joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c240
Capabilities:
Clear file content
Get file size
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push ebx
call dword [0x57e0a4]
test eax, eax
jne 0x48c275
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00535482
add esp, 0x10
ret
xor edx, edx
push edi
mov edi, dword [esp + 0x20]
cmp edx, 0x7fffffff
jb 0x48c2a9
ja 0x48c28b
cmp edi, 0xffffffff
jbe 0x48c2a9
push 0xdf
call dword [0x57e25c]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00535482
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
push ebp
push esi
cmp edx, ecx
jl 0x48c31f
mov eax, dword [esp + 0x14]
jg 0x48c2bd
cmp edi, eax
jbe 0x48c31f
push 0
push 0
push ecx
push eax
push ebx
call dword [0x57e0bc]
test eax, eax
je 0x48c33b
sub edi, dword [esp + 0x14]
je 0x48c30a
mov ebp, dword [0x57e0c0]
mov eax, 0x200
nop
cmp edi, 0x200
mov esi, edi
push 0
cmova esi, eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x58ca88
push ebx
call ebp
cmp dword [esp + 0x10], esi
jne 0x48c33b
mov eax, 0x200
sub edi, esi
jne 0x48c2e0
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00535482
add esp, 0x10
ret
push 0
push 0
push edx
push edi
push ebx
call dword [0x57e0bc]
test eax, eax
je 0x48c33b
push ebx
call dword [0x57e0b8]
test eax, eax
jne 0x48c30a
mov ecx, dword [esp + 0x1c]
xor al, al
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.00535482
add esp, 0x10
ret
Function at 0x48c770
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x48c7b1
mov eax, dword [0x58cc88]
test eax, eax
jne 0x48c79f
lea eax, [esp + 4]
push eax
call dword [0x57e258]
mov eax, dword [esp + 0x18]
mov ecx, 1
cmp ecx, eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
cmp eax, 8
jb 0x48c80d
cmp eax, 0x20
jae 0x48c7d3
pause
inc dword [esi + 0xc]
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00535482
add esp, 0x28
ret
mov ecx, esi
jne 0x48c7ef
call fcn.0048adc0
inc dword [esi + 0xc]
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00535482
add esp, 0x28
ret
call fcn.0048c820
test al, al
je 0x48c805
call dword [0x57e234]
test eax, eax
jne 0x48c80d
push eax
jmp 0x48c807
push 1
call dword [0x57e238]
inc dword [esi + 0xc]
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
call fcn.00535482
add esp, 0x28
ret

Function at 0x48fe70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55d5db
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov eax, dword [0x586220]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov esi, dword [esp + 0x15c]
lea eax, [esp + 0xc]
push 0x128
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00535f30
xor eax, eax
cmp byte [esp + 0x14], al
setne al
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00490060
mov eax, dword [esp + 0x174]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x148], xmm0
mov dword [esp + 0x148], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x14c], eax
mov eax, dword [esi]
mov dword [esp + 0x150], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x154], eax
lea eax, [esp + 0x48]
push eax
xor eax, eax
mov dword [esp + 0x168], 0
cmp byte [esp + 0x20], al
setne al
push eax
push 0x10
push dword [esi + 0xc]
lea eax, [esp + 0x30]
push eax
call fcn.00490bf0
lea eax, [esp + 0x15c]
xorps xmm0, xmm0
push eax
push eax
lea eax, [esp + 0x3c]
push eax
movdqu xmmword [esp + 0x68], xmm0
call fcn.004906c0
movdqu xmm0, xmmword [esp + 0x168]
mov esi, dword [esp + 0x18c]
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x188], 0xffffffff
movdqu xmmword [esi], xmm0
call fcn.004906a0
add esp, 0x38
mov eax, esi
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.00535482
add esp, 0x14c
ret
Function at 0x4901d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x44]
mov dword [esp + 0xc], esi
test ebp, ebp
je 0x490352
test ebx, ebx
je 0x490352
mov ecx, dword [esp + 0x40]
cmp ecx, 0x10
jbe 0x490352
test esi, esi
je 0x490352
push edi
mov edi, ecx
mov eax, 0x10
and edi, 0xf
cmove edi, eax
cmp ecx, 0x20
jbe 0x490253
push dword [esp + 0x10]
cmp edi, eax
mov edx, 0x20
mov esi, ecx
cmove eax, edx
and esi, 0xfffffff0
sub esi, eax
mov eax, dword [ebp + 0x1c]
push esi
push ebx
push ebp
call eax
add ebx, esi
add esp, 0x10
add dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
push edi
lea eax, [ebx + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.005358e0
lea eax, [esp + 0x30]
push eax
mov eax, dword [ebp + 0x14]
push ebx
push ebp
call eax
add esp, 0x18
xor eax, eax
test edi, edi
je 0x4902d4
cmp edi, 0x20
jb 0x4902c3
mov ecx, edi
mov edx, edi
and ecx, 0x1f
sub edx, ecx
jmp 0x490290
movdqu xmm0, xmmword [esp + eax + 0x24]
movdqu xmm1, xmmword [esp + eax + 0x14]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x24], xmm1
movdqu xmm0, xmmword [esp + eax + 0x34]
movdqu xmm1, xmmword [esp + eax + 0x24]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x34], xmm1
add eax, 0x20
cmp eax, edx
jb 0x490290
cmp eax, edi
jae 0x4902d4
mov cl, byte [esp + eax + 0x14]
xor byte [esp + eax + 0x24], cl
inc eax
cmp eax, edi
jb 0x4902c7
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.005358e0
add esp, 0xc
test edi, edi
je 0x49033b
mov eax, 0x10
sub eax, edi
push eax
lea eax, [esp + 0x28]
add eax, edi
push eax
lea eax, [esp + 0x1c]
add eax, edi
push eax
call fcn.005358e0
lea eax, [esp + 0x20]
push eax
push eax
mov eax, dword [ebp + 0x14]
push ebp
call eax
mov eax, dword [ebp + 0x28]
add esp, 0x18
xor eax, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [ebp + 0x2c]
xor ecx, dword [esp + 0x18]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x30]
xor ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x34]
xor ecx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00535482
add esp, 0x28
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00535482
add esp, 0x28
ret
Function at 0x490720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, esi
mov dword [esp + 0x10], ecx
and edi, 0xf
test ecx, ecx
je 0x4908a1
cmp esi, 0x10
jbe 0x4908a1
mov eax, esi
and eax, 0xfffffff0
cmp eax, 0x10
jbe 0x490784
mov eax, dword [ecx + 0x18]
and esi, 0xfffffff0
push ebx
sub esi, 0x10
push esi
push ebp
push ecx
call eax
mov ecx, dword [esp + 0x20]
add ebp, esi
add esp, 0x10
add ebx, esi
mov esi, dword [esp + 0x48]
mov eax, dword [ecx + 0x28]
lea edx, [ecx + 0x28]
xor eax, dword [ebp]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
xor eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor eax, dword [edx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
xor eax, dword [edx + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push eax
mov eax, dword [ecx + 0x10]
push ecx
mov dword [esp + 0x20], edx
call eax
add esp, 0xc
test edi, edi
je 0x490878
push edi
lea eax, [ebp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.005358e0
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.005358e0
add esp, 0x18
xor eax, eax
test edi, edi
je 0x490844
cmp edi, 0x20
jb 0x490833
mov ecx, edi
mov edx, edi
and ecx, 0x1f
sub edx, ecx
nop
movdqu xmm0, xmmword [esp + eax + 0x18]
movdqu xmm1, xmmword [esp + eax + 0x28]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x18], xmm1
movdqu xmm0, xmmword [esp + eax + 0x28]
movdqu xmm1, xmmword [esp + eax + 0x38]
pxor xmm1, xmm0
movdqu xmmword [esp + eax + 0x28], xmm1
add eax, 0x20
cmp eax, edx
jb 0x490800
cmp eax, edi
jae 0x490844
mov cl, byte [esp + eax + 0x28]
xor byte [esp + eax + 0x18], cl
inc eax
cmp eax, edi
jb 0x490837
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax + 0x10]
call eax
movdqu xmm0, xmmword [edi]
add esp, 0xc
mov eax, esi
movdqu xmmword [ebx], xmm0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00535482
add esp, 0x2c
ret
movdqu xmm0, xmmword [ebx - 0x10]
pop edi
mov eax, esi
movdqu xmmword [ebx], xmm0
pop esi
movdqu xmm0, xmmword [esp + 0x10]
pop ebp
movdqu xmmword [ebx - 0x10], xmm0
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00535482
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00535482
add esp, 0x2c
ret
Function at 0x490dd0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub esp, 8
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x18], 0
call dword [0x57e054]
test eax, eax
jne 0x490e30
call fcn.00537abe
add eax, 0x40
push eax
push 0x420950
call fcn.00537b9a
add esp, 8
mov eax, 0x10300001
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00535482
add esp, 8
ret
push esi
push dword [esp + 0x18]
push dword [esp + 0xc]
call dword [0x57e04c]
test eax, eax
jne 0x490e7a
call fcn.00537abe
add eax, 0x40
push eax
push 0x420970
call fcn.00537b9a
add esp, 8
push 0
push dword [esp + 8]
call dword [0x57e050]
mov eax, 0x10300001
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00535482
add esp, 8
ret
push 0
push dword [esp + 8]
call dword [0x57e050]
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00535482
add esp, 8
ret

Function at 0x491480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x58cce8], 0
push ebx
push esi
jne 0x491558
xor esi, esi
mov eax, esi
and al, 1
movzx ecx, al
mov eax, esi
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov dword [esi*4 + 0x58ccf0], eax
inc esi
cmp esi, 0x100
jb 0x491491
mov dword [0x58cce8], 1
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x491614
mov edx, dword [esp + 0x10]
test edx, edx
je 0x491614
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
test esi, esi
je 0x491612
push edi
nop
cmp esi, 0x10
jb 0x4915f2
mov edi, 4
lea ebx, [ebx]
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58ccf0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58ccf0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58ccf0]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58ccf0]
dec edi
jne 0x491590
sub esi, 0x10
jmp 0x491609
movzx ecx, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x58ccf0]
dec esi
test esi, esi
jne 0x491580
pop edi
mov dword [ebx], eax
pop esi
pop ebx
ret
Function at 0x491620
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x12c
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
push edi
movdqu xmm0, xmmword [ebx + 0x2c]
mov eax, dword [ebx + 0xc]
mov ebp, 0x30
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x14]
movdqu xmmword [esp + 0x38], xmm0
mov dword [esp + 0x14], eax
movdqu xmm0, xmmword [ebx + 0x3c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x1c]
movdqu xmmword [esp + 0x48], xmm0
mov dword [esp + 0x1c], eax
movdqu xmm0, xmmword [ebx + 0x4c]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x24]
movdqu xmmword [esp + 0x58], xmm0
mov dword [esp + 0x18], eax
movdqu xmm0, xmmword [ebx + 0x5c]
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x30], ebx
movdqu xmmword [esp + 0x68], xmm0
mov edx, dword [eax - 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
dec ebp
jne 0x4916b4
mov ebp, dword [esp + 0x2c]
xor edi, edi
mov ebx, dword [esp + 0x1c]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [esp + 0x18]
xor esi, eax
mov eax, ebx
mov edx, ebp
ror eax, 6
xor esi, eax
ror edx, 0xd
mov eax, dword [esp + 0x10]
and eax, ebx
or ecx, eax
mov eax, ebp
rol eax, 0xa
add esi, ecx
add esi, dword [edi + 0x4209a8]
xor edx, eax
add esi, dword [esp + edi + 0x38]
mov eax, ebp
add esi, dword [esp + 0x28]
add edi, 4
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x20]
mov ecx, eax
and eax, ebp
or ecx, ebp
and ecx, dword [esp + 0x14]
or ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
add edx, ecx
mov eax, dword [esp + 0x10]
mov ecx, ebp
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
lea ebp, [edx + esi]
mov eax, dword [esp + 0x14]
add ebx, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
cmp edi, 0x100
jb 0x4916f7
mov eax, dword [esp + 0x34]
add eax, ebp
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
add dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x12c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x14], eax
mov eax, dword [esp + 0x18]
add dword [ebx + 0x18], eax
mov eax, dword [esp + 0x10]
add dword [ebx + 0x1c], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x20], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x24], eax
mov eax, dword [esp + 0x1c]
add dword [ebx + 0x28], eax
pop ebx
xor ecx, esp
call fcn.00535482
add esp, 0x12c
ret
Function at 0x492540
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x30
mov eax, dword [0x586220]
xor eax, esp
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x34]
push ebx
push esi
push edi
mov ebx, dword [ecx + 0x24]
mov edi, 0
sub ebx, 6
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov eax, edi
je 0x49257e
mov esi, dword [esp + 0x44]
lea edi, [esp + 0x18]
mov ecx, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x4925bf
cmp edi, dword [ecx + 0x24]
ja 0x4926ff
cmp esi, ebx
jae 0x4925b3
cmp eax, 4
jae 0x4925af
mov ebx, dword [esp + 0xc]
lea edx, [eax + edi*4]
mov ecx, dword [esp + esi*4 + 0x18]
inc eax
inc esi
mov dword [ebx + edx*4 + 0x38], ecx
mov ebx, dword [esp + 0x10]
cmp esi, ebx
jb 0x492591
mov ecx, dword [esp + 0xc]
cmp eax, 4
jne 0x4925bb
inc edi
xor eax, eax
cmp esi, ebx
jb 0x492584
cmp edi, dword [ecx + 0x24]
ja 0x4926ff
mov esi, 0x5832f8
lea ecx, [ecx]
movzx ecx, byte [esp + ebx*4 + 0x15]
mov dl, byte [esp + 0x18]
xor dl, byte [ecx + 0x5800f8]
mov byte [esp + 0x18], dl
mov edx, 1
movzx ecx, byte [esp + ebx*4 + 0x16]
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x19], cl
movzx ecx, byte [esp + ebx*4 + 0x17]
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x1a], cl
movzx ecx, byte [esp + ebx*4 + 0x14]
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x1b], cl
movzx ecx, byte [esi]
inc esi
xor byte [esp + 0x18], cl
mov dword [esp + 0x14], esi
cmp ebx, 8
je 0x492640
cmp ebx, edx
jbe 0x4926a1
lea ecx, [ecx]
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, ebx
jb 0x492630
jmp 0x4926a1
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 4
jb 0x492640
movzx ecx, byte [esp + 0x24]
mov edx, 5
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x28], cl
movzx ecx, byte [esp + 0x25]
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x29], cl
movzx ecx, byte [esp + 0x26]
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x2a], cl
movzx ecx, byte [esp + 0x27]
movzx ecx, byte [ecx + 0x5800f8]
xor byte [esp + 0x2b], cl
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 8
jb 0x492693
xor esi, esi
test ebx, ebx
je 0x4926ee
mov ecx, dword [esp + 0xc]
jmp 0x4926b0
cmp edi, dword [ecx + 0x24]
ja 0x4926ee
cmp esi, ebx
jae 0x4926e2
lea esp, [esp]
cmp eax, 4
jae 0x4926de
mov ebx, dword [esp + 0xc]
lea edx, [eax + edi*4]
mov ecx, dword [esp + esi*4 + 0x18]
inc eax
inc esi
mov dword [ebx + edx*4 + 0x38], ecx
mov ebx, dword [esp + 0x10]
cmp esi, ebx
jb 0x4926c0
mov ecx, dword [esp + 0xc]
cmp eax, 4
jne 0x4926ea
inc edi
xor eax, eax
cmp esi, ebx
jb 0x4926b0
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
cmp edi, dword [ecx + 0x24]
jbe 0x4925d0
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00535482
add esp, 0x30
ret
Function at 0x492720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
movdqu xmm2, xmmword [eax]
mov eax, dword [esp + 8]
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqa xmmword [eax], xmm2
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x10], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x20], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x30], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x40], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x10
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x50], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm3, 0x20
pxor xmm2, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x60], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmmword [eax + 0x70], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm0, xmm0, 0xff
pxor xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmmword [eax + 0x80], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm0
pslldq xmm1, 4
aeskeygenassist xmm0, xmm2, 0x1b
pxor xmm3, xmm1
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
movdqa xmm2, xmm3
movdqa xmmword [eax + 0x90], xmm3
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm3
movdqa xmm1, xmm2
pxor xmm1, xmm0
pslldq xmm2, 4
aeskeygenassist xmm0, xmm3, 0x36
pxor xmm1, xmm2
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movdqa xmmword [eax + 0xa0], xmm1
ret
Function at 0x492990
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
lea eax, [esp + 0x10]
movdqa xmmword [esp], xmm0
push eax
lea eax, [esp + 0x24]
movdqa xmmword [edx], xmm0
push eax
lea eax, [esp + 8]
movdqa xmmword [esp + 0x18], xmm1
aeskeygenassist xmm0, xmm1, 1
push eax
movdqa xmmword [edx + 0x10], xmm1
movdqa xmmword [esp + 0x2c], xmm0
call fcn.00492ee0
movaps xmm0, xmmword [edx + 0x10]
lea eax, [esp + 0x1c]
movdqa xmm1, xmmword [esp + 0xc]
push eax
shufpd xmm0, xmm1, 0
lea eax, [esp + 0x30]
shufpd xmm1, xmmword [esp + 0x20], 1
push eax
movaps xmmword [edx + 0x10], xmm0
lea eax, [esp + 0x14]
aeskeygenassist xmm0, xmmword [esp + 0x24], 2
push eax
movdqa xmmword [edx + 0x20], xmm1
movdqa xmmword [esp + 0x38], xmm0
call fcn.00492ee0
movdqa xmm0, xmmword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
movdqa xmmword [edx + 0x30], xmm0
lea eax, [esp + 0x3c]
movdqa xmm0, xmmword [esp + 0x2c]
push eax
movdqa xmmword [edx + 0x40], xmm0
lea eax, [esp + 0x20]
aeskeygenassist xmm0, xmm0, 4
push eax
movdqa xmmword [esp + 0x44], xmm0
call fcn.00492ee0
movaps xmm0, xmmword [edx + 0x40]
lea eax, [esp + 0x34]
movdqa xmm1, xmmword [esp + 0x24]
push eax
shufpd xmm0, xmm1, 0
lea eax, [esp + 0x48]
shufpd xmm1, xmmword [esp + 0x38], 1
push eax
movaps xmmword [edx + 0x40], xmm0
lea eax, [esp + 0x2c]
aeskeygenassist xmm0, xmmword [esp + 0x3c], 8
push eax
movdqa xmmword [edx + 0x50], xmm1
movdqa xmmword [esp + 0x50], xmm0
call fcn.00492ee0
movdqa xmm0, xmmword [esp + 0x30]
lea eax, [esp + 0x40]
push eax
movdqa xmmword [edx + 0x60], xmm0
lea eax, [esp + 0x54]
movdqa xmm0, xmmword [esp + 0x44]
push eax
movdqa xmmword [edx + 0x70], xmm0
lea eax, [esp + 0x38]
aeskeygenassist xmm0, xmm0, 0x10
push eax
movdqa xmmword [esp + 0x5c], xmm0
call fcn.00492ee0
movaps xmm0, xmmword [edx + 0x70]
movdqa xmm1, xmmword [esp + 0x3c]
shufpd xmm0, xmm1, 0
shufpd xmm1, xmmword [esp + 0x4c], 1
movaps xmmword [edx + 0x70], xmm0
aeskeygenassist xmm0, xmmword [esp + 0x4c], 0x20
movdqa xmmword [edx + 0x80], xmm1
movdqa xmmword [esp + 0x5c], xmm0
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00492ee0
movdqa xmm0, xmmword [esp + 0x48]
lea eax, [esp + 0x58]
add esp, 0x48
movdqa xmmword [edx + 0x90], xmm0
movdqa xmm0, xmmword [esp + 0x10]
movdqa xmmword [edx + 0xa0], xmm0
aeskeygenassist xmm0, xmm0, 0x40
push eax
lea eax, [esp + 0x24]
movdqa xmmword [esp + 0x24], xmm0
push eax
lea eax, [esp + 8]
push eax
call fcn.00492ee0
movaps xmm0, xmmword [edx + 0xa0]
lea eax, [esp + 0x1c]
movdqa xmm1, xmmword [esp + 0xc]
push eax
shufpd xmm0, xmm1, 0
lea eax, [esp + 0x30]
shufpd xmm1, xmmword [esp + 0x20], 1
push eax
movaps xmmword [edx + 0xa0], xmm0
lea eax, [esp + 0x14]
aeskeygenassist xmm0, xmmword [esp + 0x24], 0x80
push eax
movdqa xmmword [edx + 0xb0], xmm1
movdqa xmmword [esp + 0x38], xmm0
call fcn.00492ee0
movdqa xmm0, xmmword [esp + 0x18]
add esp, 0x18
movdqa xmmword [edx + 0xc0], xmm0
mov esp, ebp
pop ebp
ret