joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e67a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0xc], esi
test ebp, ebp
je 0x6e6922
test ebx, ebx
je 0x6e6922
mov ecx, dword [esp + 0x40]
cmp ecx, 0x10
jbe 0x6e6922
test esi, esi
je 0x6e6922
push edi
mov edi, ecx
mov eax, 0x10
and edi, 0xf
cmove edi, eax
cmp ecx, 0x20
jbe 0x6e6823
push dword [esp + 0x10]
cmp edi, eax
mov edx, 0x20
mov esi, ecx
cmove eax, edx
and esi, 0xfffffff0
sub esi, eax
mov eax, dword [ebp + 0x1c]
push esi
push ebx
push ebp
call eax
add ebx, esi
add esp, 0x10
add dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
push edi
lea eax, [ebx + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.006f8110
lea eax, [esp + 0x30]
push eax
mov eax, dword [ebp + 0x14]
push ebx
push ebp
call eax
add esp, 0x18
xor eax, eax
test edi, edi
je 0x6e68a4
cmp edi, 0x20
jb 0x6e6893
mov ecx, edi
mov edx, edi
and ecx, 0x1f
sub edx, ecx
jmp 0x6e6860
movdqu xmm0, xmmword [esp + eax + 0x24]
movdqu xmm1, xmmword [esp + eax + 0x14]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x24], xmm1
movdqu xmm0, xmmword [esp + eax + 0x34]
movdqu xmm1, xmmword [esp + eax + 0x24]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x34], xmm1
add eax, 0x20
cmp eax, edx
jb 0x6e6860
cmp eax, edi
jae 0x6e68a4
mov cl, byte [esp + eax + 0x14]
xor byte [esp + eax + 0x24], cl
inc eax
cmp eax, edi
jb 0x6e6897
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.006f8110
add esp, 0xc
test edi, edi
je 0x6e690b
mov eax, 0x10
sub eax, edi
push eax
lea eax, [esp + 0x28]
add eax, edi
push eax
lea eax, [esp + 0x1c]
add eax, edi
push eax
call fcn.006f8110
lea eax, [esp + 0x20]
push eax
push eax
mov eax, dword [ebp + 0x14]
push ebp
call eax
mov eax, dword [ebp + 0x28]
add esp, 0x18
xor eax, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [ebp + 0x2c]
xor ecx, dword [esp + 0x18]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x30]
xor ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x34]
xor ecx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x28
ret
Function at 0x6e6cf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, esi
mov dword [esp + 0x10], ecx
and edi, 0xf
test ecx, ecx
je 0x6e6e71
cmp esi, 0x10
jbe 0x6e6e71
mov eax, esi
and eax, 0xfffffff0
cmp eax, 0x10
jbe 0x6e6d54
mov eax, dword [ecx + 0x18]
and esi, 0xfffffff0
push ebx
sub esi, 0x10
push esi
push ebp
push ecx
call eax
mov ecx, dword [esp + 0x20]
add ebp, esi
add esp, 0x10
add ebx, esi
mov esi, dword [esp + 0x48]
mov eax, dword [ecx + 0x28]
lea edx, [ecx + 0x28]
xor eax, dword [ebp]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
xor eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
xor eax, dword [edx + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push eax
mov eax, dword [ecx + 0x10]
push ecx
mov dword [esp + 0x20], edx
call eax
add esp, 0xc
test edi, edi
je 0x6e6e48
push edi
lea eax, [ebp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.006f8110
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.006f8110
add esp, 0x18
xor eax, eax
test edi, edi
je 0x6e6e14
cmp edi, 0x20
jb 0x6e6e03
mov ecx, edi
mov edx, edi
and ecx, 0x1f
sub edx, ecx
nop
movdqu xmm0, xmmword [esp + eax + 0x18]
movdqu xmm1, xmmword [esp + eax + 0x28]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x18], xmm1
movdqu xmm0, xmmword [esp + eax + 0x28]
movdqu xmm1, xmmword [esp + eax + 0x38]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x28], xmm1
add eax, 0x20
cmp eax, edx
jb 0x6e6dd0
cmp eax, edi
jae 0x6e6e14
mov cl, byte [esp + eax + 0x28]
xor byte [esp + eax + 0x18], cl
inc eax
cmp eax, edi
jb 0x6e6e07
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax + 0x10]
call eax
movdqu xmm0, xmmword [edi]
add esp, 0xc
mov eax, esi
movdqu xmmword [ebx], xmm0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2c
ret
movdqu xmm0, xmmword [ebx - 0x10]
pop edi
mov eax, esi
movdqu xmmword [ebx], xmm0
pop esi
movdqu xmm0, xmmword [esp + 0x10]
pop ebp
movdqu xmmword [ebx - 0x10], xmm0
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2c
ret
Function at 0x6e7300
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub esp, 8
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x6e7360
call fcn.0070307a
add eax, 0x40
push eax
push 0x7a2bc0
call fcn.00703bc4
add esp, 8
mov eax, 0x10300001
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.006f7ca4
add esp, 8
ret
push esi
push dword [esp + 0x18]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x6e73aa
call fcn.0070307a
add eax, 0x40
push eax
push str.CryptGenRandom_failed._n
call fcn.00703bc4
add esp, 8
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x10300001
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.006f7ca4
add esp, 8
ret
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
xor ecx, esp
call fcn.006f7ca4
add esp, 8
ret
Function at 0x6e7920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x7c]
push ebx
mov ebx, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x8c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x88]
push esi
mov esi, dword [esp + 0x80]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x18], ebx
push eax
lea eax, [esp + 0x24]
mov edi, 0x1c0
push eax
call fcn.006e5160
add esp, 0xc
push 0x1c
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.006e75b0
push 7
push dword [esp + 0x2c]
lea eax, [esp + 0x58]
push eax
call fcn.006ebc90
push dword [esp + 0x38]
lea eax, [esp + 0x60]
push dword [esp + 0x40]
push 7
push eax
push esi
call fcn.006e5df0
add esp, 0x2c
test eax, eax
je 0x6e7a8c
push esi
call fcn.006e4d80
push dword [esp + 0x20]
lea eax, [esp + 0x68]
push 7
push esi
push 7
push eax
call fcn.006eb900
push 7
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.006eb060
add esp, 0x24
cmp eax, 3
je 0x6e7a8c
push 7
push dword [esp + 0x20]
lea ebx, [esi + 0x20]
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.006eb420
push 0x1c
push dword [esp + 0x2c]
lea eax, [esp + 0x40]
push eax
call fcn.006eb5f0
push 7
push dword [esp + 0x3c]
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.006eb6a0
push 0x1c
push dword [esp + 0x40]
lea eax, [esp + 0x78]
push eax
call fcn.006eb5f0
push 7
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.006eb000
add esp, 0x44
test eax, eax
je 0x6e7a61
push 7
push dword [esp + 0x20]
lea eax, [esp + 0x30]
push eax
call fcn.006ebf40
add esp, 0xc
push 7
push dword [esp + 0x20]
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.006eb6a0
push 7
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.006eb060
add esp, 0x1c
cmp eax, 3
jne 0x6e7ab5
mov ebx, dword [esp + 0x14]
dec edi
jns 0x6e7977
push 0x40
push 0
push ebp
call fcn.006f87a0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x70
ret
test edi, edi
js 0x6e7a93
lea eax, [esp + 0x60]
push eax
push 0x1c
push ebp
call fcn.006ebec0
lea ecx, [esp + 0x34]
mov dword [ebp + 0x1c], 0
push ecx
lea ecx, [ebp + 0x20]
push 0x1c
push ecx
call fcn.006ebec0
mov ecx, dword [esp + 0x94]
add esp, 0x18
mov dword [ebp + 0x3c], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x70
ret

Function at 0x6e7ef0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x6e7f43
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x6e7f42
push ebx
mov ebx, dword [esp + 0x18]
push esi
xor esi, esi
test ebx, ebx
je 0x6e7f40
mov eax, dword [edi]
movzx ecx, byte [esi + ebp]
mov edx, 8
xor eax, ecx
jmp 0x6e7f20
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xa001
xor eax, ecx
dec edx
jne 0x6e7f20
inc esi
mov dword [edi], eax
cmp esi, ebx
jb 0x6e7f10
pop esi
pop ebx
pop ebp
pop edi
ret
Function at 0x6e9e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x6e9e86
add eax, 0x188
mov dword [esp + 4], eax
jmp fcn.006e7f50
ret

Function at 0x6e9e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
je 0x6e9efe
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6e9efe
dec eax
lea ecx, [ebp + 0x188]
shr eax, 3
push ebx
inc eax
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push edi
jmp 0x6e9ec0
mov edi, dword [eax]
mov ebx, dword [eax + 4]
push esi
push eax
push ecx
call fcn.006e7f50
mov eax, dword [ebp]
lea ecx, [ebp + 0x188]
xor dword [esi], eax
add esp, 0xc
mov eax, dword [ebp + 4]
xor dword [esi + 4], eax
add esi, 8
mov eax, dword [esp + 0x18]
add eax, 8
mov dword [ebp], edi
dec dword [esp + 0x14]
mov dword [ebp + 4], ebx
mov dword [esp + 0x18], eax
jne 0x6e9ec0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x6e9f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x6e9f14
add eax, 8
mov dword [esp + 4], eax
jmp fcn.006e7f50
ret

Function at 0x6e9f20
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x6e9f78
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x6e9f77
push ebp
mov ebp, dword [esp + 0x14]
lea ecx, [edi + 8]
dec ebx
push esi
mov esi, dword [esp + 0x1c]
sub ebp, esi
shr ebx, 3
inc ebx
mov eax, dword [esi + ebp]
xor eax, dword [edi]
mov dword [esi], eax
mov eax, dword [esi + ebp + 4]
xor eax, dword [edi + 4]
push esi
push esi
push ecx
mov dword [esi + 4], eax
call fcn.006e7f50
mov eax, dword [esi]
lea ecx, [edi + 8]
mov dword [edi], eax
add esp, 0xc
mov eax, dword [esi + 4]
add esi, 8
mov dword [edi + 4], eax
dec ebx
jne 0x6e9f46
pop esi
pop ebp
pop ebx
pop edi
ret

Function at 0x6ea4f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x18]
xor cl, cl
mov eax, edi
mov bh, 1
mov dword [esp + 8], eax
test edi, edi
je 0x6ea54a
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
nop
movzx edx, bh
lea esi, [esi + 1]
inc bh
mov bl, byte [edx + ebp]
add cl, bl
mov byte [esp + 0x20], cl
movzx ecx, cl
mov al, byte [ecx + ebp]
mov byte [edx + ebp], al
mov byte [ecx + ebp], bl
movzx ecx, byte [edx + ebp]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + ebp]
xor byte [esi - 1], cl
mov cl, byte [esp + 0x20]
dec edi
jne 0x6ea510
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x6ea5b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x78
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x74], eax
mov ecx, dword [esp + 0x84]
mov eax, 0x20
mov edx, dword [esp + 0x80]
push ebx
mov ebx, dword [esp + 0x8c]
movdqu xmm0, xmmword [ecx]
push esi
mov esi, dword [esp + 0x84]
push edi
mov edi, dword [esp + 0x98]
cmp edi, eax
movdqu xmmword [esp + 0x2c], xmm0
cmova edi, eax
mov eax, dword [ecx + 0x18]
movq xmm0, qword [ecx + 0x10]
mov dword [esp + 0x44], eax
mov eax, dword [ecx + 0x38]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x64]
push 1
push eax
movq qword [esp + 0x44], xmm0
lea eax, [esp + 0x34]
movdqu xmm0, xmmword [ecx + 0x20]
push eax
push edx
movdqu xmmword [esp + 0x58], xmm0
push esi
movq xmm0, qword [ecx + 0x30]
movq qword [esp + 0x6c], xmm0
call fcn.006e4ca0
add esp, 0x14
test eax, eax
je 0x6ea704
lea eax, [esp + 0xc]
push eax
push 0x1c
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x38]
push 0x38
push eax
call fcn.006ea720
add esp, 0x14
xor ecx, ecx
test edi, edi
je 0x6ea6ed
cmp edi, 0x20
jb 0x6ea6d2
lea edx, [ebx - 1]
lea eax, [esp + edi + 0xb]
add edx, edi
cmp ebx, eax
ja 0x6ea684
lea eax, [esp + 0xc]
cmp edx, eax
jae 0x6ea6d2
mov eax, edi
lea esi, [esp + 0xc]
and eax, 0x1f
mov edx, edi
push ebp
sub edx, eax
lea ebp, [esp + 0x20]
sub esi, ebx
mov eax, ebx
sub ebp, ebx
lea esp, [esp]
movdqu xmm0, xmmword [eax]
add ecx, 0x20
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm0, xmmword [eax - 0x10]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp ecx, edx
jb 0x6ea6a0
pop ebp
cmp ecx, edi
jae 0x6ea6ed
lea edx, [esp + 0xc]
sub edx, ebx
lea eax, [ebx + ecx]
sub edi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edi
jne 0x6ea6e1
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x78
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x78
ret
Function at 0x6ea7d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x78
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x84]
mov ecx, 0x20
push ebx
mov ebx, dword [esp + 0x80]
push ebp
mov ebp, dword [esp + 0x88]
push esi
mov esi, dword [esp + 0x98]
cmp esi, ecx
push edi
mov edi, dword [esp + 0x98]
cmova esi, ecx
lea ecx, [esp + 0x4c]
push ecx
push eax
push ebx
call fcn.006e4ff0
add esp, 0xc
test eax, eax
jne 0x6ea8fa
push 1
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x54]
push eax
push ebp
push ebx
call fcn.006e4ca0
add esp, 0x14
test eax, eax
je 0x6ea8fa
lea eax, [esp + 0x10]
push eax
push 0x1c
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x58]
push 0x38
push eax
call fcn.006ea720
add esp, 0x14
xor ecx, ecx
test esi, esi
je 0x6ea8e2
cmp esi, 0x20
jb 0x6ea8c7
lea edx, [edi - 1]
lea eax, [esp + esi + 0xf]
add edx, esi
cmp edi, eax
ja 0x6ea87f
lea eax, [esp + 0x10]
cmp edx, eax
jae 0x6ea8c7
mov eax, esi
lea ebx, [esp + 0x10]
and eax, 0x1f
lea ebp, [esp + 0x20]
mov edx, esi
sub ebx, edi
sub edx, eax
mov eax, edi
sub ebp, edi
movdqu xmm0, xmmword [eax]
add ecx, 0x20
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [ebx + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm0, xmmword [eax - 0x10]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp ecx, edx
jb 0x6ea896
cmp ecx, esi
jae 0x6ea8e2
lea edx, [esp + 0x10]
sub edx, edi
lea eax, [edi + ecx]
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec esi
jne 0x6ea8d6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x78
ret
mov ecx, dword [esp + 0x84]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x78
ret
Function at 0x6eccc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
movdqu xmm2, xmmword [eax]
mov eax, dword [esp + 8]
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqa xmmword [eax], xmm2
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x10], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x20], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x30], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x40], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x10
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x50], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm3, 0x20
pxor xmm2, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x60], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x70], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x80], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x1b
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm2, xmm3
movdqa xmmword [eax + 0x90], xmm3
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm3
movdqa xmm1, xmm2
pxor xmm1, xmm0
pslldq xmm2, 4
aeskeygenassist xmm0, xmm3, 0x36
pxor xmm1, xmm2
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movdqa xmmword [eax + 0xa0], xmm1
ret
Function at 0x6ecf30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
lea eax, [esp + 0x10]
movdqa xmmword [esp], xmm0
push eax
lea eax, [esp + 0x24]
movdqa xmmword [edx], xmm0
push eax
lea eax, [esp + 8]
movdqa xmmword [esp + 0x18], xmm1
aeskeygenassist xmm0, xmm1, 1
push eax
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [esp + 0x2c], xmm0
call fcn.006ed480
movaps xmm0, xmmword [edx + 0x10]
lea eax, [esp + 0x1c]
movdqa xmm1, xmmword [esp + 0xc]
push eax
shufpd xmm0, xmm1, 0
lea eax, [esp + 0x30]
shufpd xmm1, xmmword [esp + 0x20], 1
push eax
movaps xmmword [edx + 0x10], xmm0
lea eax, [esp + 0x14]
aeskeygenassist xmm0, xmmword [esp + 0x24], 2
push eax
movdqa xmmword [edx + 0x20], xmm1
movdqa xmmword [esp + 0x38], xmm0
call fcn.006ed480
movdqa xmm0, xmmword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
movdqa xmmword [edx + 0x30], xmm0
lea eax, [esp + 0x3c]
movdqa xmm0, xmmword [esp + 0x2c]
push eax
movdqa xmmword [edx + 0x40], xmm0
lea eax, [esp + 0x20]
aeskeygenassist xmm0, xmm0, 4
push eax
movdqa xmmword [esp + 0x44], xmm0
call fcn.006ed480
movaps xmm0, xmmword [edx + 0x40]
lea eax, [esp + 0x34]
movdqa xmm1, xmmword [esp + 0x24]
push eax
shufpd xmm0, xmm1, 0
lea eax, [esp + 0x48]
shufpd xmm1, xmmword [esp + 0x38], 1
push eax
movaps xmmword [edx + 0x40], xmm0
lea eax, [esp + 0x2c]
aeskeygenassist xmm0, xmmword [esp + 0x3c], 8
push eax
movdqa xmmword [edx + 0x50], xmm1
movdqa xmmword [esp + 0x50], xmm0
call fcn.006ed480
movdqa xmm0, xmmword [esp + 0x30]
lea eax, [esp + 0x40]
push eax
movdqa xmmword [edx + 0x60], xmm0
lea eax, [esp + 0x54]
movdqa xmm0, xmmword [esp + 0x44]
push eax
movdqa xmmword [edx + 0x70], xmm0
lea eax, [esp + 0x38]
aeskeygenassist xmm0, xmm0, 0x10
push eax
movdqa xmmword [esp + 0x5c], xmm0
call fcn.006ed480
movaps xmm0, xmmword [edx + 0x70]
movdqa xmm1, xmmword [esp + 0x3c]
shufpd xmm0, xmm1, 0
shufpd xmm1, xmmword [esp + 0x4c], 1
movaps xmmword [edx + 0x70], xmm0
aeskeygenassist xmm0, xmmword [esp + 0x4c], 0x20
movdqa xmmword [edx + 0x80], xmm1
movdqa xmmword [esp + 0x5c], xmm0
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.006ed480
movdqa xmm0, xmmword [esp + 0x48]
lea eax, [esp + 0x58]
add esp, 0x48
movdqa xmmword [edx + 0x90], xmm0
movdqa xmm0, xmmword [esp + 0x10]
movdqa xmmword [edx + 0xa0], xmm0
aeskeygenassist xmm0, xmm0, 0x40
push eax
lea eax, [esp + 0x24]
movdqa xmmword [esp + 0x24], xmm0
push eax
lea eax, [esp + 8]
push eax
call fcn.006ed480
movaps xmm0, xmmword [edx + 0xa0]
lea eax, [esp + 0x1c]
movdqa xmm1, xmmword [esp + 0xc]
push eax
shufpd xmm0, xmm1, 0
lea eax, [esp + 0x30]
shufpd xmm1, xmmword [esp + 0x20], 1
push eax
movaps xmmword [edx + 0xa0], xmm0
lea eax, [esp + 0x14]
aeskeygenassist xmm0, xmmword [esp + 0x24], 0x80
push eax
movdqa xmmword [edx + 0xb0], xmm1
movdqa xmmword [esp + 0x38], xmm0
call fcn.006ed480
movdqa xmm0, xmmword [esp + 0x18]
add esp, 0x18
movdqa xmmword [edx + 0xc0], xmm0
mov esp, ebp
pop ebp
ret
Function at 0x6f2650
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push esi
xor esi, esi
test edx, edx
je 0x6f26eb
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push edi
cmp edx, 0x20
jb 0x6f26c7
lea eax, [ebx - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x6f2681
cmp ecx, ebx
jae 0x6f26c7
movdqa xmm1, xmmword [str.gggggggggggggggg]
mov eax, edx
and eax, 0x1f
mov ecx, edx
sub ecx, eax
mov edi, ebp
mov eax, ebx
sub edi, ebx
jmp 0x6f26a0
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [esi + ebp + 0x10], xmm0
add esi, 0x20
cmp esi, ecx
jb 0x6f26a0
cmp esi, edx
jae 0x6f26e2
mov edi, edx
lea ecx, [esi + ebp]
sub ebx, ebp
sub edi, esi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor al, 0x67
mov byte [ecx - 1], al
dec edi
jne 0x6f26d4
pop edi
mov byte [edx + ebp], 0
pop ebp
pop ebx
pop esi
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax + edx], 0
ret

Function at 0x6fe844
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret