joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442bb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0x10], 0
ja 0x442bc4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x442c10
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x442bee
mov esi, dword [esi]
mov edx, dword [ebp - 4]
lea ecx, [eax + eax]
push ecx
push esi
push 1
push 0
push str.Start_Page
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x442c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c739b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], esi
mov word [ebp - 0x234], ax
push 0x206
lea edx, [ebp - 0x216]
xor ecx, ecx
push esi
mov dword [ebp - 4], esi
push edx
mov word [ebp - 0x218], cx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsTheWorld.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x442d12
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x218]
push edx
push esi
push esi
push str.Path
push eax
mov dword [ebp - 0x23c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x442cf0
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x442cf0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.0040b420
cmp dword [ebp - 0x224], esi
jbe 0x442d7e
push 0xd
push str.TheWorld.ini
lea ecx, [ebp - 0x234]
call fcn.0040b420
mov ecx, dword [ebp - 0x234]
mov esi, 8
cmp dword [ebp - 0x220], esi
jae 0x442d45
lea ecx, [ebp - 0x234]
cmp dword [edi + 0x14], esi
jb 0x442d4e
mov eax, dword [edi]
jmp 0x442d50
mov eax, edi
push ecx
push eax
push str.HomePage
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0x220], esi
jb 0x442d7a
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, 1
jmp 0x442d99
cmp dword [ebp - 0x220], 8
jb 0x442d97
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7299
mov esp, ebp
pop ebp
ret
Function at 0x445290
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6e28
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 8]
jae 0x4452da
lea eax, [ebp + 8]
lea ecx, [ebp - 0x94]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
push ebx
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
cmp dword [ebp + 0x1c], 8
mov esi, eax
mov eax, dword [ebp + 8]
jae 0x445302
lea eax, [ebp + 8]
push esi
push ebx
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov ebx, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x9c]
push eax
push str.VarFileInfoTranslation
push esi
call ebx
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x8e]
push edx
mov word [ebp - 0x90], cx
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x9c]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileVersion
lea edx, [ebp - 0x90]
call fcn.00446cf0
add esp, 0x18
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x90]
push edx
push esi
call ebx
push 0x28
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
mov ebx, eax
mov eax, dword [ebp - 0x98]
add esp, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
xor ecx, ecx
mov eax, ebx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], cx
lea edx, [eax + 2]
jmp 0x4453c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4453c0
sub eax, edx
sar eax, 1
push eax
push ebx
mov ecx, edi
call fcn.00403c20
cmp dword [ebp + 0x1c], 8
jb 0x4453eb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7299
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x445610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x445633
xor eax, 0xedb88320
test al, 1
je 0x445640
shr eax, 1
xor eax, 0xedb88320
jmp 0x445642
shr eax, 1
test al, 1
je 0x44564f
shr eax, 1
xor eax, 0xedb88320
jmp 0x445651
shr eax, 1
test al, 1
je 0x44565e
shr eax, 1
xor eax, 0xedb88320
jmp 0x445660
shr eax, 1
test al, 1
je 0x44566d
shr eax, 1
xor eax, 0xedb88320
jmp 0x44566f
shr eax, 1
test al, 1
je 0x44567c
shr eax, 1
xor eax, 0xedb88320
jmp 0x44567e
shr eax, 1
test al, 1
je 0x44568b
shr eax, 1
xor eax, 0xedb88320
jmp 0x44568d
shr eax, 1
test al, 1
je 0x44569a
shr eax, 1
xor eax, 0xedb88320
jmp 0x44569c
shr eax, 1
mov dword [ebp + ecx*4 - 0x404], eax
inc ecx
cmp ecx, 0x100
jl 0x445625
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jle 0x4456df
push ebx
push edi
jmp 0x4456c0
movsx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [ebp + edi*4 - 0x404]
inc ecx
cmp ecx, edx
jl 0x4456c0
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
not eax
call fcn.004b7299
mov esp, ebp
pop ebp
ret
Function at 0x44af70
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6da8
mov eax, dword fs:[0]
push eax
mov eax, 0x61f0
call fcn.004b7690
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, 8
cmp dword [ebp + 0x1c], ebx
jae 0x44afb8
lea eax, [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0x44afdc
cmp dword [ebp + 0x1c], ebx
jb 0x44afd5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor al, al
jmp 0x44b0ff
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x61e0], eax
lea eax, [ebp - 0x30e8]
lea ecx, [ebp - 0x20a0]
lea edx, [ebp - 0x5178]
mov dword [ebp - 0x61c8], eax
mov eax, 0x824
mov dword [ebp - 0x61f8], ecx
mov dword [ebp - 0x61ec], edx
lea ecx, [ebp - 0x4130]
lea edx, [ebp - 0x61c0]
mov dword [ebp - 0x61f4], eax
mov dword [ebp - 0x61e8], eax
mov dword [ebp - 0x61dc], eax
mov dword [ebp - 0x61d4], eax
mov dword [ebp - 0x61cc], eax
mov dword [ebp - 0x61c4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x61fc], 0x3c
mov dword [ebp - 0x61d8], ecx
mov dword [ebp - 0x61d0], edx
cmp dword [ebp + 0x1c], ebx
jae 0x44b062
lea eax, [ebp + 8]
lea ecx, [ebp - 0x61fc]
push ecx
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov edx, dword [ebp - 0x61ec]
mov eax, edx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44b080
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.00403c20
mov edx, dword [ebp - 0x61d0]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44b0a3
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esi + 0x20]
call fcn.00403c20
mov edx, dword [ebp - 0x61c8]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44b0c7
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esi + 0x3c]
call fcn.00403c20
mov dx, word [ebp - 0x61e4]
mov word [esi + 0x1c], dx
cmp dword [ebp + 0x1c], ebx
jb 0x44b0fd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7299
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x44bb10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
mov dword [esi], vtable.ThreadBase.0
je 0x44bb50
cmp byte [esi + 0xd], 0
jne 0x44bb50
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0xd], 1
mov dword [esi + 8], 0
mov dword [esi + 4], 0
test byte [ebp + 8], 1
je 0x44bb60
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x44bbb0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0xc], bl
je 0x44bbdf
cmp byte [esi + 0xd], bl
jne 0x44bbdf
mov eax, dword [esi + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call edi
mov byte [esi + 0xd], 1
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
lea edx, [esi + 4]
push edx
push ebx
push esi
push 0x44baf0
push ebx
push ebx
mov word [esi + 0xc], bx
mov dword [esi + 0x10], ebx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 8], eax
cmp eax, ebx
je 0x44bc0f
cmp byte [esi + 0xd], bl
je 0x44bc0b
push eax
call edi
mov byte [esi + 0xc], 1
movzx eax, byte [esi + 0xc]
pop edi
pop ebx
ret

Function at 0x44f0a0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.004b7690
mov eax, dword [0x4fbf50]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x44f127
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x44f127
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call sub.MSVCR100.dll__vsnprintf
add esp, 0x10
test eax, eax
jns 0x44f0fd
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b7299
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call sub.MSVCR100.dll__vsnprintf
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x44f1b5
call fcn.0044ef60
test eax, eax
jle 0x44f1b5
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b7299
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.004b7299
add esp, 0x108
ret

Function at 0x44f210
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x44f232
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x44f226
pop esi
movzx eax, cl
pop edi
ret
Function at 0x450cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x450cde
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x450d20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x450d3e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x450d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x450da2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x450e00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x450e22
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x450e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x450eaa
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x450f10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x450f3a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x450fa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
add ecx, 0x10
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm0, xmmword [edx + ecx - 0x10]
jmp fcn.0045101e

Function at 0x451090
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
add ecx, 0x10
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm0, xmmword [edx + ecx - 0x10]
jmp fcn.0045110e
Function at 0x452910
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x452bbc
test edx, edx
je 0x452bbc
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x452ad0
cmp ecx, 0xc0
je 0x4529f0
cmp ecx, 0x80
jne 0x452bc4
nop
nop
nop
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.004529d6
aeskeygenassist xmm1, xmm0, 2
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 4
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 8
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004529d0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004529d0
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.00452a70
aeskeygenassist xmm1, xmm2, 2
call fcn.00452ab0
aeskeygenassist xmm1, xmm2, 4
call fcn.00452a60
aeskeygenassist xmm1, xmm2, 8
call fcn.00452ab0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00452a60
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00452ab0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00452a60
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00452ab0
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.00452b86
aeskeygenassist xmm1, xmm0, 1
call fcn.00452ba0
aeskeygenassist xmm1, xmm2, 2
call fcn.00452b80
aeskeygenassist xmm1, xmm0, 2
call fcn.00452ba0
aeskeygenassist xmm1, xmm2, 4
call fcn.00452b80
aeskeygenassist xmm1, xmm0, 4
call fcn.00452ba0
aeskeygenassist xmm1, xmm2, 8
call fcn.00452b80
aeskeygenassist xmm1, xmm0, 8
call fcn.00452ba0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00452b80
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00452ba0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00452b80
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00452ba0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00452b80
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x452bf0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00452910
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x452c59
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x452c26
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x4530d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004b7690
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x160]
push edi
mov dword [esp + 0x18], eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x16c], ecx
mov dword [esi + 0x168], ecx
cmp ebx, 0xc
jne 0x453145
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
lea edi, [ebx - 0xb]
jmp 0x453214
mov eax, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp ebx, 0x10
jb 0x4531c2
mov ecx, dword [esp + 0x1c]
shr eax, 4
mov edi, ecx
mov dword [esp + 0x20], eax
shl eax, 4
sub edi, esi
add ecx, eax
mov dword [esp + 0x1c], ecx
push ebp
lea ecx, [ecx]
lea ecx, [edi + esi + 2]
mov eax, esi
mov ebp, 4
jmp 0x453180
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec ebp
jne 0x453180
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x24]
add esp, 8
add edi, 0x10
sub ebx, 0x10
dec dword [esp + 0x24]
jne 0x453170
mov eax, dword [esp + 0x10]
xor ecx, ecx
pop ebp
cmp ebx, ecx
je 0x4531eb
jbe 0x4531db
mov ecx, dword [esp + 0x1c]
mov eax, esi
sub ecx, esi
mov edi, ebx
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec edi
jne 0x4531d2
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add esp, 8
mov ecx, dword [esp + 0x10]
shld ecx, eax, 3
add eax, eax
bswap ecx
xor dword [esi + 8], ecx
add eax, eax
lea ecx, [esi + 0x60]
add eax, eax
push ecx
bswap eax
xor dword [esi + 0xc], eax
push esi
call dword [esp + 0x20]
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
mov edx, dword [esi + 0x174]
mov ecx, dword [esi + 0x170]
push edx
lea eax, [esi + 0x20]
push eax
push esi
call ecx
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x453240
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.004b7690
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x38]
or ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x164]
mov edx, dword [esi + 0x160]
mov dword [esp + 0xc], eax
je 0x45326f
mov eax, 0xfffffffe
pop esi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x453320
jb 0x453293
test ecx, ecx
jne 0x453320
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x4532d6
lea esp, [esp]
test ebx, ebx
je 0x4532c5
mov al, byte [ebp]
xor byte [edi + esi + 0x40], al
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x4532b0
jmp 0x4532c9
test edi, edi
jne 0x453312
lea ecx, [esi + 0x60]
push ecx
lea eax, [esi + 0x40]
push eax
call edx
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x4532fa
push eax
push ebp
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
call dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add esp, 0x10
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x453312
xor eax, eax
mov edi, ebx
test ebx, ebx
je 0x453312
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x453306
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret