joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100454f0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.10044e90
mov edi, eax
add esp, 4
test edi, edi
jne 0x10045596
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.10030ee0
push 0x1011cd48
push esi
push 0x1011cd44
push ebx
push str.fopen_
push 5
call fcn.100311e0
add esp, 0x2c
call fcn.100e205b
cmp dword [eax], 2
je 0x10045575
call fcn.100e205b
cmp dword [eax], 6
je 0x10045575
push 0xb8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.10030ee0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xb6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.10030ee0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10148a40
call fcn.1002c5e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100455b8
push edi
call fcn.100e2f7d
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.1002c010
push edi
push 1
push 0x6a
push esi
call fcn.1002c370
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x10049b00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x10049b47
mov al, byte [edx]
test al, al
je 0x10049b47
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x10049b17
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1005b2a0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.100e1f90
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x1005b300
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.100e1f90
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret

Function at 0x1005b740
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x1005b7e0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x1006a890
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x1006a973
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x1006a90e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x1006a960
shl edx, 0x10
cmp edi, 2
jne 0x1006a91f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x1006a94d
lea edx, [edi + 0x3c]
jmp 0x1006a95a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x1006a8b0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x1006dfa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.100e4860
mov eax, dword [0x1014c240]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
dec edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
test eax, eax
jne 0x1006dffd
call fcn.10042600
mov dword [esp + 0x10], eax
test esi, esi
jne 0x1006e005
mov dword [esp + 0x14], eax
push eax
call fcn.10042760
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x1006e049
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.10030ee0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100e200a
add esp, 0x5c
ret
inc eax
cmp dword [esp + 0x1c], eax
jge 0x1006e05b
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x1006e025
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.100424c0
add esp, 0x18
test eax, eax
je 0x1006e034
sub edi, ebp
dec edi
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.100e1f90
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.100e20b0
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.1002aef0
add esp, 0x20
test eax, eax
jle 0x1006e034
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.100298e0
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1006e0f6
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x1006e025
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.1006de20
add esp, 0x14
test eax, eax
jl 0x1006e148
test edi, edi
jle 0x1006e12f
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
lea esp, [esp]
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x1006e120
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.1006de20
add esp, 0x14
test eax, eax
jge 0x1006e16a
mov edx, dword [esp + 0x10]
push edx
call fcn.10029ae0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100e200a
add esp, 0x5c
ret
test esi, esi
jle 0x1006e181
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x1006e176
mov eax, dword [esp + 0x10]
push eax
call fcn.10029ae0
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100e200a
add esp, 0x5c
ret
Function at 0x1006f050
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x1006f119
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x1006f071
cmp al, 0x6b
jne 0x1006f119
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x1006f0da
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x1006f091
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x1006f091
cmp al, 0xbb
jne 0x1006f0ba
inc ecx
cmp ecx, esi
jl 0x1006f081
sub esi, ecx
test ecx, ecx
jne 0x1006f0dd
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10030ee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10030ee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x1006f106
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.10030ee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.100e20b0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.10030ee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x10073060
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x10073072
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.100426f0
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x10073122
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x100730c0
test esi, esi
jle 0x10073101
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x100730b0
jmp 0x10073101
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x100730e5
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.100e1f90
add esp, 0xc
test esi, esi
jle 0x10073101
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x100730f3
push esi
push ebx
push ebx
push edi
call fcn.10042700
add esp, 0x10
pop ebp
test eax, eax
jne 0x10073122
push esi
push ebx
call fcn.100373a0
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x10085ca0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.100e4860
mov eax, dword [0x1014c240]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x10085e34
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.1009eb00
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.1009eb80
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.1009d200
push ebp
call fcn.1009eb00
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.1009eb80
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.1009d200
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x10085ce3
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.100e200a
add esp, 0xa0
ret

Function at 0x10086170
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.100e1f90
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x1008ac40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100e4860
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x28]
test esi, esi
je 0x1008ac85
test ebx, ebx
je 0x1008ac85
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x1008ac60
cmp ebx, 0x10
jb 0x1008ad00
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x1008acec
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x1008acd7
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x1008acb6
test ebx, ebx
je 0x1008ad3d
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec ebx
mov byte [eax + ecx], dl
inc eax
test ebx, ebx
jne 0x1008ad23
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1008af80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.100e4860
mov eax, dword [0x1014c240]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, dword [esp + 0x44]
mov ebx, edx
lea edx, [esi - 1]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
cmp edx, 0x7f
ja 0x1008b139
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
push ebp
mov dword [esp + 0x20], edx
mov edx, dword [edi + 8]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0xc]
push edi
push edi
mov dword [esp + 0x34], edx
call ecx
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0xc
sar esi, 3
cmp dword [esp + 0x58], 0
je 0x1008b027
test esi, esi
jle 0x1008b06e
mov eax, dword [esp + 0x14]
mov edx, edi
lea ebp, [esp + 0x2c]
sub edx, ebx
sub ebp, ebx
sub eax, ebx
mov ecx, ebx
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov ebx, dword [esp + 0x14]
mov byte [ecx + ebp], al
mov byte [ebx + ecx], al
inc ecx
sub esi, 1
jne 0x1008b010
jmp 0x1008b06e
xor ebp, ebp
test esi, esi
jle 0x1008b06e
lea eax, [esp + 0x2c]
mov ecx, eax
sub ebx, eax
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
jmp 0x1008b054
mov edx, dword [esp + 0x18]
lea ecx, [esp + ebp + 0x2c]
mov al, byte [ebx + ecx]
mov dl, byte [edx + ecx]
xor dl, al
mov byte [ecx], al
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, esi
mov byte [eax + ecx], dl
jl 0x1008b050
mov eax, dword [esp + 0x4c]
mov ecx, eax
and ecx, reloc.WS2_32.dll_getsockopt
jns 0x1008b081
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x1008b0c2
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100e200a
add esp, 0x34
ret
mov dl, 8
sub dl, cl
mov byte [esp + 0x13], dl
inc edi
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
shl dl, cl
movzx ecx, byte [esp + 0x13]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
mov ecx, dword [esp + 0x14]
shl dl, cl
movzx ecx, byte [esp + 0x13]
or al, bl
mov byte [edi], al
mov al, byte [esi + 2]
mov bl, al
shr bl, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi + 1], dl
movzx edx, byte [esi + 3]
shr dl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
add esi, 4
add edi, 4
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x1008b0d4
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e200a
add esp, 0x34
ret
Function at 0x1008b2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1008b2fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x1008b340
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1008b35e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x1008b3a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1008b3c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x1008b420
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1008b442
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x1008b4a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1008b4ca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x1008b530
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1008b55a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x1008b5c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x1008b61f

Function at 0x1008b6a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x1008b6ff