joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417d18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x1110], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xb
jl 0x417d2d
mov dword [ebp - 4], 0x100
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x1110]
push eax
call fcn.0068f320
mov byte [ebp - 0x1106], 0
xor edx, edx
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp byte [ebp + eax - 0x1110], 0x20
ja 0x417d81
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x1110], 0x5f
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ebp + ecx - 0x1110]
add dword [ebp - 0xc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xa
jl 0x417d69
push 0x694c36
push 0x694c2e
call fcn.004abab8
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417e3a
push dword [ebp - 0x10]
push 1
push 0x1000
lea edx, [ebp - 0x1010]
push edx
call fcn.004abd98
add esp, 0x10
push dword [ebp - 0x10]
call fcn.004ab74c
pop ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov al, byte [ebp - 8]
and al, 0xff
mov edx, dword [ebp - 8]
xor byte [ebp + edx - 0x1010], al
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1000
jl 0x417ddf
push 0xa
mov eax, 0x6dfef4
call fcn.00401acc
push eax
lea edx, [ebp - 0x76e]
push edx
call fcn.004a9bd8
add esp, 0xc
test eax, eax
jne 0x417e3a
push 0xa
lea ecx, [ebp - 0x1110]
push ecx
lea eax, [ebp - 0xb56]
push eax
call fcn.004a9bd8
add esp, 0xc
test eax, eax
jne 0x417e3a
xor eax, eax
jmp 0x417e59
lea eax, [ebp - 0x1110]
mov edx, dword [ebp - 0xc]
call fcn.00417e60
dec eax
je 0x417e53
dec eax
je 0x417e57
jmp 0x417d99
mov al, 1
jmp 0x417e59
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x417e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffcdc
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
mov eax, 0x694de4
call fcn.004a9dd4
mov word [ebp - 0x20], 8
lea eax, [ebp - 4]
call fcn.0040296c
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 0x14
call fcn.00466730
push dword [0x6dfeb8]
push str._smg_mf1.mbl
pop eax
pop eax
jmp 0x4181ed
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
call fcn.004b25f0
and al, 0xff
mov edx, dword [ebp - 0x6c]
mov byte [ebp + edx - 0x1080], al
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x1000
jl 0x4181f2
push dword [ebp - 0x34]
call fcn.004a9b0c
pop ecx
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x68], eax
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x64]
jge 0x41825a
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x6c]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 0x6c]
mov byte [ebp + edx - 0xbc6], al
mov ecx, dword [ebp - 0x6c]
xor eax, eax
mov al, byte [ebp + ecx - 0xbc6]
add dword [ebp - 0x68], eax
inc dword [ebp - 0x6c]
mov edx, dword [ebp - 0x6c]
cmp edx, dword [ebp - 0x64]
jl 0x41822d
mov ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp - 0x38]
je 0x418288
mov eax, 1
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0068eae0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x41831d
mov eax, 0x6dfef4
call fcn.00401acc
push eax
lea edx, [ebp - 0x7de]
push edx
call fcn.004a9adc
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov al, byte [ebp - 0x6c]
and al, 0xff
mov edx, dword [ebp - 0x6c]
xor byte [ebp + edx - 0x1080], al
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x1000
jl 0x4182a7
push 0x694c54
push str.chk.dat
call fcn.004abab8
add esp, 8
mov dword [ebp - 0x80], eax
mov word [ebp - 0x20], 0x14
push dword [ebp - 0x80]
push 1
push 0x1000
lea ecx, [ebp - 0x1080]
push ecx
call fcn.004abf38
add esp, 0x10
push dword [ebp - 0x80]
call fcn.004ab74c
pop ecx
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0068eae0
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x47e7bc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x47e7c2
ret
Function at 0x4bc7b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor ebx, ebx
lea eax, [ebp - 0x38]
xor ecx, ecx
inc ebx
mov cl, byte [edx]
mov dword [eax], ecx
add eax, 4
add edx, dword [ebp + 0x14]
cmp ebx, 0xa
jl 0x4bc7dd
xor edx, edx
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0x34]
mov eax, dword [ecx]
inc ebx
sub eax, dword [ecx - 4]
cdq
xor eax, edx
sub eax, edx
add dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0x14]
add ecx, 4
cdq
xor eax, edx
sub eax, edx
add edi, eax
cmp ebx, 4
jl 0x4bc7fb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x20]
add ecx, 0xffffff01
cmp dword [ebp - 0xc], 0xff
setl al
and eax, 1
neg eax
and ecx, eax
add ecx, 0xff
add dword [edx], ecx
cmp edi, 0xff
setl al
and eax, 1
lea ecx, [edi - 0xff]
neg eax
mov edx, dword [ebp + 0x24]
and ecx, eax
add ecx, 0xff
add dword [edx], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x1c]
jge 0x4bc953
cmp edi, dword [ebp + 0x1c]
jge 0x4bc953
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0x18]
jge 0x4bc953
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0x18]
jge 0x4bc953
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
add eax, eax
lea ecx, [ecx + ecx*2]
add ecx, eax
lea eax, [ebp - 0x38]
add ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x28]
add ecx, 4
sar ecx, 3
mov byte [esi], cl
add esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x38]
add edx, edx
mov ecx, dword [ebp - 0x30]
add edx, dword [ebp - 0x34]
add ecx, ecx
add edx, ecx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x24]
add edx, 4
sar edx, 3
mov byte [esi], dl
add esi, dword [ebp + 0xc]
xor ebx, ebx
mov edx, dword [eax]
mov ecx, dword [eax + 0xc]
add edx, dword [eax + 4]
add ecx, ecx
add edx, dword [eax + 8]
inc ebx
add edx, ecx
add edx, dword [eax + 0x10]
add edx, dword [eax + 0x14]
add edx, dword [eax + 0x18]
add eax, 4
add edx, 4
sar edx, 3
mov byte [esi], dl
add esi, dword [ebp + 0xc]
cmp ebx, 4
jl 0x4bc8e0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x24]
add edx, edx
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
add eax, edx
add ecx, ecx
add eax, dword [ebp - 0x18]
add eax, ecx
add eax, 4
sar eax, 3
mov byte [esi], al
add esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, edx
lea ecx, [ecx + ecx*2]
add eax, edx
add eax, ecx
add eax, 4
sar eax, 3
mov byte [esi], al
jmp 0x4bc96b
mov ebx, 1
lea eax, [ebp - 0x34]
mov dl, byte [eax]
add eax, 4
mov byte [esi], dl
inc ebx
add esi, dword [ebp + 0xc]
cmp ebx, 8
jle 0x4bc95b
inc dword [ebp - 4]
inc dword [ebp - 8]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jl 0x4bc7d2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc988
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor edx, edx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
dec edx
xor ebx, ebx
lea eax, [ebp - 0x34]
xor ecx, ecx
inc ebx
mov cl, byte [edx]
inc edx
mov dword [eax], ecx
add eax, 4
cmp ebx, 0xa
jl 0x4bc9ab
xor edx, edx
xor ebx, ebx
mov esi, edx
mov edi, edx
lea ecx, [ebp - 0x30]
mov eax, dword [ecx]
inc ebx
sub eax, dword [ecx - 4]
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0x14]
add ecx, 4
cdq
xor eax, edx
sub eax, edx
add esi, eax
cmp ebx, 4
jl 0x4bc9c6
cmp edi, 0xff
lea ecx, [edi - 0xff]
setl al
and eax, 1
mov edx, dword [ebp + 0x18]
neg eax
and ecx, eax
add ecx, 0xff
add dword [edx], ecx
cmp esi, 0xff
setl al
and eax, 1
lea ecx, [esi - 0xff]
neg eax
mov edx, dword [ebp + 0x18]
and ecx, eax
add ecx, 0xff
add dword [edx + 4], ecx
cmp edi, dword [ebp + 0x14]
jge 0x4bcb24
cmp esi, dword [ebp + 0x14]
jge 0x4bcb24
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + 0x10]
jge 0x4bcb24
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x10]
jge 0x4bcb24
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add ecx, ecx
mov eax, dword [ebp - 4]
lea edx, [edx + edx*2]
add edx, ecx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x24]
add edx, 4
sar edx, 3
mov byte [eax], dl
inc dword [ebp - 4]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
add edx, edx
add ecx, ecx
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
add edx, ecx
add edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x20]
add edx, 4
sar edx, 3
mov byte [eax], dl
lea eax, [ebp - 0x34]
inc dword [ebp - 4]
xor ebx, ebx
mov edx, dword [eax]
mov ecx, dword [eax + 0xc]
add edx, dword [eax + 4]
add ecx, ecx
add edx, dword [eax + 8]
inc ebx
add edx, ecx
mov ecx, dword [ebp - 4]
add edx, dword [eax + 0x10]
add edx, dword [eax + 0x14]
add edx, dword [eax + 0x18]
add eax, 4
add edx, 4
sar edx, 3
mov byte [ecx], dl
inc dword [ebp - 4]
cmp ebx, 4
jl 0x4bcaaa
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
add edx, edx
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add eax, edx
mov edx, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
add edx, edx
add eax, edx
add eax, 4
sar eax, 3
mov byte [ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
add edx, edx
add eax, edx
lea ecx, [ecx + ecx*2]
add eax, ecx
mov edx, dword [ebp - 4]
add eax, 4
sar eax, 3
mov byte [edx], al
mov eax, dword [ebp + 0xc]
add dword [ebp - 8], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jl 0x4bc99c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8be4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xca
jne 0x4d8c1f
push dword [ebp + 8]
call fcn.004e3afa
pop ecx
mov edx, dword [ebp + 8]
cmp byte [edx + 0x40], 0
je 0x4d8c15
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0xcf
mov al, 1
pop ecx
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xcb
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0xcb
jne 0x4d8cc3
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1a0]
cmp byte [edx + 0x10], 0
je 0x4d8cb2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x4d8c51
mov eax, dword [ebp + 8]
push eax
mov edx, dword [eax + 8]
call dword [edx]
pop ecx
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ecx + 0x1a0]
call dword [eax]
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d8c6c
xor eax, eax
pop ecx
pop ebp
ret
cmp dword [ebp - 4], 2
je 0x4d8cb2
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
je 0x4d8c3e
cmp dword [ebp - 4], 3
je 0x4d8c87
cmp dword [ebp - 4], 1
jne 0x4d8c3e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
inc dword [eax + 4]
mov edx, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
cmp edx, dword [eax + 8]
jl 0x4d8c3e
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x120]
add dword [ecx + 8], edx
jmp 0x4d8c3e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x7c]
mov edx, dword [ebp + 8]
mov dword [edx + 0x84], eax
jmp 0x4d8cf2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0xcc
je 0x4d8cf2
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [edx + 0x14], 0x15
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [eax]
call dword [edx]
pop ecx
push dword [ebp + 8]
call fcn.004d8cfe
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d8cfe
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x4d8dce
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [edx + 0x190]
call dword [ecx]
pop ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x78], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0xcc
jmp 0x4d8dce
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x4d8d69
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x78]
mov dword [ecx + 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x60]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [eax + 8]
call dword [edx]
pop ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x78]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp + 8]
add edx, 0x78
push edx
push 0
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ecx + 0x194]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x78]
cmp ecx, dword [ebp - 4]
jne 0x4d8d9d
xor eax, eax
pop ecx
pop ebp
ret
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x78]
mov eax, dword [ebp + 8]
cmp ecx, dword [eax + 0x60]
jb 0x4d8d38
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [edx + 0x190]
call dword [ecx + 4]
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [eax + 0x190]
call dword [edx]
pop ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x78], eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x190]
cmp byte [ecx + 8], 0
jne 0x4d8d9d
mov eax, dword [ebp + 8]
cmp byte [eax + 0x41], 0
je 0x4d8ded
mov edx, 0xce
jmp 0x4d8df2
mov edx, 0xcd
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov al, 1
pop ecx
pop ebp
ret
Function at 0x4f5fc3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x4f600c
cmp dword [ebp + 0xc], 0xf0
jae 0x4f5ffa
push dword [ebp - 4]
call fcn.004f9239
pop ecx
push 2
call fcn.004f918c
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
push 0xf0
push 0
push dword [ebp - 4]
call fcn.004a99a8
add esp, 0xc
pop ecx
pop ebp
ret
Function at 0x5f0108
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0x9908b0df
movd mm4, eax
punpckldq mm4, mm4
mov eax, 1
movd mm5, eax
punpckldq mm5, mm5
movq mm6, mm5
psllq mm6, 0x1f
movq mm7, mm6
psubd mm7, mm5
lea esi, [0x71f2f8]
add esi, 0x388
mov edi, esi
add edi, 0x634
mov ecx, 0xffffff8f
movq mm0, qword [esi + ecx*8]
pand mm0, mm6
movq mm1, qword [esi + ecx*8 + 4]
movq mm2, qword [edi + ecx*8]
pand mm1, mm7
por mm0, mm1
movq mm3, mm1
psrld mm0, 1
pand mm3, mm5
pxor mm2, mm0
psubd mm3, mm5
movq mm0, qword [esi + ecx*8 + 8]
pandn mm3, mm4
movq mm1, qword [esi + ecx*8 + 0xc]
pxor mm3, mm2
movq mm2, qword [edi + ecx*8 + 8]
pand mm0, mm6
movq qword [esi + ecx*8], mm3
pand mm1, mm7
inc ecx
jne 0x5f015d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov dword [esi], ebx
lea esi, [0x71f2f8]
mov eax, dword [esi]
add esi, 0x9c0
mov dword [esi], eax
mov edi, esi
sub edi, 0x38c
add esi, 4
add edi, 4
mov ecx, 0xffffff39
movq mm0, qword [esi + ecx*8]
pand mm0, mm6
movq mm1, qword [esi + ecx*8 + 4]
movq mm2, qword [edi + ecx*8]
pand mm1, mm7
por mm0, mm1
movq mm3, mm1
psrld mm0, 1
pand mm3, mm5
pxor mm2, mm0
psubd mm3, mm5
movq mm0, qword [esi + ecx*8 + 8]
pandn mm3, mm4
movq mm1, qword [esi + ecx*8 + 0xc]
pxor mm3, mm2
movq mm2, qword [edi + ecx*8 + 8]
pand mm0, mm6
movq qword [esi + ecx*8], mm3
pand mm1, mm7
inc ecx
jne 0x5f01f8
push ebp
mov eax, 0x9d2c5680
movd mm6, eax
punpckldq mm6, mm6
mov eax, 0xefc60000
movd mm7, eax
punpckldq mm7, mm7
lea esi, [0x71f2f8]
lea edi, [0x71fcbc]
add esi, 0x9c0
add edi, 0x9c0
mov ecx, 0xfffffec8
movq mm0, qword [esi + ecx*8]
movq mm1, mm0
psrld mm0, 0xb
pxor mm0, mm1
movq mm2, qword [esi + ecx*8 + 8]
movq mm1, mm0
pslld mm0, 7
movq mm3, mm2
psrld mm2, 0xb
pand mm0, mm6
pxor mm2, mm3
pxor mm0, mm1
movq mm3, mm2
pslld mm2, 7
movq mm1, mm0
pslld mm0, 0xf
pand mm2, mm6
pand mm0, mm7
pxor mm2, mm3
pxor mm0, mm1
movq mm3, mm2
pslld mm2, 0xf
movq mm1, mm0
pand mm2, mm7
psrld mm0, 0x12
pxor mm2, mm3
pxor mm1, mm0
movq mm0, qword [esi + ecx*8 + 0x10]
movq mm3, mm2
movq qword [edi + ecx*8], mm1
psrld mm2, 0x12
movq mm1, mm0
pxor mm3, mm2
movq mm2, qword [esi + ecx*8 + 0x18]
psrld mm0, 0xb
movq qword [edi + ecx*8 + 8], mm3
pxor mm0, mm1
add ecx, 2
jne 0x5f0274
pop ebp
emms
xor eax, eax
mov dword [0x71f2f4], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5f02f8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [0x6b75d8], 0
je 0x5f0311
call fcn.005f0108
jmp 0x5f044e
lea esi, [0x71f2f8]
add esi, 0x38c
mov edi, esi
add edi, 0x634
mov ecx, 0xffffff1d
mov eax, dword [esi + ecx*4]
mov ebx, dword [esi + ecx*4 + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi + ecx*4]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [esi + ecx*4], ebx
mov ebx, dword [esi + ecx*4 + 8]
inc ecx
jne 0x5f0331
lea esi, [0x71f2f8]
mov eax, dword [esi]
add esi, 0x9c0
mov dword [esi], eax
mov edi, esi
sub edi, 0x38c
mov ecx, 0xfffffe73
mov eax, dword [esi + ecx*4]
mov ebx, dword [esi + ecx*4 + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi + ecx*4]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [esi + ecx*4], ebx
mov ebx, dword [esi + ecx*4 + 8]
inc ecx
jne 0x5f038d
push ebp
lea esi, [0x71f2f8]
lea edi, [0x71fcbc]
add esi, 0x9c0
add edi, 0x9c0
mov ecx, 0xfffffec8
mov eax, dword [esi + ecx*8]
mov edx, dword [esi + ecx*8 + 4]
mov ebx, eax
shr eax, 0xb
mov ebp, edx
shr edx, 0xb
xor eax, ebx
xor edx, ebp
mov ebx, eax
shl eax, 7
mov ebp, edx
shl edx, 7
and eax, 0x9d2c5680
and edx, 0x9d2c5680
xor eax, ebx
xor edx, ebp
mov ebx, eax
shl eax, 0xf
mov ebp, edx
shl edx, 0xf
and eax, 0xefc60000
and edx, 0xefc60000
xor eax, ebx
xor edx, ebp
mov ebx, eax
shr eax, 0x12
mov ebp, edx
shr edx, 0x12
xor eax, ebx
xor edx, ebp
mov dword [edi + ecx*8], eax
mov dword [edi + ecx*8 + 4], edx
mov eax, dword [esi + ecx*8 + 8]
inc ecx
jne 0x5f03e6
pop ebp
xor eax, eax
mov dword [0x71f2f4], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5fa1bc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push esi
push edi
mov eax, 0x6b8e98
call fcn.004a9dd4
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.005fd5f4
add dword [ebp - 8], 2
mov eax, dword [ebp + 8]
mov edx, 0x6bce50
add eax, 0x18
mov ecx, 0x6bcbbc
add esp, 0xc
mov dword [eax], edx
mov dword [eax], ecx
mov edx, 0x6bcbd8
mov dword [eax], edx
mov ecx, 0x6bcc0c
mov dword [eax], ecx
mov edx, 0x6bce50
mov eax, dword [ebp + 8]
mov ecx, 0x6bcb9c
add eax, 0x1c
mov dword [eax], edx
mov dword [eax], ecx
mov eax, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], ecx
mov eax, dword [ebp + 8]
add eax, 0x28
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov esi, edx
lea edi, [ecx + 0x30]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x40], edx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x44], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x48], ecx
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x50], 1
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5fa2b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push esi
push edi
mov eax, 0x6b8ebc
call fcn.004a9dd4
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.005fd5f4
add dword [ebp - 8], 2
mov eax, dword [ebp + 8]
mov edx, 0x6bce50
add eax, 0x18
mov ecx, 0x6bcbbc
add esp, 0xc
mov dword [eax], edx
mov dword [eax], ecx
mov edx, 0x6bcbd8
mov dword [eax], edx
mov ecx, 0x6bcc0c
mov dword [eax], ecx
mov edx, 0x6bce50
mov eax, dword [ebp + 8]
mov ecx, 0x6bcb9c
add eax, 0x1c
mov dword [eax], edx
mov dword [eax], ecx
mov eax, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], ecx
mov eax, dword [ebp + 8]
add eax, 0x28
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov esi, edx
lea edi, [ecx + 0x30]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x40], edx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x44], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x48], ecx
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x50], 1
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x608e6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov ecx, 0xc
mov eax, dword [ebp + 0x10]
cdq
idiv ecx
mov dword [ebp + 0x10], edx
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
cmp eax, 0xc
jb 0x608ee9
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x608ec2
mov edx, dword [ebp - 8]
mov bl, byte [eax + esi]
xor byte [edi], bl
inc eax
inc edi
dec edx
cmp eax, 0xc
jb 0x608ea8
xor ecx, ecx
mov dword [ebp + 0x10], ecx
mov dword [ebp - 8], edx
cmp edx, 0xc
jb 0x608ee9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0xc
div ecx
mov dword [ebp - 8], edx
mov ecx, eax
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov edx, dword [esi + 8]
xor dword [edi], eax
xor dword [edi + 4], ebx
xor dword [edi + 8], edx
add edi, 0xc
dec ecx
jne 0x608edb
mov edx, dword [ebp - 8]
cmp edx, 0
je 0x608f05
mov eax, dword [ebp + 0x10]
mov bl, byte [eax + esi]
xor byte [edi], bl
inc eax
cmp eax, 0xc
jne 0x608f01
xor eax, eax
inc edi
dec edx
jne 0x608ef4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x62bfe0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 4]
mov dl, byte [eax + 7]
add edx, ecx
xor ecx, ecx
mov cl, byte [eax + 5]
add edx, ecx
xor ecx, ecx
mov cl, byte [eax + 6]
add edx, ecx
movzx ecx, word [eax]
cmp edx, ecx
je 0x62c03e
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
jmp 0x62c018
shl dword [eax + 0x1c], 1
or dword [eax + 0x1c], 1
inc edx
movzx ecx, word [eax]
cmp edx, ecx
jl 0x62c010
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
not ecx
not edx
and edx, ecx
mov ecx, dword [eax + 0x14]
not ecx
and edx, ecx
mov ecx, dword [eax + 0x18]
not ecx
and edx, ecx
and dword [eax + 0x1c], edx
pop ebp
ret
xor edx, edx
mov dword [eax + 0x1c], edx
pop ebp
ret