joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580990
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [ebx + 0x28]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [edi + 0x38], 0
je 0x5809be
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [ebx + 0x24]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x5809e8
push edi
call fcn.0057aea0
add esp, 4
mov esi, eax
mov ebp, dword [ebx + 0x24]
push edi
call fcn.0057ae80
add esp, 4
push esi
push eax
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebp
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
push 0xf
push ebx
call fcn.0057bad0
add esp, 8
lea eax, [esi + 1]
cmp eax, 1
ja case.0x580a10.104
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x66
jle 0x580a32
lea ecx, [eax - 0x67]
cmp ecx, 0x25
ja case.default.0x580a10
jmp dword [ecx*4 + 0xa789ac]
push 0xa
push ebx
call fcn.0057baf0
add esp, 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x3c], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 4
je case.0x580a10.103
cmp eax, 0xb
je case.0x580a10.103
jmp case.0x580a10.104
cmp eax, 0x2733
je case.0x580a10.103
jmp case.0x580a10.104

Function at 0x582bf0
Capabilities:
Check if file exists

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
push ebp
push edi
call fcn.005dca10
add esp, 8
mov esi, eax
push 0x62
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
xor ebx, ebx
test eax, eax
sete al
test esi, esi
je 0x582c64
mov byte [esp + 3], al
push 0xa7921c
call fcn.0057b960
add esp, 4
test eax, eax
je 0x582ccd
movzx ecx, byte [esp + 3]
mov bl, cl
shl ebx, 4
inc ebx
push 0
push eax
mov edi, eax
call fcn.0057bad0
add esp, 8
push esi
push ebx
push 0x6a
push edi
call fcn.0057c390
mov eax, edi
add esp, 0x10
jmp 0x582d04
call fcn.005b5560
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.005b5660
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
push edi
push str.calling_fopen__s___s_
push eax
push 2
call fcn.005b5750
add esp, 0x14
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 2
je 0x582cab
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 6
jne 0x582cd8
call fcn.005b5560
push str.BIO_new_file
push 0x4b
push str.crypto_bio_bss_file.c
call fcn.005b5660
add esp, 0xc
push 0
push pe_nt_image_headers32
jmp 0x582cf8
push esi
call fcn.00786c28
add esp, 4
jmp 0x582d02
call fcn.005b5560
push str.BIO_new_file
push 0x4d
push str.crypto_bio_bss_file.c
call fcn.005b5660
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.005b5750
add esp, 0xc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x583a20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push ebx
push esi
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
push 0xf
push edi
call fcn.0057bad0
add esp, 8
mov eax, esi
inc eax
cmp eax, 1
ja case.0x583a6c.104
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x66
jle 0x583a84
lea ecx, [eax - 0x67]
cmp ecx, 0x25
ja case.default.0x583a6c
jmp dword [ecx*4 + 0xa79720]
push 0xa
push edi
call fcn.0057baf0
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebx
ret
cmp eax, 4
je case.0x583a6c.103
cmp eax, 0xb
je case.0x583a6c.103
jmp case.0x583a6c.104
cmp eax, 0x2733
je case.0x583a6c.103
jmp case.0x583a6c.104
Function at 0x5885b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp + 4], edx
mov edi, ecx
mov ebp, dword [esp + 0x40]
push ecx
call fcn.00587bd0
add esp, 4
lea edx, [eax + 7]
lea ecx, [eax + 0xe]
test edx, edx
cmovns ecx, edx
sar ecx, 3
xor esi, esi
cmp dword [esp + 0x48], 0
mov ebx, 0
mov edx, 0
je 0x588731
add ecx, edx
cmp ebp, 0xffffffff
je 0x588760
cmp ecx, ebp
jle 0x588670
movups xmm0, xmmword [edi]
movups xmmword [esp + 0x18], xmm0
mov eax, dword [edi + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp], edx
jle 0x588637
mov ecx, dword [esp + 0x18]
nop dword [eax]
cmp dword [ecx + eax*4 - 4], 0
jne 0x588633
lea edx, [eax - 1]
cmp eax, 1
mov eax, edx
jg 0x588620
xor eax, eax
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x588643
mov dword [esp + 0x24], 0
lea eax, [esp + 0x18]
push eax
call fcn.00587bd0
add esp, 4
mov ecx, eax
add eax, 7
add ecx, 0xe
test eax, eax
cmovns ecx, eax
sar ecx, 3
add ecx, dword [esp]
mov eax, 0xffffffff
cmp ecx, ebp
jg 0x588786
mov eax, dword [edi + 8]
test eax, eax
je 0x58876d
mov dword [esp], esi
mov esi, dword [esp + 0x44]
xor edx, edx
cmp esi, 1
sete cl
test ebp, ebp
je 0x588784
mov dl, cl
lea ecx, [edx*2 - 1]
mov dword [esp + 0x10], ecx
cmp esi, 1
mov ecx, dword [esp + 4]
lea esi, [ecx + ebp - 1]
cmove esi, ecx
mov ecx, dword [edi + 4]
shl eax, 2
mov edx, 1
sub edx, eax
mov dword [esp + 0xc], edx
shl ecx, 2
neg ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
xor edi, edi
xor eax, eax
mov dword [esp + 0x14], ebp
nop word cs:[eax + eax]
mov ecx, dword [esp + 8]
mov ecx, dword [ecx]
mov edx, eax
and edx, 0xfffffffc
mov ebp, dword [ecx + edx]
mov ecx, dword [esp + 4]
lea edx, [ecx + edi]
lea ecx, [eax*8]
shr ebp, cl
sar edx, 0x1f
and edx, ebp
mov ebp, dword [esp + 0x14]
movzx ecx, dl
xor ecx, dword [esp]
add ebx, ecx
mov byte [esi], bl
movzx edx, bl
xor ebx, ebx
cmp ecx, edx
seta bl
mov ecx, dword [esp + 0xc]
add ecx, eax
shr ecx, 0x1f
add eax, ecx
add esi, dword [esp + 0x10]
inc edi
cmp ebp, edi
jne 0x5886e0
jmp 0x588780
mov ebx, dword [edi + 0xc]
xor edx, edx
test ebx, ebx
sete dl
mov dword [esp], edx
mov esi, 0xff
cmove esi, ebx
lea edx, [ecx*8]
cmp edx, eax
mov edx, dword [esp]
cmovne edx, ebx
add ecx, edx
cmp ebp, 0xffffffff
jne 0x5885fa
mov ebp, ecx
mov eax, dword [edi + 8]
test eax, eax
jne 0x58867b
test ebp, ebp
je 0x588784
push ebp
push 0
push dword [esp + 0xc]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov eax, ebp
jmp 0x588786
xor eax, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5889d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [edx]
mov ebp, dword [edx + 4]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
movzx eax, byte [edx + 0x10]
shr al, 2
cmp ebp, ecx
sete dl
and dl, al
cmp dl, 1
jne 0x588a69
xor eax, eax
test ebp, ebp
jle 0x588a9f
xor edi, edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebp
nop word cs:[eax + eax]
mov ecx, dword [esi + edi*4]
mov ebp, dword [ebx + edi*4]
mov edx, ebp
xor edx, ecx
mov ebx, ecx
sub ebx, ebp
xor ebx, ebp
or ebx, edx
xor ebx, ecx
sar ebx, 0x1f
mov esi, ebx
not ebx
and ebx, eax
or ebx, esi
mov esi, dword [esp + 8]
mov eax, ebp
sub eax, ecx
xor eax, ecx
or eax, edx
xor eax, ebp
mov ebp, dword [esp]
sar eax, 0x1f
mov ecx, eax
not eax
and eax, ebx
mov ebx, dword [esp + 4]
and ecx, 1
or eax, ecx
inc edi
cmp ebp, edi
jne 0x588a20
jmp 0x588a9f
mov eax, ebp
sub eax, ecx
jne 0x588a9f
jmp 0x588a8d
mov ecx, dword [esi + ebp*4 - 4]
mov edx, dword [ebx + ebp*4 - 4]
dec ebp
cmp ecx, edx
jne 0x588a95
test ebp, ebp
jg 0x588a80
xor eax, eax
jmp 0x588a9f
xor eax, eax
cmp edx, ecx
adc eax, 0xffffffff
or eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x588e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, eax
not ecx
dec eax
and eax, ecx
shr eax, 0x1f
dec eax
mov ecx, dword [edx + 4]
mov edi, dword [esi + 4]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 4], ecx
xor dword [esi + 4], edi
mov ecx, dword [edx + 0xc]
mov edi, dword [esi + 0xc]
xor edi, ecx
and edi, eax
xor ecx, edi
mov dword [edx + 0xc], ecx
xor dword [esi + 0xc], edi
mov ecx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
mov ebx, dword [esi + 0x10]
xor ebx, edi
and ebx, eax
and ebx, 4
xor edi, ebx
mov dword [edx + 0x10], edi
xor dword [esi + 0x10], ebx
test ecx, ecx
jle 0x588faf
mov edx, dword [edx]
mov esi, dword [esi]
xor edi, edi
cmp ecx, 4
jb 0x588f53
lea ebx, [edx + ecx*4]
mov dword [esp], ebx
lea ebp, [esi + ecx*4]
cmp edx, ebp
setb bl
cmp esi, dword [esp]
setb bh
test bl, bh
jne 0x588f53
mov edi, ecx
and edi, 0x7ffffffc
movd xmm0, eax
pshufd xmm0, xmm0, 0
xor ebx, ebx
nop word [eax + eax]
movdqu xmm1, xmmword [edx + ebx*4]
movdqu xmm2, xmmword [esi + ebx*4]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm0
pxor xmm1, xmm3
movdqu xmmword [edx + ebx*4], xmm1
pxor xmm3, xmm2
movdqu xmmword [esi + ebx*4], xmm3
add ebx, 4
cmp edi, ebx
jne 0x588f20
cmp edi, ecx
je 0x588faf
mov ebx, edi
test cl, 1
je 0x588f71
mov ebx, dword [edx + edi*4]
mov ebp, dword [esi + edi*4]
xor ebp, ebx
and ebp, eax
xor ebx, ebp
mov dword [edx + edi*4], ebx
xor dword [esi + edi*4], ebp
mov ebx, edi
or ebx, 1
lea ebp, [ecx - 1]
cmp edi, ebp
je 0x588faf
nop dword [eax + eax]
mov edi, dword [edx + ebx*4]
mov ebp, dword [esi + ebx*4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4], edi
xor dword [esi + ebx*4], ebp
mov edi, dword [edx + ebx*4 + 4]
mov ebp, dword [esi + ebx*4 + 4]
xor ebp, edi
and ebp, eax
xor edi, ebp
mov dword [edx + ebx*4 + 4], edi
xor dword [esi + ebx*4 + 4], ebp
add ebx, 2
cmp ecx, ebx
jne 0x588f80
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5d5770
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
je 0x5d57dd
movzx ecx, byte [edx]
test cl, cl
je 0x5d57dd
inc edx
mov edi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
movsx eax, cl
mov ebp, edi
or ebp, eax
mov ecx, eax
shr ecx, 2
xor ecx, eax
and cl, 0xf
mov esi, ebx
mov al, 0x20
sub al, cl
shl esi, cl
mov ecx, eax
xor edx, edx
shrd ebx, edx, cl
mov edx, dword [esp]
xor ecx, ecx
add edi, 0x100
test al, 0x20
cmovne ebx, ecx
mov eax, ebx
or eax, esi
imul ebp, ebp
mov ebx, ebp
xor ebx, eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x5d5790
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d5e30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor eax, eax
test edx, edx
je 0x5d5ea0
movzx ecx, byte [edx]
test cl, cl
je 0x5d5ea0
inc edx
mov esi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
and cl, 0xdf
movsx eax, cl
mov ebp, esi
or ebp, eax
mov ecx, eax
shr ecx, 2
xor ecx, eax
and cl, 0xf
mov edi, ebx
mov al, 0x20
sub al, cl
shl edi, cl
mov ecx, eax
xor edx, edx
shrd ebx, edx, cl
mov edx, dword [esp]
xor ecx, ecx
test al, 0x20
cmovne ebx, ecx
mov eax, ebx
or eax, edi
imul ebp, ebp
mov ebx, ebp
xor ebx, eax
add esi, 0x100
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x5d5e50
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d83a0
Capabilities:
Access the windows event log
Check os version
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x220
mov esi, esp
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x5d8406
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5d8406
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
push eax
push ebx
push 0x200
push ecx
mov ebx, ecx
call fcn.00786820
add esp, 0x10
test eax, eax
mov ecx, 0x200
cmovns ecx, eax
lea eax, [esi + 8]
push 0
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5d859e
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
lea eax, [eax*2 + 5]
inc edi
and eax, 0xfffffffc
call fcn.00787ee0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push edi
push ebx
push edi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 8]
test eax, eax
setne al
test edi, edi
sete cl
or cl, al
jne 0x5d849e
xor eax, eax
cmp edi, 0x10
jb 0x5d8491
mov eax, edi
and eax, 0xfffffff0
xor ecx, ecx
nop word [eax + eax]
movq xmm0, qword [edx + ecx]
punpcklbw xmm0, xmm0
movq xmm1, qword [edx + ecx + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqa xmmword [ebx + ecx*2], xmm0
movdqa xmmword [ebx + ecx*2 + 0x10], xmm1
add ecx, 0x10
cmp eax, ecx
jne 0x5d8460
jmp 0x5d849a
movsx ecx, byte [edx + eax]
mov word [ebx + eax*2], cx
inc eax
cmp edi, eax
jne 0x5d8491
test edi, edi
je 0x5d8501
xor eax, eax
jmp 0x5d84b5
inc eax
cmp eax, edi
jae 0x5d8501
cmp word [ebx + eax*2], 0x25
jne 0x5d84b0
nop dword [eax]
inc eax
movzx ecx, word [ebx + eax*2]
lea edx, [ecx - 0x30]
cmp edx, 0xa
jb case.0x5d84d5.42
lea edx, [ecx - 0x2a]
cmp edx, 0x39
ja case.default.0x5d84d5
jmp dword [edx*4 + 0xa8d494]
mov word [ebx + eax*2], 0x63
jmp case.0x5d84d5.43
cmp ecx, 0x73
jne case.0x5d84d5.43
mov word [ebx + eax*2], 0x53
jmp case.0x5d84d5.43
mov word [ebx + eax*2], 0x43
jmp case.0x5d84d5.43
mov word [ebx + eax*2], 0x73
jmp case.0x5d84d5.43
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea edi, [esi + 0x10]
push eax
push ebx
push 0xff
push edi
call fcn.007867d0
add esp, 0x10
mov word [esi + 0x20e], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x5d858e
call fcn.005d82a0
test eax, eax
jle 0x5d858e
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x5d859e
mov dword [esi + 8], edi
sub esp, 0x24
lea ecx, [esi + 8]
mov dword [esp + 0x1c], ecx
movd xmm0, dword [0xa8d490]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x5d859e
push 0x10
push str.OpenSSL:_FATAL
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e7f20
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
cmp ecx, 0
je 0x5e7f4b
mov dl, byte [esi]
lea esi, [esi + 1]
xor dl, byte [edi]
lea edi, [edi + 1]
or al, dl
dec ecx
jne 0x5e7f37
neg eax
shr eax, 0x1f
pop edi
pop esi
ret
Function at 0x5e9f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5ea037
xor eax, eax
nop word cs:[eax + eax]
mov dword [esp], eax
mov ebp, eax
shr ebp, 3
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + ebp]
mov ecx, dword [esp]
mov bh, cl
and bh, 7
mov dl, bh
xor dl, 7
movzx ecx, dl
mov esi, edx
bt eax, ecx
setb bl
shl bl, 7
mov edi, dword [esp + 0x38]
movups xmm0, xmmword [edi]
movups xmmword [esp + 4], xmm0
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x50]
add esp, 0xc
movzx eax, bl
xor bl, byte [edi]
cmp dword [esp + 0x40], 0
movzx ecx, bl
cmove ecx, eax
movdqu xmm2, xmmword [esp + 4]
movdqa xmm0, xmm2
psrldq xmm0, 1
movd xmm1, ecx
pslldq xmm1, 0xf
por xmm1, xmm0
psrlw xmm1, 7
pand xmm1, xmmword [0xa8f0c0]
movdqa xmm0, xmm2
paddb xmm0, xmm2
por xmm0, xmm1
movdqu xmmword [edi], xmm0
mov edi, dword [esp + 0x2c]
movzx eax, byte [edi + ebp]
btr eax, esi
and bl, 0x80
movzx edx, bl
mov cl, bh
shr edx, cl
or edx, eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov byte [edi + ebp], dl
inc eax
cmp ecx, eax
jne 0x5e9f80
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5ea040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [esp + 0x2c], 0
je 0x5ea102
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x3c], 0
lea ebp, [esp + 1]
je 0x5ea0b1
xor edi, edi
nop dword [eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [ebx]
xor al, byte [esi + edi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + edi], al
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ea070
jmp 0x5ea102
xor edi, edi
nop word cs:[eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [esi + edi]
movzx ecx, byte [ebx]
xor cl, al
mov edx, dword [esp + 0x28]
mov byte [edx + edi], cl
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ea0c0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5eaa00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0x38]
mov eax, 0xfffffffe
or ecx, dword [esi + 0x3c]
jne 0x5eac14
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x34]
mov ebx, dword [esi + 0x30]
add ebx, ecx
adc edx, 0
mov eax, 0xffffffff
mov edi, ebx
neg edi
mov edi, 0x20000000
sbb edi, edx
jb 0x5eac14
mov edi, dword [esp + 0x24]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edx
mov eax, dword [esi + 0x170]
test eax, eax
je 0x5eaaa0
test ecx, ecx
je 0x5eac0c
nop dword [eax]
movzx edx, byte [edi]
xor byte [esi + eax + 0x40], dl
inc edi
lea ebx, [ecx - 1]
inc eax
and eax, 0xf
je 0x5eaa78
cmp ecx, 1
mov ecx, ebx
jne 0x5eaa60
test eax, eax
jne 0x5eac0c
lea eax, [esi + 0x40]
lea ecx, [esi + 0x60]
push ecx
push eax
call dword [esi + 0x168]
add esp, 8
mov ebp, ebx
and ebp, 0xfffffff0
mov dword [esp + 8], ebp
jne 0x5eaaad
mov ebp, edi
jmp 0x5eaac5
mov ebx, ecx
mov ebp, ebx
and ebp, 0xfffffff0
mov dword [esp + 8], ebp
je 0x5eaa9c
lea eax, [esi + 0x40]
lea ecx, [esi + 0x60]
push ebp
push edi
push ecx
push eax
call dword [esi + 0x164]
add esp, 0x10
add ebp, edi
and ebx, 0xf
test ebx, ebx
je 0x5eac0a
lea ecx, [esi + 0x40]
mov dword [esp], 0
cmp ebx, 8
mov dword [esp + 4], ebx
jb 0x5eaba0
mov eax, dword [esp + 8]
lea edx, [ebx + eax]
add edx, edi
cmp ecx, edx
lea edx, [esi + ebx + 0x40]
setb bl
cmp ebp, edx
setb dl
test bl, dl
mov ebx, dword [esp + 4]
jne 0x5eaba0
mov dword [esp], 0
cmp ebx, 0x20
jb 0x5eab6e
mov eax, ebx
and eax, 0xffffffe0
mov edx, dword [esp + 8]
add edx, edi
add edx, 0x10
xor ebx, ebx
nop word cs:[eax + eax]
movups xmm0, xmmword [edx + ebx - 0x10]
movups xmm1, xmmword [edx + ebx]
movups xmm2, xmmword [esi + ebx + 0x40]
xorps xmm2, xmm0
movups xmm0, xmmword [esi + ebx + 0x50]
xorps xmm0, xmm1
movups xmmword [esi + ebx + 0x40], xmm2
movups xmmword [esi + ebx + 0x50], xmm0
add ebx, 0x20
cmp eax, ebx
jne 0x5eab30
mov ebx, dword [esp + 4]
cmp ebx, eax
je 0x5eac0a
mov dword [esp], eax
test bl, 0x18
je 0x5eaba0
mov edx, dword [esp]
mov eax, ebx
and eax, 0xfffffff8
nop word cs:[eax + eax]
movsd xmm0, qword [ebp + edx]
movsd xmm1, qword [ecx + edx]
xorps xmm1, xmm0
movlps qword [ecx + edx], xmm1
add edx, 8
cmp eax, edx
jne 0x5eab80
mov dword [esp], eax
cmp ebx, eax
je 0x5eac0a
mov edx, dword [esp]
and ebx, 3
je 0x5eabbc
mov edx, dword [esp]
nop dword [eax + eax]
movzx eax, byte [ebp + edx]
xor byte [ecx + edx], al
inc edx
dec ebx
jne 0x5eabb0
mov ebx, dword [esp + 4]
mov eax, dword [esp]
sub eax, ebx
cmp eax, 0xfffffffc
ja 0x5eac0a
mov eax, dword [esp + 8]
add eax, edi
add eax, 3
nop word cs:[eax + eax]
movzx ecx, byte [eax + edx - 3]
xor byte [esi + edx + 0x40], cl
movzx ecx, byte [eax + edx - 2]
xor byte [esi + edx + 0x41], cl
movzx ecx, byte [eax + edx - 1]
xor byte [esi + edx + 0x42], cl
movzx ecx, byte [eax + edx]
xor byte [esi + edx + 0x43], cl
add edx, 4
cmp ebx, edx
jne 0x5eabe0
mov eax, ebx
mov dword [esi + 0x170], eax
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ee350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x5ee49b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x5ee3b1
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push str.crypto_modes_ocb128.c
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.005daf20
add esp, 0x10
test eax, eax
je 0x5ee4ad
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0xa8f140]
movdqa xmm1, xmmword [0xa8f150]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x5ee3d0
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5ee4a5