joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8860
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax]
mov edx, dword [esp + 0x18]
shl ecx, 8
mov dword [edx], ecx
movzx ecx, byte [eax + 1]
or dword [edx], ecx
movzx ecx, byte [eax + 2]
shl ecx, 8
mov dword [edx + 4], ecx
movzx ecx, byte [eax + 3]
or dword [edx + 4], ecx
movzx esi, byte [eax + 4]
shl esi, 8
mov dword [edx + 8], esi
movzx esi, byte [eax + 5]
or dword [edx + 8], esi
movzx esi, byte [eax + 6]
lea ecx, [edx + 8]
shl esi, 8
mov dword [edx + 0xc], esi
movzx esi, byte [eax + 7]
or dword [edx + 0xc], esi
movzx esi, byte [eax + 8]
shl esi, 8
mov dword [edx + 0x10], esi
movzx esi, byte [eax + 9]
or dword [edx + 0x10], esi
movzx esi, byte [eax + 0xa]
shl esi, 8
mov dword [edx + 0x14], esi
movzx esi, byte [eax + 0xb]
or dword [edx + 0x14], esi
movzx esi, byte [eax + 0xc]
shl esi, 8
mov dword [edx + 0x18], esi
movzx esi, byte [eax + 0xd]
or dword [edx + 0x18], esi
movzx esi, byte [eax + 0xe]
shl esi, 8
mov dword [edx + 0x1c], esi
movzx eax, byte [eax + 0xf]
or eax, esi
mov dword [edx + 0x1c], eax
lea eax, [edx + 0x20]
xor ebx, ebx
jmp 0x4b8900
mov esi, dword [ecx]
mov edi, dword [ecx - 4]
mov edx, esi
shr edx, 7
mov ebp, edi
shl ebp, 9
or edx, ebp
and edx, 0xffff
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov ebp, edx
shr ebp, 7
shl esi, 9
or ebp, esi
and ebp, 0xffff
mov dword [eax + 4], ebp
mov esi, dword [ecx + 8]
shl edx, 9
mov ebp, esi
shr ebp, 7
or edx, ebp
and edx, 0xffff
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov ebp, edx
shr ebp, 7
shl esi, 9
or ebp, esi
and ebp, 0xffff
mov dword [eax + 0xc], ebp
mov esi, dword [ecx + 0x10]
mov ebp, esi
shr ebp, 7
shl edx, 9
or edx, ebp
and edx, 0xffff
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 0x14]
mov ebp, edx
shr ebp, 7
shl esi, 9
or ebp, esi
and ebp, 0xffff
mov dword [eax + 0x14], ebp
mov esi, dword [ecx - 8]
cmp ebx, 5
jge 0x4b89c3
mov ebp, esi
shl edx, 9
shr ebp, 7
shl esi, 9
shr edi, 7
or edx, ebp
or esi, edi
and edx, 0xffff
and esi, 0xffff
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
inc ebx
add eax, 0x20
add ecx, 0x20
cmp ebx, 6
jl 0x4b8900
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4b8b40
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 8
call fcn.0044a310
mov eax, dword [esp + 0xc]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 4]
mov dword [esp], ecx
movzx ecx, byte [eax + 7]
push esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ecx, 8
shl esi, 8
or ecx, eax
or edx, esi
shl ecx, 0x10
or ecx, edx
cmp dword [esp + 0x24], 0
mov dword [esp + 8], ecx
pop esi
je 0x4b8bb6
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004e6d80
jmp 0x4b8bcf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.004e6eb0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
add esp, 0x10
shr ecx, 0x18
mov byte [eax + 6], dl
mov byte [eax + 7], cl
add esp, 8
ret
Function at 0x4b9770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.0044a310
mov eax, dword [0x547e80]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, dword [esp + 0x48]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [esp + 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x31], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x30], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x32], al
mov byte [esp + 0x33], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x24], edx
mov byte [esp + 0x34], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ebx
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
test ebp, ebp
je 0x4b9944
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x40]
sub eax, ebp
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
test esi, esi
jne 0x4b98bd
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004e6c40
mov ebx, dword [esp + 0x2c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x3d], al
mov eax, dword [esp + 0x30]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x40], al
shr eax, 0x18
shr ecx, 8
shr edx, 0x10
add esp, 0xc
inc dword [esp + 0x1c]
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], bl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], dl
mov cl, byte [esp + esi + 0x30]
xor cl, byte [ebp]
inc esi
mov byte [eax + ebp], cl
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x4b9855
cmp dword [esp + 0x1c], 0
je 0x4b992b
mov eax, dword [esp + 0x2c]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x24]
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00446098
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00446098
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00446098
add esp, 0x2c
ret
Function at 0x4ba770
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0044a310
mov eax, dword [0x547e80]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x4ba7bf
mov eax, 1
mov dword [esi], ebp
jmp 0x4ba7c1
mov ebp, dword [esi]
test ecx, ecx
je 0x4ba8a4
push ebp
call fcn.00488120
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x4ba7f0
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.004747f0
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x4ba847
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.00474970
add esp, 0xc
test eax, eax
je 0x4ba946
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.00474b20
add esp, 0xc
test eax, eax
je 0x4ba946
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.00474b30
add esp, 0xc
test eax, eax
je 0x4ba946
jmp 0x4ba881
cmp edi, 0x80
jbe 0x4ba863
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.004747f0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.00443e60
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x4ba8ac
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.004463e0
add esp, 0xc
jmp 0x4ba8ac
test eax, eax
je 0x4ba932
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4ba8b0
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.00474970
add esp, 0xc
test eax, eax
je 0x4ba946
push ebp
call fcn.00488120
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00474b20
add esp, 0x10
test eax, eax
je 0x4ba946
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4ba8f4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.00474970
add esp, 0xc
test eax, eax
je 0x4ba946
push ebp
call fcn.00488120
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00474b20
add esp, 0x10
test eax, eax
je 0x4ba946
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.00474cc0
add esp, 8
test eax, eax
jne 0x4ba94a
xor eax, eax
jmp 0x4ba94f
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00446098
add esp, 0x8c
ret
Function at 0x4c6f60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4c6f79
mov esi, edi
mov edi, eax
jmp 0x4c6f7b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4c6f8b
mov eax, ebx
jmp 0x4c6f95
push eax
push ebx
call fcn.0046dba0
add esp, 8
test eax, eax
jne 0x4c6f9d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4c6fb9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4c6fa4
cmp eax, dword [esi + 4]
jge 0x4c6fd0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4c6fc0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4c6ff1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4c6fee
dec eax
test eax, eax
jg 0x4c6fe0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4dea30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
inc edx
mov dword [esp + 0x18], edx
cmp eax, 0x302
jge 0x4dea5d
cmp eax, 0x100
je 0x4dea5d
mov esi, dword [esp + 0x10]
cmp edx, dword [esi + 4]
jbe 0x4dea79
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
add edx, ecx
cmp edx, eax
ja 0x4dea58
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
test dword [edi + 0x100], 0x200
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ebx
movzx ebx, byte [eax + ecx - 1]
push ebp
je 0x4deada
cmp dword [edi + 0x88], 0
jne 0x4deada
mov edx, dword [edi + 0x58]
mov ecx, 8
mov eax, 0x537f74
add edx, ecx
sub edx, eax
lea esp, [esp]
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x4deacd
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x4deab0
test bl, 1
jne 0x4deacd
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov edx, dword [edi + 0x58]
test byte [edx], 8
je 0x4deada
test ebx, ebx
je 0x4deada
dec ebx
mov eax, dword [edi + 0x80]
mov ecx, dword [eax]
push ecx
call fcn.00472160
add esp, 4
test eax, 0x200000
je 0x4deb04
or edx, 0xffffffff
pop ebp
sub edx, ebx
add dword [esi + 4], edx
pop ebx
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [esi + 4]
mov eax, edx
sub eax, ebx
sub eax, dword [esp + 0x20]
mov ecx, 0xff
not eax
lea edi, [edx - 1]
sar eax, 0x1f
cmp edi, ecx
jae 0x4deb22
mov ecx, edi
test ecx, ecx
je 0x4deb5d
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], ebx
lea edi, [edi + edx - 1]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x20]
movzx ebp, byte [edi]
not ecx
sar ecx, 0x1f
movzx ecx, cl
xor ebp, ebx
and ecx, ebp
not ecx
and eax, ecx
mov ecx, 1
sub dword [esp + 0x20], ecx
sub edi, ecx
sub dword [esp + 0x14], ecx
jne 0x4deb35
mov ecx, eax
shr ecx, 4
and eax, ecx
mov ecx, eax
shr ecx, 2
and eax, ecx
lea ecx, [eax + eax]
and ecx, eax
shl ecx, 0x1e
sar ecx, 0x1f
lea eax, [ebx + 1]
and eax, ecx
sub edx, eax
shl eax, 8
or dword [esi], eax
pop ebp
mov eax, ecx
pop ebx
and eax, 1
not ecx
pop edi
mov dword [esi + 4], edx
or eax, ecx
pop esi
ret
Function at 0x4deba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.0044a310
mov eax, dword [0x547e80]
xor eax, esp
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb4]
push edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x24], edi
sub edi, esi
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
cmp dword [esp + 0xbc], esi
jae 0x4dec08
push str.orig_len___md_size
push 0x113
push str.._ssl_s3_cbc.c
call fcn.004747f0
add esp, 0xc
cmp esi, 0x40
jbe 0x4dec24
push str.md_size___EVP_MAX_MD_SIZE
push 0x114
push str.._ssl_s3_cbc.c
call fcn.004747f0
add esp, 0xc
mov eax, dword [esp + 0xbc]
lea ebp, [esp + 0x28]
neg ebp
and ebp, 0x3f
lea edx, [esi + 0x100]
lea ebp, [esp + ebp + 0x28]
cmp eax, edx
jbe 0x4dec50
mov ebx, eax
sub ebx, esi
sub ebx, 0x100
mov dword [esp + 0x14], ebx
mov eax, esi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebx
add eax, edi
xor edx, edx
div esi
push esi
push 0
push ebp
mov edi, edx
mov dword [esp + 0x28], edi
call fcn.004463e0
add esp, 0xc
xor ecx, ecx
cmp ebx, dword [esp + 0xbc]
jae 0x4dece0
mov eax, dword [esp + 0xb4]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x24]
mov edi, ebx
sub edi, eax
sub eax, dword [esp + 0x18]
add edx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xbc]
sub eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
add eax, edi
not eax
sar eax, 0x1f
mov byte [esp + 0x13], al
mov eax, edi
not eax
sar eax, 0x1f
not al
and al, byte [edx]
inc ecx
and al, byte [esp + 0x13]
inc edi
or byte [ecx + ebp - 1], al
mov eax, ecx
sub eax, esi
sar eax, 0x1f
and ecx, eax
inc edx
dec dword [esp + 0x14]
jne 0x4deca8
mov edi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
je 0x4ded07
mov ecx, edi
xor ecx, 0x20
mov dl, byte [ecx + ebp]
mov cl, byte [edi + ebp]
mov edx, dword [esp + 0x20]
mov byte [edx + eax], cl
inc edi
mov ecx, edi
sub ecx, esi
sar ecx, 0x1f
inc eax
and edi, ecx
cmp eax, esi
jb 0x4dece6
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00446098
add esp, 0x9c
ret
Function at 0x4dfed0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0044a310
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebp, ebp
push ebp
xor esi, esi
call fcn.004d35e0
add esp, 0xc
test eax, eax
je 0x4dff26
lea ecx, [ecx]
mov edx, dword [esp + 0x10]
shl edx, 0xa
test dword [esp + 0x1c], edx
je 0x4dff0e
inc esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
inc ebp
push ebp
call fcn.004d35e0
add esp, 0xc
test eax, eax
jne 0x4dff00
mov eax, dword [esp + 0x4c]
cdq
idiv esi
mov ebx, eax
cmp esi, 1
jne 0x4dff3c
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x50]
mov ebp, dword [esp + 0x48]
push edi
push 0
push eax
call fcn.004463e0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x60], 0
call fcn.004d35e0
add esp, 0x18
test eax, eax
je 0x4e001d
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x1c], eax
je 0x4dfff9
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4e002a
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push edi
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x6c]
push eax
and edx, 1
push ecx
mov ecx, dword [esp + 0x50]
add edx, ebx
push edx
mov edx, dword [esp + 0x5c]
push ebp
call fcn.004dfac0
add esp, 0x30
test eax, eax
je 0x4e0048
add ebp, ebx
test edi, edi
jle 0x4dfff9
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
sub ecx, eax
mov esi, edi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4dfff0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x54], eax
call fcn.004d35e0
add esp, 0xc
test eax, eax
jne 0x4dff71
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.00468730
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4e6fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x4e70b0
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4e704e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004e6c40
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4e7020
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4e7157
call 0x4e7060
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x4e7100
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004e6c40
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4e70bd
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4e7157
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004e6c40
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4e7155
jmp 0x4e7157
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e71c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x4e7299
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4e7237
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004e6d80
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4e7209
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4e7340
call 0x4e7249
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4e72e9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004e6eb0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4e72a6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4e7340
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004e6eb0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4e733e
jmp 0x4e7340
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4efa30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x4efcdc
test edx, edx
je 0x4efcdc
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x4efbf0
cmp ecx, 0xc0
je 0x4efb10
cmp ecx, 0x80
jne 0x4efce4
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.004efaf6
aeskeygenassist xmm1, xmm0, 2
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 4
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 8
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004efaf0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004efaf0
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.004efb90
aeskeygenassist xmm1, xmm2, 2
call fcn.004efbd0
aeskeygenassist xmm1, xmm2, 4
call fcn.004efb80
aeskeygenassist xmm1, xmm2, 8
call fcn.004efbd0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004efb80
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004efbd0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004efb80
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004efbd0
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.004efca6
aeskeygenassist xmm1, xmm0, 1
call fcn.004efcc0
aeskeygenassist xmm1, xmm2, 2
call fcn.004efca0
aeskeygenassist xmm1, xmm0, 2
call fcn.004efcc0
aeskeygenassist xmm1, xmm2, 4
call fcn.004efca0
aeskeygenassist xmm1, xmm0, 4
call fcn.004efcc0
aeskeygenassist xmm1, xmm2, 8
call fcn.004efca0
aeskeygenassist xmm1, xmm0, 8
call fcn.004efcc0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004efca0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004efcc0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004efca0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004efcc0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004efca0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x4efd10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.004efa30
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x4efd71
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4efd42
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret