joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e0b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dl, 1
nop word [eax + eax]
movzx eax, dl
mov cl, dl
sar cl, 7
and cl, 0x1b
mov byte [ebp + ebx - 0x204], dl
mov byte [ebp + eax - 0x104], bl
mov al, dl
add al, al
inc ebx
xor cl, al
xor dl, cl
cmp ebx, 0x100
jl 0x41e0d0
mov cl, 1
mov edx, 0x49a7c0
movzx eax, cl
mov dword [edx], eax
mov al, cl
sar al, 7
add cl, cl
and al, 0x1b
add edx, 4
xor cl, al
cmp edx, 0x49a7e8
jl 0x41e101
mov byte [0x49a7f0], 0x63
xor ebx, ebx
mov byte [0x49ad53], 0
nop dword [eax]
movzx eax, byte [ebp + ebx - 0x103]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov dl, byte [ecx]
mov cl, dl
rol cl, 1
xor dl, cl
rol cl, 1
xor dl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x49a7f1], al
inc ebx
movzx eax, al
mov byte [eax + 0x49acf0], bl
lea eax, [ebx + 1]
cmp eax, 0x100
jl 0x41e130
xor edi, edi
mov dword [ebp - 0x20c], 0xff
nop
mov dl, byte [edi + 0x49a7f0]
mov bl, dl
movzx ecx, dl
sar bl, 7
mov al, dl
add al, al
and bl, 0x1b
xor bl, al
movzx eax, dl
movzx esi, bl
xor esi, eax
movzx eax, bl
shl esi, 8
xor esi, ecx
shl esi, 8
xor esi, ecx
shl esi, 8
xor esi, eax
mov al, byte [edi + 0x49acf0]
mov dword [edi*4 + 0x49c1f0], esi
rol esi, 8
mov dword [edi*4 + 0x49bdf0], esi
rol esi, 8
mov dword [edi*4 + 0x49b1f0], esi
rol esi, 8
mov dword [edi*4 + 0x49adf0], esi
test al, al
je 0x41e25d
movzx eax, al
xor edx, edx
mov ebx, 0xff
movzx ecx, byte [ebp + eax - 0x104]
mov eax, dword [ebp - 0xf6]
movzx eax, al
add eax, ecx
div ebx
mov eax, dword [ebp - 0xfb]
movzx eax, al
add eax, ecx
movzx esi, byte [ebp + edx - 0x204]
xor edx, edx
div ebx
mov eax, dword [ebp - 0xf7]
movzx eax, al
add eax, ecx
movzx ebx, byte [ebp + edx - 0x204]
xor edx, edx
div dword [ebp - 0x20c]
movzx eax, byte [ebp + edx - 0x204]
xor edx, edx
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0xf9]
movzx eax, al
add eax, ecx
mov ecx, 0xff
div ecx
movzx eax, byte [ebp + edx - 0x204]
jmp 0x41e269
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x208], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x208]
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, esi
mov dword [edi*4 + 0x49b9f0], eax
rol eax, 8
mov dword [edi*4 + 0x49b5f0], eax
rol eax, 8
mov dword [edi*4 + 0x49c5f0], eax
rol eax, 8
mov dword [edi*4 + 0x49a8f0], eax
inc edi
cmp edi, 0x100
jl 0x41e180
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x420450
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [esp + 0x10], edx
mov eax, dword [eax]
mov dword [esp + 0xc], eax
push edi
mov edi, ecx
cmp eax, 0xf
jbe 0x42047c
lea eax, [esi - 0x21]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x4205f0
mov ecx, dword [ebp + 0x14]
sub dword [ebp + 0x10], ecx
nop word [eax + eax]
dec dword [esp + 0x14]
test eax, eax
jne 0x4205c6
cmp dword [0x49a634], eax
jne 0x4204d9
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [0x49a624], eax
mov eax, ecx
mov dword [0x49a628], esi
mov dword [0x49a62c], ecx
mov dword [0x49a630], edx
mov dword [0x49a638], eax
mov dword [0x49a634], 1
test dword [0x49a638], 0x2000000
je 0x4204f9
lea eax, [edi - 8]
shr eax, 2
and eax, 3
je 0x4204f9
mov esi, 4
sub esi, eax
jmp 0x4204fb
xor esi, esi
mov ecx, dword [edi + 4]
cmp esi, ecx
je 0x420522
mov eax, dword [edi]
add ecx, 2
inc eax
shl eax, 4
push eax
lea eax, [edi + ecx*4]
push eax
lea eax, [edi + 8]
lea eax, [eax + esi*4]
push eax
call fcn.00449ea0
add esp, 0xc
mov dword [edi + 4], esi
cmp dword [0x49a634], 0
jne 0x420560
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [0x49a624], eax
mov eax, ecx
mov dword [0x49a628], esi
mov dword [0x49a62c], ecx
mov dword [0x49a630], edx
mov dword [0x49a638], eax
mov dword [0x49a634], 1
test dword [0x49a638], 0x2000000
je 0x4205a9
mov eax, dword [edi + 4]
mov esi, dword [ebp + 0xc]
lea eax, [edi + eax*4]
movaps xmm1, xmmword [eax + 8]
add eax, 0x18
mov ecx, dword [edi]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
sub ecx, 1
je 0x42059d
nop word [eax + eax]
aesenc xmm1, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x420590
aesenclast xmm1, xmmword [eax]
movups xmmword [esi], xmm1
xor esi, esi
jmp 0x4205bf
mov eax, dword [ebp + 0xc]
mov ecx, edi
push eax
mov edx, eax
call fcn.0041f480
mov esi, eax
add esp, 4
test esi, esi
jne 0x4205f5
mov ecx, dword [ebp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [ebp + 0x10]
mov cl, byte [edx + ecx]
mov edx, dword [ebp + 0xc]
xor cl, byte [eax + edx]
inc eax
mov edx, dword [ebp + 0x14]
and eax, 0xf
mov dword [esp + 0x10], eax
mov byte [edx], cl
mov ecx, edx
inc ecx
cmp dword [esp + 0x14], 0
mov dword [ebp + 0x14], ecx
jne 0x420490
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
mov edi, ecx
mov dword [esp + 0x14], eax
cmp eax, 0xf
jbe 0x42062c
mov eax, 0xffffffdf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], 0
test ecx, ecx
je 0x4207b1
mov edx, ecx
nop dword [eax]
nop word [eax + eax]
mov dword [esp + 0x1c], 0x10
test eax, eax
jne 0x42074e
lea ecx, [edi + 8]
call fcn.0041e2c0
mov esi, eax
mov eax, dword [edi + 4]
cmp esi, eax
je 0x420691
mov ecx, dword [edi]
add eax, 2
inc ecx
shl ecx, 4
push ecx
lea eax, [edi + eax*4]
push eax
lea eax, [edi + 8]
lea eax, [eax + esi*4]
push eax
call fcn.00449ea0
add esp, 0xc
mov dword [edi + 4], esi
cmp dword [0x49a634], 0
jne 0x4206d1
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [0x49a624], eax
mov eax, ecx
mov dword [0x49a628], esi
mov dword [0x49a62c], ecx
mov dword [0x49a630], edx
mov dword [0x49a638], eax
mov dword [0x49a634], 1
jmp 0x4206d6
mov eax, dword [0x49a638]
mov edx, dword [ebp + 0xc]
test eax, 0x2000000
je 0x42071a
mov eax, dword [edi + 4]
movups xmm0, xmmword [edx]
lea eax, [edi + eax*4]
mov ecx, dword [edi]
movaps xmm1, xmmword [eax + 8]
add eax, 0x18
pxor xmm1, xmm0
sub ecx, 1
je 0x42070d
nop dword [eax + eax]
aesenc xmm1, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x420700
aesenclast xmm1, xmmword [eax]
mov eax, dword [ebp + 0x10]
movups xmmword [eax], xmm1
jmp 0x420733
mov eax, dword [ebp + 0x10]
mov ecx, edi
push eax
call fcn.0041f480
add esp, 4
test eax, eax
jne 0x4207bc
mov edx, dword [ebp + 0xc]
mov eax, 3
mov ecx, dword [edx + eax*4]
bswap ecx
add ecx, 1
bswap ecx
mov dword [edx + eax*4], ecx
jne 0x42075b
test eax, eax
je 0x42075b
dec eax
jmp 0x420738
mov ecx, dword [esp + 0x14]
mov eax, 0x10
sub eax, ecx
jmp 0x420767
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov esi, edx
mov edx, dword [ebp + 0x14]
sub esi, dword [esp + 0x18]
cmp eax, esi
cmovbe esi, eax
mov eax, dword [ebp + 0x10]
add eax, ecx
mov ecx, dword [ebp + 0x18]
push esi
push eax
mov eax, dword [esp + 0x20]
add ecx, eax
lea edx, [eax + edx]
call fcn.0041a9c0
mov ecx, dword [esp + 0x20]
xor eax, eax
mov edx, dword [esp + 0x18]
add ecx, esi
add esp, 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp ecx, edx
jb 0x420650
mov ecx, edx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add eax, ecx
and eax, 0xf
mov dword [edx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], ecx
jbe 0x420e7c
push ebx
mov ebx, dword [ebp + 8]
push edi
mov eax, dword [0x49a620]
xor eax, ecx
mov ecx, dword [0x49a620]
xor ecx, eax
mov eax, dword [0x49a620]
xor ecx, dword [ebp + 0x10]
xor eax, ecx
mov edi, eax
neg eax
shr edi, 1
neg edi
or edi, eax
shr edi, 0x1f
dec edi
cmp esi, edx
je 0x420e5e
test ebx, ebx
je 0x420e5e
mov ecx, edx
mov eax, esi
sub ecx, esi
mov dword [ebp - 0xc], ecx
nop word [eax + eax]
mov esi, dword [0x49a620]
lea eax, [eax + 4]
mov edx, dword [ecx + eax - 4]
xor esi, edi
mov ecx, dword [eax - 4]
not esi
and ecx, esi
and edx, edi
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax - 4], edx
sub ebx, 1
jne 0x420e30
mov edx, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
lea eax, [ebx*4]
inc ecx
add edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
cmp ecx, dword [ebp + 0xc]
jb 0x420df2
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4240a0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x68]
push esi
push edi
push 0x5c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.0044bde0
add esp, 0xc
mov dword [ebp - 0x68], 0
mov edx, edi
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
push esi
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0xc3d2e1f0
call fcn.00423f30
mov esi, eax
add esp, 4
test esi, esi
jne 0x42411b
mov edx, ebx
lea ecx, [ebp - 0x68]
call fcn.00423fe0
mov esi, eax
mov ecx, 0x5c
lea eax, [ebp - 0x68]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x424123
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448a58
mov esp, ebp
pop ebp
ret

Function at 0x424a40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x64]
push esi
push edi
push 0x58
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.0044bde0
add esp, 0xc
mov dword [ebp - 0x64], 0
mov edx, edi
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
push esi
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.004248d0
mov esi, eax
add esp, 4
test esi, esi
jne 0x424ab4
mov edx, ebx
lea ecx, [ebp - 0x64]
call fcn.00424980
mov esi, eax
mov ecx, 0x58
lea eax, [ebp - 0x64]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x424ac0
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448a58
mov esp, ebp
pop ebp
ret
Function at 0x425450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 8], edx
push esi
mov esi, ecx
push edi
cmp ebx, 8
jb 0x42556a
mov eax, dword [esi + 0xc8]
mov ecx, 8
and eax, 7
sub ecx, eax
mov dword [esp + 0x14], ecx
je 0x4254f5
test ecx, ecx
jle 0x4254cf
nop dword [eax + eax]
mov ecx, dword [esi + 0xc8]
mov eax, ecx
shr eax, 3
and ecx, 7
shl ecx, 3
lea edi, [esi + eax*8]
movzx eax, byte [edx]
cdq
call fcn.00469e00
xor dword [edi], eax
dec ebx
xor dword [edi + 4], edx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
dec eax
inc dword [esi + 0xc8]
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
test eax, eax
jg 0x425490
mov eax, dword [esi + 0xc8]
xor edx, edx
movzx ecx, word [esi + 0xce]
div ecx
mov dword [esi + 0xc8], edx
test edx, edx
jne 0x4254f1
mov ecx, esi
call fcn.00424ae0
mov edx, dword [esp + 0x10]
cmp ebx, 8
jb 0x42556a
mov eax, ebx
shr eax, 3
mov dword [esp + 0x14], eax
jmp 0x425514
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0xc8]
mov edi, ecx
mov eax, dword [edx]
and ecx, 7
mov edx, dword [edx + 4]
shl ecx, 3
shr edi, 3
call fcn.00469e00
xor dword [esi + edi*8], eax
sub ebx, 8
xor dword [esi + edi*8 + 4], edx
xor edx, edx
mov eax, dword [esi + 0xc8]
movzx ecx, word [esi + 0xce]
add eax, 8
div ecx
add dword [esp + 0x10], 8
mov dword [esi + 0xc8], edx
test edx, edx
jne 0x425563
mov ecx, esi
call fcn.00424ae0
sub dword [esp + 0x14], 1
jne 0x425510
test ebx, ebx
je 0x4255c2
nop
mov ecx, dword [esi + 0xc8]
dec ebx
mov eax, ecx
and ecx, 7
shr eax, 3
shl ecx, 3
lea edi, [esi + eax*8]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
cdq
call fcn.00469e00
xor dword [edi], eax
xor dword [edi + 4], edx
xor edx, edx
mov eax, dword [esi + 0xc8]
movzx ecx, word [esi + 0xce]
inc eax
div ecx
inc dword [esp + 0x10]
mov dword [esi + 0xc8], edx
test edx, edx
jne 0x4255be
mov ecx, esi
call fcn.00424ae0
test ebx, ebx
jne 0x425570
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426cc0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x49611c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x68]
push esi
push edi
push 0x5c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.0044bde0
add esp, 0xc
mov dword [ebp - 0x68], 0
mov edx, edi
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
push esi
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0xc3d2e1f0
call fcn.00426b40
mov esi, eax
add esp, 4
test esi, esi
jne 0x426d3b
mov edx, ebx
lea ecx, [ebp - 0x68]
call fcn.00426bf0
mov esi, eax
mov ecx, 0x5c
lea eax, [ebp - 0x68]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x426d43
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448a58
mov esp, ebp
pop ebp
ret

Function at 0x426d90
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
test edx, edx
je 0x426d9f
cmp edx, 1
je 0x426d9f
mov eax, 0xffffff8b
ret
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
test edx, edx
jne 0x426e37
mov dword [ecx + 0x10], 0xf3bcc908
xor eax, eax
mov dword [ecx + 0x14], 0x6a09e667
mov dword [ecx + 0x18], 0x84caa73b
mov dword [ecx + 0x1c], 0xbb67ae85
mov dword [ecx + 0x20], 0xfe94f82b
mov dword [ecx + 0x24], 0x3c6ef372
mov dword [ecx + 0x28], 0x5f1d36f1
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0xade682d1
mov dword [ecx + 0x34], 0x510e527f
mov dword [ecx + 0x38], 0x2b3e6c1f
mov dword [ecx + 0x3c], 0x9b05688c
mov dword [ecx + 0x40], 0xfb41bd6b
mov dword [ecx + 0x44], 0x1f83d9ab
mov dword [ecx + 0x48], 0x137e2179
mov dword [ecx + 0x4c], 0x5be0cd19
mov dword [ecx + 0xd0], edx
ret
mov dword [ecx + 0x10], 0xc1059ed8
xor eax, eax
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
mov dword [ecx + 0xd0], edx
ret
Function at 0x428420
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
movaps xmm1, xmmword [ecx + eax*4 + 8]
lea eax, [ecx + eax*4]
mov ecx, dword [ecx]
add eax, 0x18
push esi
mov esi, dword [ebx + 8]
dec ecx
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
test edx, edx
jne 0x428482
test ecx, ecx
je 0x42846d
nop dword [eax + eax]
aesdec xmm1, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x428460
aesdeclast xmm1, xmmword [eax]
mov eax, dword [ebx + 0xc]
movups xmmword [eax], xmm1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test ecx, ecx
je 0x42849d
nop word [eax + eax]
aesenc xmm1, xmmword [eax]
add eax, 0x10
sub ecx, 1
jne 0x428490
aesenclast xmm1, xmmword [eax]
mov eax, dword [ebx + 0xc]
pop esi
movups xmmword [eax], xmm1
xor eax, eax
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x428630
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shl eax, 4
add eax, edx
movaps xmm0, xmmword [eax]
sub eax, 0x10
movaps xmmword [ecx], xmm0
add ecx, 0x10
cmp eax, edx
jbe 0x428662
nop dword [eax + eax]
aesimc xmm0, xmmword [eax]
sub eax, 0x10
movaps xmmword [ecx], xmm0
lea ecx, [ecx + 0x10]
cmp eax, edx
ja 0x428650
movaps xmm0, xmmword [eax]
movaps xmmword [ecx], xmm0
pop ebp
ret
Function at 0x428670
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmmword [ecx], xmm0
movaps xmm2, xmmword [ecx]
aeskeygenassist xmm0, xmm2, 1
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 2
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movaps xmmword [ecx + 0x10], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movaps xmmword [ecx + 0x20], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movaps xmmword [ecx + 0x30], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movaps xmmword [ecx + 0x40], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movaps xmmword [ecx + 0x50], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movaps xmmword [ecx + 0x60], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pxor xmm1, xmm0
pslldq xmm2, 4
movaps xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm1
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movaps xmmword [ecx + 0x70], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm2, xmm3
pxor xmm2, xmm1
pslldq xmm3, 4
pxor xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm2
movaps xmmword [ecx + 0x80], xmm2
pslldq xmm2, 4
movaps xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movaps xmm3, xmm2
pxor xmm3, xmm1
pslldq xmm2, 4
pxor xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm0, xmm0, 0xff
pxor xmm0, xmm3
movaps xmmword [ecx + 0x90], xmm3
pslldq xmm3, 4
movaps xmm1, xmm3
pslldq xmm3, 4
pxor xmm1, xmm0
movaps xmm0, xmm3
pxor xmm0, xmm1
pslldq xmm3, 4
pxor xmm0, xmm3
movaps xmmword [ecx + 0xa0], xmm0
ret
Function at 0x428890
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmmword [ecx], xmm0
movq xmm0, qword [edx + 0x10]
movq qword [ecx + 0x10], xmm0
movq xmm2, qword [ecx + 0x10]
movaps xmm1, xmmword [ecx]
aeskeygenassist xmm0, xmm2, 1
pshufd xmm3, xmm0, 0x55
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm2
movups xmmword [ecx + 0x18], xmm3
movaps xmm0, xmm1
movd dword [ecx + 0x28], xmm1
psrldq xmm0, 4
movd dword [ecx + 0x2c], xmm0
aeskeygenassist xmm0, xmm1, 2
pshufd xmm4, xmm0, 0x55
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pshufd xmm2, xmm4, 0xff
pxor xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm1
movups xmmword [ecx + 0x30], xmm4
movaps xmm0, xmm2
movd dword [ecx + 0x40], xmm2
psrldq xmm0, 4
movd dword [ecx + 0x44], xmm0
aeskeygenassist xmm0, xmm2, 4
pshufd xmm3, xmm0, 0x55
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm2
movaps xmm0, xmm1
movd dword [ecx + 0x58], xmm1
psrldq xmm0, 4
movd dword [ecx + 0x5c], xmm0
movups xmmword [ecx + 0x48], xmm3
aeskeygenassist xmm0, xmm1, 8
pshufd xmm4, xmm0, 0x55
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pshufd xmm2, xmm4, 0xff
pxor xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm1
movaps xmm0, xmm2
movd dword [ecx + 0x70], xmm2
psrldq xmm0, 4
movd dword [ecx + 0x74], xmm0
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm3, xmm0, 0x55
movups xmmword [ecx + 0x60], xmm4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pslldq xmm4, 4
pxor xmm3, xmm4
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm2
movups xmmword [ecx + 0x78], xmm3
movaps xmm0, xmm1
movd dword [ecx + 0x88], xmm1
psrldq xmm0, 4
movd dword [ecx + 0x8c], xmm0
aeskeygenassist xmm0, xmm1, 0x20
pshufd xmm4, xmm0, 0x55
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pslldq xmm3, 4
pxor xmm4, xmm3
pshufd xmm2, xmm4, 0xff
pxor xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm1
movaps xmm0, xmm2
movd dword [ecx + 0xa0], xmm2
psrldq xmm0, 4
movd dword [ecx + 0xa4], xmm0
movups xmmword [ecx + 0x90], xmm4
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm5, xmm0, 0x55
pxor xmm5, xmm4
pslldq xmm4, 4
pxor xmm5, xmm4
pslldq xmm4, 4
pxor xmm5, xmm4
pslldq xmm4, 4
pxor xmm5, xmm4
pshufd xmm3, xmm5, 0xff
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
movaps xmm0, xmm3
movd dword [ecx + 0xb8], xmm3
psrldq xmm0, 4
movd dword [ecx + 0xbc], xmm0
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0x55
movups xmmword [ecx + 0xa8], xmm5
pxor xmm1, xmm5
pslldq xmm5, 4
pxor xmm1, xmm5
pslldq xmm5, 4
pxor xmm1, xmm5
pslldq xmm5, 4
pxor xmm1, xmm5
pshufd xmm0, xmm1, 0xff
pxor xmm0, xmm3
pslldq xmm3, 4
pxor xmm0, xmm3
movd dword [ecx + 0xd0], xmm0
psrldq xmm0, 4
movups xmmword [ecx + 0xc0], xmm1
movd dword [ecx + 0xd4], xmm0
ret
Function at 0x428f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
mov edx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 8], eax
mov eax, esi
mov dword [ebp - 0x14], edx
sub ecx, eax
push edi
mov edx, 4
mov dword [ebp - 4], ecx
xor edi, edi
sub ebx, eax
sub edx, eax
nop word [eax + eax]
mov eax, dword [ebx + esi]
lea esi, [esi + 4]
xor eax, dword [esi - 4]
add edi, 4
mov dword [ecx + esi - 4], eax
lea eax, [edx + esi]
cmp eax, 8
jbe 0x428f90
mov edx, 8
mov eax, edx
sub eax, edi
mov dword [ebp - 0x18], eax
cmp edi, edx
jae 0x429072
cmp eax, 0x20
jb 0x429052
mov eax, dword [ebp - 0x14]
lea esi, [edi + eax]
lea ecx, [eax + 7]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
lea ecx, [edi + eax]
add eax, 7
cmp esi, eax
ja 0x428fe6
cmp dword [ebp - 0xc], ecx
jae 0x42904d
mov esi, dword [ebp - 8]
lea eax, [esi + 7]
cmp dword [ebp - 0x10], eax
ja 0x428ff9
lea eax, [edi + esi]
cmp dword [ebp - 0xc], eax
jae 0x42904d
mov eax, dword [ebp - 0x18]
and eax, 0x1f
sub edx, eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x18], edx
sub esi, dword [ebp - 0x14]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
movups xmm0, xmmword [ecx]
add edi, 0x20
lea ecx, [ecx + 0x20]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx + esi - 0x20], xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [ecx - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, dword [ebp - 0x18]
jb 0x429016
mov edx, 8
jmp 0x429054
mov esi, dword [ebp - 4]
jmp 0x429054
mov esi, ecx
cmp edi, 8
jae 0x429072
mov eax, dword [ebp + 8]
add eax, edi
sub edx, edi
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x429060
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret