joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435004
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x17907d43]
mov dh, 0xef
shl dword [eax + 0x68ab31c1], 0xc
sub byte [eax], bh
cmp byte [edi], bh
dec edi
xor al, 0xdc
ficom word [ebx - 0x83111fb]
push ebx
sbb byte [eax], 0x82
vpandn xmm1, xmm6, xmm4
adc al, 0xdd
stosb byte es:[edi], al
leave
int3
aad 0xe4
jle 0x434ead
invalid
les ecx, [ebx - 0x6e3a0fd6]
xchg esi, eax
jecxz 0x434f01
mov edi, 0x1d22e230
sbb dh, byte [ebp + 0x1676aa99]
hlt
shr dword [ecx], cl
or al, 0xd7
in al, dx
jnp 0x434fe4
xchg esp, eax
cli
pop ds
dec ebx
mov eax, dword [0x28c46e84]
or dword [esi - 0x3623b250], 0x28bfaf1f
mov al, 0xe7
inc ecx
nop
cmp eax, 0xcc74a3d1
xor ah, bh
int3
mov eax, dword [ecx + edx*8]
xchg byte [eax + 0x152f87f1], al
mov ds, word [edi + edx]
sub dl, byte [edx]
dec eax
xchg esp, eax
jbe 0x434f34
adc edi, dword [edx - 0x70]
pushal
idiv byte [ecx]
sal byte [esi - 0x1a], 1
xchg dword [esp + edi*2 + 0x40], edi
sar ah, cl
jecxz 0x434f62
dec edi
inc edi
sub edi, edi
mov edi, 0xbd7697e1
outsb dx, byte [esi]
mov ah, 0xc4
sbb dl, al
out 0xdf, ax
scasb al, byte es:[edi]
mov dword [0x2c1ad619], eax
arpl dx, cx
mov byte [0x31793757], al
mov ah, 0xe6
xor bl, byte [ebp + 0x2e]
jne 0x434f87
shl byte [edi + 0x1d5c3c37], 0xb2
iretd
stc
add dword [ebx], ebp
imul edx, ecx, 0xffffffd1
xor al, 0x1f
xchg edx, eax
call 0xfbda20de
xchg esi, eax
sti
pop es
cld
jo 0x434f84
in eax, 7
xor byte [ecx - 0xc6c3f6d], bl
js 0x435063
mov bh, byte [edi + 0x48]
jbe 0x434fc3
js 0x434faa
scasd eax, dword es:[edi]
inc ebp
aaa
das
pop ebp
cmp al, 0xd2
lahf
sbb dword [esi + 0x40e8e4d4], eax
jge 0x434ff1
adc eax, dword [eax + ecx*2]
mov dword [0xc8477770], eax
ljmp 0xfa3b
iretd

Function at 0x436f5c
Capabilities:
Encode data using xor

Disassembly:
imul edi, eax, 0xfe07b50d
xor byte [edx - 0x48ecc83a], bl
xor eax, 0x8ae26bbc
invalid
xchg ebx, eax
mov edx, 0xc0db8b6e
push 0x6ca6802a
cmp al, 0x5b
jl 0x436fde
sub byte [edi - 0x53], ah
daa
mov al, 0xb7
jge 0x436faa
movsb byte es:[edi], byte [esi]
mov ecx, 0xcb5b4cc1
push esp
and ah, ah
loopne 0x436f14
push esi
sal dword [ebx - 0x36a37be9], cl
invalid
inc edx
arpl di, cx
mov dword [0xe9e35608], eax
imul ebp, dword [ecx + eax + 0x64], 0x20496ef5
adc al, byte [0x1a9569cb]
sub al, 0xe0
pop edx
push esp
call 0x260a4bf0
push ds
retf
inc esp
dec edx
int 0x5d
sub dh, byte [ebx]
xor esi, edi
sub eax, 0xc06f3d0e
jae 0x436fad
sbb edi, ecx
pushfd
cwde
add eax, 0x430da4a1
sbb eax, 0xe2e27958
rol byte [ebx + 0x33], 1
sbb al, 0x15
pop ecx
pop ebp
add al, 0
and byte [ebx], bl
xchg ebp, eax
out dx, al
outsd dx, dword [esi]
adc byte [ebx], ch
adc al, 0x8e
int 0x39
ret 0x6153
Function at 0x437778
Capabilities:
Encode data using xor

Disassembly:
stc
jns 0x437768
test al, 0xd0
invalid
sahf
rcr al, cl
jmp 0x437757
jbe 0x437731
add edx, dword [ecx]
shl dword [ebp - 0x23], 0x85
imul esi, dword [ecx], 2
add bh, byte [edx]
stosd dword es:[edi], eax
outsb dx, byte [esi]
cmc
fsubr st(0)
adc edx, dword [esi + ecx*2]
pushal
add bh, byte [edx + 0x26f9a864]
neg byte [ecx]
stc
neg byte es:[ecx]
xor ah, 0xb8
mov esi, 0x415a3fd0
fcom dword [eax + 0x25d4a534]
aam 0x25
push edi
pushal
cmp dword [esi], 0xd2e4d613
inc ebx
fist dword [ebp + 0x31]
mov dword [ecx + 4], eax
add al, 0x1c
rol byte [esi + 0x7785d5c1], 1
invalid
cdq
sbb edi, dword es:[ebx - 0x1088ccda]
clc
mov edi, 0x3ff60e7
xor ecx, esp
inc edi
je 0x8f832a95
loop 0x437742
sub byte [eax - 0x6a458535], ah
adc esi, ebx
lcall 0x3395, 0x6aa86298
invalid
Function at 0x4380a0
Capabilities:
Encode data using xor

Disassembly:
inc esi
mov dl, 0xc7
insd dword es:[edi], dx
test eax, 0x1a7a4b5f
xor edx, dword [esi - 0x77]
movsb byte es:[edi], byte [esi]
pop esp
sbb byte [edi], dh
or eax, 0x9a72bf08
xor byte [edx - 0x4c2f3bae], dh
popfd
xchg ebx, eax
js 0x438076
dec edx
sbb eax, 0x30c8bca8
lahf
imul ebp, eax, 0xc9dc187f
sbb ah, bl
leave
sbb ah, bl
leave
xor ecx, esp
sbb dh, byte [esi + 0x1b]
jbe 0x4380c3
inc ecx
mov ch, 0x8d
adc esp, edx
cli
jmp 0x4380fd
jae 0x438101
sub dword [edx - 0x23], ebp
cmp al, 0xe6
adc al, 0xc
cld
in al, 0x44
xor dl, byte [ecx + 6]
adc byte [ebx + 0x741f6c70], ah
lahf
pop ds
je 0x438079
loopne 0x4380a6
pop ecx
retf 0x69bc
sbb dword [esi], 0x6dd1790b
outsb dx, byte [esi]
shr dword [ebp + 0x6e], 1
cmp byte [eax + 0x4c], ch
sbb eax, 0xcc8ca49d
not ch
sahf
popal
inc eax
pop ecx
rol esi, cl
and dword [0x149e5b46], esp
fmul st(3)
je 0x43816d
jg 0x43813e
xor byte [esi - 0xf1212c9], ah
jns 0x4380d7
cmp ecx, ebx
or al, 0x76
pop edx
invalid
cmp ecx, dword [edi]
xchg dword [ebx - 0x3a], edi
inc eax
xor edx, dword [ebx - 0x5e06c2fb]
and dword [ebx + 0x33], ebx
mov byte [esi], cl
scasd eax, dword es:[edi]
mov edx, dword [ebx - 0xbbac75d]
cmp dword [eax], edi
aad 0x14
lcall 0x4b29, 0x41eb5341
lds edx, [ebx - 0x47314e5a]
xor edx, esp
xor ebx, edx
adc esi, ebp
out dx, al
out 0x76, eax
sar bh, 0xcc
push cs
mov dword [eax], esi
in eax, dx
popfd
outsb dx, byte [esi]
dec esi
push ds
dec edx
xchg byte [esi + 0x74], bl
jb 0x438199
mul dword [esi - 0x3f2345a8]
adc eax, 0x87a71281
cmpsd dword [esi], dword es:[edi]
xchg dword [ebp - 2], esi
jne 0x43818c
in al, dx
mov eax, dword [0xec31e1fa]
sahf
xor al, 0x58
invalid
mov ebx, ebx
loop 0x4381fb
xchg dword [ebp + esi*8 + 0x34], edi
xchg edi, eax
fucomp st(2)
push 0xffffffffffffffc1
fdivp st(7)
push ds
das
pop eax
mov bh, 0x84
pop ss
sub byte [edx + 0x13], al
mov bl, 0xdb
idiv dword [edx]
mov ch, 0xad
inc edi
and byte [ebx + 0x13], cl
jmp 0x58bac85e
inc esi
add al, 0x47
or esi, dword [esi + 0x93cdf5]
xor eax, 0x362c4b5c
and ch, byte [esi]
aas
adc al, 0x6c
shr byte [eax + 0x7947e2d0], cl
inc edi
jns 0x438281
invalid
jns 0x438281
or byte [esi], 0x68
cwde
shl eax, cl
retf 0xb677
push cs
push 0xcae0d398
ja 0x4381c6
mov dword [esi - 0x37bf2c56], eax
xchg esp, eax
sub byte [eax], ch
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
loopne 0x43824e
jmp 0x438205
bound esi, qword [ebx - 0xcf089d]
invalid
cmpsd dword [esi], dword es:[edi]
add dh, dl
inc ebx
xchg byte [ebp + ebx*2 - 0x2563608f], ah
fidivr word [ebx + 0x1eb79f8f]
mov ebp, 0xafb9953f
push 0xfffffffffffffffc
loopne 0x4382bd
jnp 0x4382d8
cdq
popal
js 0x4382b9
push 0x4b
dec esp
invalid
salc
Function at 0x43832c
Capabilities:
Encode data using xor

Disassembly:
stc
mov byte [0xb4e5389c], al
mov byte fs:[0xb7593e50], al
mov byte fs:[0xb7593e50], al
pop ecx
mov bh, 0xb7
xor eax, 0x186fb4dc
adc ebp, dword gs:[ebp - 0x2a]
mov bh, 0x35
fdiv qword [edi + ebp*2 + 0x6d136518]
salc
lea esi, [eax + 0x7f]
pop ebp
xor ch, byte [edi]
daa
loop 0x4382b8
sbb dword [esi], eax
outsb dx, byte [esi]
mov al, 0x73
imul esp, dword [eax], 0x66
jbe 0x4382b5
aad 0x9f
xchg edx, eax
in eax, 0x99
in eax, 0xc0
cwde
jge 0x438262
cwde
test esi, ebp
mov ebp, 0xc85bc2a
mov dword [ecx - 0xa], ebp
cmp byte [ebx - 0xd], ah
bound ebx, qword [ebp + 0x7b06ba10]
and al, 0xff
invalid
jl 0x4382ae
push 0x528660e9
pop edx
push 0xffffffffffffffad
cli
mov eax, es
mul byte [edi + 0x78]
invalid
movsb byte es:[edi], byte [esi]
invalid
stosb byte es:[edi], al

Function at 0x43907c
Capabilities:
Encode data using add xor sub operations

Disassembly:
imul ebp, dword [edi*2 - 0x7cb628c4], 0x42
popal
mov ch, 0x8f
mov ebp, 0xf7be621a
push eax
dec edi
inc ebx
mov bl, 0xdb
stosb byte es:[edi], al
push 0x5723b78
push cs
dec edx
and byte [ebx], ah
lds ebp, [edx - 0x6bef4988]
mov ch, 0x20

Function at 0x43a004
Capabilities:
Encode data using xor

Disassembly:
pop ss
stosb byte es:[edi], al
std
xor eax, 0x6549a046
mov cs, word [ecx + 0x5920e4fd]
or al, 0x73
push ecx
mov dword [0xe9d700f], eax
mul byte [edi]
mov ds, word [eax + 1]
ret 0xcfc8
jbe 0x439fc3
js 0x43a01a
stosd dword es:[edi], eax
fmul qword [edi + ecx*4]
pop eax
fnstenv [ebp + 0x6291b0f3]
wait
mov edx, dword [edi]
lodsd eax, dword [esi]
xchg esp, eax
ror byte [ebx + 4], 1
mov esp, 0x1e2fda26
add al, 0xbc
fisubr dword es:[edi]
push ds
lodsb al, byte [esi]
arpl word [ebx], cx
bound esp, qword [edx + 0x1d063d2e]
xor al, 0xa4
adc esp, ecx
adc dword [eax], edi
add al, 0x9f
dec edi
jmp 0x43a0a8
pop esi
aaa
lcall 0xcdd7, 0xdcdc1bec
ret
push ecx
loopne 0x43a03c
fistp word [ebx + 0x16]
outsd dx, dword [esi]
adc bl, byte [eax - 0x5f]
adc eax, 0x8eeedf98
jp 0x43a0d3
sbb dword [ecx + 0x113112ce], 0x6c6b7d1c
cmpsb byte [esi], byte es:[edi]
rol byte [edx - 0x65486115], 1
adc al, 0x6f
xchg esp, eax
loopne 0x43a100
stc
or byte [edi - 0x6278fea8], bl
and edi, ecx
add dword [edi + 0x5acf219d], eax
pop edx
add eax, dword [esi]
xor al, 0x2d
jo 0x43a0d8
adc byte [esi - 0x27d34bc8], al
and ch, dl
invalid
mov ch, 0x2a
or esp, ebp
pop esi
adc edi, dword [edi]
fistp dword [esi]
cmp cl, byte [esi - 0x47a11847]
invalid
Function at 0x4412e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
adc eax, 0xddbdb5dd
fnsave dword [ebp + 0x2fd3ddbd]
fnsave dword [ebp + 0x2fd3ddbd]
or bl, byte [ebx]
stosd dword es:[edi], eax
inc ecx
stosd dword es:[edi], eax
pop ds
adc byte [ebx + 0x2d930428], al
mul byte [ebp - 0x4e]
fnsave dword [edi + 0x7cd8f969]
mov dword [edx + eax*8], ebp
sbb dword [esi + 0x1faf4aa7], edx
pushal
loope 0x4412e2
xor al, 0x53
push edx
and dword [eax + 0x123518e0], ecx
not ah
jge 0x441382
add al, byte [0xf979a629]
xchg edi, eax
sub byte [ebx], 0xf6
outsb dx, byte [esi]
and esi, ebp
invalid
invalid
xor byte [ebx + ecx], bl
or esp, dword [ebp + 0x652b4258]
mov gs, word [edx - 0x690a3cb1]
or dword [eax - 0x5cbe470], 0xffffff97
cmp dword [esi + 0x2a7fc50d], ebx
push es
inc ecx
jnp 0x441407
fmul qword [edi + 0x20]
sahf
adc dword [edx + eax*8], edx
cmp dword [ebx + esi*8], esi
mov byte [0x82940af9], al
imul esi, dword [ebp + 0x16], 0x7a8e6808
pushfd
jge 0x44137e
xchg esp, eax
sbb al, 0x8f
adc dword [edx + 0x7469811a], edx
test al, 0xf1
mov ebx, 0x67bf0901
arpl ax, bx
enter 0xffffffffffff8cf9, 0x45
push eax
push 0x22
and byte [0xf44fcddd], ch
push dword [esi + 0x1f]
stosb byte es:[edi], al
xchg ebx, eax
pop ds
and eax, 0x37fc92e2
lds esp, [ecx]
xchg ebx, eax
imul dword [ebp + 0x16d591c6]
test eax, 0xf2901dec
sbb al, 0x7d
xor cl, byte [esi - 0x572148b6]
aam 0x96
in al, 0xc3
xchg ebx, eax
add al, 0x29
jbe 0x4413bb
pop eax
sbb al, 0x3c
and al, 0x38
cmp al, 0x82
loopne 0x441443
push 0x50922d0f
sar dword [ebx + 0x6cb12c97], 0xd2
dec ecx
push edi
invalid
invalid
Function at 0x442894
Capabilities:
Encode data using xor

Disassembly:
salc
pop esi
xchg byte [eax - 0x47f69780], bl
idiv bl
scasb al, byte es:[edi]
rcr byte [eax + 0x33542da0], 0xca
inc esi
out dx, eax
mov ebx, 0x3f98a6e2
outsd dx, dword [esi]
dec esi
push es
xor byte [ecx + 0x38fb4e7], ch
hlt
and bh, byte [edx - 0x71]
mov ss, word [edx - 0x1482cce]
insb byte es:[edi], dx
xchg edx, eax
sub byte [esi + 0x22], 0x42
push esp
loope 0x4428e2
or bh, byte [ecx + 0x78428155]
in al, dx
or edx, edx
and dword [esi], 0xffffff81
xchg dword [edi], esi
inc ebx
xchg edi, eax
loopne 0x4428f6
rcl byte [ecx + 0x69840ea5], 0xec
jle 0x4428bc
mov esi, 0x3c76143f
jno 0x4428de
wait
loope 0x44282f
and eax, 0x4d5f05c0
out dx, eax
retf
add eax, 0x3b6fdd3a
in al, dx
push ebp
int1
or esp, ebp
ljmp 0x3bbc
wait
mov bl, 0xc3
xchg ecx, eax
cli
jae 0x442868
inc edi
arpl word [esi + esi*2 + 0x22a29bbc], di
test al, 0x9d
adc eax, 0xa83b59f5
or esi, dword [0xfe017a29]
test al, 0xb
xor eax, 0xfe017a29
sub dword [edx + 1], edi
invalid
div ch
or edx, dword [edi + edx*2 - 0x63]
sbb esi, 0xd83b40cc
xchg dword [edx + 0x52], eax
pop esi
pop eax
jge 0x4428f3
div dword [ecx + 0x42d5ef29]
mov esp, 0x6caf776e
mov edi, 0x44940a79
cmp bl, byte [edi + 0x46]
arpl si, bx
dec esi
or eax, dword [edi - 0x37]
lds esp, [edi]
mov dl, 0x80
pop esi
test eax, 0xd5fbbcf5
test al, 0xd8
test dword [eax + 0x6c1ce413], 0xdca92be2
inc edx
push ds
mov al, 0x58
and al, 0xfe
and dword [eax - 0x360082c2], esi
jns 0x442999
fnop
push ds
jb 0x4428df
fdivr dword [ebx + 0x6dd46fbf]
in al, dx
and dword [edi + 0x55], 0x45
dec ebx
mov ecx, 0xbb54211f
cmp eax, 0xe0c8ddb8
pop ebp
mov eax, 0x5de0c8dd
invalid
cmp eax, 0xc24f835a
inc ebp
enter 0xffffffffffffd4ff, 0x6c
and eax, ecx
out dx, eax
fiadd word [ecx]
test al, 0x46
inc ebp
sub byte [esi - 0x39], al
scasd eax, dword es:[edi]
and al, 0xf4
ja 0x442963
invalid
inc eax
or esi, dword [0xd9746211]
stc
push edx
in al, dx
xchg esi, eax
mov edx, 0xc4cc9d38
jns 0x442962
mov word [esi - 0x5f4425d9], es
popal
inc ebx
aad 0x93
ja 0x44297b
dec ebx
cmc
mov cl, 0x5c
cmp esi, dword [ebp - 0x1e]
aaa
cdq
lodsd eax, dword [esi]
jno 0x44296d
and edx, dword [edi + 0x66]
mov al, byte [0x46b243f1]
xchg ecx, eax
mov ebx, ds
dec esp
sbb eax, 0xdd89437a
sub bl, byte [edi + 0x4f63474d]
movsd dword es:[edi], dword [esi]
sub byte [esi + eax*2 + 6], ah
jecxz 0x4429b4
or byte [eax - 0x7f], ch
fstp xword [edx]
push 0x3df9514f
add eax, 0xa17f33e4
movsb byte es:[edi], byte [esi]
invalid

Function at 0x44d0f8
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx], 0x1c
and eax, 0x232d4458
dec ebp
inc esi
out dx, al
invalid
xor ecx, 0x53
sbb dword [edx + edx*4 - 0x10], ecx
push esi
sbb esp, 0xa698e6e8
dec esi
jbe 0x44d09f
outsd dx, dword [esi]
jae 0x44d152
outsb dx, byte [esi]
sbb esp, dword [eax + ebx*2 - 0x2a47ffec]
sahf
push ds
aas
invalid
int3
fdivr st(0), st(0)
or ah, ah
cld
jns 0x44d182
popfd
sub ax, 0x5148
jmp 0x44d12a
scasb al, byte es:[edi]
pop esp
sbb dword [eax + 0x694ff29d], 0xffffffa6
outsd dx, dword [esi]
adc ebx, esp
mov cl, 0x59
cdq
mov bh, 0xa0
or al, 0xfe
clc
push ebp
daa
xchg ebp, eax
inc ebx
sbb edx, 0xffffffa5
retf 0x2e74
Function at 0x44d84c
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebp + 4], 0xffffffd3
xor byte [esi + 0xd], dh
in eax, 0xeb
bound edi, qword [ebx + 0x6607a5ca]
push ss
push ss
pop esp
and dword [ebp - 0xb], edx
pop eax
push ebx
mov eax, dword [0xa6f570f7]
insd dword es:[edi], dx
popfd
sal byte [ebx], 1
xor ecx, dword [esi + 0x4e]
mov ebp, 0x2fe4decf
sbb bh, byte [edx - 0xa]
sbb dword [ecx + 0x241b9d06], ebp
invalid
neg byte [ecx]
test eax, 0x241b9d06
invalid
push 0xe7a10c58
popal
or cl, ah
xchg dword [esi + 0x61], eax
fisubr dword [eax + 0xa64d314]
jge 0x44d81e
outsb dx, byte [esi]
xor al, 0x73
mov dword [0xf64b816c], eax
push ecx
int1
ja 0x44d846
ret

Function at 0x450740
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
lcall 0xe472, 0xeddae62d
lodsd eax, dword [esi]
cmp dh, byte [esi]
sbb dword [ebp + 0x11e476a0], edi
dec esi
pop ds
adc al, 0x62
lcall 0xbf9, 0x38261a98
mov cl, 0x44
add eax, 0x355bb320
xlatb
push 0xffffffffffffffa6
out dx, eax
bound ebx, qword [eax + esi*2 - 0x51]
scasd eax, dword es:[edi]
popal
lahf
xor dword [eax - 0x2e], 0x834636bb
pop esi
sub cl, byte [ebp + ebp - 0x26]
adc eax, 0x8392d698
xor dh, byte [edi + 0x40]
test dword [0x94360654], ebp
mov fs, word [edx + 0x333abe04]
jne 0x45076a
add bh, byte [eax + 0x2fe73099]
add al, 0x38
invalid
Function at 0x4097f0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x409810
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x40d660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d67e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x40d6c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d6de
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x40d720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d742
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x40d7a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d7c2
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x40d820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d84a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x40d8b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d8da
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x40d940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40d99f

Function at 0x40da20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40da7f
Function at 0x40f400
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x40f920
test edx, edx
je 0x40f920
call fcn.0040f417
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x40f960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0040f400
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x40f9d1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x40f996
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x4102e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x410364
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x41033c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x410344
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.00410369