joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490000
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.0053a250
mov eax, dword [0x5b46a4]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x490075
cmp ebx, dword [esi]
je 0x49006c
test edi, edi
je 0x490052
cmp dword [esp + 0xa0], eax
jge 0x49006c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0053a230
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x49007b
mov ebx, dword [esi]
test ebx, ebx
je 0x490052
push ebp
test edi, edi
je 0x49014d
push ebx
call fcn.0045f330
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x4900ab
push str.j____int_sizeof_ctx__key_
push 0x6a
push str..cryptohmachmac.c
call fcn.00447740
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x490105
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.004478c0
add esp, 0xc
test eax, eax
je 0x4901fa
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.00447a70
add esp, 0xc
test eax, eax
je 0x4901fa
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.00447a80
add esp, 0xc
test eax, eax
je 0x4901fa
jmp 0x49012a
cmp eax, 0x80
ja 0x4901fa
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.0053b750
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x490155
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.0053bcd0
add esp, 0xc
jmp 0x490155
test eax, eax
je 0x4901e6
xor eax, eax
jmp 0x490160
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x490160
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.004478c0
add esp, 0xc
test eax, eax
je 0x4901fa
push ebx
call fcn.0045f330
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00447a70
add esp, 0x10
test eax, eax
je 0x4901fa
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x4901a4
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.004478c0
add esp, 0xc
test eax, eax
je 0x4901fa
push ebx
call fcn.0045f330
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00447a70
add esp, 0x10
test eax, eax
je 0x4901fa
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.00447c10
add esp, 8
test eax, eax
jne 0x4901fe
xor eax, eax
jmp 0x490203
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053a230
add esp, 0x88
ret
Function at 0x49e240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x49e259
mov esi, edi
mov edi, eax
jmp 0x49e25b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x49e26b
mov eax, ebx
jmp 0x49e275
push eax
push ebx
call fcn.004408a0
add esp, 8
test eax, eax
jne 0x49e27d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x49e299
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x49e284
cmp eax, dword [esi + 4]
jge 0x49e2b0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x49e2a0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x49e2d1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x49e2ce
dec eax
test eax, eax
jg 0x49e2c0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4ba7d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0053a250
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
inc ebp
cmp eax, 0x302
jge 0x4ba806
cmp eax, 0x100
je 0x4ba806
mov esi, dword [esp + 0x18]
cmp ebp, dword [esi + 4]
jbe 0x4ba825
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
lea esi, [edx + ebp]
cmp esi, ecx
ja 0x4ba7ff
add dword [eax + 0xc], edx
add dword [eax + 0x10], edx
sub ecx, edx
mov dword [eax + 4], ecx
mov esi, eax
test dword [edi + 0x100], 0x200
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ebx
movzx ebx, byte [eax + ecx - 1]
je 0x4ba878
cmp dword [edi + 0x88], 0
jne 0x4ba878
mov edx, dword [edi + 0x58]
push 8
add edx, 8
push 0x5a2dec
push edx
call fcn.00447770
add esp, 0xc
test eax, eax
jne 0x4ba86b
test bl, 1
jne 0x4ba86b
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x4ba878
test ebx, ebx
je 0x4ba878
dec ebx
mov ecx, dword [edi + 0x80]
mov edx, dword [ecx]
push edx
call fcn.00448bd0
add esp, 4
test eax, 0x200000
je 0x4ba8a3
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea eax, [ebx + ebp]
mov esi, edi
sub esi, eax
xor esi, eax
mov ecx, edi
xor ecx, eax
or esi, ecx
xor esi, edi
shr esi, 0x1f
mov ecx, 0xff
lea eax, [edi - 1]
dec esi
mov dword [esp + 0x18], ecx
cmp eax, ecx
jae 0x4ba8d1
mov ecx, eax
mov dword [esp + 0x18], eax
xor ebp, ebp
test ecx, ecx
je 0x4ba927
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea edx, [eax + edi - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
nop
mov edx, ebx
sub edx, ebp
shr edx, 0x1f
mov eax, ebp
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0x18]
jb 0x4ba8f0
mov edx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
lea eax, [ebx + 1]
and eax, ecx
sub edi, eax
shl eax, 8
or dword [edx], eax
pop ebx
mov dword [edx + 4], edi
mov eax, ecx
pop edi
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x4ba960
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.0053a250
mov eax, dword [0x5b46a4]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x1c], esi
sub esi, edi
xor ebp, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebp
cmp ebx, edi
jae 0x4ba9ca
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.00447740
add esp, 0xc
cmp edi, 0x40
jbe 0x4ba9e6
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.00447740
add esp, 0xc
lea ecx, [esp + 0x30]
neg ecx
and ecx, 0x3f
lea edx, [edi + 0x100]
lea ecx, [esp + ecx + 0x30]
mov dword [esp + 0x20], ecx
cmp ebx, edx
jbe 0x4baa10
mov eax, ebx
sub eax, edi
sub eax, 0x100
mov dword [esp + 0x14], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
xor edx, edx
div edi
push edi
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
call fcn.0053bcd0
mov ecx, dword [esp + 0x20]
add esp, 0xc
xor esi, esi
cmp ecx, dword [esp + 0xc4]
jae 0x4baaf0
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x1f
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0xc]
shr edx, 0x1f
sub ecx, ebx
sub ebx, dword [esp + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
jmp 0x4baa88
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
add ebx, ecx
shr ebx, 0x1f
xor bl, dl
mov eax, ebp
shr eax, 0x1f
xor dl, al
or bl, dl
mov dl, byte [esp + 0x2c]
xor bl, al
dec bl
mov byte [esp + 0x13], bl
mov ebx, ecx
shr ebx, 0x1f
xor bl, dl
xor dl, al
or bl, dl
mov edx, dword [esp + 0x18]
mov dl, byte [edx + ebp]
xor al, bl
dec al
not al
and al, dl
and al, byte [esp + 0x13]
mov edx, dword [esp + 0x20]
or byte [esi + edx], al
inc esi
mov eax, esi
sub eax, edi
xor eax, edi
mov ebx, esi
xor ebx, edi
or eax, ebx
xor eax, esi
shr eax, 0x1f
neg eax
inc ebp
and esi, eax
inc ecx
cmp ebp, dword [esp + 0xc4]
jb 0x4baa80
mov ebx, dword [esp + 0x24]
jmp 0x4baaf4
mov edx, dword [esp + 0x20]
xor esi, esi
test edi, edi
je 0x4bab2d
lea ebx, [ebx]
mov ecx, ebx
xor ecx, 0x20
mov al, byte [ecx + edx]
mov cl, byte [ebx + edx]
mov eax, dword [esp + 0x28]
mov byte [eax + esi], cl
inc ebx
mov ecx, ebx
sub ecx, edi
xor ecx, edi
mov eax, ebx
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
inc esi
and ebx, ecx
cmp esi, edi
jb 0x4bab00
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0053a230
add esp, 0xa4
ret
Function at 0x4bb9e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0053a250
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
xor esi, esi
call fcn.004abae0
add esp, 0xc
test eax, eax
je 0x4bba3a
lea esp, [esp]
mov edx, dword [esp + 0xc]
shl edx, 0xa
test dword [esp + 0x1c], edx
je 0x4bba1e
inc esi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
inc ebp
push ebp
call fcn.004abae0
add esp, 0xc
test eax, eax
jne 0x4bba10
test esi, esi
jne 0x4bba5e
push 0x10a
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.004380c0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x4c]
cdq
idiv esi
push ebx
mov ebx, eax
cmp esi, 1
jne 0x4bba75
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x4c]
push edi
push 0
push eax
call fcn.0053bcd0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x30], 0
call fcn.004abae0
add esp, 0x18
test eax, eax
je 0x4bbb55
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x20], eax
je 0x4bbb31
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4bbb62
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push edi
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x70]
push eax
and edx, 1
push ecx
mov ecx, dword [esp + 0x54]
add edx, ebx
push edx
mov edx, dword [esp + 0x60]
push ebp
call fcn.004bb5d0
add esp, 0x30
test eax, eax
je 0x4bbb80
add ebp, ebx
test edi, edi
jle 0x4bbb31
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
sub ecx, eax
mov esi, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4bbb28
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.004abae0
add esp, 0xc
test eax, eax
jne 0x4bbab0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
push 0x115
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.004380c0
add esp, 0x14
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x4c9760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x4c9830
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4c97ce
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004c93c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4c97a0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4c98d7
call 0x4c97e0
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x4c9880
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004c93c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4c983d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4c98d7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004c93c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4c98d5
jmp 0x4c98d7
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c9940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x4c9a19
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4c99b7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004c9500
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4c9989
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4c9ac0
call 0x4c99c9
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4c9a69
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004c9630
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4c9a26
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4c9ac0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004c9630
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4c9abe
jmp 0x4c9ac0
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d1db0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x4d205c
test edx, edx
je 0x4d205c
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x4d1f70
cmp ecx, 0xc0
je 0x4d1e90
cmp ecx, 0x80
jne 0x4d2064
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.004d1e76
aeskeygenassist xmm1, xmm0, 2
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 4
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 8
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004d1e70
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004d1e70
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.004d1f10
aeskeygenassist xmm1, xmm2, 2
call fcn.004d1f50
aeskeygenassist xmm1, xmm2, 4
call fcn.004d1f00
aeskeygenassist xmm1, xmm2, 8
call fcn.004d1f50
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d1f00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d1f50
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d1f00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004d1f50
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.004d2026
aeskeygenassist xmm1, xmm0, 1
call fcn.004d2040
aeskeygenassist xmm1, xmm2, 2
call fcn.004d2020
aeskeygenassist xmm1, xmm0, 2
call fcn.004d2040
aeskeygenassist xmm1, xmm2, 4
call fcn.004d2020
aeskeygenassist xmm1, xmm0, 4
call fcn.004d2040
aeskeygenassist xmm1, xmm2, 8
call fcn.004d2020
aeskeygenassist xmm1, xmm0, 8
call fcn.004d2040
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d2020
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d2040
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d2020
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d2040
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d2020
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x4d2090
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.004d1db0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x4d20f1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4d20c2
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x4d26a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4d26c0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4d6d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x4d6e6f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x4d6e05
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004d6440
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4d6dcf
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4d6f26
call 0x4d6e17
pop edx
lea ecx, [edx + 0x129]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4d6ec7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004d68f0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4d6e7c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4d6f26
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004d68f0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4d6f24
jmp 0x4d6f26
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret