
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov edx, dword [0x101af17c]
add edx, 0x20cc
mov dword [0x101af17c], edx
mov cl, byte [0x101af18c]
mov edx, dword [0x101af188]
mov byte [ebx + edx], cl
mov edx, dword [0x101af184]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101af188]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x101af194], ecx
mov dword [0x101af17c], 0x395
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x34]
mov dl, byte [edx + esi]
xor dl, byte [ebx + ecx]
mov ecx, dword [ebp - 0x18]
mov byte [ecx + esi], dl
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x30], edi
jne 0x1014658f
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10146787
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x101af180]
mov edi, esi
add edi, 0xffffdf43
mov dword [0x101af17c], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edx
jmp 0x101467f2
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffe336
mov dword [0x101af180], ecx
mov dword [ebp - 0x3c], eax
call fcn.101461c8
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.10146ae1
cmp eax, 0
mov dword [ebp - 0x40], eax
je 0x101468ae
jmp 0x1014681a
mov eax, dword [ebp - 0x38]
mov cl, byte [eax + 0x10147624]
mov dl, byte [eax + 0x101475f5]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x38], eax
je 0x101467b9
jmp 0x101467f2
mov eax, dword [ebp - 0x40]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.10146684
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x101af17c], 0x21cb
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x50], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx], ecx
add ecx, 0x1114
mov esi, dword [ebp - 0x44]
cmp esi, 0
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
je 0x101468a4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
add esp, 0x54
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x54
pop esi
pop edi
pop ebp
ret
Function at 0xebfc94
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x58], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0xec0641
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0xec0681
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xec0681
call 0xec0659
pop esi
xor eax, eax
lea edx, [esi + 0x46]
nop
nop
nop
push edx
push dword fs:[eax]
mov dword fs:[eax], esp
lea esi, [esi + 0xd4]
dec eax
movzx edx, byte [ebx]
xor dl, al
shr eax, 8
xor eax, dword [esi + edx*4]
inc ebx
dec ecx
jne 0xec0670
not eax
pop dword fs:[0]
add esp, 4
pop esi
pop ebx
pop ebp
ret 8

Function at 0xec0ca5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
call 0xec0cb1
pop ebx
sub ebx, 0x10b96c4
movdqu xmmword [ebp - 0x10], xmm6
movdqu xmmword [ebp - 0x20], xmm7
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqa xmm1, xmmword [eax]
movdqa xmm2, xmmword [eax + 0x10]
movdqa xmm3, xmmword [eax + 0x20]
movdqa xmm4, xmmword [eax + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm1, xmm0
sub edx, 0x40
add eax, 0x40
cmp edx, 0x40
jb 0xec0d65
movdqu xmm0, xmmword [ebx + 0x10b9668]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
movdqa xmm5, xmm4
pclmulqdq xmm4, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm4, xmm5
pxor xmm1, xmmword [eax]
pxor xmm2, xmmword [eax + 0x10]
pxor xmm3, xmmword [eax + 0x20]
pxor xmm4, xmmword [eax + 0x30]
sub edx, 0x40
add eax, 0x40
cmp edx, 0x40
jge 0xec0cf7
movdqu xmm0, xmmword [ebx + 0x10b9678]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp edx, 0x10
jb 0xec0ddd
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmmword [eax]
sub edx, 0x10
add eax, 0x10
cmp edx, 0x10
jge 0xec0dba
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movdqu xmm0, xmmword [ebx + 0x10b9688]
movdqu xmm3, xmmword [ebx + 0x10b9698]
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqu xmm0, xmmword [ebx + 0x10b96a8]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movdqu xmm6, xmmword [ebp - 0x10]
movdqu xmm7, xmmword [ebp - 0x20]
not eax
pop ebx
leave
ret 0xc

Function at 0xec0e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0xec0ecc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xec0ecc
call 0xec0ea4
pop esi
xor eax, eax
lea edx, [esi + 0x46]
nop
nop
nop
push edx
push dword fs:[eax]
mov dword fs:[eax], esp
lea esi, [esi + 0xd5]
dec eax
movzx edx, byte [ebx]
xor dl, al
shr eax, 8
xor eax, dword [esi + edx*4]
inc ebx
dec ecx
jne 0xec0ebb
not eax
pop dword fs:[0]
add esp, 4
pop esi
pop ebx
pop ebp
ret 8
Function at 0xec3606
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [edi + 0xc]
cmp edx, eax
jb 0xec355e
jmp 0xec380e
xor eax, eax
pop edi
pop ebp
ret 8
add edi, 0x28
dec ecx
jne 0xec34bf
jmp 0xec355e
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
add edi, dword [edi + 0x3c]
movzx ecx, word [edi + 6]
movzx eax, word [edi + 0x14]
lea edi, [edi + eax + 0x18]
mov edx, dword [ebp + 0xc]
jmp 0xec34bf
add edx, ecx
mov eax, edx
pop edi
pop ebp
ret 8
sub edx, dword [edi + 0xc]
cmp dword [edi + 0x10], 0
je 0xec355e
jmp 0xec381e
add eax, dword [edi + 8]
cmp eax, edx
jbe 0xec3571
jmp 0xec37c3
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0xec355e
jmp 0xec36f0
Function at 0xec45f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
call fcn.00ec4606

Function at 0xec7e09
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x3020100
mov dword [ebp - 8], 0x7060504
mov dword [ebp - 4], 0xb0a0908
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqu xmm1, xmmword [ecx]
movdqu xmmword [edx], xmm1
movdqu xmm5, xmmword [ebp - 0x10]
add edx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 2
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 4
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 8
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 0x10
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 0x20
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 0x40
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 0x80
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.00ec7eb9
aeskeygenassist xmm2, xmm1, 0x36
call fcn.00ec7eb9
leave
ret 8
Function at 0xec7ee9
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
movdqu xmmword [ebp - 0x10], xmm6
movdqu xmmword [ebp - 0x20], xmm7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movq xmm7, qword [ecx + 0x10]
movq qword [edx + 0x10], xmm7
pshufd xmm4, xmm7, 0x4f
movdqu xmm1, xmmword [ecx]
movdqu xmmword [edx], xmm1
pxor xmm3, xmm3
pxor xmm6, xmm6
aeskeygenassist xmm2, xmm4, 1
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x18], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0x28], xmm7
aeskeygenassist xmm2, xmm4, 2
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x30], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0x40], xmm7
aeskeygenassist xmm2, xmm4, 4
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x48], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0x58], xmm7
aeskeygenassist xmm2, xmm4, 8
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x60], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0x70], xmm7
aeskeygenassist xmm2, xmm4, 0x10
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x78], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0x88], xmm7
aeskeygenassist xmm2, xmm4, 0x20
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0x90], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0xa0], xmm7
aeskeygenassist xmm2, xmm4, 0x40
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0xa8], xmm1
movdqa xmm5, xmm4
pslldq xmm5, 4
shufps xmm6, xmm1, 0xf0
pxor xmm6, xmm5
pxor xmm4, xmm6
pshufd xmm7, xmm4, 0xe
movdqu xmmword [edx + 0xb8], xmm7
aeskeygenassist xmm2, xmm4, 0x80
pshufd xmm2, xmm2, 0xff
shufps xmm3, xmm1, 0x10
pxor xmm1, xmm3
shufps xmm3, xmm1, 0x8c
pxor xmm1, xmm3
pxor xmm1, xmm2
movdqu xmmword [edx + 0xc0], xmm1
movdqu xmm6, xmmword [ebp - 0x10]
movdqu xmm7, xmmword [ebp - 0x20]
leave
ret 8
Function at 0xec82c9
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x3020100
mov dword [ebp - 8], 0x7060504
mov dword [ebp - 4], 0xb0a0908
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqu xmm1, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmmword [edx], xmm1
movdqu xmmword [edx + 0x10], xmm3
add edx, 0x20
movdqu xmm5, xmmword [ebp - 0x10]
aeskeygenassist xmm2, xmm3, 1
call fcn.00ec8389
aeskeygenassist xmm2, xmm3, 2
call fcn.00ec8389
aeskeygenassist xmm2, xmm3, 4
call fcn.00ec8389
aeskeygenassist xmm2, xmm3, 8
call fcn.00ec8389
aeskeygenassist xmm2, xmm3, 0x10
call fcn.00ec8389
aeskeygenassist xmm2, xmm3, 0x20
call fcn.00ec8389
aeskeygenassist xmm2, xmm3, 0x40
pshufd xmm2, xmm2, 0xff
movdqu xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movdqu xmmword [edx], xmm1
leave
ret 8

Function at 0xec8389
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pshufd xmm2, xmm2, 0xff
movdqu xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movdqu xmmword [edx], xmm1
add edx, 0x10
aeskeygenassist xmm4, xmm1, 0
pshufd xmm2, xmm4, 0xaa
movdqu xmm4, xmm3
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pxor xmm3, xmm2
movdqu xmmword [edx], xmm3
add edx, 0x10
ret