joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f9b0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
movzx edi, byte [esi + 0x68]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
lea edx, [esi + 0x28]
shld ecx, eax, 9
shl eax, 9
lea ebx, [edi*8]
mov byte [esi + edi + 0x28], pe_nt_image_headers32
or ebx, eax
mov eax, edi
xor eax, 0x3f
je 0x1002fa08
mov dword [esp + 0x10], ecx
lea ecx, [edi + edx + 1]
push eax
push 0
push ecx
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
xor edi, 0x38
bswap ebx
bswap ecx
cmp edi, 8
jae 0x1002fa55
push 1
push edx
push esi
mov edi, ecx
call fcn.10131eb0
add esp, 0xc
xorps xmm0, xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x2c]
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], edi
push 1
push eax
jmp 0x1002fa5e
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ebx
push 1
push edx
push esi
call fcn.10131eb0
add esp, 0xc
movups xmm1, xmmword [esi + 0x10]
movdqu xmm0, xmmword [esi]
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x68], 0
mov eax, dword [0x1044f00c]
mov esi, dword [0x1044eff8]
movdqa xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm1
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x1002fae1
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1002fb5c
mov dword [esi], eax
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1002fb5c
movdqa xmm2, xmmword [esp]
pxor xmm0, xmm0
movdqa xmm3, xmmword [esp + 0x10]
mov edx, 0x20
movdqa xmm1, xmm2
punpcklbw xmm2, xmm0
punpckhbw xmm1, xmm0
pshuflw xmm2, xmm2, 0x1b
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm2, xmm2, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm2, xmm1
movdqa xmm1, xmm3
punpcklbw xmm3, xmm0
punpckhbw xmm1, xmm0
pshuflw xmm0, xmm3, 0x1b
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm0, xmm1
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x20
push 1
call fcn.1001ac80
add esp, 8
ud2
Function at 0x10030640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [edx + 0x10]
mov edi, dword [edx]
mov eax, dword [edx + 0x14]
mov ebx, dword [edx + 4]
add edi, esi
adc ebx, eax
add esi, 1
movd xmm0, edi
adc eax, 0
mov dword [edx + 0x10], esi
movd xmm1, ebx
mov dword [edx + 0x14], eax
punpckldq xmm0, xmm1
mov eax, dword [ebp + 8]
movdqu xmm2, xmmword [edx + 8]
punpcklqdq xmm0, xmm2
pxor xmm0, xmmword [ecx]
aesenc xmm0, xmmword [ecx + 0x10]
aesenc xmm0, xmmword [ecx + 0x20]
aesenc xmm0, xmmword [ecx + 0x30]
aesenc xmm0, xmmword [ecx + 0x40]
aesenc xmm0, xmmword [ecx + 0x50]
aesenc xmm0, xmmword [ecx + 0x60]
aesenc xmm0, xmmword [ecx + 0x70]
aesenc xmm0, xmmword [ecx + 0x80]
aesenc xmm0, xmmword [ecx + 0x90]
aesenc xmm0, xmmword [ecx + 0xa0]
aesenc xmm0, xmmword [ecx + 0xb0]
aesenc xmm0, xmmword [ecx + 0xc0]
aesenc xmm0, xmmword [ecx + 0xd0]
aesenclast xmm0, xmmword [ecx + 0xe0]
movdqu xmmword [eax], xmm0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10066ac0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push 5
call sub.KERNEL32.dll_GetComputerNameExW
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10066ba6
xor ebx, ebx
cmp ecx, 0x40000000
setb al
jae 0x10066bdc
mov bl, al
lea edi, [ecx + ecx]
add ebx, ebx
test edi, edi
js 0x10066be3
mov dword [ebp - 0x14], ecx
je 0x10066b94
mov esi, dword [0x1044eff8]
mov eax, dword [esi]
test eax, eax
jne 0x10066b28
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10066b9a
mov dword [esi], eax
push edi
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
mov esi, eax
test esi, esi
je 0x10066b9a
lea eax, [ebp - 0x10]
push eax
push esi
push 5
call sub.KERNEL32.dll_GetComputerNameExW
test eax, eax
je 0x10066bea
mov eax, dword [ebp - 0x14]
dec eax
cmp dword [ebp - 0x10], eax
jne 0x10066bf8
mov ebx, dword [ebp + 8]
xor eax, eax
nop dword [eax]
cmp word [esi + eax*2], 0
je 0x10066b70
inc eax
add edi, 0xfffffffe
jne 0x10066b60
mov eax, dword [ebp - 0x14]
push eax
push esi
push ebx
call fcn.10169f90
add esp, 0xc
mov eax, dword [0x1044eff8]
push esi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ebx
test esi, esi
jne 0x10066b37
push edi
push ebx
call fcn.1001ac80
add esp, 8
ud2
mov dword [ebp - 0x2c], str.GetComputerNameExW_did_not_provide_buffer_size
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_gethostname_0.4.3_src_lib.rs
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push 0x10330328
push eax
call fcn.100272b0
add esp, 8
ud2
call fcn.1001ac40
ud2
call fcn.1001ac40
ud2
mov dword [ebp - 0x2c], str.GetComputerNameExW_failed_to_read_hostname._n________Please_report_this_issue_to__https:__github.com_swsnr_gethostname.rs_issues__
mov eax, 0x10330290
jmp 0x10066c04
mov eax, 0x103302e0
mov dword [ebp - 0x2c], 0x103302d8
lea ecx, [ebp - 0x2c]
mov dword [ecx + 4], 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_gethostname_0.4.3_src_lib.rs
mov dword [ecx + 0xc], 0
push eax
push ecx
call fcn.100272b0
add esp, 8
ud2

Function at 0x10069c70
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x370
call fcn.10069c84
Function at 0x10072c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, ecx
mov ecx, dword [edx + 0x18]
movsd xmm0, qword [edx + 0x10]
movsd xmm2, qword [edx]
movsd xmm1, qword [edx + 8]
mov eax, dword [ebp + 8]
mov ebx, edx
mov dword [esp + 0x80], ecx
movsd qword [esp + 0x78], xmm0
movsd qword [esp + 0x70], xmm1
movsd qword [esp + 0x68], xmm2
sub esp, 4
lea ecx, [esp + 0x3c]
push 0
push eax
push ecx
call fcn.100663a0
add esp, 0x10
movsd xmm1, qword [esp + 0x40]
mov eax, dword [esp + 0x48]
movsd xmm0, qword [esp + 0x38]
movsd xmm2, qword [ebx]
mov edi, dword [esp + 0x4c]
movsd qword [esp + 0x30], xmm1
movsd xmm1, qword [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x18]
movsd qword [esp + 0x28], xmm0
movsd qword [esp + 0xc], xmm2
movsd qword [esp + 0x1c], xmm1
movsd xmm1, qword [ebx + 8]
mov dword [esp + 0x24], eax
mov eax, dword [0x1044f00c]
mov ebx, dword [0x1044eff8]
movsd qword [esp + 0x14], xmm1
mov dword [esp + 8], 1
movzx eax, byte [eax]
mov eax, dword [ebx]
test eax, eax
jne 0x10072cc9
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x10072d66
mov dword [ebx], eax
push 0x8000
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10072d66
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x18]
movsd xmm2, qword [esp + 8]
movsd xmm3, qword [esp + 0x10]
movsd xmm4, qword [esp + 0x28]
movsd xmm5, qword [esp + 0x30]
mov ecx, dword [esp + 4]
movsd qword [esp + 0x50], xmm0
movsd qword [esp + 0x48], xmm1
movsd qword [esp + 0x40], xmm3
movsd qword [esp + 0x38], xmm2
movsd qword [esp + 0x58], xmm4
movsd qword [esp + 0x60], xmm5
movsd qword [esi + 0x28], xmm5
movsd qword [esi + 0x20], xmm4
movsd qword [esi + 0x18], xmm0
movsd qword [esi + 0x10], xmm1
movsd qword [esi + 8], xmm3
movsd qword [esi], xmm2
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0x8000
mov dword [esi + 0x40], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x8000
push 1
call fcn.1001ac80
add esp, 8
ud2
Function at 0x1009c860
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1009c892
mov ebx, dword [ebp + 0xc]
push 2
push edi
push ebx
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x1009c892
mov esi, eax
push edi
push ebx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1009c89a
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1044f00c]
movzx eax, byte [eax]
push 4
push 4
call fcn.10001510
add esp, 8
test eax, eax
jne 0x1009c8c0
push 4
push 4
call fcn.1001ac80
add esp, 8
ud2
add esi, 0x80000000
lea edi, [ebp - 0x14]
mov dword [eax], esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], 0x10335510
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x10335590
mov dword [ebp - 0x18], 0x1009c7b0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x34]
push 0x10335570
push eax
call fcn.100272b0
add esp, 8
ud2
Function at 0x100b3cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x580
call fcn.100b3d04
Function at 0x100b7c80
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov edx, dword [esi + 0xa4]
movzx ecx, byte [edi + 0x27c]
mov eax, dword [esi + 0x94]
mov dword [esp + 8], esi
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0xa8]
mov dword [esp + 0x6c], edx
mov edx, dword [esi + 0xac]
mov dword [esi + 0xa4], 1
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esp + 0x9c], edx
mov edx, dword [ebp + 0xc]
mov ebx, edx
mov dword [esp + 0x78], edx
and ebx, 0x7ffffff
mov edx, ebx
shr edx, cl
call fcn.100b7cff
Function at 0x100db6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x550
mov ecx, dword [ebp + 0xc]
call fcn.100db6e7
Function at 0x100f4c00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov eax, dword [0x102bc07c]
test eax, eax
je 0x100f4c2b
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x100f4c43
cmp dword [eax + 4], 0
je 0x100f4c43
add eax, 8
add esp, 0x18
pop esi
pop ebp
ret
push 0x102bc07c
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x100f4c1c
mov eax, dword [0x102bc07c]
test eax, eax
je 0x100f4cf4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x100f4d10
mov esi, eax
test eax, eax
jne 0x100f4cbb
mov eax, dword [0x1044f00c]
mov esi, dword [0x1044eff8]
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x100f4c89
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x100f4d27
mov dword [esi], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f4d27
mov dword [eax], 0x102bc07c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x102bc07c]
test eax, eax
je 0x100f4d18
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x100f4cd0
mov ecx, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x100f4ce1
mov ecx, 1
lock xadd dword [0x102bc078], ecx
test ecx, ecx
je 0x100f4d35
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], ecx
add esp, 0x18
pop esi
pop ebp
ret
push 0x102bc07c
call fcn.1017d760
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x100f4c60
xor eax, eax
add esp, 0x18
pop esi
pop ebp
ret
push 0x102bc07c
call fcn.1017d760
add esp, 4
jmp 0x100f4cb4
push 0xc
push 4
call fcn.1001ac80
add esp, 8
ud2
mov dword [ebp - 0x1c], 0x1033af88
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x10335f70
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x1c]
push 0x1033af90
push eax
call fcn.100272b0
add esp, 8
ud2
Function at 0x10111c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
test esi, esi
je 0x10111c69
cmp dword [eax], 0
jne 0x10111ca2
mov ebx, dword [edx + 8]
xor eax, eax
mov dword [edx + 8], 0
test ebx, ebx
je 0x10111ca2
mov edi, dword [0x1044eff8]
add esi, 4
jmp 0x10111c56
add esi, 0x10
dec ebx
je 0x10111c9d
cmp dword [esi], 0
je 0x10111c50
push dword [esi - 4]
push 0
push dword [edi]
call sub.KERNEL32.dll_HeapFree
jmp 0x10111c50
mov ebx, dword [eax]
test ebx, ebx
je 0x10111ca0
mov esi, dword [eax + 8]
test esi, esi
je 0x10111ca0
mov ecx, dword [ebx + 8]
cmp esi, 1
jne 0x10111caa
test ecx, ecx
je 0x10111e18
add ebx, 0xc
shl esi, 4
nop dword [eax]
mov byte [ebx], 0
add ebx, 0x10
add esi, 0xfffffff0
jne 0x10111c90
jmp 0x10111ca0
mov edx, dword [ebp + 0xc]
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [esi + 0xfffffff]
xor edi, edi
mov eax, edx
and eax, 0xfffffff
cmp eax, 8
jb 0x10111df3
movd xmm0, ecx
and edx, 7
mov edi, eax
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x1033b340]
sub edi, edx
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x88]
mov ecx, edi
movdqa xmm2, xmm1
nop dword [eax]
movd xmm3, dword [edx - 0x40]
movd xmm5, dword [edx - 0x50]
movd xmm4, dword [edx - 0x70]
movd xmm6, dword [edx - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edx]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edx - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x30]
sub edx, 0xffffff80
add ecx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x10111cf0
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [ebp - 0x10], 0
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ecx, xmm0
je 0x10111e0d
sub eax, edi
shl edi, 4
lea edx, [edi + ebx + 0x18]
nop dword [eax]
mov edi, dword [edx]
cmp ecx, edi
cmovae ecx, edi
add edx, 0x10
dec eax
jne 0x10111e00
mov edx, dword [ebp + 0xc]
test ecx, ecx
jne 0x10111c86
lea edi, [ebx + 4]
jmp 0x10111e26
add edi, 0x10
dec esi
je 0x10111e3e
cmp dword [edi], 0
je 0x10111e20
push dword [edi - 4]
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x10111e20
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x10111e56
push ebx
push 0
mov eax, dword [0x1044eff8]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [esi], 0
jmp 0x10111ca2
Function at 0x10121f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x10122065
js 0x101220b3
mov eax, dword [0x1044f00c]
mov edi, edx
lea ecx, [esi*8]
movzx eax, byte [eax]
mov eax, dword [0x1044eff8]
mov eax, dword [eax]
test eax, eax
jne 0x10121f81
mov esi, ecx
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1012209c
mov ecx, dword [0x1044eff8]
mov dword [ecx], eax
mov ecx, esi
mov esi, ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1012209c
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp esi, 0x10
jb 0x1012203b
lea edx, [eax + esi*8 - 8]
cmp edx, eax
jb 0x1012203b
lea edx, [eax + esi*8 - 4]
mov esi, eax
add esi, 4
cmp edx, esi
jb 0x1012203b
mov esi, dword [ebp + 8]
lea edx, [esi - 1]
cmp edx, 0x1fffffff
ja 0x1012203b
movdqa xmm0, xmmword [0x1033b500]
mov ecx, esi
xor edx, edx
and ecx, 0xfffffffe
nop dword [eax]
movdqu xmm1, xmmword [edi + edx*8]
pshufd xmm3, xmm1, 0xed
pshufd xmm2, xmm1, 0xe8
movdqa xmm5, xmm3
movdqa xmm1, xmm2
movdqa xmm6, xmm2
pxor xmm5, xmm0
pxor xmm1, xmm0
movdqa xmm4, xmm5
pcmpgtd xmm4, xmm1
pcmpgtd xmm1, xmm5
pand xmm6, xmm4
pandn xmm4, xmm3
pand xmm2, xmm1
pandn xmm1, xmm3
por xmm4, xmm6
por xmm1, xmm2
punpckldq xmm4, xmm1
movdqu xmmword [eax + edx*8], xmm4
add edx, 2
cmp ecx, edx
jne 0x10121fe0
cmp ecx, esi
je 0x1012206a
mov dword [ebp - 0x20], ebx
nop
mov esi, dword [edi + ecx*8 + 4]
mov edx, dword [edi + ecx*8]
cmp edx, esi
mov ebx, esi
cmovb ebx, edx
cmova esi, edx
mov dword [eax + ecx*8], ebx
mov dword [eax + ecx*8 + 4], esi
mov esi, dword [ebp + 8]
inc ecx
cmp esi, ecx
jne 0x10122040
mov ebx, dword [ebp - 0x20]
jmp 0x1012206a
mov eax, 4
test esi, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
sete byte [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.1010ea30
movsd xmm0, qword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x14]
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
not eax
shr eax, 0x1a
and eax, 4
push esi
push eax
call fcn.1001ac80
add esp, 8
ud2
call fcn.1001ac40
ud2
Function at 0x10155500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [edx + 8]
mov dword [esp], ecx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
cmp dword [esi], 0
je 0x10155524
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 4]
jmp 0x10155533
mov edi, dword [esi + 4]
cmp edi, 6
jae 0x1015569f
add esi, 8
test edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
je 0x10155608
dec edi
add esi, 0x10
nop word cs:[eax + eax]
nop dword [eax]
movsd xmm0, qword [esi - 0x10]
movsd xmm1, qword [esi - 8]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
lea ebx, [esp + 0x38]
lea edx, [esp + 0xc]
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm0
mov eax, dword [eax + 0xc]
push ebx
push dword [eax + 0x20]
call fcn.10151b00
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
xor edx, 0x2e
or edx, ecx
je 0x1015562e
lea ebx, [esp + 0x32]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov ebx, dword [ebx]
mov dword [esp + 4], ebx
lea ebx, [esp + 0x32]
movzx ebx, word [ebx + 4]
mov word [esp + 8], bx
movzx ebx, word [esp + 0x30]
cmp bx, word [ebp + 8]
mov ebx, dword [esp + 0x2c]
je 0x10155671
add esi, 0x10
add edi, 0xffffffff
jb 0x10155560
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x1015561c
mov ecx, dword [esp + 0xc]
sub ecx, dword [eax]
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], ecx
jmp 0x1015561c
cmp dword [edx + 0x14], 0
jne 0x1015561c
mov dword [edx + 0x14], 1
mov dword [edx + 0x18], 0
mov eax, dword [esp]
mov dword [eax + 4], 0
mov dword [eax], 0x2e
jmp 0x10155697
lea edx, [esp + 0x32]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
movzx eax, word [edx + 4]
movzx edx, word [esp + 0x30]
mov dword [esp + 4], esi
mov dword [ecx + 0x12], esi
mov esi, dword [esp + 0x28]
mov word [ecx + 0x16], ax
mov word [esp + 8], ax
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], esi
mov word [ecx + 0x10], dx
mov dword [ecx + 4], 0
mov dword [ecx], 0x2f
jmp 0x10155697
movzx esi, word [esp + 8]
mov edi, dword [esp]
mov word [edi + 0x16], si
mov esi, dword [esp + 4]
mov dword [edi + 0x12], esi
mov dword [edi + 4], ecx
movzx ecx, word [ebp + 8]
mov dword [edi], eax
mov dword [edi + 8], edx
mov dword [edi + 0xc], ebx
mov word [edi + 0x10], cx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10330a14
push 5
push edi
call fcn.1002ac30
add esp, 0xc
ud2

Function at 0x101556c0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x300
mov edi, dword [ebp + 8]
call fcn.101556d7
Function at 0x1015c3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x200
mov eax, dword [ebp + 8]
call fcn.1015c3c7
Function at 0x10163f50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x10164074
mov dword [esp], ecx
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
movzx ecx, byte [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ch, dl
and ch, 0x3f
cmp ch, 0xd
je 0x10164095
and edx, 0x3f
cmp edx, 0xe
je 0x101640a4
cmp edx, 0xf
jne 0x10164083
mov eax, dword [edi + 0x68]
test eax, eax
je 0x10164083
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x10164106
mov edx, dword [ebx + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
xor edi, edi
mov dword [esp + 0x24], eax
mov dword [esp + 8], edx
mov edx, ecx
mov ecx, dword [esp + 8]
jmp 0x10163fd8
mov dword [esp + 0xc], edx
sub edx, edi
jbe 0x10164017
mov esi, dword [ebp + 0xc]
shr edx, 1
xor ebx, ebx
add edx, edi
imul eax, edx, 0x110
cmp dword [ecx + eax + 0x108], esi
mov eax, 0xff
setne bl
cmovb ebx, eax
cmp bl, 1
je 0x10163fd0
movzx eax, bl
cmp eax, 0xff
jne 0x10164106
inc edx
mov edi, edx
mov edx, dword [esp + 0xc]
sub edx, edi
ja 0x10163fd8
test edi, edi
je 0x10164106
mov eax, dword [esp + 0x28]
dec edi
cmp edi, eax
jae 0x1016417b
mov edx, dword [esp + 8]
imul ecx, edi, 0x110
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x18]
cmp dword [edx + ecx + 0xa8], 0
jne 0x10164059
add edx, ecx
mov ecx, dword [edx + 0xac]
cmp ecx, eax
jbe 0x10164128
mov edx, dword [esp]
movzx eax, byte [esp + 0x12]
movzx esi, word [esp + 0x10]
mov byte [esp + 6], al
mov word [esp + 4], si
jmp 0x10164109
mov dword [ecx + 4], 0
mov byte [ecx], 0x4b
jmp 0x10164120
mov eax, dword [esp]
mov dword [eax + 4], 0
mov byte [eax], 0x4b
jmp 0x10164120
movzx edx, cl
mov ecx, dword [esp]
push esi
push edi
push ebx
push eax
push dword [ebp + 0x14]
jmp 0x101640d2
mov edx, ebx
movzx ebx, cl
lea ecx, [esp + 0x10]
push ebx
push eax
call fcn.1015bd30
add esp, 8
movzx eax, byte [esp + 0x10]
cmp al, 0x4b
jne 0x101640dc
mov ecx, dword [esp]
mov edx, ebx
push esi
push edi
push dword [ebp + 0x18]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.10162840
add esp, 0x14
jmp 0x10164120
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp]
movzx edi, word [esp + 0x11]
mov esi, dword [esp + 0x14]
movsd xmm0, qword [esp + 0x18]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
movsd qword [edx + 8], xmm0
jmp 0x10164120
mov edx, dword [esp]
movzx eax, byte [esp + 6]
movzx esi, word [esp + 4]
mov byte [edx + 3], al
mov word [edx + 1], si
mov byte [edx], 0x37
mov dword [edx + 4], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
sub eax, ecx
xor ecx, ecx
cmp byte [edx + 0xc9], 8
mov dword [esp + 8], edx
mov edi, eax
sete cl
shl ecx, 3
add ecx, dword [edx + 0xcc]
mov edx, dword [edx + 0xc4]
sub ecx, edx
add ecx, 4
sub edi, ecx
jb 0x10164174
cmp edi, edx
jae 0x10164174
mov edi, dword [esp + 0x24]
mov ecx, dword [esp]
mov edx, 1
add edi, 8
push esi
push edi
push ebx
push eax
push dword [esp + 0x18]
jmp 0x101640d2
mov ecx, eax
jmp 0x10164059
push 0x10438f04
push eax
push edi
call fcn.100273d0
add esp, 0xc
ud2