joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc940
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dbca1
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x625fc4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6241dc]
cmp eax, dword [ecx + 0x1018]
jg 0x4cc9a5
mov eax, 0x6102a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bca10
mov esp, ebp
pop ebp
ret
push 0x6241dc
call fcn.005bc93a
add esp, 4
cmp dword [0x6241dc], 0xffffffff
jne 0x4cc987
push 0x190
lea eax, [ebp - 0x1a0]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005be800
add esp, 0xc
lea eax, [ebp - 0x1a0]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x5eacc0
mov dword [0x6102a0], eax
call fcn.005bc7e4
push 0x6241dc
call fcn.005bc8f0
add esp, 8
jmp 0x4cc987

Function at 0x4ccc90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ecx
push ebp
mov ebp, dword [esp + 0x40]
push esi
test ebx, ebx
je 0x4ccdca
test ecx, ecx
je 0x4ccdca
mov esi, dword [esp + 0x40]
cmp esi, 0x10
jbe 0x4ccdca
test ebp, ebp
je 0x4ccdca
push edi
mov edi, esi
mov eax, 0x10
and edi, 0xf
cmove edi, eax
cmp esi, 0x20
jbe 0x4ccd14
cmp edi, eax
mov edx, 0x20
push ebp
cmove eax, edx
and esi, 0xfffffff0
sub esi, eax
mov eax, dword [ebx + 0x1c]
push esi
push ecx
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, esi
add ebp, esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
lea eax, [ecx + 0x10]
push edi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.005be280
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x20]
mov eax, dword [ebx + 0x14]
push ebx
call eax
add esp, 0x18
xor ecx, ecx
test edi, edi
je 0x4ccd4d
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x14]
xor byte [esp + ecx + 0x24], al
inc ecx
cmp ecx, edi
jb 0x4ccd40
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.005be280
add esp, 0xc
test edi, edi
je 0x4ccdb5
mov eax, 0x10
sub eax, edi
push eax
lea eax, [esp + 0x28]
add eax, edi
push eax
lea eax, [esp + 0x1c]
add eax, edi
push eax
call fcn.005be280
lea eax, [esp + 0x20]
push eax
push eax
mov eax, dword [ebx + 0x14]
push ebx
call eax
mov eax, dword [ebx + 0x28]
add esp, 0x18
xor eax, dword [esp + 0x14]
mov dword [ebp], eax
mov ecx, dword [ebx + 0x2c]
xor ecx, dword [esp + 0x18]
mov dword [ebp + 4], ecx
mov ecx, dword [ebx + 0x30]
xor ecx, dword [esp + 0x1c]
mov dword [ebp + 8], ecx
mov ecx, dword [ebx + 0x34]
xor ecx, dword [esp + 0x20]
mov dword [ebp + 0xc], ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
Function at 0x4ccde0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 8], eax
push edi
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x4ccf23
test edi, edi
je 0x4ccf23
test ebx, ebx
je 0x4ccf23
test eax, eax
je 0x4ccf23
push esi
cmp eax, 0x10
jae 0x4cce62
mov esi, 0x10
sub esi, eax
add eax, 0x28
add eax, ebp
push esi
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.005be280
push dword [esp + 0x1c]
lea eax, [esp + 0x34]
add eax, esi
push edi
push eax
call fcn.005be280
movups xmm0, xmmword [esp + 0x3c]
mov eax, dword [esp + 0x28]
add esp, 0x18
jmp 0x4cce67
movups xmm0, xmmword [eax + edi - 0x10]
mov esi, eax
lea ecx, [ebp + 0x28]
shr esi, 4
movups xmmword [esp + 0x14], xmm0
test esi, esi
je 0x4ccec5
lea eax, [esp + 0x24]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push ebp
call eax
movups xmm0, xmmword [edi]
lea ecx, [ebp + 0x28]
add esp, 0xc
movups xmmword [ecx], xmm0
mov eax, dword [edi]
xor eax, dword [esp + 0x24]
mov dword [ebx], eax
mov eax, dword [edi + 4]
xor eax, dword [esp + 0x28]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
xor eax, dword [esp + 0x2c]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
add edi, 0x10
xor eax, dword [esp + 0x30]
mov dword [ebx + 0xc], eax
add ebx, 0x10
sub esi, 1
jne 0x4cce78
mov eax, dword [esp + 0x10]
mov esi, eax
and esi, 0xf
je 0x4ccf07
lea eax, [esp + 0x24]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push ebp
call eax
add esp, 0xc
xor edx, edx
test esi, esi
je 0x4ccf03
lea eax, [esp + 0x24]
sub edi, eax
sub ebx, eax
nop dword [eax]
lea ecx, [esp + 0x24]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [ebx + ecx], al
cmp edx, esi
jb 0x4ccef0
mov eax, dword [esp + 0x10]
movups xmm0, xmmword [esp + 0x14]
pop esi
pop edi
movups xmmword [ebp + 0x28], xmm0
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
Function at 0x4cd0c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, esi
mov dword [esp + 0x10], ecx
and edi, 0xf
test ebp, ebp
je 0x4cd1ef
cmp esi, 0x10
jbe 0x4cd1ef
mov eax, esi
and eax, 0xfffffff0
cmp eax, 0x10
jbe 0x4cd128
mov eax, dword [ebp + 0x18]
and esi, 0xfffffff0
push ebx
sub esi, 0x10
push esi
push ecx
push ebp
call eax
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, esi
add ebx, esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
mov eax, dword [ebp + 0x28]
xor eax, dword [ecx]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
xor eax, dword [ebp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 8]
xor eax, dword [ebp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0xc]
xor eax, dword [ebp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push eax
mov eax, dword [ebp + 0x10]
push ebp
call eax
add esp, 0xc
test edi, edi
je 0x4cd1ca
mov eax, dword [esp + 0x10]
add eax, 0x10
push edi
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.005be280
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.005be280
add esp, 0x18
xor ecx, ecx
test edi, edi
je 0x4cd19d
nop dword [eax]
mov al, byte [esp + ecx + 0x24]
xor byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, edi
jb 0x4cd190
lea edi, [ebp + 0x28]
push edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push ebp
call eax
movups xmm0, xmmword [edi]
add esp, 0xc
mov eax, esi
movups xmmword [ebx], xmm0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
movups xmm0, xmmword [ebx - 0x10]
pop edi
mov eax, esi
movups xmmword [ebx], xmm0
pop esi
movups xmm0, xmmword [esp + 0xc]
pop ebp
movups xmmword [ebx - 0x10], xmm0
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
Function at 0x4cd210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
push ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 8], ebp
push esi
push edi
mov edi, dword [esp + 0x40]
test ebx, ebx
je 0x4cd375
mov esi, dword [esp + 0x38]
test esi, esi
je 0x4cd375
test edi, edi
je 0x4cd375
mov eax, ebp
lea ecx, [ebx + 0x28]
shr eax, 4
test eax, eax
je 0x4cd2ad
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ebx + 0x10]
push ecx
push ebx
call eax
mov eax, dword [esi]
lea ecx, [ebx + 0x28]
xor eax, dword [esp + 0x28]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [esi + 4]
xor eax, dword [esp + 0x20]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
xor eax, dword [esp + 0x24]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
add esi, 0x10
xor eax, dword [esp + 0x28]
mov dword [edi + 0xc], eax
movups xmm0, xmmword [edi]
add edi, 0x10
movups xmmword [ecx], xmm0
sub ebp, 1
jne 0x4cd260
mov ebp, dword [esp + 0x10]
and ebp, 0xf
je 0x4cd35c
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ebx + 0x10]
push ecx
push ebx
call eax
add esp, 0xc
xor edx, edx
test ebp, ebp
je 0x4cd2f7
lea eax, [esp + 0x1c]
sub esi, eax
lea ecx, [esp + 0x1c]
mov eax, edi
sub eax, ecx
mov dword [esp + 0x14], eax
mov ebx, eax
nop
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [ebx + ecx], al
cmp edx, ebp
jb 0x4cd2e0
mov ebx, dword [esp + 0x18]
add edi, ebp
lea ecx, [ebx + 0x28]
mov ebp, dword [esp + 0x10]
cmp ebp, 0x10
jae 0x4cd340
mov esi, 0x10
lea eax, [ebp + 0x28]
sub esi, ebp
add eax, ebx
push esi
push eax
push ecx
call fcn.005be280
push ebp
sub edi, ebp
lea eax, [esi + 0x28]
add eax, ebx
push edi
push eax
call fcn.005be280
add esp, 0x18
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005bca10
add esp, 0x20
ret
movups xmm0, xmmword [edi - 0x10]
pop edi
pop esi
mov eax, ebp
pop ebp
movups xmmword [ecx], xmm0
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005bca10
add esp, 0x20
ret
mov ebp, dword [esp + 0x10]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005bca10
add esp, 0x20
ret
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x20
ret
Function at 0x4cd680
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0xc4
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0xc0], eax
push esi
mov esi, dword [esp + 0xcc]
lea eax, [esp + 0x41]
push 0x3f
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x48], 0
movq qword [esp + 0x40], xmm0
mov byte [esp + 0x4c], 0
call fcn.005be800
add esp, 0xc
mov dword [esp + 0x80], 0
test esi, esi
je 0x4cd83f
lea eax, [esp + 0x14]
push eax
call fcn.004d0000
add esp, 4
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4cd741
push 2
call fcn.004debc8
push eax
push 0x421240
call fcn.004dfddf
add esp, 0xc
jmp 0x4cd77a
lea eax, [esp + 0x84]
push eax
push 0x20
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4cd76e
push 2
call fcn.004debc8
push eax
push 0x421260
call fcn.004dfddf
add esp, 0xc
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x20
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004d0040
add esp, 0xc
mov dword [esp + 4], 0
lea eax, [esp + 4]
mov dword [esp + 8], 0
xorps xmm0, xmm0
movlpd qword [esp + 0xc], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4cd7ff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], edx
call fcn.004dcdec
mov eax, dword [esp + 0x10]
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
push 0x20
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004d0040
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xb4]
push eax
call fcn.004cff10
push 0x20
lea eax, [esp + 0xbc]
push eax
push esi
call fcn.004cd860
add esp, 0x20
mov dword [esi + 0x24], 1
mov ecx, dword [esp + 0xc4]
pop esi
xor ecx, esp
call fcn.005bca10
add esp, 0xc4
ret
Function at 0x4cecf0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x30
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x34]
push ebx
push esi
push edi
mov edi, dword [edx + 0x24]
mov ebx, 0
sub edi, 6
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
mov eax, ebx
je 0x4ced7b
mov esi, dword [esp + 0x44]
mov ecx, edi
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
xor esi, esi
nop
cmp ebx, dword [edx + 0x24]
ja 0x4ceec8
cmp esi, edi
jae 0x4ced62
nop dword [eax]
cmp eax, 4
jae 0x4ced5e
mov edi, dword [esp + 0xc]
lea edx, [eax + ebx*4]
mov ecx, dword [esp + esi*4 + 0x18]
inc eax
inc esi
mov dword [edi + edx*4 + 0x38], ecx
mov edi, dword [esp + 0x10]
cmp esi, edi
jb 0x4ced40
mov edx, dword [esp + 0xc]
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, edi
jb 0x4ced30
cmp ebx, dword [edx + 0x24]
ja 0x4ceec8
mov esi, 0x6134c0
nop dword [eax]
movzx ecx, byte [esp + edi*4 + 0x15]
mov dl, byte [esp + 0x18]
xor dl, byte [ecx + 0x6102c0]
mov byte [esp + 0x18], dl
movzx ecx, byte [esp + edi*4 + 0x16]
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x19], cl
movzx ecx, byte [esp + edi*4 + 0x17]
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x1a], cl
movzx ecx, byte [esp + edi*4 + 0x14]
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x1b], cl
movzx ecx, byte [esi]
inc esi
xor cl, dl
mov dword [esp + 0x14], esi
mov byte [esp + 0x18], cl
mov edx, 1
cmp edi, 8
je 0x4cee07
cmp edi, edx
jbe 0x4cedfd
nop
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, edi
jb 0x4cedf0
test edi, edi
je 0x4ceebb
jmp 0x4cee6e
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 4
jb 0x4cee07
movzx ecx, byte [esp + 0x24]
mov edx, 5
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x28], cl
movzx ecx, byte [esp + 0x25]
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x29], cl
movzx ecx, byte [esp + 0x26]
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x2a], cl
movzx ecx, byte [esp + 0x27]
movzx ecx, byte [ecx + 0x6102c0]
xor byte [esp + 0x2b], cl
nop word [eax + eax]
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 8
jb 0x4cee60
xor esi, esi
mov ecx, dword [esp + 0xc]
cmp ebx, dword [ecx + 0x24]
ja 0x4ceeb7
cmp esi, edi
jae 0x4cee9e
nop dword [eax]
cmp eax, 4
jae 0x4cee9e
mov edi, dword [esp + 0xc]
lea edx, [eax + ebx*4]
mov ecx, dword [esp + esi*4 + 0x18]
inc eax
inc esi
mov dword [edi + edx*4 + 0x38], ecx
mov edi, dword [esp + 0x10]
cmp esi, edi
jb 0x4cee80
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, edi
jb 0x4cee70
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
cmp ebx, dword [ecx + 0x24]
jbe 0x4ced90
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x30
ret
Function at 0x4ceee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
movups xmm2, xmmword [eax]
mov eax, dword [esp + 8]
movaps xmm1, xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
movups xmmword [eax], xmm2
pxor xmm0, xmm2
pslldq xmm1, 4
movaps xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x10], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x20], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x30], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x40], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x10
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x50], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm3, 0x20
pxor xmm2, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x60], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm1, xmm3
movups xmmword [eax + 0x70], xmm3
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movaps xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movaps xmm1, xmm2
movups xmmword [eax + 0x80], xmm2
pslldq xmm1, 4
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movaps xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x1b
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movaps xmm2, xmm3
movups xmmword [eax + 0x90], xmm3
pslldq xmm2, 4
movaps xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm3
movaps xmm1, xmm2
pxor xmm1, xmm0
pslldq xmm2, 4
aeskeygenassist xmm0, xmm3, 0x36
pxor xmm1, xmm2
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movups xmmword [eax + 0xa0], xmm1
ret
Function at 0x4cfd40
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x12c
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
movups xmm0, xmmword [ebx + 0x2c]
mov eax, dword [ebx + 0xc]
mov ebp, 0x30
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x14]
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x10], eax
movups xmm0, xmmword [ebx + 0x3c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x1c]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x24], eax
movups xmm0, xmmword [ebx + 0x4c]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x24]
movups xmmword [esp + 0x58], xmm0
mov dword [esp + 0x18], eax
movups xmm0, xmmword [ebx + 0x5c]
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x34], ebx
movups xmmword [esp + 0x68], xmm0
nop dword [eax]
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebp, 1
jne 0x4cfdd0
mov ebp, dword [esp + 0x2c]
xor edi, edi
mov ebx, dword [esp + 0x24]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [esp + 0x18]
xor esi, eax
mov eax, ebx
mov edx, ebp
ror eax, 6
xor esi, eax
ror edx, 0xd
mov eax, dword [esp + 0x14]
and eax, ebx
or ecx, eax
mov eax, ebp
rol eax, 0xa
add esi, ecx
add esi, dword [edi + 0x4212c0]
xor edx, eax
add esi, dword [esp + edi + 0x38]
mov eax, ebp
add esi, dword [esp + 0x28]
add edi, 4
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x1c]
mov ecx, eax
and eax, ebp
or ecx, ebp
and ecx, dword [esp + 0x10]
or ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add edx, ecx
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
lea ebp, [edx + esi]
mov eax, dword [esp + 0x10]
add ebx, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
cmp edi, 0x100
jb 0x4cfe14
mov eax, dword [esp + 0x30]
add eax, ebp
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
add dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x12c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x14], eax
mov eax, dword [esp + 0x14]
add dword [ebx + 0x18], eax
mov eax, dword [esp + 0x18]
add dword [ebx + 0x1c], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x20], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x24], eax
mov eax, dword [esp + 0x1c]
add dword [ebx + 0x28], eax
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x12c
ret
Function at 0x4f32f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dbdf5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov al, byte [ecx]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
xor edx, edx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x24], al
xor edi, edi
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x4f3378
mov esi, ecx
lea ecx, [ebp - 0x24]
sub esi, eax
push esi
call fcn.0046f7f0
mov edi, dword [ebp - 0x20]
push esi
mov esi, dword [ebp - 0x28]
push esi
push edi
call fcn.005be280
mov edx, dword [ebp - 0x20]
sub edi, esi
mov esi, dword [ebp - 0x30]
add esp, 0xc
add edi, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 1
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
mov ecx, dword [ecx + 0x10]
mov eax, ecx
not eax
add eax, eax
xor eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
sub edi, edx
je 0x4f33b5
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 0x14]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x4f33a4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4f344f
mov eax, dword [ecx]
lea edx, [ebp - 0x24]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x4f33e1
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4f33d3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4f342d
mov esi, dword [ebp - 0x18]
sub esi, eax
mov edx, esi
je 0x4f3402
mov ecx, eax
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4f33f7
mov dword [ebp - 4], 2
cmp esi, 0x1000
jb 0x4f3423
mov ecx, dword [eax - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f344a
mov eax, ecx
push esi
push eax
call fcn.005bc4f7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bca10
mov esp, ebp
pop ebp
ret 4
call fcn.004d7f94
call fcn.005a76da
int3