joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101538a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, edx
mov dword [ebp - 0x14], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x7258595a
call fcn.10152089
mov edi, eax
mov dword [esp], esi
mov dword [esp + 4], 0x6758595a
call fcn.10152089
mov ebx, eax
mov dword [esp], esi
mov dword [esp + 4], 0x6258595a
call fcn.10152089
mov esi, eax
xor eax, eax
test edi, edi
je 0x1015398c
test ebx, ebx
je 0x1015398c
test esi, esi
je 0x1015398c
movsd xmm0, qword [esi]
movsd xmm1, qword [ebx]
movsd xmm2, qword [edi]
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0xc], xmm1
movsd qword [esp + 4], xmm2
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
mov dword [esp], edi
call fcn.10155a98
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [ebx + 8]
mov eax, dword [ebp - 0x10]
movsd xmm2, qword [eax + 8]
lea eax, [edi + 0x18]
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0xc], xmm1
movsd qword [esp + 4], xmm2
mov dword [esp], eax
call fcn.10155a98
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [ebx + 0x10]
mov eax, dword [ebp - 0x10]
movsd xmm2, qword [eax + 0x10]
add edi, 0x30
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0xc], xmm1
movsd qword [esp + 4], xmm2
mov dword [esp], edi
call fcn.10155a98
xor eax, eax
inc eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1015fa50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp byte [0x1044aa6c], 0
jne 0x1015faff
mov eax, dword [0x1044aa70]
test eax, eax
je 0x1015fac6
mov eax, dword [0x1044aa70]
test eax, eax
je 0x1015fabf
push 0xffffffffffffffff
push dword [0x1044aa70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1015fabf
cmp dword [0x10440ea0], 0
jne 0x1015fa9d
push 0x10440ea0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x1044aa70]
test eax, eax
je 0x1015faec
push dword [0x1044aa70]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x1015faec
mov byte [0x1044aa6c], 1
jmp 0x1015faff
push str.Mutex_lock_failed
jmp 0x1015faf1
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x1015fa6d
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x1044aa70], ecx
je 0x1015fa6d
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1015fa6d
push str.Mutex_unlock_failed
push 3
push 0
call fcn.10148bd9
add esp, 0xc
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10178270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
test edi, edi
je 0x101782cd
cmp dword [edi], 0
je 0x101782d2
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x101782a0
call fcn.101786b0
push dword [edi + 0xc]
call fcn.10181b0a
add esp, 4
mov dword [edi + 0xc], 0
mov eax, dword [edi + 0x10]
test eax, eax
je 0x101782b8
push eax
call fcn.10181b0a
add esp, 4
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push dword [edi + 0x40]
call fcn.10181b0a
add esp, 4
xor eax, eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
jmp 0x10178319
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x101782e9
push eax
call fcn.10181b0a
add esp, 4
mov dword [edi + 0x2c], 0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x10178301
push eax
call fcn.10181b0a
add esp, 4
xor eax, eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov eax, dword [edi + 0x34]
test eax, eax
je 0x10178319
push eax
call fcn.10181b0a
add esp, 4
xor eax, eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
push dword [edi + 0xcc]
call fcn.101945bf
add esp, 4
mov esi, dword [edi + 0x9c]
test esi, esi
je 0x10178365
mov ebx, dword [edi + 0x68]
imul ebx, dword [edi + 0x6c]
test ebx, ebx
je 0x10178352
mov ecx, esi
call fcn.101786b0
add esi, 0x160c
dec ebx
jne 0x1017833c
mov esi, dword [edi + 0x9c]
push esi
call fcn.10181b0a
add esp, 4
mov dword [edi + 0x9c], 0
mov ecx, dword [edi + 0x74]
test ecx, ecx
je 0x101783a4
mov eax, dword [edi + 0x70]
test eax, eax
je 0x10178393
xor esi, esi
mov ecx, dword [edi + 0x74]
mov ecx, dword [ecx + esi*8]
test ecx, ecx
je 0x1017838b
push ecx
call fcn.10181b0a
add esp, 4
mov eax, dword [edi + 0x70]
inc esi
cmp esi, eax
jb 0x10178375
mov ecx, dword [edi + 0x74]
xor esi, esi
mov dword [edi + 0x70], esi
push ecx
call fcn.10181b0a
add esp, 4
mov dword [edi + 0x74], esi
lea ebx, [edi + 0x50]
push dword [edi + 0x88]
call fcn.10181b0a
add esp, 4
xor esi, esi
mov dword [edi + 0x88], esi
mov dword [edi + 0x78], esi
push dword [edi + 0x64]
call fcn.10181b0a
add esp, 4
mov dword [edi + 0x64], esi
test byte [edi + 0xb8], 2
jne 0x101783e5
push dword [edi + 0xa8]
call fcn.10181b0a
add esp, 4
xorps xmm0, xmm0
movups xmmword [ebx + 0x5c], xmm0
movups xmmword [ebx + 0x50], xmm0
movups xmmword [ebx + 0x40], xmm0
movups xmmword [ebx + 0x30], xmm0
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x10], xmm0
movups xmmword [ebx], xmm0
push dword [edi + 0xbc]
call fcn.1016f59a
add esp, 4
mov dword [edi + 0xbc], esi
push dword [edi + 0xc0]
call fcn.1016f59a
add esp, 4
mov dword [edi + 0xbc], esi
push dword [edi + 0xc4]
call fcn.10178847
add esp, 4
mov dword [edi + 0xc4], esi
push dword [edi + 0x48]
call fcn.10177dcd
add esp, 4
mov dword [edi + 0x48], esi
push dword [edi + 0x4c]
call fcn.10177dcd
add esp, 4
mov dword [edi + 0x4c], esi
push dword [edi + 0xd0]
call fcn.10197175
add esp, 4
mov dword [edi + 0xd0], esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10181b0a
Function at 0x1019ac50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm1, xmmword [ecx]
movdqu xmm2, xmmword [ecx + 0x10]
movdqu xmm4, xmmword [ecx + 0x20]
movdqu xmm3, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm1
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x1019ad1e
movdqa xmm1, xmmword [0x10326d90]
movdqa xmm5, xmmword [0x10326da0]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm1, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm1, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm1, 0
pclmulqdq xmm4, xmm5, 0x11
pxor xmm4, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm1, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm4, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm3, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x1019aca0
movdqa xmm1, xmmword [0x10326db0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm2
movdqa xmm2, xmmword [0x10326dc0]
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm4
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
cmp eax, 0x10
jb 0x1019ae68
lea edx, [eax - 0x10]
mov esi, edx
shr esi, 4
inc esi
and esi, 3
je 0x1019adc8
shl esi, 4
xor edi, edi
nop word cs:[eax + eax]
movdqu xmm3, xmmword [ecx + edi]
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
add edi, 0x10
cmp esi, edi
jne 0x1019ada0
add ecx, edi
sub eax, edi
movdqa xmm3, xmm0
cmp edx, 0x30
jb 0x1019ae6c
nop word cs:[eax + eax]
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pclmulqdq xmm0, xmm2, 0x11
movdqu xmm3, xmmword [ecx]
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x20]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x30]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
add ecx, 0x40
add eax, 0xffffffc0
movdqa xmm0, xmm3
cmp eax, 0xf
ja 0x1019ade0
jmp 0x1019ae6c
movdqa xmm3, xmm0
movdqa xmm0, xmmword [0x10326dc0]
pclmulqdq xmm0, xmm3, 1
psrldq xmm3, 8
pxor xmm3, xmm0
pxor xmm1, xmm1
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
psrldq xmm3, 4
pclmulqdq xmm0, xmmword [0x10326dd0], 0
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x10326de0], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x10326df0], 0
pxor xmm2, xmm0
pextrd eax, xmm2, 1
pop esi
pop edi
pop ebp
ret
Function at 0x101e4f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.101f013a
mov edx, eax
test ebx, ebx
je 0x101e4f27
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x101e4f32
movzx eax, word [eax]
jmp 0x101e4f49
xor ecx, ecx
test dl, dl
je 0x101e4f5c
jmp 0x101e4ff0
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
mov byte [ebp - 0x10], dl
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp - 0x10]
xor edi, edi
cmp ax, 0xffff
sete al
je 0x101e4f56
mov edi, ebx
mov ecx, edi
cmp dl, al
je 0x101e4fd6
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov dword [ebp - 0x10], ecx
je 0x101e4f6e
movzx edi, word [eax]
jmp 0x101e4f81
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov edi, eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [section..00cfg]
movzx eax, di
mov ecx, ebx
push eax
push 8
call esi
test al, al
je 0x101e4fd0
mov esi, dword [ebp + 8]
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x10]
je 0x101e4fba
add eax, 2
mov dword [edi + 0xc], eax
jmp 0x101e4f0d
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
jmp 0x101e4f0a
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.101f013a
mov ebx, eax
test edi, edi
je 0x101e4ff9
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
je 0x101e4fff
movzx eax, word [eax]
jmp 0x101e5010
mov ecx, esi
call fcn.101f013a
mov ebx, eax
test bl, bl
jne 0x101e501b
jmp 0x101e5021
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
cmp ax, 0xffff
sete al
xor bl, al
jne 0x101e5021
mov eax, dword [ebp + 0x10]
or byte [eax], 2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x101f35d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x101f35df
pop ebp
jmp fcn.101f30b0
cmp dword [ebp + 0x10], 0
jne 0x101f35ea
call fcn.101f4c70
xor eax, eax
pop ebp
ret

Function at 0x101f3ba0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.101f37e0

Function at 0x101f3bac
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
cmp eax, 0xcc
je 0x101f3c8a
cmp eax, 0xcb
je 0x101f3c15
cmp eax, 0xca
jne 0x101f3beb
push esi
call fcn.101f879e
add esp, 4
cmp dword [esi + 0x40], 0
je 0x101f3c0e
mov dword [esi + 0x14], 0xcf
xor eax, eax
inc eax
pop esi
pop ebp
ret
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x101f3c8a
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x101f3c7e
mov eax, dword [esi + 8]
test eax, eax
je 0x101f3c36
mov ecx, dword [eax]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov eax, dword [esi + 0x1b4]
mov ecx, dword [eax]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
test eax, eax
je 0x101f3be8
cmp eax, 2
je 0x101f3c7e
and eax, 0xfffffffd
cmp eax, 1
jne 0x101f3c21
mov eax, dword [esi + 8]
test eax, eax
je 0x101f3c21
mov edx, dword [eax + 4]
inc edx
mov dword [eax + 4], edx
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x101f3c21
add ecx, dword [esi + 0x140]
mov dword [eax + 8], ecx
jmp 0x101f3c21
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
mov ecx, esi
pop esi
pop ebp
jmp fcn.101f3c93
Function at 0x101fce87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov edi, dword [ecx + edx*4 + 0x48]
test edi, edi
jne 0x101fceba
mov eax, dword [esi]
mov dword [eax + 0x14], 0x34
mov eax, dword [esi]
mov dword [eax + 0x18], ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pxor xmm0, xmm0
xor eax, eax
movdqa xmm1, xmmword [0x103c5c70]
movdqa xmm2, xmmword [0x104020d0]
movdqa xmm3, xmmword [0x1028bd70]
movq xmm4, qword [edi + eax*2]
pxor xmm4, xmm1
pcmpgtw xmm4, xmm2
punpcklwd xmm4, xmm4
psrad xmm4, 0x10
movdqa xmm5, xmm4
pandn xmm5, xmm0
pand xmm4, xmm3
movdqa xmm0, xmm4
por xmm0, xmm5
add eax, 4
cmp eax, 0x40
jne 0x101fced8
pxor xmm1, xmm1
pcmpeqd xmm0, xmm1
movmskps ecx, xmm0
xor ecx, 0xf
cmp dword [edi + 0x80], 0
jne 0x101fcfc2
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov dword [ebp - 0x10], ecx
test cl, cl
setne bl
mov ecx, esi
mov edx, 0xff
call fcn.101fce3f
mov ecx, esi
mov edx, 0xdb
call fcn.101fce3f
mov eax, ebx
shl eax, 6
add eax, 0x43
mov dword [ebp - 0x14], eax
mov ecx, esi
xor edx, edx
call fcn.101fce3f
mov ecx, esi
mov edx, dword [ebp - 0x14]
call fcn.101fce3f
shl ebx, 4
add ebx, dword [ebp - 0x18]
mov ecx, esi
mov edx, ebx
call fcn.101fce3f
mov ebx, 0xffffff00
mov dword [ebp - 0x1c], edi
mov eax, dword [ebx + 0x10401f84]
movzx eax, word [edi + eax*2]
cmp byte [ebp - 0x10], 0
je 0x101fcfa6
mov edi, esi
mov esi, eax
mov edx, eax
shr edx, 8
mov ecx, edi
call fcn.101fce3f
mov eax, esi
mov esi, edi
mov edi, dword [ebp - 0x1c]
movzx edx, al
mov ecx, esi
call fcn.101fce3f
add ebx, 4
jne 0x101fcf7f
mov dword [edi + 0x80], 1
mov ecx, dword [ebp - 0x10]
xor eax, eax
test cl, cl
setne al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1022d3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1022d562
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1022d562
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov edi, dword [edi]
push eax
push edi
push esi
mov esi, dword [esi]
mov edi, dword [edi]
test eax, 0x1f
je 0x1022d418
mov dl, byte [esi + eax - 1]
mov byte [esi + eax], dl
vpxor ymm0, ymm0, ymm0
vpcmpeqb xmm7, xmm7, xmm7
vpsrldq xmm7, xmm7, 0xf
vpand ymm7, ymm7, ymmword [esi]
add eax, 0x1f
and eax, 0xffffffe0
cmp eax, 0x20
ja 0x1022d450
vpcmpeqb xmm6, xmm6, xmm6
vpslldq xmm6, xmm6, 0xf
vperm2i128 ymm6, ymm6, ymm6, 1
vpand ymm6, ymm6, ymmword [esi]
jmp 0x1022d460
vmovdqu ymm6, ymmword [esi + 0x20]
vperm2i128 ymm6, ymm0, ymm6, 0x20
vpslldq ymm6, ymm6, 0xf
vmovdqu ymm1, ymmword [esi]
vperm2i128 ymm2, ymm0, ymm1, 0x20
vpalignr ymm2, ymm1, ymm2, 0xf
vperm2i128 ymm4, ymm0, ymm1, 3
vpalignr ymm3, ymm4, ymm1, 1
vpor ymm2, ymm2, ymm7
vpor ymm3, ymm3, ymm6
vpsrldq ymm7, ymm4, 0xf
vpunpckhbw ymm4, ymm1, ymm0
vpunpcklbw ymm5, ymm1, ymm0
vperm2i128 ymm1, ymm5, ymm4, 0x20
vperm2i128 ymm4, ymm5, ymm4, 0x31
vpunpckhbw ymm5, ymm2, ymm0
vpunpcklbw ymm6, ymm2, ymm0
vperm2i128 ymm2, ymm6, ymm5, 0x20
vperm2i128 ymm5, ymm6, ymm5, 0x31
vpunpckhbw ymm6, ymm3, ymm0
vpunpcklbw ymm0, ymm3, ymm0
vperm2i128 ymm3, ymm0, ymm6, 0x20
vperm2i128 ymm6, ymm0, ymm6, 0x31
vpxor ymm0, ymm0, ymm0
vpmullw ymm1, ymm1, ymmword [0x104039c0]
vpmullw ymm4, ymm4, ymmword [0x104039c0]
vpaddw ymm2, ymm2, ymmword [0x10403980]
vpaddw ymm5, ymm5, ymmword [0x10403980]
vpaddw ymm3, ymm3, ymmword [0x104039a0]
vpaddw ymm6, ymm6, ymmword [0x104039a0]
vpaddw ymm2, ymm2, ymm1
vpaddw ymm5, ymm5, ymm4
vpsrlw ymm2, ymm2, 2
vpsrlw ymm5, ymm5, 2
vpaddw ymm3, ymm3, ymm1
vpaddw ymm6, ymm6, ymm4
vpsrlw ymm3, ymm3, 2
vpsrlw ymm6, ymm6, 2
vpsllw ymm3, ymm3, 8
vpsllw ymm6, ymm6, 8
vpor ymm2, ymm2, ymm3
vpor ymm5, ymm5, ymm6
vmovdqu ymmword [edi], ymm2
vmovdqu ymmword [edi + 0x20], ymm5
sub eax, 0x20
add esi, 0x20
add edi, 0x40
cmp eax, 0x20
ja 0x1022d450
test eax, eax
jne 0x1022d434
pop esi
pop edi
pop eax
add esi, 4
add edi, 4
dec ecx
jg 0x1022d403
vzeroupper
pop edi
pop esi
pop ebp
ret
Function at 0x10232660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ah, 2
mov al, 4
movq mm2, qword [esi]
movq mm3, qword [esi + 8]
movq mm0, mm2
movq mm1, mm3
psraw mm2, 0xf
psraw mm3, 0xf
pxor mm0, mm2
pxor mm1, mm3
psubw mm0, mm2
psubw mm1, mm3
paddw mm0, qword [edx + 0x80]
paddw mm1, qword [edx + 0x88]
movq mm4, mm0
movq mm5, mm1
pmulhw mm0, qword [edx]
pmulhw mm1, qword [edx + 8]
paddw mm0, mm4
paddw mm1, mm5
movq mm6, qword [edx + 0x100]
movq mm7, qword [edx + 0x108]
movq mm4, mm0
movq mm5, mm1
pmulhw mm0, mm6
pmulhw mm1, mm7
psraw mm6, 0xf
psraw mm7, 0xf
pand mm6, mm4
pand mm7, mm5
paddw mm0, mm6
paddw mm1, mm7
psraw mm4, 0xf
psraw mm5, 0xf
pand mm4, qword [edx + 0x100]
pand mm5, qword [edx + 0x108]
paddw mm0, mm4
paddw mm1, mm5
pxor mm0, mm2
pxor mm1, mm3
psubw mm0, mm2
psubw mm1, mm3
movq qword [edi], mm0
movq qword [edi + 8], mm1
add esi, 0x10
add edx, 0x10
add edi, 0x10
dec al
jne 0x10232672
dec ah
jne 0x10232670
emms
pop edi
pop esi
pop ebp
ret

Function at 0x10232960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, 2
movdqa xmm4, xmmword [esi]
movdqa xmm5, xmmword [esi + 0x10]
movdqa xmm6, xmmword [esi + 0x20]
movdqa xmm7, xmmword [esi + 0x30]
movdqa xmm0, xmm4
movdqa xmm1, xmm5
movdqa xmm2, xmm6
movdqa xmm3, xmm7
psraw xmm4, 0xf
psraw xmm5, 0xf
psraw xmm6, 0xf
psraw xmm7, 0xf
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
psubw xmm0, xmm4
psubw xmm1, xmm5
psubw xmm2, xmm6
psubw xmm3, xmm7
paddw xmm0, xmmword [edx + 0x80]
paddw xmm1, xmmword [edx + 0x90]
paddw xmm2, xmmword [edx + 0xa0]
paddw xmm3, xmmword [edx + 0xb0]
pmulhuw xmm0, xmmword [edx]
pmulhuw xmm1, xmmword [edx + 0x10]
pmulhuw xmm2, xmmword [edx + 0x20]
pmulhuw xmm3, xmmword [edx + 0x30]
pmulhuw xmm0, xmmword [edx + 0x100]
pmulhuw xmm1, xmmword [edx + 0x110]
pmulhuw xmm2, xmmword [edx + 0x120]
pmulhuw xmm3, xmmword [edx + 0x130]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
psubw xmm0, xmm4
psubw xmm1, xmm5
psubw xmm2, xmm6
psubw xmm3, xmm7
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm1
movdqa xmmword [edi + 0x20], xmm2
movdqa xmmword [edi + 0x30], xmm3
add esi, 0x40
add edx, 0x40
add edi, 0x40
dec eax
jne 0x10232973
pop edi
pop esi
pop ebp
ret
Function at 0x10248be8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10248c27
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10248c27
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10248c27
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10248c27
cmp dword [ecx + 0x74], 0xe
jbe 0x10248c27
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1024bf01
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1023ba70
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1025b9c3
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1024bf43
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1024c09f
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1023b810
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1044bf40]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1025f49a
mov ecx, dword [esi*4 + 0x1044bf40]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1024c098
cmp eax, dword [ecx + edi + 0x24]
jne 0x1024c098
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1024c098
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1025f49a
add esp, 0x14
test edx, edx
jl 0x1024c098
jg 0x1024c00e
test eax, eax
jb 0x1024c098
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1024c098
jl 0x1024c028
cmp dword [ebp - 0x1008], eax
ja 0x1024c098
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1024c046
test ebx, ebx
je 0x1024c07f
cmp ecx, edi
jae 0x1024c07f
mov al, byte [ecx]
cmp al, 0xd
jne 0x1024c060
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1024c06c
cmp byte [ecx + 1], 0xa
jne 0x1024c06c
inc ecx
jmp 0x1024c06c
movzx eax, al
movsx eax, byte [eax + 0x10444538]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1024c046
cmp edx, ebx
jne 0x1024c046
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1024c09d
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1023b4d8
leave
ret
Function at 0x10259506
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x10427a04
push str.FlsAlloc
push 0x1f
call fcn.102599b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1025953a
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10259540
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10259584
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x10427a28
push str.FlsGetValue
push 0x21
call fcn.102599b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x102595bb
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x102595c3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x10427a3c
push str.FlsSetValue
push 0x22
call fcn.102599b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x102595fd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]