joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c18bd
Capabilities:
Set socket configuration

Disassembly:
push esi
sub esp, 0xc
mov dword [esp + 8], 0x4020
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, dword [0x7f3de4]
cmp eax, 2
je 0x4c1960
test eax, eax
jne 0x4c191e
sub esp, 0x14
movaps xmm0, xmmword [0x732180]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.004cbac4
add esp, 0x14
test al, al
je 0x4c1914
mov dword [0x7f3de4], 2
jmp 0x4c1960
mov dword [0x7f3de4], 1
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
mov ecx, esp
push eax
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4c1948
cmp dword [esp], 0x4020
jg 0x4c1960
lea eax, [esp + 8]
push 4
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
pop esi
ret

Function at 0x4c29f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov eax, dword [edx + 0x18]
mov eax, dword [eax + 0x1e4]
test byte [eax + 0x45], 8
jne 0x4c2ad3
mov esi, edx
mov edi, dword [ecx + 8]
lea eax, [esp + 0xc]
mov dword [eax], 0x80
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movaps xmmword [ebx], xmm0
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx + 0x20], xmm0
movaps xmmword [ebx + 0x30], xmm0
movaps xmmword [ebx + 0x40], xmm0
movaps xmmword [ebx + 0x50], xmm0
movaps xmmword [ebx + 0x60], xmm0
movaps xmmword [ebx + 0x70], xmm0
push eax
push ebx
push dword [edi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4c2a80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
lea eax, [esp + 0x9c]
push 0x100
push eax
push edi
call fcn.004d6673
add esp, 0xc
push eax
push edi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4c2aca
lea eax, [edi + 0x120]
add edi, 0xf0
push eax
push edi
push dword [esp + 0x14]
push ebx
call fcn.004bba59
add esp, 0x10
test al, al
jne 0x4c2ad3
call fcn.0070acc3
lea ecx, [esp + 0x9c]
push 0x100
push ecx
push dword [eax]
call fcn.004d6673
add esp, 0xc
mov edi, eax
call fcn.0070acc3
push edi
push dword [eax]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push esi
call fcn.004abf08
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c3783
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x100
mov ebp, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x118]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 8]
xor edx, edx
mov dword [ebp], edx
push edx
push edi
push eax
push dword [ecx + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp eax, 0xffffffff
jne 0x4c381a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4c37df
mov dword [ebp], 0x51
jmp 0x4c3813
mov edi, eax
mov eax, esp
push 0x100
push eax
push edi
call fcn.004d6673
add esp, 0xc
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.004abf08
add esp, 0xc
mov eax, dword [ebx + 4]
mov dword [eax + 0x8ec], edi
mov dword [ebp], 0x38
mov edi, dword [esp + 0x11c]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4c384c
cmp byte [eax + 0x68b], 0
je 0x4c384c
mov ecx, dword [ebx]
test ecx, ecx
je 0x4c384c
mov edx, dword [ecx]
cmp dword [edx + 8], 0
jle 0x4c384c
push dword [ebp]
push esi
push edi
push str.nw_in_read_len_zu______d__err_d
push ecx
push eax
call fcn.004abff5
add esp, 0x18
mov edx, esi
sar edx, 0x1f
mov eax, esi
add esp, 0x100
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c6f24
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
xor edi, edi
inc edi
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push edi
push ebx
call dword [0x7ec0e4]
add esp, 8
test eax, eax
je 0x4c6f68
mov esi, eax
push edi
push eax
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x4c6f65
cmp eax, edi
je 0x4c6f65
cmp eax, 0x8001
jae 0x4c6f65
mov ebx, esi
cmp eax, edi
mov edi, eax
jae 0x4c6f33
jmp 0x4c6f74
push esi
jmp 0x4c6f69
push ebx
call dword [0x7ec0e0]
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4cbc6c
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
push esi
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
push esi
call fcn.0070868c
add esp, 0x18
cmp eax, 0xffffffff
cmove eax, esi
pop esi
ret
Function at 0x4cd016
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebp], 0
lea esi, [esp + 4]
push esi
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test eax, eax
jne 0x4cd158
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x4cd143
xor ebp, ebp
mov dword [esp], 0
mov eax, dword [ebx + 0x14]
mov esi, 0
test eax, eax
je 0x4cd079
push eax
call fcn.007149b0
add esp, 4
mov esi, eax
inc esi
mov eax, dword [ebx + 4]
cmp eax, 2
je 0x4cd08d
cmp eax, 0x17
jne 0x4cd09d
mov ecx, 0x1c
jmp 0x4cd092
mov ecx, 0x10
cmp dword [ebx + 0x18], 0
je 0x4cd09d
cmp dword [ebx + 0x10], ecx
jae 0x4cd0aa
mov edi, ebp
mov ebx, dword [ebx + 0x1c]
mov ebp, edi
test ebx, ebx
jne 0x4cd061
jmp 0x4cd127
lea eax, [esi + ecx]
add eax, 0x20
push eax
mov dword [esp + 0xc], ecx
call dword [0x7ec0dc]
add esp, 4
test eax, eax
je 0x4cd162
mov edi, eax
movups xmm0, xmmword [ebx]
movups xmmword [eax], xmm0
mov ecx, dword [esp + 8]
mov dword [eax + 0x10], ecx
xor eax, eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x20]
mov dword [edi + 0x18], eax
push ecx
push dword [ebx + 0x18]
mov dword [esp + 0x14], eax
push eax
call fcn.006fb4d0
add esp, 0xc
test esi, esi
je 0x4cd110
mov eax, dword [esp + 0xc]
add eax, dword [esp + 8]
mov dword [edi + 0x14], eax
push esi
push dword [ebx + 0x14]
push eax
call fcn.006fb4d0
add esp, 0xc
mov eax, dword [esp]
test eax, eax
cmove eax, edi
mov dword [esp], eax
test ebp, ebp
je 0x4cd09f
mov dword [ebp + 0x1c], edi
jmp 0x4cd09f
mov eax, dword [esp + 4]
test eax, eax
je 0x4cd136
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
xor esi, esi
mov eax, dword [esp]
test eax, eax
mov ebp, dword [esp + 0x30]
jne 0x4cd155
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, 0x2af9
xor eax, eax
mov dword [ebp], eax
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x4cd171
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, 8
mov eax, dword [esp]
test eax, eax
mov ebp, dword [esp + 0x30]
je 0x4cd153
mov edi, dword [eax + 0x1c]
push eax
call dword [0x7ec0e0]
add esp, 4
mov eax, edi
test edi, edi
jne 0x4cd181
jmp 0x4cd153
Function at 0x4dabc8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.004bd0ac
add esp, 4
push edi
call fcn.0070fc67
add esp, 4
mov edi, eax
push esi
call fcn.0070fc67
add esp, 4
mov esi, eax
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4dac52
xor ebx, ebx
inc ebx
mov eax, esp
push eax
call fcn.004bd0ac
sub esp, 0x1c
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esp + 0x10], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esp], xmm0
call fcn.004bd182
add esp, 0x20
cmp eax, 0x3e9
sbb edx, 0
jae 0x4dac78
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x4dac0e
test edi, edi
je 0x4dac5f
push edi
call fcn.00712486
add esp, 4
xor ebx, ebx
test esi, esi
je 0x4dac6e
push esi
call fcn.00712486
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x4dac61
push edi
call fcn.00712486
add esp, 4
jmp 0x4dac61
Function at 0x4e0da8
Capabilities:
Set socket configuration

Disassembly:
push eax
xor eax, eax
cmp dword [esp + 0xc], 0
mov ecx, dword [esp + 8]
setne al
mov edx, esp
mov dword [edx], eax
push edx
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret

Function at 0x4e30f0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 8]
cmp byte [eax + 0x290], 2
je fcn.004cc26c
mov al, 1
ret
Function at 0x4ead38
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
lea eax, [ecx + eax*2]
add eax, 0xc
push eax
call dword [0x7ec0dc]
add esp, 4
mov esi, eax
test eax, eax
je 0x4eae3b
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi], edi
add eax, 0xc
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xc]
add ecx, eax
mov dword [esi + 8], ecx
cmp dword [edi + 0x10], ebx
jae 0x4eada7
push eax
call dword [edi]
add esp, 4
push ebx
push ebp
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
mov ebp, dword [esi + 8]
add ebp, dword [edi + 0xc]
push dword [esi + 4]
push ebp
call dword [edi + 8]
add esp, 8
mov ebx, dword [edi + 0x14]
mov eax, dword [esi + 4]
push eax
call dword [edi]
add esp, 4
push dword [esi + 8]
call dword [edi]
add esp, 4
test ebx, ebx
mov ecx, edi
je 0x4eae0d
xor edi, edi
mov dword [esp + 4], ebx
mov al, byte [ebp + edi]
xor al, 0x36
mov byte [esp + 3], al
xor eax, eax
inc eax
push eax
lea eax, [esp + 7]
push eax
push dword [esi + 4]
mov ebx, esi
mov esi, ebp
mov ebp, ecx
call dword [ecx + 4]
add esp, 0xc
mov al, byte [esi + edi]
xor al, 0x5c
mov byte [esp + 3], al
xor eax, eax
inc eax
push eax
lea eax, [esp + 7]
push eax
push dword [ebx + 8]
call dword [ebp + 4]
mov ecx, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0xc
inc edi
cmp ebx, edi
jne 0x4eadc1
cmp ebx, dword [ecx + 0x10]
jae 0x4eae3b
mov ebp, ecx
xor edi, edi
inc edi
push edi
push 0x74f350
push dword [esi + 4]
call dword [ebp + 4]
add esp, 0xc
push edi
push 0x74f351
push dword [esi + 8]
call dword [ebp + 4]
add esp, 0xc
inc ebx
cmp ebx, dword [ebp + 0x10]
jb 0x4eae17
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4fd154
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push edi
push esi
sub esp, 0xc
xor edi, edi
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
sub esp, 0x14
movaps xmm0, xmmword [0x763c60]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 2
test eax, eax
je 0x4fd21b
lea eax, [esp + 4]
push eax
push edi
push edi
push 0x8002
push dword [eax - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4fd20f
mov esi, dword [esp + 0x1c]
push dword [esp + 0x20]
call fcn.004b6c51
add esp, 4
xor edi, edi
push edi
push eax
push esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea esi, [esp + 8]
mov dword [esi], edi
push edi
push esi
push edi
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esi], 0x10
jne 0x4fd1ec
push 0
push esi
push dword [esp + 0x20]
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 4]
test eax, eax
je 0x4fd1fb
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp]
test eax, eax
je 0x4fd20b
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor esi, esi
jmp 0x4fd21b
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
add esp, 0xc
pop esi
pop edi
ret
Function at 0x526740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x52681b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x5267b6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00526380
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x526784
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x5268d4
call fcn.005267c8
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x526873
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00526380
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x52682c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x5268d4
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00526380
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5268cf
jmp 0x5268d4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x526940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x526a24
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x5269bf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005264e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x52698d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x526add
call fcn.005269d1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x526a7c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00526610
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x526a35
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x526add
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00526610
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x526ad8
jmp 0x526add
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x527b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x527c6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x527bfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00527340
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x527bc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x527d33
call fcn.00527c0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x527cca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00527760
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x527c7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x527d33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00527760
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x527d2e
jmp 0x527d33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x528330
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x528350
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x52c1a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x52c1be
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x52c200
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x52c21e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x52c260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x52c282
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x52c2e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x52c302
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x52c360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x52c38a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret