joyce8/EMBER2024-capa huggingface dataset:
Function at 0xee7450
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [ecx]
movups xmm2, xmmword [ecx + 0x10]
movups xmmword [edx], xmm1
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0x10], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movups xmmword [edx + 0x20], xmm1
movaps xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm1, 1
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0x30], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 2
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movups xmmword [edx + 0x40], xmm1
movaps xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm1, 2
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0x50], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movups xmmword [edx + 0x60], xmm1
movaps xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm1, 4
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0x70], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 8
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movups xmmword [edx + 0x80], xmm1
movaps xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm1, 8
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0x90], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movups xmmword [edx + 0xa0], xmm1
movaps xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm1, 0x10
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0xb0], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 0x20
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movups xmmword [edx + 0xc0], xmm1
movaps xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm1, 0x20
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 4
pxor xmm0, xmm1
movups xmmword [edx + 0xd0], xmm2
movaps xmm1, xmm0
pslldq xmm1, 8
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movups xmmword [edx + 0xe0], xmm1
ret
Function at 0xee76d3
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0xb1a054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
and edx, 0xfffffffe
push edi
mov edi, dword [ebx + 8]
movups xmm6, xmmword [esi]
cmp edx, edi
jae 0xee77d5
lea ecx, [edx + 1]
xorps xmm5, xmm5
xorps xmm7, xmm7
shl ecx, 4
pslldq xmm7, 8
add ecx, esi
psrldq xmm5, 8
movups xmm4, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x20]
movaps xmm3, xmm4
movaps xmm0, xmm4
pclmulqdq xmm0, xmm6, 1
pclmulqdq xmm3, xmm6, 0x10
pxor xmm3, xmm0
movaps xmm1, xmm4
pclmulqdq xmm1, xmm6, 0
movaps xmm0, xmm3
mov eax, edx
pslldq xmm0, 8
add edx, 2
pxor xmm1, xmm0
psrldq xmm3, 8
movaps xmm2, xmm1
pshufd xmm0, xmm1, 0x4e
pclmulqdq xmm2, xmmword [0xaf7dd0], 0
pxor xmm2, xmm0
shr eax, 1
movaps xmm1, xmm2
pshufd xmm0, xmm2, 0x4e
pclmulqdq xmm1, xmmword [0xaf7dd0], 0
pxor xmm1, xmm0
add eax, eax
pclmulqdq xmm4, xmm6, 0x11
pxor xmm4, xmm3
pxor xmm4, xmm1
movups xmmword [ecx - 0x30], xmm4
movups xmm3, xmmword [esi + eax*8]
movaps xmm0, xmm3
pclmulqdq xmm0, xmm3, 0
pxor xmm0, xmm7
movaps xmm1, xmm0
pshufd xmm0, xmm0, 0x4e
pclmulqdq xmm1, xmmword [0xaf7dd0], 0
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x4e
movaps xmm2, xmm1
pclmulqdq xmm2, xmmword [0xaf7dd0], 0
pxor xmm2, xmm0
pclmulqdq xmm3, xmm3, 0x11
pxor xmm3, xmm5
pxor xmm2, xmm3
movups xmmword [ecx - 0x20], xmm2
cmp edx, edi
jb 0xee7700
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00ee447d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0xee7be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 8], 0
push esi
nop word [eax + eax]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + eax]
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + eax]
inc eax
mov ecx, dword [ebp + 8]
xor esi, edx
or ecx, esi
mov dword [ebp + 8], ecx
cmp eax, 0x10
jl 0xee7c00
mov eax, dword [ebp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xeeb230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0xeeb26d
cmp esi, edx
jb 0xeeb26d
sub edx, eax
mov esi, pe_nt_image_headers32
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0xeeb255
pop esi
pop ebp
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop word [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
pxor xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [esi - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0xeeb280
pop esi
pop ebp
ret
Function at 0xeedeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xb1a054]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
xor eax, eax
mov cl, dl
mov dword [ebp - 0xc], edx
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xa]
push ebx
mov byte [ebp - 0xe], cl
mov bl, dl
mov cl, byte [ebp - 0xb]
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 8], dx
mov ch, byte [ebp - 7]
mov byte [ebp - 0xd], cl
nop dword [eax]
mov cl, byte [esi + eax]
mov bh, byte [eax + 0xaf7e40]
xor bh, cl
or bh, bl
mov bl, byte [eax + 0xaf7e60]
xor bl, cl
mov byte [ebp - 0x11], bh
or bl, byte [ebp - 0xd]
mov byte [ebp - 0x17], bl
mov byte [ebp - 0xd], bl
mov bl, byte [eax + 0xaf7e80]
xor bl, cl
or bl, byte [ebp - 0xe]
mov byte [ebp - 0x16], bl
mov byte [ebp - 0xe], bl
mov bl, byte [eax + 0xaf7ea0]
xor bl, cl
or bl, byte [ebp - 0xf]
mov byte [ebp - 0x15], bl
mov byte [ebp - 0xf], bl
mov bl, byte [eax + 0xaf7ec0]
xor bl, cl
or bl, byte [ebp - 0x10]
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x10], bl
mov bl, byte [eax + 0xaf7ee0]
xor bl, cl
or bl, ch
mov byte [ebp - 0x13], bl
mov ch, bl
mov bl, byte [eax + 0xaf7f00]
inc eax
xor bl, cl
or bl, dl
mov byte [ebp - 0x12], bl
mov dl, bl
mov bl, bh
cmp eax, 0x1f
jb 0xeedef0
mov bl, byte [eax + esi]
movzx esi, byte [eax + 0xaf7f00]
and bl, 0x7f
movzx ecx, bl
xor esi, ecx
movzx ecx, dl
movzx edx, byte [eax + 0xaf7ee0]
or esi, ecx
movzx ecx, bl
dec esi
xor edx, ecx
movzx ecx, byte [ebp - 0x13]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0xaf7ec0]
xor edx, ecx
movzx ecx, byte [ebp - 0x14]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0xaf7ea0]
xor edx, ecx
movzx ecx, byte [ebp - 0x15]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0xaf7e80]
xor edx, ecx
movzx ecx, byte [ebp - 0x16]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0xaf7e60]
movzx eax, byte [eax + 0xaf7e40]
xor edx, ecx
movzx ecx, byte [ebp - 0x17]
or edx, ecx
movzx ecx, bl
xor eax, ecx
dec edx
movzx ecx, bh
or esi, edx
or eax, ecx
mov ecx, dword [ebp - 4]
dec eax
xor ecx, ebp
or eax, esi
shr eax, 8
pop esi
and eax, 1
pop ebx
call fcn.00ee447d
mov esp, ebp
pop ebp
ret

Function at 0xeee810
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [edx], 0x61707865
mov dword [edx + 4], 0x3320646e
mov dword [edx + 8], 0x79622d32
mov dword [edx + 0xc], 0x6b206574
mov eax, dword [ecx]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x2c], eax
pop ebp
ret
Function at 0xef10e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x38], eax
mov dword [edx], 0x61707865
mov dword [edx + 4], 0x3320646e
mov dword [edx + 8], 0x79622d32
mov dword [edx + 0xc], 0x6b206574
pop ebp
ret

Function at 0xefd090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
imul eax, dword [ebp + 0xc], 0x3c0
add eax, 0xaf8180
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00efcf00
Function at 0xf218bb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov esi, ebx
test eax, eax
je 0xf21a37
push edi
push 3
pop edi
jmp 0xf218ec
mov edx, dword [ebp - 0x14]
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 8], al
inc esi
mov ch, byte [ebp - 6]
mov cl, byte [ebp - 8]
mov dword [ebp - 0x14], edx
mov dl, byte [ebp - 7]
mov byte [ebp - 3], ch
mov byte [ebp - 1], dl
mov byte [ebp - 2], cl
cmp esi, edi
jne 0xf2197e
mov edi, dword [ebp - 0x10]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0xc], al
mov esi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0xb], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], ch
cmp dword [0xb1b220], 0x10
mov ecx, 0xb1b20c
movzx eax, byte [ebp + esi - 0xc]
cmovae ecx, dword [0xb1b20c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00ecd7f4
inc esi
cmp esi, 4
jl 0xf21946
mov dl, byte [ebp - 1]
mov esi, ebx
mov cl, byte [ebp - 2]
mov ch, byte [ebp - 3]
push 3
pop edi
mov eax, dword [ebp + 8]
test eax, eax
jne 0xf218e9
mov dword [ebp + 8], esi
test esi, esi
je 0xf21a36
cmp esi, edi
jge 0xf219b5
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 8]
add eax, esi
push ebx
push eax
call fcn.00efe880
mov ch, byte [ebp - 6]
add esp, 0xc
mov dl, byte [ebp - 7]
mov cl, byte [ebp - 8]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0xc], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0xb], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 9], ch
lea eax, [esi + 1]
mov byte [ebp - 0xa], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0xf21a21
mov edi, dword [ebp - 0x10]
mov esi, eax
cmp dword [0xb1b220], 0x10
mov ecx, 0xb1b20c
movzx eax, byte [ebp + ebx - 0xc]
cmovae ecx, dword [0xb1b20c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00ecd7f4
inc ebx
cmp ebx, esi
jl 0xf219f2
mov esi, dword [ebp + 8]
push 3
pop edi
cmp esi, edi
jge 0xf21a36
sub edi, esi
mov ecx, dword [ebp - 0x10]
push 0x3d
call fcn.00ecd7f4
sub edi, 1
jne 0xf21a27
pop edi
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
leave
ret
Function at 0xf59e98
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
push edi
call fcn.0105c446
xor edx, edx
movzx ecx, bl
inc edx
test eax, eax
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
leave
ret

Function at 0xf619f7
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, ecx
xor eax, eax
push edi
push eax
push 0xb0a53b
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
call fcn.00ecd850
cmp dword [ebx + 0x1c], 0x10
mov ecx, 0x3f708a4e
mov eax, 0x2fcf7b8c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
mov edx, 0x7bcbda75
mov dword [ebp - 0x24], eax
lea eax, [ebx + 8]
cmovae eax, dword [ebx + 8]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xf0bd1553
mov dword [ebp - 0x1c], edx
movaps xmm1, xmmword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], 0xf0bd7721
pxor xmm1, xmmword [ebp - 0x30]
push ecx
push eax
movaps xmmword [ebp - 0x20], xmm1
call fcn.00f0206a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0xf61ad4
push 2
push 0
push edi
call fcn.00f05fc6
add esp, 0xc
push edi
call fcn.00f01afb
pop ecx
push 0
push 0
push edi
mov dword [ebp - 4], eax
call fcn.00f05fc6
add esp, 0xc
mov ecx, esi
push 0
push dword [ebp - 4]
call fcn.00ed28ab
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0xf61abf
mov eax, dword [esi]
push edi
push dword [ebp - 4]
push 1
push eax
call fcn.00f0a89d
push edi
call fcn.00f05a78
add esp, 0x14
lea ecx, [ebx + 8]
call fcn.00ecd7ce
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0xf6bb9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x100ac], ebx
je 0xf6bbfa
cmp dword [edi + 0x7c], ebx
jbe 0xf6bbfa
mov eax, 0xffffff5c
lea ecx, [edi + 0x100d0]
sub eax, edi
lea esi, [edi + 0xa4]
mov dword [ebp - 4], eax
call fcn.00f6d108
movzx ecx, byte [esi]
mov ebx, eax
mov edx, dword [edi + 0x100dc]
push ecx
lea ecx, [edi + 0x100d0]
call fcn.00f6d0c2
xor byte [esi], bl
inc esi
mov eax, dword [ebp - 4]
add eax, esi
pop ecx
lea ecx, [edi + 0x100d0]
cmp eax, dword [edi + 0x7c]
jb 0xf6bbc8
xor ebx, ebx
mov esi, dword [edi + 0x7c]
lea eax, [edi + 0xa4]
push esi
push eax
push dword [edi + 0x2c]
push dword [edi + 0x1c]
call dword [edi + 8]
add esp, 0x10
mov dword [edi + 0x7c], ebx
or ecx, 0xffffffff
mov edx, ebx
cmp eax, esi
cmovne edx, ecx
add dword [edi + 0x100c0], esi
mov ecx, dword [edi + 0x48]
mov eax, edx
adc dword [edi + 0x100c4], ebx
add dword [edi + 0x100c8], ecx
mov dword [edi + 0x48], ebx
adc dword [edi + 0x100cc], ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0xf6d0c2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebp + 8]
mov edx, dword [edi + 8]
movzx eax, al
shr ecx, 8
xor ecx, dword [esi + eax*4]
movzx eax, cl
add eax, dword [edi + 4]
mov dword [edi], ecx
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
mov dword [edi + 8], edx
pop edi
pop esi
pop ebp
ret
Function at 0xf85418
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, edx
mov eax, ecx
mov dword [esp + 4], eax
push esi
push edi
test ebx, ebx
je 0xf8551a
push 0x44
pop edx
call fcn.00f9a52f
mov edi, eax
test edi, edi
je 0xf8551a
mov esi, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [esp + 0xc]
push esi
call fcn.00f856f0
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi], eax
mov edx, dword [ebx + 8]
push esi
call fcn.00f855ae
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push 0
push esi
call fcn.00f85805
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push esi
call fcn.00f856f0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov edx, dword [ebx + 0x14]
push 0
push esi
call fcn.00f85805
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push esi
call fcn.00f856f0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
mov byte [edi + 4], al
mov edx, dword [ebx + 0x1c]
push esi
call fcn.00f85418
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push 0
push esi
call fcn.00f85805
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], eax
mov edx, dword [ebx + 0x2c]
push 0
push esi
call fcn.00f85805
mov dword [edi + 0x2c], eax
xor edx, edx
mov dword [edi + 0x30], edx
mov ecx, 0xfff7
mov dword [edi + 0x34], edx
add esp, 0x10
mov ax, word [ebx + 6]
or dword [edi + 0x38], 0xffffffff
and ax, cx
or dword [edi + 0x3c], 0xffffffff
or dword [edi + 0x40], 0xffffffff
mov word [edi + 6], ax
mov eax, edi
mov dword [edi + 0x24], edx
jmp 0xf8551c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xfcd830
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xfcd93c
test eax, eax
je 0xfcd93c
push esi
push edi
mov ecx, 0x10
mov esi, 0xb41ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0xfcd923
lea edi, [eax + 4]
jmp 0xfcd887
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0xfcd89c
mov dword [ebp - 4], 2
jmp 0xfcd8bd
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0xfcd8b3
mov dword [ebp - 4], 1
jmp 0xfcd8bd
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0xfcd933
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0xfcd8f6
mov byte [ecx], 0x3d
jmp 0xfcd902
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0xfcd90d
mov byte [ecx], 0x3d
jmp 0xfcd913
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0xfcd884
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4050c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453a40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x46300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 0x2c
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push edi
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea esi, [edi + 0x3c]
add esp, 0xc
mov dword [ebp - 0x18], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
jns 0x4051eb
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, dword [esi + 0x14]
jle 0x4051eb
shl ecx, 2
call fcn.0040b000
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x10], eax
test edx, edx
je 0x4051e2
mov ecx, dword [esi + 0x10]
shl ecx, 2
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x18]
add esp, 0xc
call fcn.0040b0a0
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
xorps xmm0, xmm0
mov dword [esi + 0x2c], 0
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x30], 0
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], eax
mov eax, edi
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x34], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x84], 0
movups xmmword [edi + 0x74], xmm0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret