joyce8/EMBER2024-capa huggingface dataset:
Function at 0x697b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xdc
mov ebp, dword [esp + 0x100]
xor eax, eax
cmp edx, ebp
jb 0x697da5
cmp ebp, 0x40
ja 0x697da5
test ebp, ebp
je 0x697bc3
mov eax, dword [esp + 0xfc]
mov esi, dword [esp + 0xf8]
mov edi, dword [esp + 0xf4]
mov ebx, dword [ecx]
mov dword [esp + 4], ebx
sub ebx, ebp
mov dword [ecx], ebx
mov ecx, dword [esp + 0xf0]
cmp eax, 1
jne 0x697bd5
test edi, edi
je 0x697bab
add ecx, ebx
mov dword [edi], ecx
mov eax, 1
test esi, esi
je 0x697da5
mov dword [esi], 0
jmp 0x697da5
xor eax, eax
cmp dword [esp + 0x104], 0
setne al
jmp 0x697da5
mov dword [esp], edx
lea eax, [esp + 0x1c]
push 0
push ebp
push eax
push dword [esp + 0x114]
call fcn.00603b90
add esp, 0x10
test eax, eax
jle 0x697da3
test edi, edi
je 0x697da3
test esi, esi
je 0x697da3
push 0xf5
push str.ssl_record_methods_tls_pad.c
push ebp
call fcn.005dadf0
add esp, 0xc
mov ecx, eax
mov dword [edi], eax
test eax, eax
mov eax, 0
je 0x697da5
mov dword [esp + 0x18], ecx
mov dword [esi], 1
lea eax, [esp + 0x5c]
neg eax
and eax, 0x3f
add eax, esp
add eax, 0x5c
mov edi, ebp
or edi, 0x100
xor ecx, ecx
mov esi, dword [esp]
mov dword [esp + 0x14], ebx
mov ebx, esi
sub ebx, edi
cmovb ebx, ecx
push ebp
push 0
mov dword [esp + 0x14], eax
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edx, 0
cmp ebx, esi
jae 0x697d03
cmp esi, edi
cmovb edi, esi
mov eax, dword [esp + 4]
neg eax
mov dword [esp + 0x10], eax
xor ecx, ecx
xor edx, edx
xor esi, esi
nop dword [eax]
mov dword [esp + 8], esi
mov dword [esp], edi
mov esi, ebx
xor esi, dword [esp + 0x14]
mov edi, esi
not edi
dec esi
and esi, edi
mov edi, ebx
mov eax, dword [esp + 4]
xor edi, eax
mov ebp, dword [esp + 0x10]
add ebp, ebx
xor ebp, eax
or ebp, edi
sar esi, 0x1f
xor ebp, ebx
or ecx, esi
sar ebp, 0x1f
and ecx, ebp
mov ebp, dword [esp + 8]
and esi, ebp
mov eax, dword [esp + 0xf0]
movzx eax, byte [eax + ebx]
and al, cl
mov edi, dword [esp + 0xc]
or byte [edi + ebp], al
mov edi, ebp
mov ebp, dword [esp + 0x100]
or edx, esi
lea eax, [edi + 1]
mov esi, 0xfffffffe
sub esi, edi
mov edi, eax
sub edi, ebp
and esi, edi
mov edi, dword [esp]
sar esi, 0x1f
and esi, eax
inc ebx
dec edi
jne 0x697c90
mov eax, dword [esp + 0x104]
movzx eax, al
mov dword [esp], eax
not eax
mov dword [esp + 8], eax
cmp ebp, 1
mov eax, ebp
adc eax, 0
mov dword [esp + 4], eax
xor ebp, ebp
nop word cs:[eax + eax]
mov ecx, edx
and ecx, 0xffffffdf
mov eax, edx
or eax, 0x20
test dl, 0x20
mov ebx, 0
mov esi, 0xff
cmove ebx, esi
mov esi, dword [esp + 0xc]
movzx ecx, byte [esi + ecx]
mov edi, ebx
and edi, ecx
movzx eax, byte [esi + eax]
not ebx
and ebx, eax
or ebx, edi
movzx ecx, byte [esp + ebp + 0x1c]
mov edi, dword [esp]
and edi, ebx
mov eax, dword [esp + 8]
and eax, ecx
or eax, edi
lea ebx, [edx + 1]
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp], al
mov eax, 0xfffffffe
sub eax, edx
mov ecx, ebx
sub ecx, dword [esp + 0x100]
and eax, ecx
sar eax, 0x1f
and eax, ebx
inc ebp
mov edx, eax
cmp dword [esp + 4], ebp
jne 0x697d30
mov eax, 1
jmp 0x697da5
xor eax, eax
add esp, 0xdc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x697db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, 1
setne cl
add ecx, esi
mov edi, dword [ebx]
xor eax, eax
cmp ecx, edi
ja 0x697e2b
mov ebp, dword [esp + 0x24]
cmp edx, 1
jne 0x697e12
cmp dword [esp + 0x20], esi
jb 0x697e2b
cmp esi, 0x40
ja 0x697e2b
mov eax, 1
test esi, esi
je 0x697e2b
sub edi, esi
mov dword [ebx], edi
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x697e02
add ebp, edi
mov dword [ecx], ebp
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x697e2b
mov dword [ecx], 0
jmp 0x697e2b
movzx edx, byte [ebp + edi - 1]
cmp dword [esp + 0x38], 0
je 0x697e33
not esi
add edi, esi
sub edi, edx
mov dword [ebx], edi
mov eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add ecx, edx
mov ebx, ecx
xor ebx, edi
mov eax, edi
sub eax, ecx
xor eax, ecx
or eax, ebx
xor eax, edi
not eax
sar eax, 0x1f
cmp edi, 0x100
mov ecx, 0x100
cmovb ecx, edi
test edi, edi
mov dword [esp], edi
je 0x697e6f
mov esi, edi
xor edi, edi
cmp esi, 4
jae 0x697e76
mov esi, edx
mov ebp, ecx
jmp 0x697f39
mov esi, edx
jmp 0x697f6e
mov edi, ecx
and edi, 0x1fc
movd xmm1, eax
movaps xmm0, xmmword [0xacec30]
movss xmm0, xmm1
mov dword [esp + 4], edx
movd xmm2, edx
pshufd xmm1, xmm2, 0
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0
lea eax, [esi + ebp]
add eax, 0xfffffffc
mov edx, ecx
mov ebp, ecx
and ebp, 0xfffffffc
neg ebp
movdqa xmm4, xmmword [0xacec40]
xor ecx, ecx
por xmm1, xmmword [0xacec50]
pxor xmm5, xmm5
movdqa xmm7, xmmword [0xacec60]
movdqa xmm3, xmm4
pxor xmm3, xmmword [0xacec50]
pcmpgtd xmm3, xmm1
movd xmm6, dword [eax + ecx]
punpcklbw xmm6, xmm5
pshuflw xmm6, xmm6, 0x1b
packuswb xmm6, xmm6
pxor xmm6, xmm2
punpcklbw xmm6, xmm5
punpcklwd xmm6, xmm5
pxor xmm6, xmmword [0xacec70]
por xmm6, xmm3
pand xmm0, xmm6
paddd xmm4, xmm7
add ecx, 0xfffffffc
cmp ebp, ecx
jne 0x697ed0
pshufd xmm1, xmm0, 0xee
pand xmm1, xmm0
pshufd xmm0, xmm1, 0x55
pand xmm0, xmm1
movd eax, xmm0
mov ebp, edx
cmp edx, edi
mov esi, dword [esp + 4]
je 0x697f6e
mov ecx, edi
not ecx
add ecx, dword [esp]
add ecx, dword [esp + 0x24]
nop word cs:[eax + eax]
movzx edx, byte [ecx]
mov ebx, esi
xor dl, bl
cmp edi, esi
movzx edx, dl
not edx
mov ebx, 0xffffffff
cmova edx, ebx
and eax, edx
inc edi
dec ecx
cmp ebp, edi
jne 0x697f50
xor ecx, ecx
xor ebx, ebx
cmp al, 0xff
not esi
cmovne esi, ecx
sete bl
neg ebx
add esi, dword [esp]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
mov edx, dword [esp + 0x20]
push dword [esp + 0x3c]
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.00697b50
add esp, 0x24
jmp 0x697e2e
Function at 0x698530
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x698550
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x69b720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69b73e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x69b780
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69b79e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x69b7e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69b802
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x69b850
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69b872
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x69b8c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69b8ea
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x69b950
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69b97a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x69b9e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x69ba2f

Function at 0x69ba3e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69ba20
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x69bab0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x69baff

Function at 0x69bb0e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69baf0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x69e5f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0069e0a0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x69e659
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x69e622
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x6a1830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
test esi, esi
sete al
mov ebp, edx
test edx, edx
sete dl
or dl, al
jne 0x6a186b
movzx eax, byte [esi]
test byte [ecx + 5], 1
jne 0x6a1883
shr al, 7
xor ecx, ecx
mov ebx, eax
mov edx, ebp
jmp 0x6a1944
mov eax, 1
xor edx, edx
xor ebx, ebx
xor ecx, ecx
test edi, edi
jne 0x6a1952
jmp 0x6a19e7
mov cl, 0xff
mov bl, 1
cmp al, 0x80
mov edx, ebp
ja 0x6a1944
xor ebx, ebx
neg al
jno 0x6a1944
cmp edx, 2
jb 0x6a1940
mov eax, 1
cmp edx, 9
jb 0x6a1930
lea ecx, [edx - 1]
mov edi, ecx
and edi, 0xfffffff8
lea eax, [edi + 1]
pxor xmm1, xmm1
mov edx, esi
xor esi, esi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax]
movd xmm3, dword [edx + esi + 1]
movd xmm4, dword [edx + esi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add esi, 8
cmp edi, esi
jne 0x6a18d0
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd ebx, xmm0
cmp ecx, edi
mov esi, edx
mov edx, ebp
mov edi, dword [esp + 0x20]
je 0x6a193b
nop word cs:[eax + eax]
movzx ecx, byte [esi + eax]
or ebx, ecx
inc eax
cmp edx, eax
jne 0x6a1930
test ebx, ebx
setne bl
mov ecx, ebx
neg cl
movzx ebx, bl
lea eax, [edx + ebx]
test edi, edi
je 0x6a19e7
mov edi, dword [edi]
test edi, edi
je 0x6a19e7
mov dword [esp + 4], eax
mov byte [edi], cl
test edx, edx
je 0x6a19dd
add edi, ebx
add esi, edx
add edi, edx
mov dword [esp], edx
mov edx, ecx
and dl, 1
movzx ebx, dl
mov edx, dword [esp]
test dl, 1
mov ebp, esi
jne 0x6a198a
mov eax, edx
cmp edx, 1
jne 0x6a19a8
jmp 0x6a19dd
lea eax, [edx - 1]
movzx edx, byte [ebp - 1]
xor dl, cl
dec ebp
movzx edx, dl
add ebx, edx
mov edx, dword [esp]
mov byte [edi - 1], bl
dec edi
shr ebx, 8
cmp edx, 1
je 0x6a19dd
neg eax
xor esi, esi
nop dword [eax]
movzx edx, byte [ebp + esi - 1]
xor dl, cl
movzx edx, dl
add edx, ebx
mov byte [edi + esi - 1], dl
shr edx, 8
movzx ebx, byte [ebp + esi - 2]
xor bl, cl
movzx ebx, bl
add ebx, edx
mov byte [edi + esi - 2], bl
shr ebx, 8
add esi, 0xfffffffe
cmp eax, esi
jne 0x6a19b0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 4]
add dword [ecx], eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6a1ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6a1b21
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
mov edi, ebx
and edi, 0xffffff80
test edx, edx
je 0x6a1b01
mov dword [edx], edi
mov dword [esp], edi
cmp eax, 1
jne 0x6a1b58
mov eax, 1
test ecx, ecx
je 0x6a1b50
movzx edx, byte [esi]
cmp byte [esp], 0
je 0x6a1b1d
neg dl
mov byte [ecx], dl
jmp 0x6a1b50
call fcn.005b5560
push str.c2i_ibuf
push 0xa0
push str.crypto_asn1_a_int.c
call fcn.005b5660
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.005b5750
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edx, byte [esi]
test edx, edx
je 0x6a1bff
cmp edx, 0xff
jne 0x6a1c3a
cmp eax, 9
jae 0x6a1b7d
xor edi, edi
mov edx, 1
jmp 0x6a1bf0
lea ebp, [eax - 1]
mov dword [esp + 4], ebp
and ebp, 0xfffffff8
lea edx, [ebp + 1]
pxor xmm1, xmm1
xor edi, edi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [esi + edi + 1]
movd xmm4, dword [esi + edi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add edi, 8
cmp ebp, edi
jne 0x6a1ba0
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp + 4], ebp
je 0x6a1bfb
nop dword [eax + eax]
movzx ebp, byte [esi + edx]
or edi, ebp
inc edx
cmp eax, edx
jne 0x6a1bf0
test edi, edi
je 0x6a1c3a
mov edi, eax
movzx edx, byte [esi + 1]
and dl, 0x80
cmp byte [esp], dl
mov eax, 0xffffffff
jne 0x6a1c3e
call fcn.005b5560
push str.c2i_ibuf
push 0xc1
push str.crypto_asn1_a_int.c
call fcn.005b5660
add esp, 0xc
push 0
push 0xdd
jmp 0x6a1b44
mov edi, eax
xor eax, eax
add eax, edi
test ecx, ecx
je 0x6a1b50
test eax, eax
je 0x6a1b4e
mov dh, bl
sar dh, 7
add esi, edi
add ecx, eax
shr ebx, 7
test al, 1
mov byte [esp], dh
jne 0x6a1c70
mov edi, eax
cmp eax, 1
je 0x6a1b50
jmp 0x6a1c8e
lea edi, [eax - 1]
mov dl, byte [esi - 1]
xor dl, dh
dec esi
movzx edx, dl
add ebx, edx
mov byte [ecx - 1], bl
dec ecx
shr ebx, 8
cmp eax, 1
je 0x6a1b50
mov dword [esp + 4], eax
neg edi
xor ebp, ebp
movzx eax, byte [esp]
nop word [eax + eax]
movzx edx, byte [esi + ebp - 1]
xor dl, al
movzx edx, dl
add edx, ebx
mov byte [ecx + ebp - 1], dl
shr edx, 8
mov ah, byte [esi + ebp - 2]
xor ah, al
movzx ebx, ah
add ebx, edx
mov byte [ecx + ebp - 2], bl
shr ebx, 8
add ebp, 0xfffffffe
cmp edi, ebp
jne 0x6a1ca0
mov eax, dword [esp + 4]
jmp 0x6a1b50
Function at 0x6a28d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea edi, [ecx - 1]
xor edx, edx
mov esi, ebx
nop word [eax + eax]
mov ecx, eax
mov byte [esp + edx + 0xf], al
mov ebp, ebx
shld ebp, eax, 0x18
shr esi, 8
dec edx
mov dword [esp + 0x14], edx
inc edi
mov edx, edi
mov edi, 0xff
cmp edi, eax
mov edi, edx
mov edx, dword [esp + 0x14]
mov eax, 0
sbb eax, ebx
mov eax, ebp
mov ebx, esi
jb 0x6a28f0
test edx, edx
je 0x6a29f6
mov eax, edx
neg eax
mov dword [esp + 4], eax
mov esi, edx
not esi
cmp dword [esp + 0x38], 0
je 0x6a2a0f
mov bl, 0xff
mov al, 1
cmp cl, 0x80
ja 0x6a2a16
xor eax, eax
neg cl
jno 0x6a2a16
cmp dword [esp + 4], 2
jb 0x6a29f0
mov ebx, 1
cmp esi, 8
jb 0x6a29d7
lea eax, [esp + edx]
add eax, 0x15
mov ebp, esi
and ebp, 0xfffffff8
lea ebx, [ebp + 1]
pxor xmm1, xmm1
mov ecx, ebp
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [eax - 4]
movd xmm4, dword [eax]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add eax, 8
add ecx, 0xfffffff8
jne 0x6a2990
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd eax, xmm0
cmp esi, ebp
je 0x6a29eb
lea ecx, [ebx + edx]
dec ecx
add ebx, edx
nop dword [eax]
movzx ebp, byte [esp + ecx + 0x11]
or eax, ebp
inc ecx
inc ebx
jne 0x6a29e0
test eax, eax
setne al
mov ebx, eax
neg bl
jmp 0x6a2a16
mov ecx, 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6a2ab0
mov byte [eax], 0
jmp 0x6a2ab0
shr cl, 7
xor ebx, ebx
mov eax, ecx
movzx eax, al
mov ecx, eax
sub ecx, edx
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x6a2ab0
mov dword [esp], ecx
mov byte [ebp], bl
mov dword [esp + 0x10], eax
add ebp, eax
mov ecx, ebx
and cl, 1
movzx ecx, cl
mov eax, dword [esp + 4]
test al, 1
jne 0x6a2a54
lea edi, [esp + 0x10]
sub ebp, edx
mov esi, eax
cmp edx, 0xffffffff
jne 0x6a2a75
jmp 0x6a2aad
movzx eax, byte [esp + 0xf]
xor al, bl
movzx eax, al
add ecx, eax
mov eax, dword [esp + 0x10]
mov byte [edi + eax], cl
lea edi, [esp + 0xf]
add ebp, esi
shr ecx, 8
cmp edx, 0xffffffff
je 0x6a2aad
neg esi
xor edx, edx
nop dword [eax]
movzx eax, byte [edi + edx - 1]
xor al, bl
movzx eax, al
add eax, ecx
mov byte [ebp + edx - 1], al
shr eax, 8
movzx ecx, byte [edi + edx - 2]
xor cl, bl
movzx ecx, cl
add ecx, eax
mov byte [ebp + edx - 2], cl
shr ecx, 8
add edx, 0xfffffffe
cmp esi, edx
jne 0x6a2a80
mov ecx, dword [esp]
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret