joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69d2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d2fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x69d340
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d35e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x69d3a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d3c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x69d410
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d432
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x69d480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d4aa
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x69d510
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d53a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x69d5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x69d5ef

Function at 0x69d5fe
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d5e0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x69d670
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x69d6bf

Function at 0x69d6ce
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69d6b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x6a01b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0069fc60
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x6a0219
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x6a01e2
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x6a33f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
test esi, esi
sete al
mov ebp, edx
test edx, edx
sete dl
or dl, al
jne 0x6a342b
movzx eax, byte [esi]
test byte [ecx + 5], 1
jne 0x6a3443
shr al, 7
xor ecx, ecx
mov ebx, eax
mov edx, ebp
jmp 0x6a3504
mov eax, 1
xor edx, edx
xor ebx, ebx
xor ecx, ecx
test edi, edi
jne 0x6a3512
jmp 0x6a35a7
mov cl, 0xff
mov bl, 1
cmp al, 0x80
mov edx, ebp
ja 0x6a3504
xor ebx, ebx
neg al
jno 0x6a3504
cmp edx, 2
jb 0x6a3500
mov eax, 1
cmp edx, 9
jb 0x6a34f0
lea ecx, [edx - 1]
mov edi, ecx
and edi, 0xfffffff8
lea eax, [edi + 1]
pxor xmm1, xmm1
mov edx, esi
xor esi, esi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax]
movd xmm3, dword [edx + esi + 1]
movd xmm4, dword [edx + esi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add esi, 8
cmp edi, esi
jne 0x6a3490
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd ebx, xmm0
cmp ecx, edi
mov esi, edx
mov edx, ebp
mov edi, dword [esp + 0x20]
je 0x6a34fb
nop word cs:[eax + eax]
movzx ecx, byte [esi + eax]
or ebx, ecx
inc eax
cmp edx, eax
jne 0x6a34f0
test ebx, ebx
setne bl
mov ecx, ebx
neg cl
movzx ebx, bl
lea eax, [edx + ebx]
test edi, edi
je 0x6a35a7
mov edi, dword [edi]
test edi, edi
je 0x6a35a7
mov dword [esp + 4], eax
mov byte [edi], cl
test edx, edx
je 0x6a359d
add edi, ebx
add esi, edx
add edi, edx
mov dword [esp], edx
mov edx, ecx
and dl, 1
movzx ebx, dl
mov edx, dword [esp]
test dl, 1
mov ebp, esi
jne 0x6a354a
mov eax, edx
cmp edx, 1
jne 0x6a3568
jmp 0x6a359d
lea eax, [edx - 1]
movzx edx, byte [ebp - 1]
xor dl, cl
dec ebp
movzx edx, dl
add ebx, edx
mov edx, dword [esp]
mov byte [edi - 1], bl
dec edi
shr ebx, 8
cmp edx, 1
je 0x6a359d
neg eax
xor esi, esi
nop dword [eax]
movzx edx, byte [ebp + esi - 1]
xor dl, cl
movzx edx, dl
add edx, ebx
mov byte [edi + esi - 1], dl
shr edx, 8
movzx ebx, byte [ebp + esi - 2]
xor bl, cl
movzx ebx, bl
add ebx, edx
mov byte [edi + esi - 2], bl
shr ebx, 8
add esi, 0xfffffffe
cmp eax, esi
jne 0x6a3570
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 4]
add dword [ecx], eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6a36a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6a36e1
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
mov edi, ebx
and edi, 0xffffff80
test edx, edx
je 0x6a36c1
mov dword [edx], edi
mov dword [esp], edi
cmp eax, 1
jne 0x6a3718
mov eax, 1
test ecx, ecx
je 0x6a3710
movzx edx, byte [esi]
cmp byte [esp], 0
je 0x6a36dd
neg dl
mov byte [ecx], dl
jmp 0x6a3710
call fcn.005b7120
push str.c2i_ibuf
push 0xa0
push str.crypto_asn1_a_int.c
call fcn.005b7220
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.005b7310
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edx, byte [esi]
test edx, edx
je 0x6a37bf
cmp edx, 0xff
jne 0x6a37fa
cmp eax, 9
jae 0x6a373d
xor edi, edi
mov edx, 1
jmp 0x6a37b0
lea ebp, [eax - 1]
mov dword [esp + 4], ebp
and ebp, 0xfffffff8
lea edx, [ebp + 1]
pxor xmm1, xmm1
xor edi, edi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [esi + edi + 1]
movd xmm4, dword [esi + edi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add edi, 8
cmp ebp, edi
jne 0x6a3760
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp + 4], ebp
je 0x6a37bb
nop dword [eax + eax]
movzx ebp, byte [esi + edx]
or edi, ebp
inc edx
cmp eax, edx
jne 0x6a37b0
test edi, edi
je 0x6a37fa
mov edi, eax
movzx edx, byte [esi + 1]
and dl, 0x80
cmp byte [esp], dl
mov eax, 0xffffffff
jne 0x6a37fe
call fcn.005b7120
push str.c2i_ibuf
push 0xc1
push str.crypto_asn1_a_int.c
call fcn.005b7220
add esp, 0xc
push 0
push 0xdd
jmp 0x6a3704
mov edi, eax
xor eax, eax
add eax, edi
test ecx, ecx
je 0x6a3710
test eax, eax
je 0x6a370e
mov dh, bl
sar dh, 7
add esi, edi
add ecx, eax
shr ebx, 7
test al, 1
mov byte [esp], dh
jne 0x6a3830
mov edi, eax
cmp eax, 1
je 0x6a3710
jmp 0x6a384e
lea edi, [eax - 1]
mov dl, byte [esi - 1]
xor dl, dh
dec esi
movzx edx, dl
add ebx, edx
mov byte [ecx - 1], bl
dec ecx
shr ebx, 8
cmp eax, 1
je 0x6a3710
mov dword [esp + 4], eax
neg edi
xor ebp, ebp
movzx eax, byte [esp]
nop word [eax + eax]
movzx edx, byte [esi + ebp - 1]
xor dl, al
movzx edx, dl
add edx, ebx
mov byte [ecx + ebp - 1], dl
shr edx, 8
mov ah, byte [esi + ebp - 2]
xor ah, al
movzx ebx, ah
add ebx, edx
mov byte [ecx + ebp - 2], bl
shr ebx, 8
add ebp, 0xfffffffe
cmp edi, ebp
jne 0x6a3860
mov eax, dword [esp + 4]
jmp 0x6a3710
Function at 0x6a4490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea edi, [ecx - 1]
xor edx, edx
mov esi, ebx
nop word [eax + eax]
mov ecx, eax
mov byte [esp + edx + 0xf], al
mov ebp, ebx
shld ebp, eax, 0x18
shr esi, 8
dec edx
mov dword [esp + 0x14], edx
inc edi
mov edx, edi
mov edi, 0xff
cmp edi, eax
mov edi, edx
mov edx, dword [esp + 0x14]
mov eax, 0
sbb eax, ebx
mov eax, ebp
mov ebx, esi
jb 0x6a44b0
test edx, edx
je 0x6a45b6
mov eax, edx
neg eax
mov dword [esp + 4], eax
mov esi, edx
not esi
cmp dword [esp + 0x38], 0
je 0x6a45cf
mov bl, 0xff
mov al, 1
cmp cl, 0x80
ja 0x6a45d6
xor eax, eax
neg cl
jno 0x6a45d6
cmp dword [esp + 4], 2
jb 0x6a45b0
mov ebx, 1
cmp esi, 8
jb 0x6a4597
lea eax, [esp + edx]
add eax, 0x15
mov ebp, esi
and ebp, 0xfffffff8
lea ebx, [ebp + 1]
pxor xmm1, xmm1
mov ecx, ebp
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [eax - 4]
movd xmm4, dword [eax]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add eax, 8
add ecx, 0xfffffff8
jne 0x6a4550
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd eax, xmm0
cmp esi, ebp
je 0x6a45ab
lea ecx, [ebx + edx]
dec ecx
add ebx, edx
nop dword [eax]
movzx ebp, byte [esp + ecx + 0x11]
or eax, ebp
inc ecx
inc ebx
jne 0x6a45a0
test eax, eax
setne al
mov ebx, eax
neg bl
jmp 0x6a45d6
mov ecx, 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6a4670
mov byte [eax], 0
jmp 0x6a4670
shr cl, 7
xor ebx, ebx
mov eax, ecx
movzx eax, al
mov ecx, eax
sub ecx, edx
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x6a4670
mov dword [esp], ecx
mov byte [ebp], bl
mov dword [esp + 0x10], eax
add ebp, eax
mov ecx, ebx
and cl, 1
movzx ecx, cl
mov eax, dword [esp + 4]
test al, 1
jne 0x6a4614
lea edi, [esp + 0x10]
sub ebp, edx
mov esi, eax
cmp edx, 0xffffffff
jne 0x6a4635
jmp 0x6a466d
movzx eax, byte [esp + 0xf]
xor al, bl
movzx eax, al
add ecx, eax
mov eax, dword [esp + 0x10]
mov byte [edi + eax], cl
lea edi, [esp + 0xf]
add ebp, esi
shr ecx, 8
cmp edx, 0xffffffff
je 0x6a466d
neg esi
xor edx, edx
nop dword [eax]
movzx eax, byte [edi + edx - 1]
xor al, bl
movzx eax, al
add eax, ecx
mov byte [ebp + edx - 1], al
shr eax, 8
movzx ecx, byte [edi + edx - 2]
xor cl, bl
movzx ecx, cl
add ecx, eax
mov byte [ebp + edx - 2], cl
shr ecx, 8
add edx, 0xfffffffe
cmp esi, edx
jne 0x6a4640
mov ecx, dword [esp]
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6aa880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6aa95f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6aa8f5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006aa040
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6aa8bf
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6aaa16
call 0x6aa907
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6aa9b7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006aa460
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6aa96c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6aaa16
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006aa460
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6aaa14
jmp 0x6aaa16
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6aac00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [eax]
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx ecx, byte [edx + 2]
movzx esi, byte [edx + 3]
mov dword [esp + 0x18], esi
movzx esi, byte [edx + 4]
mov dword [esp + 0x14], esi
movzx ebx, byte [edx + 5]
movzx esi, byte [edx + 6]
mov dword [esp + 0x10], esi
movzx edx, byte [edx + 7]
mov byte [esp], al
mov esi, eax
mov eax, ebp
mov byte [esp + 1], al
shl esi, 0x18
shl ebp, 0x10
or ebp, esi
mov byte [esp + 2], cl
shl ecx, 8
or ecx, ebp
mov eax, dword [esp + 0x18]
or ecx, eax
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
mov esi, eax
mov byte [esp + 5], bl
shl esi, 0x18
shl ebx, 0x10
or ebx, esi
mov eax, dword [esp + 0x10]
mov byte [esp + 6], al
shl eax, 8
or eax, ebx
or eax, edx
mov byte [esp + 7], dl
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 0
je 0x6aad2f
xor ebp, ebp
xor ebx, ebx
jmp 0x6aaccd
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x30]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x34]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x38], ebp
je 0x6aacfc
test edi, edi
jne 0x6aacb0
push dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
call fcn.006aa040
add esp, 8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
bswap edx
mov dword [esp], edx
mov edx, eax
bswap edx
mov dword [esp + 4], edx
inc ebx
jmp 0x6aacb0
test ebx, ebx
je 0x6aad2f
mov edx, ecx
shr edx, 0x18
mov esi, dword [esp + 0x40]
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov byte [esi + 2], ch
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov byte [esi + 6], ah
mov byte [esi + 7], al
mov eax, dword [esp + 0x44]
mov dword [eax], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6aad40
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push 0x1048
push 0xa4aca0
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
cmp esi, 0x48
mov eax, 0x48
cmovl eax, esi
add eax, edi
xor ecx, ecx
mov edx, edi
jmp 0x6aadab
movzx edx, byte [edx]
movzx ebx, byte [ebx]
shl edx, 0x10
shl ebx, 8
or ebx, edx
movzx edx, byte [ebp]
or edx, ebx
shl edx, 8
movzx edi, byte [edi]
or edi, edx
mov ebx, dword [esp + 0x1c]
xor dword [ebx + ecx*4], edi
inc ecx
mov edx, esi
cmp ecx, 0x12
je 0x6aadf7
lea ebx, [edx + 1]
cmp ebx, eax
jae 0x6aadd0
lea ebp, [ebx + 1]
cmp ebp, eax
jae 0x6aaddb
lea edi, [ebp + 1]
cmp edi, eax
jae 0x6aade6
lea esi, [edi + 1]
cmp esi, eax
jb 0x6aad80
jmp 0x6aadf1
mov ebx, dword [esp + 0x24]
lea ebp, [ebx + 1]
cmp ebp, eax
jb 0x6aadb9
mov ebp, dword [esp + 0x24]
lea edi, [ebp + 1]
cmp edi, eax
jb 0x6aadc0
mov edi, dword [esp + 0x24]
lea esi, [edi + 1]
cmp esi, eax
jb 0x6aad80
mov esi, dword [esp + 0x24]
jmp 0x6aad80
mov dword [esp], 0
mov dword [esp + 4], 0
mov edi, esp
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 8], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x10], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x18], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x20], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x28], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x30], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x38], xmm0
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x40], xmm0
mov esi, 0xfffffffe
push ebx
push edi
call fcn.006aa040
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + esi*4 + 0x50], xmm0
add esi, 2
cmp esi, 0x3fe
jb 0x6aaec0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b39b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [eax]
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx ecx, byte [edx + 2]
movzx esi, byte [edx + 3]
mov dword [esp + 0x18], esi
movzx esi, byte [edx + 4]
mov dword [esp + 0x14], esi
movzx ebx, byte [edx + 5]
movzx esi, byte [edx + 6]
mov dword [esp + 0x10], esi
movzx edx, byte [edx + 7]
mov byte [esp], al
mov esi, eax
mov eax, ebp
mov byte [esp + 1], al
shl esi, 0x18
shl ebp, 0x10
or ebp, esi
mov byte [esp + 2], cl
shl ecx, 8
or ecx, ebp
mov eax, dword [esp + 0x18]
or ecx, eax
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
mov esi, eax
mov byte [esp + 5], bl
shl esi, 0x18
shl ebx, 0x10
or ebx, esi
mov eax, dword [esp + 0x10]
mov byte [esp + 6], al
shl eax, 8
or eax, ebx
or eax, edx
mov byte [esp + 7], dl
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 0
je 0x6b3adf
xor ebp, ebp
xor ebx, ebx
jmp 0x6b3a7d
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x30]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x34]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x38], ebp
je 0x6b3aac
test edi, edi
jne 0x6b3a60
push dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
call fcn.006b4800
add esp, 8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
bswap edx
mov dword [esp], edx
mov edx, eax
bswap edx
mov dword [esp + 4], edx
inc ebx
jmp 0x6b3a60
test ebx, ebx
je 0x6b3adf
mov edx, ecx
shr edx, 0x18
mov esi, dword [esp + 0x40]
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov byte [esi + 2], ch
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov byte [esi + 6], ah
mov byte [esi + 7], al
mov eax, dword [esp + 0x44]
mov dword [eax], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret