joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5eeb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x2c]
mov esi, dword [eax]
test esi, esi
js 0x5eebcd
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
sete cl
test eax, eax
sete dl
or dl, cl
jne 0x5eebd7
nop dword [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp]
inc ebp
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
inc esi
and esi, 0xf
je 0x5eebd9
cmp eax, 1
mov eax, ecx
jne 0x5eebb0
jmp 0x5eebd9
mov ecx, 0xffffffff
jmp 0x5eed12
mov ecx, eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x5eecaa
mov dword [esp], ecx
push edx
push edi
push edi
call eax
add esp, 0xc
cmp esi, 0xf
ja 0x5eec37
mov eax, dword [edi + esi]
xor eax, dword [ebp + esi]
mov dword [ebx + esi], eax
cmp esi, 0xb
ja 0x5eec37
mov eax, dword [edi + esi + 4]
xor eax, dword [ebp + esi + 4]
mov dword [ebx + esi + 4], eax
cmp esi, 7
ja 0x5eec37
mov eax, dword [edi + esi + 8]
xor eax, dword [ebp + esi + 8]
mov dword [ebx + esi + 8], eax
cmp esi, 3
ja 0x5eec37
mov eax, dword [edi + esi + 0xc]
xor eax, dword [ebp + esi + 0xc]
mov dword [ebx + esi + 0xc], eax
mov ecx, dword [esp]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
xor esi, esi
cmp ecx, 0x10
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
jb 0x5eecaa
nop word cs:[eax + eax]
push edx
push edi
push edi
mov edi, ecx
call dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov ecx, edi
mov edi, dword [esp + 0x34]
add esp, 0xc
mov eax, dword [edi]
xor eax, dword [ebp]
mov dword [ebx], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
xor eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
xor eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x30]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
cmp ecx, 0xf
ja 0x5eec60
test ecx, ecx
je 0x5eeccc
push edx
push edi
push edi
mov edi, ecx
call eax
mov edx, edi
add esp, 0xc
test dl, 1
jne 0x5eecd0
mov eax, edx
mov edi, dword [esp + 0x28]
cmp edx, 1
jne 0x5eecf0
jmp 0x5eed12
mov ecx, esi
jmp 0x5eed12
mov edi, dword [esp + 0x28]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
lea eax, [edx - 1]
mov byte [ebx + esi], cl
inc esi
mov ecx, esi
cmp edx, 1
je 0x5eed12
nop word [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
mov byte [ebx + esi], cl
movzx edx, byte [edi + esi + 1]
xor dl, byte [ebp + esi + 1]
lea ecx, [esi + 2]
mov byte [ebx + esi + 1], dl
mov esi, ecx
add eax, 0xfffffffe
jne 0x5eecf0
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6135f0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x18]
jne 0x613670
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx]
mov dh, dl
and dh, 0xfe
cmp dh, 0x6a
jne 0x613670
cmp dl, 0x6b
jne 0x6136a2
cmp eax, 4
jl 0x6136df
lea edx, [ecx + eax]
add edx, 0xfffffffe
add eax, 0xfffffffd
add ecx, 2
xor esi, esi
nop dword [eax]
movzx edi, byte [ecx - 1]
cmp edi, 0xbb
jne 0x6136c3
inc esi
inc ecx
cmp eax, esi
jne 0x613630
xor eax, eax
cmp byte [edx + eax], 0xcc
je 0x6136ae
call fcn.005b5560
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x8b
jmp 0x613690
call fcn.005b5560
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x89
push 4
call fcn.005b5750
add esp, 0xc
mov eax, 0xffffffff
pop esi
pop edi
ret
inc ecx
add eax, 0xfffffffe
mov edx, ecx
cmp byte [edx + eax], 0xcc
jne 0x61364e
push eax
push edx
push dword [esp + 0x14]
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, esi
add esp, 0xc
pop esi
pop edi
ret
cmp edi, 0xba
jne 0x6136ed
test esi, esi
je 0x6136df
sub eax, esi
mov edx, ecx
cmp byte [edx + eax], 0xcc
jne 0x61364e
jmp 0x6136ae
call fcn.005b5560
push str.RSA_padding_check_X931
push 0x56
jmp 0x6136f9
call fcn.005b5560
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x8a
jmp 0x613690

Function at 0x61c550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x61c57d
mov eax, dword [eax]
test eax, eax
je 0x61c57d
mov eax, dword [eax + 0x20]
test eax, eax
je 0x61c57d
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp eax
mov dword [esp + 0xf], 0x207265
mov dword [esp + 0xc], 0x65746e45
mov word [esp + 8], 0x20
mov dword [esp + 4], 0x726f6620
mov word [esp + 2], 0x3a
test ebp, ebp
je 0x61c632
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
test ebx, ebx
je 0x61c5ca
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add esi, eax
add esi, 0xb
jmp 0x61c5cd
add esi, 6
add esi, 2
push 0x166
push str.crypto_ui_ui_lib.c
push esi
call fcn.005dadf0
add esp, 0xc
test eax, eax
je 0x61c632
mov edi, eax
lea eax, [esp + 0xc]
push esi
push eax
push edi
call fcn.005dcc90
add esp, 0xc
push esi
push ebp
push edi
call fcn.005dccf0
add esp, 0xc
test ebx, ebx
je 0x61c621
lea eax, [esp + 4]
push esi
push eax
push edi
call fcn.005dccf0
add esp, 0xc
push esi
push ebx
push edi
call fcn.005dccf0
add esp, 0xc
lea eax, [esp + 2]
push esi
push eax
push edi
call fcn.005dccf0
add esp, 0xc
jmp 0x61c634
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x63f7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
cmp ebx, 2
jb 0x63f868
mov dword [esp], ecx
mov eax, ebx
shr ebx, 1
lea esi, [edx + eax]
xor edi, edi
cmp ebx, 1
je 0x63f84b
and ebx, 0xfffffffe
mov eax, dword [esp + 0x18]
lea ebp, [eax - 1]
xor edi, edi
nop dword [eax + eax]
movzx eax, byte [edx + edi]
mov ah, byte [edx + ebp]
mov byte [edx + edi], ah
mov byte [edx + ebp], al
movzx eax, byte [edx + edi + 1]
mov ecx, edi
xor ecx, 0xfffffffe
mov ah, byte [esi + ecx]
mov byte [edx + edi + 1], ah
mov byte [esi + ecx], al
add edi, 2
add ebp, 0xfffffffe
cmp ebx, edi
jne 0x63f820
mov ebx, dword [esp + 0x18]
test bl, 2
mov ecx, dword [esp]
je 0x63f868
movzx eax, byte [edx + edi]
mov ebp, edi
not ebp
mov ah, byte [esi + ebp]
mov byte [edx + edi], ah
mov byte [esi + ebp], al
push ecx
push ebx
push edx
call fcn.00588240
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x64e860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov edi, dword [esp + 0x60]
mov ebp, dword [esp + 0x5c]
mov esi, edi
and esi, 0xf
je 0x64e991
lea eax, [esi + 0x10]
sub edi, eax
mov dword [esp], ecx
je 0x64e8a4
mov eax, dword [ecx + 0x70]
push edi
push edx
push ebp
push ecx
mov ebx, edx
call dword [eax + 4]
add esp, 0x10
test eax, eax
je 0x64e98d
add ebx, edi
add ebp, edi
mov ecx, dword [esp]
mov edx, ebx
mov dword [esp + 4], edx
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [esp + 0x38], xmm0
lea eax, [edx + esi]
movups xmm0, xmmword [edx + esi]
movups xmmword [esp + 0x28], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x20], xmm0
mov ebx, ecx
mov ecx, dword [ecx + 0x70]
lea edx, [esp + 0x18]
push 0x10
push eax
push edx
push ebx
call dword [ecx + 4]
add esp, 0x10
test eax, eax
mov edi, dword [esp + 0x60]
je 0x64e98d
add ebx, 0x20
lea eax, [esp + 8]
push esi
push dword [esp + 8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea eax, [esp + esi]
add eax, 8
lea ecx, [esp + esi]
add ecx, 0x18
mov edx, 0x10
sub edx, esi
push edx
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
cmp esi, 8
jb 0x64e950
mov ecx, edi
and ecx, 7
mov eax, esi
sub eax, ecx
xor edx, edx
nop dword [eax]
movsd xmm0, qword [esp + edx + 8]
movsd xmm1, qword [esp + edx + 0x18]
xorps xmm1, xmm0
movlps qword [ebp + edx + 0x10], xmm1
add edx, 8
cmp eax, edx
jne 0x64e930
test ecx, ecx
je 0x64e962
nop
movzx ecx, byte [esp + eax + 0x18]
xor cl, byte [esp + eax + 8]
mov byte [ebp + eax + 0x10], cl
inc eax
cmp esi, eax
jne 0x64e950
movups xmm0, xmmword [esp + 0x38]
movups xmmword [ebx], xmm0
mov ecx, dword [esp]
mov eax, dword [ecx + 0x70]
push 0x10
lea edx, [esp + 0xc]
push edx
push ebp
push ecx
call dword [eax + 4]
add esp, 0x10
test eax, eax
je 0x64e98d
movups xmm0, xmmword [esp + 0x28]
movups xmmword [ebx], xmm0
jmp 0x64e9a3
xor edi, edi
jmp 0x64e9a3
mov eax, dword [ecx + 0x70]
push edi
push edx
push ebp
push ecx
call dword [eax + 4]
add esp, 0x10
test eax, eax
cmove edi, eax
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x651470
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
xorps xmm0, xmm0
movsd qword [eax + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0xd0], xmm0
movups xmmword [eax + 0xc0], xmm0
movups xmmword [eax + 0xb0], xmm0
movups xmmword [eax + 0xa0], xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x70], xmm0
movups xmmword [eax + 0x60], xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmm0, xmmword [0xabddc0]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0xabddd0]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0xabdde0]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [0xabddf0]
movups xmmword [eax + 0x30], xmm0
movzx edx, byte [ecx]
mov dword [eax + 0xe4], edx
mov edx, 0xf3bcc908
xor edx, dword [ecx]
mov esi, 0x6a09e667
xor esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov dword [eax], edx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov esi, 0xbb67ae85
xor esi, dword [ecx + 0xc]
mov dword [eax + 0xc], esi
mov dword [eax + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov esi, 0x3c6ef372
xor esi, dword [ecx + 0x14]
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov esi, 0xa54ff53a
xor esi, dword [ecx + 0x1c]
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov esi, 0x510e527f
xor esi, dword [ecx + 0x24]
mov dword [eax + 0x24], esi
mov dword [eax + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov esi, 0x9b05688c
xor esi, dword [ecx + 0x2c]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov esi, 0x1f83d9ab
xor esi, dword [ecx + 0x34]
mov dword [eax + 0x34], esi
mov dword [eax + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov esi, 0x5be0cd19
xor esi, dword [ecx + 0x3c]
mov dword [eax + 0x3c], esi
mov dword [eax + 0x38], edx
mov eax, 1
pop esi
ret
Function at 0x6515b0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
xorps xmm0, xmm0
movsd qword [esi + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0xd0], xmm0
movups xmmword [esi + 0xc0], xmm0
movups xmmword [esi + 0xb0], xmm0
movups xmmword [esi + 0xa0], xmm0
movups xmmword [esi + 0x90], xmm0
movups xmmword [esi + 0x80], xmm0
movups xmmword [esi + 0x70], xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmm1, xmmword [0xabddc0]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0xabddd0]
movups xmmword [esi + 0x10], xmm1
movups xmm1, xmmword [0xabdde0]
movups xmmword [esi + 0x20], xmm1
movups xmm1, xmmword [0xabddf0]
movups xmmword [esi + 0x30], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0xe4], edx
mov ebx, dword [ecx]
mov edx, 0x6a09e667
xor edx, dword [ecx + 4]
movzx edi, bh
xor ebx, 0xf3bcc908
mov dword [esi + 4], edx
mov dword [esi], ebx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov ebx, 0xbb67ae85
xor ebx, dword [ecx + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov ebx, 0x3c6ef372
xor ebx, dword [ecx + 0x14]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov ebx, 0xa54ff53a
xor ebx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov ebx, 0x510e527f
xor ebx, dword [ecx + 0x24]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov ebx, 0x9b05688c
xor ebx, dword [ecx + 0x2c]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov ebx, 0x1f83d9ab
xor ebx, dword [ecx + 0x34]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov ebx, 0x5be0cd19
xor ebx, dword [ecx + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], edx
movups xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x70], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x80], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x90], xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esi + 0xa0], xmm0
movups xmm0, xmmword [esp + 0x50]
movups xmmword [esi + 0xb0], xmm0
movups xmm0, xmmword [esp + 0x60]
movups xmmword [esi + 0xc0], xmm0
movups xmm0, xmmword [esp + 0x70]
movups xmmword [esi + 0xd0], xmm0
mov dword [esi + 0xe0], pe_nt_image_headers32
push pe_nt_image_headers32
push ebx
call fcn.005e7ed0
add esp, 8
mov eax, 1
add esp, 0x80
pop esi
pop edi
pop ebx
ret
Function at 0x6561d0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
xorps xmm0, xmm0
movsd qword [ecx + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x60], xmm0
movups xmmword [ecx + 0x50], xmm0
movups xmmword [ecx + 0x40], xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [0xabde00]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0xabde10]
movups xmmword [ecx + 0x10], xmm0
movzx edx, byte [eax]
mov dword [ecx + 0x74], edx
mov edx, 0x6a09e667
xor edx, dword [eax]
mov dword [ecx], edx
mov edx, 0xbb67ae85
xor edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [eax + 0x14]
mov dword [ecx + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [eax + 0x18]
mov dword [ecx + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [eax + 0x1c]
mov dword [ecx + 0x1c], edx
mov eax, 1
ret

Function at 0x656270
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
xorps xmm0, xmm0
movsd qword [esi + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmm1, xmmword [0xabde00]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0xabde10]
movups xmmword [esi + 0x10], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0x74], edx
mov edx, dword [ecx]
movzx edi, dh
xor edx, 0x6a09e667
mov dword [esi], edx
mov edx, 0xbb67ae85
xor edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [ecx + 8]
mov dword [esi + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [ecx + 0xc]
mov dword [esi + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [ecx + 0x10]
mov dword [esi + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [ecx + 0x14]
mov dword [esi + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [ecx + 0x18]
mov dword [esi + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], edx
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x40], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x50], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0x40
push 0x40
push ebx
call fcn.005e7ed0
add esp, 8
mov eax, 1
add esp, 0x40
pop esi
pop edi
pop ebx
ret
Function at 0x66c570
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x66c77e
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x820
mov dword [esp + 8], edx
mov edi, dword [ecx + 0x44]
mov eax, dword [ecx + 0x54]
mov ebx, eax
shl eax, 0xa
mov dword [esp + 0x14], eax
add eax, edi
add eax, 0xfffffc00
lea edx, [esp + 0x18]
push 0x400
push eax
push edx
mov esi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 4], eax
cmp eax, 2
jb 0x66c6d7
mov edx, ebx
shl edx, 0xb
mov esi, dword [esp + 4]
imul esi, ebx
shl esi, 0xa
add esi, edi
lea eax, [esp + 0x18]
cmp eax, esi
lea esi, [edi + edx - 0x400]
setb cl
lea eax, [esp + 0x418]
cmp esi, eax
setb ch
and ch, cl
shr ebx, 0x15
and ebx, 1
or bl, ch
mov dword [esp + 0x10], ebx
lea ecx, [edi + edx]
add ecx, 0xfffffc30
add edx, edi
add edx, 0xfffffc08
mov edi, 1
jmp 0x66c633
inc edi
mov eax, dword [esp + 0x14]
add ecx, eax
add edx, eax
cmp edi, dword [esp + 4]
je 0x66c6d7
cmp byte [esp + 0x10], 0
je 0x66c670
xor esi, esi
nop dword [eax]
mov eax, dword [edx + esi*8 - 8]
mov ebx, dword [edx + esi*8 - 4]
xor dword [esp + esi*8 + 0x18], eax
xor dword [esp + esi*8 + 0x1c], ebx
mov eax, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [esp + esi*8 + 0x24], ebx
xor dword [esp + esi*8 + 0x20], eax
add esi, 2
cmp esi, 0x80
jne 0x66c640
jmp 0x66c620
xor esi, esi
nop word cs:[eax + eax]
movups xmm0, xmmword [ecx + esi*8 - 0x30]
movups xmm1, xmmword [ecx + esi*8 - 0x20]
movups xmm2, xmmword [esp + esi*8 + 0x18]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x28]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x18], xmm2
movups xmmword [esp + esi*8 + 0x28], xmm0
movups xmm0, xmmword [ecx + esi*8 - 0x10]
movups xmm1, xmmword [ecx + esi*8]
movups xmm2, xmmword [esp + esi*8 + 0x38]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x48]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x38], xmm2
movups xmmword [esp + esi*8 + 0x48], xmm0
add esi, 8
cmp esi, 0x80
jne 0x66c680
jmp 0x66c620
xor eax, eax
nop dword [eax]
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x420], edx
mov dword [esp + eax*8 + 0x41c], ecx
inc eax
cmp eax, 0x80
jne 0x66c6e0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 0x5c]
lea esi, [esp + 0x41c]
mov edx, dword [esp + 8]
push 0x400
push esi
push dword [edi + 4]
call fcn.0066c780
add esp, 0xc
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.005e7ed0
add esp, 8
push 0x400
push esi
call fcn.005e7ed0
add esp, 8
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x4c]
shl ecx, 0xa
cmp dword [edi + 0x40], 0
je 0x66c763
push 0x310
push str.providers_implementations_kdfs_argon2.c
push ecx
push eax
call fcn.005dc370
jmp 0x66c774
push 0x313
push str.providers_implementations_kdfs_argon2.c
push ecx
push eax
call fcn.005db1d0
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x687460
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x14]
push 1
push ebx
call fcn.00604e00
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.006050d0
add esp, 8
test eax, eax
je 0x6874e9
mov edi, eax
sub esp, 0x14
movaps xmm0, xmmword [0xacaa50]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x6874c4
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x6874c6
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00605160
add esp, 0xc
push ebx
call fcn.00604dd0
add esp, 4
test eax, eax
jne 0x68756a
push 1
push ebx
call fcn.00604e00
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.006050d0
add esp, 8
test eax, eax
je 0x687561
mov edi, eax
mov eax, esp
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x687540
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x687542
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00605160
add esp, 0xc
push ebx
call fcn.00604dd0
add esp, 4
test eax, eax
jne 0x68756a
push ebx
call fcn.00604dd0
add esp, 4
add esp, 4
pop esi
pop edi
pop ebx
ret