joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b998c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9a65
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b9a80
push ebx
push 0x4b9a90
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a4fc
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040754c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a224
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4b9a0e
mov ax, 0x83
call fcn.004b95b0
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004b9960
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4b9a17
call fcn.004b9960
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9a6c
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax

Function at 0x4b9b80
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b9c49
jmp 0x4b9c3d
cmp dword [esi + 0x10], 0x1000
jne 0x4b9c2b
test byte [esi + 0x15], 1
jne 0x4b9c2b
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4b9bdc
cmp ebp, 2
je 0x4b9bdc
cmp ebp, 0x10
je 0x4b9bdc
cmp ebp, 0x20
jne 0x4b9bf8
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4b9bf8
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4b9c09
mov eax, dword [esi]
add eax, ebx
call fcn.004b9b78
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4b9bfc
cmp byte [esp + 4], 0
je 0x4b9c2b
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b9c49
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4b9bb1
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4098b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409902
test eax, edx
je 0x409905
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4098c5
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4098eb
add ecx, 4
js 0x4098db
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4098e8
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409911
test edx, edx
jne 0x4098b8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4275cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [eax]
mov edx, dword [edx]
cmp eax, edx
je 0x4275e9
test eax, edx
je 0x4275ec
mov cl, byte [eax]
mov ch, byte [edx]
cmp cl, ch
je 0x4275f6
movzx eax, cl
movzx edx, ch
sub eax, edx
ret
xor eax, eax
ret
test edx, edx
je 0x427633
test eax, eax
jne 0x4275d8
dec eax
ret
push ebx
xor ecx, ecx
mov ebx, dword [eax - 4]
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42761c
add ecx, 4
js 0x42760c
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x427619
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
pop ebx
pop ebx
sub eax, edx
ret
mov eax, 1
ret
Function at 0x427844
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
mov esi, ecx
mov ebx, eax
add edx, eax
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
movzx eax, word [ebx]
mov dword [esp], eax
or eax, eax
je 0x4279e7
add ebx, 2
mov eax, dword [esp]
test ah, 0x80
je 0x4278a2
and eax, 0x7fff
movzx edx, word [ebx]
shl edx, 0xf
or eax, edx
mov dword [esp], eax
add ebx, 2
lea ebp, [esi - 1]
mov ecx, dword [ebx]
add ebx, 4
mov dword [esp + 0x14], ecx
mov edi, 1
cmp ebx, dword [esp + 0x10]
jae 0x4279e7
mov ecx, dword [esp + 0x14]
test ecx, edi
jne 0x4278f6
mov al, byte [ebx]
inc ebx
mov byte [esi], al
inc esi
cmp ebx, dword [esp + 0x10]
lea eax, [esi - 3]
jae 0x4279e7
cmp eax, ebp
jbe 0x4278f0
inc ebp
mov eax, dword [ebp]
mov edx, eax
shr eax, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
add edi, edi
jne 0x4278c1
jmp 0x4278a5
movzx edx, word [ebx]
add ebx, 2
mov eax, edx
and edx, 0xf
add edx, 2
shr eax, 4
cmp edx, 2
jne 0x427913
movzx edx, byte [ebx]
inc ebx
add edx, 0x12
mov eax, dword [esp + eax*4 + 0x1c]
mov ecx, esi
mov dword [esp + 0x18], edx
sub ecx, eax
cmp ecx, edx
jl 0x4279d1
cmp edx, 0x20
ja 0x42796d
sub edx, 8
jg 0x42793b
movq xmm0, qword [eax]
movq qword [esi], xmm0
jmp 0x42799b
movq xmm0, qword [edx + eax]
movq xmm1, qword [eax]
cmp edx, 8
jle 0x427962
movq xmm2, qword [eax + 8]
cmp edx, 0x10
jle 0x42795d
movq xmm3, qword [eax + 0x10]
movq qword [esi + 0x10], xmm3
movq qword [esi + 8], xmm2
movq qword [esi], xmm1
movq qword [edx + esi], xmm0
jmp 0x42799b
push esi
movups xmm2, xmmword [eax]
lea eax, [edx + eax - 0x10]
lea edx, [edx + esi - 0x10]
movups xmm1, xmmword [eax]
push edx
neg edx
and esi, 0xfffffff0
lea edx, [esi + edx + 0x10]
pop esi
movups xmm0, xmmword [edx + eax]
movaps xmmword [edx + esi], xmm0
add edx, 0x10
jl 0x427987
movups xmmword [esi], xmm1
pop esi
movups xmmword [esi], xmm2
cmp esi, ebp
jbe 0x4279b7
inc ebp
mov edx, dword [ebp]
mov eax, edx
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
cmp esi, ebp
ja 0x42799f
add esi, dword [esp + 0x18]
cmp ebx, dword [esp + 0x10]
jae 0x4279e7
add edi, edi
lea ebp, [esi - 1]
je 0x4278a5
jmp 0x4278bd
push ebx
push esi
lea ebx, [edx + eax]
add esi, edx
neg edx
mov al, byte [edx + ebx]
mov byte [edx + esi], al
inc edx
jne 0x4279da
pop esi
pop ebx
jmp 0x42799b
mov eax, dword [esp]
add esp, 0x401c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x428214
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, esi
dec ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
add dword [ebp - 4], 4
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x428357
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x10]
jne 0x42828f
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
mov byte [esi], al
inc dword [ebp - 4]
inc esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x428357
mov eax, esi
sub eax, 3
cmp ebx, eax
jae 0x428284
inc ebx
mov eax, dword [ebx]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ebx
shl dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jne 0x428246
jmp 0x428227
mov eax, dword [ebp - 4]
movzx eax, word [eax]
add dword [ebp - 4], 2
mov edx, eax
and edx, 0xf
add edx, 2
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 2
jne 0x4282b9
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
add edx, 0x12
mov dword [ebp - 0x14], edx
inc dword [ebp - 4]
shr eax, 4
mov edx, dword [ebp + 8]
mov edx, dword [edx + eax*4]
mov ecx, esi
sub ecx, edx
cmp ecx, dword [ebp - 0x14]
jae 0x4282f3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], eax
neg eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + eax]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + eax], dl
inc eax
test eax, eax
jne 0x4282df
jmp 0x42831a
cmp dword [ebp - 0x14], 8
jbe 0x42830a
mov ecx, dword [ebp + 8]
mov eax, edx
mov edx, esi
mov ecx, dword [ebp - 0x14]
call fcn.00426be0
jmp 0x42831a
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov edx, dword [eax]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x428357
cmp esi, ebx
jbe 0x42833f
inc ebx
mov eax, dword [ebx]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ebx
cmp esi, ebx
ja 0x428326
add esi, dword [ebp - 0x14]
mov ebx, esi
dec ebx
shl dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jne 0x428246
jmp 0x428227
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4283b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, ebx
dec esi
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
add edi, 4
mov dword [ebp - 8], 1
cmp edi, dword [ebp - 4]
jae 0x42850f
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 8]
jne 0x428429
movzx eax, byte [edi]
mov byte [ebx], al
inc edi
inc ebx
cmp edi, dword [ebp - 4]
jae 0x42850f
cmp ebx, dword [ebp + 0xc]
jae 0x42850f
mov eax, ebx
sub eax, 3
cmp esi, eax
jae 0x42841e
inc esi
mov eax, dword [esi]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
shl dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4283df
jmp 0x4283c7
movzx eax, word [edi]
add edi, 2
mov edx, eax
and edx, 0xf
add edx, 2
mov dword [ebp - 0x10], edx
shr eax, 4
cmp dword [ebp - 0x10], 2
jne 0x42844d
movzx edx, byte [edi]
add edx, 0x12
mov dword [ebp - 0x10], edx
inc edi
mov edx, dword [ebp - 0x10]
add edx, ebx
cmp edx, dword [ebp + 0xc]
jb 0x428480
mov edx, dword [ebp + 8]
mov esi, dword [edx + eax*4]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0xc]
sub eax, ebx
add esi, eax
add dword [ebp - 0x14], eax
neg eax
movzx edx, byte [esi + eax]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], dl
inc eax
test eax, eax
jne 0x42846c
jmp 0x42850f
cmp dword [ebp - 0x10], 8
jbe 0x428493
mov edx, dword [ebp + 8]
mov ecx, ebx
sub ecx, dword [edx + eax*4]
cmp ecx, dword [ebp - 0x10]
jae 0x4284c5
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], eax
neg eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + eax]
mov byte [ebp - 0x1d], dl
mov edx, dword [ebp - 0x1c]
movzx ecx, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc eax
test eax, eax
jne 0x4284aa
jmp 0x4284d5
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov edx, ebx
mov ecx, dword [ebp - 0x10]
call fcn.00426be0
cmp edi, dword [ebp - 4]
jae 0x42850f
cmp ebx, esi
jbe 0x4284f7
inc esi
mov eax, dword [esi]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
cmp ebx, esi
ja 0x4284de
add ebx, dword [ebp - 0x10]
mov esi, ebx
dec esi
shl dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4283df
jmp 0x4283c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43d00c
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, edx
movzx edx, byte [esi]
cmp dl, 7
je 0x43d102
and edx, 0x7f
movzx edx, byte [edx + 0x537314]
imul edx, edx, 0x63
mov eax, dword [eax + 4]
lea edi, [eax + edx*4]
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x43d043
cmp esi, dword [ebx + 4]
je 0x43d11d
mov eax, esi
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
and eax, 0x1f
mov dword [esp], eax
mov eax, dword [esp]
mov ebx, dword [edi + eax*4 + 0xc]
test ebx, ebx
je 0x43d084
cmp esi, dword [ebx + 4]
jne 0x43d084
mov dword [edi + 8], ebx
jmp 0x43d11d
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
mov eax, dword [eax]
and eax, 0xfffffffe
mov dword [esp + 8], eax
mov edx, dword [esp + 8]
add edx, 2
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
call fcn.00427bf4
test al, al
jne 0x43d0b6
mov eax, dword [esp + 4]
call fcn.004303b4
mov eax, dword [esp]
mov edx, dword [edi + eax*4 + 0x8c]
test edx, edx
je 0x43d0e6
mov eax, edx
cmp esi, dword [eax]
je 0x43d0dd
add eax, 8
mov ecx, edx
sub ecx, 4
mov ecx, dword [ecx]
lea ecx, [edx + ecx*4]
cmp ecx, eax
jbe 0x43d0e2
jmp 0x43d0c6
mov eax, dword [eax + 4]
jmp 0x43d0e4
xor eax, eax
mov ebx, eax
mov eax, edi
mov edx, 2
call fcn.00427c00
test ebx, ebx
je 0x43d11d
mov dword [edi + 8], ebx
mov eax, dword [esp]
mov dword [edi + eax*4 + 0xc], ebx
jmp 0x43d11d
mov eax, esi
movzx edx, byte [eax + 1]
add edx, 2
add eax, edx
mov ebx, eax
mov eax, ebx
call fcn.0043863c
add eax, 0xffffffbc
mov eax, dword [eax]
mov ebx, eax
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x43d4f4
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
movzx eax, byte [eax + 0x537314]
imul eax, eax, 0x63
mov edx, dword [ebx + 4]
lea eax, [edx + eax*4]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov edi, dword [esi]
and edi, 0xfffffffe
cmp edi, dword [esi]
jne 0x43d53a
lea edx, [edi + 1]
mov eax, esi
mov ecx, edi
call fcn.00427bf4
test al, al
jne 0x43d53e
xor eax, eax
jmp 0x43d540
mov al, 1
test al, al
jne 0x43d54b
mov eax, esi
call fcn.0043040c
xor ecx, ecx
push ebp
push 0x43d5fc
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 4]
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
push ebp
and eax, 0x1f
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 0x8c]
call fcn.0043d4b0
pop ecx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
mov edx, eax
dec eax
test eax, eax
je 0x43d5b0
mov ecx, dword [ebp - 4]
add ecx, 2
movzx ecx, byte [ecx + eax]
and cl, 0xdf
add dl, cl
jmp 0x43d59a
and dl, 0x1f
push ebp
movzx eax, dl
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 0x10c]
call fcn.0043d4b0
pop ecx
lea eax, [ebx + 8]
lea edx, [ebx + 0x10]
mov ecx, edx
mov edx, dword [ebp - 8]
call fcn.00426314
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
inc dword [ebx + eax*4 + 0x2c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d603
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.00427c00
ret

Function at 0x454b4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, eax
mov eax, dword [ebp + 0x10]
mov ecx, eax
mov edx, eax
mov ebx, eax
ror eax, 6
ror edx, 0xb
ror ecx, 0x19
xor eax, edx
mov edx, dword [ebp + 0x18]
xor eax, ecx
mov ecx, dword [ebp + 0x1c]
add ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x18], eax
xor eax, edx
mov dword [ebp + 0x14], ebx
and eax, ebx
xor eax, edx
add eax, dword [edi*4 + 0x537b14]
add eax, ecx
mov ecx, dword [ebp + 0xc]
add eax, dword [ebp + edi*4 + 0x20]
mov ebx, dword [ebp]
add ecx, eax
mov esi, eax
mov dword [ebp + 0x10], ecx
mov eax, ebx
mov edx, ebx
ror eax, 2
mov ecx, ebx
ror edx, 0xd
ror ecx, 0x16
xor eax, edx
xor eax, ecx
mov ecx, dword [ebp + 4]
add esi, eax
mov eax, ebx
mov edx, ebx
or eax, ecx
and eax, dword [ebp + 8]
and edx, ecx
or eax, edx
inc edi
add esi, eax
mov dword [ebp], esi
mov eax, dword [ebp + 8]
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
cmp edi, 0x40
jne 0x454b54
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x454c28
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov eax, dword [edx]
mov ebx, dword [edx + 4]
bswap eax
bswap ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0xc]
bswap eax
bswap ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
bswap eax
bswap ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [edx + 0x18]
mov ebx, dword [edx + 0x1c]
bswap eax
bswap ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 0x24]
bswap eax
bswap ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
bswap eax
bswap ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov eax, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
bswap eax
bswap ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov eax, dword [edx + 0x38]
mov ebx, dword [edx + 0x3c]
bswap eax
bswap ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
lea esi, [esi + 0x40]
mov ecx, 0x30
mov eax, dword [esi - 8]
mov edi, dword [esi - 0x1c]
mov edx, eax
mov ebx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x454cb3
pop ebx
pop edi
pop esi
ret

Function at 0x454d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [edx]
movups xmm5, xmmword [0x454e14]
cmp al, 0x80
je 0x454eb3
cmp al, 0xc0
je 0x454f24
movups xmm3, xmmword [edx + 0x10]
add edx, 0x20
aeskeygenassist xmm2, xmm3, 1
call fcn.00454e24
aeskeygenassist xmm2, xmm3, 2
call fcn.00454e24
aeskeygenassist xmm2, xmm3, 4
call fcn.00454e24
aeskeygenassist xmm2, xmm3, 8
call fcn.00454e24
aeskeygenassist xmm2, xmm3, 0x10
call fcn.00454e24
aeskeygenassist xmm2, xmm3, 0x20
call fcn.00454e24
aeskeygenassist xmm2, xmm3, 0x40
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
ret
add edx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 2
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 4
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 8
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 0x10
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 0x20
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 0x40
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 0x80
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.00454e85
aeskeygenassist xmm2, xmm1, 0x36
call fcn.00454e85
ret
Function at 0x454e24
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
add edx, 0x10
aeskeygenassist xmm4, xmm1, 0
pshufd xmm2, xmm4, 0xaa
movups xmm4, xmm3
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pxor xmm3, xmm2
movups xmmword [edx], xmm3
add edx, 0x10
ret

Function at 0x455908
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0x5557e8
cmp dword [esp + 4], 0
jle 0x455986
and edx, 0x1fff
mov ecx, 0x2000
sub ecx, edx
cmp ecx, dword [esp + 4]
jle 0x45593b
mov ecx, dword [esp + 4]
mov edi, dword [esp]
mov eax, dword [esp + 8]
add eax, edx
mov esi, ecx
cmp esi, 4
jl 0x45595d
sub esi, 4
mov ebx, dword [eax]
xor dword [edi], ebx
add edi, 4
add eax, 4
cmp esi, 4
jge 0x45594b
test esi, esi
jle 0x45596d
dec esi
movzx ebx, byte [eax + esi]
xor byte [edi + esi], bl
test esi, esi
jg 0x455961
mov eax, ecx
neg eax
shl eax, 0x1f
sub eax, ecx
add dword [esp], eax
add edx, ecx
sub dword [esp + 4], ecx
cmp dword [esp + 4], 0
jne 0x455924
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x455e28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov ebx, 0x5557e8
mov eax, 0x5577e8
add edx, 0x10
dec dword [esp]
mov ecx, dword [edx]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx], esi
mov ecx, dword [edx + 4]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 4], esi
mov ecx, dword [edx + 8]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 8], esi
mov ecx, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 0xc], esi
cmp dword [esp], 1
jne 0x455e39
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4562b8
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
add eax, 0x20
xor ecx, ecx
mov edx, 0x4c
call fcn.00426aec
ret