joyce8/EMBER2024-capa huggingface dataset:
Function at 0x698110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xdc
mov ebp, dword [esp + 0x100]
xor eax, eax
cmp edx, ebp
jb 0x698365
cmp ebp, 0x40
ja 0x698365
test ebp, ebp
je 0x698183
mov eax, dword [esp + 0xfc]
mov esi, dword [esp + 0xf8]
mov edi, dword [esp + 0xf4]
mov ebx, dword [ecx]
mov dword [esp + 4], ebx
sub ebx, ebp
mov dword [ecx], ebx
mov ecx, dword [esp + 0xf0]
cmp eax, 1
jne 0x698195
test edi, edi
je 0x69816b
add ecx, ebx
mov dword [edi], ecx
mov eax, 1
test esi, esi
je 0x698365
mov dword [esi], 0
jmp 0x698365
xor eax, eax
cmp dword [esp + 0x104], 0
setne al
jmp 0x698365
mov dword [esp], edx
lea eax, [esp + 0x1c]
push 0
push ebp
push eax
push dword [esp + 0x114]
call fcn.00604150
add esp, 0x10
test eax, eax
jle 0x698363
test edi, edi
je 0x698363
test esi, esi
je 0x698363
push 0xf5
push str.ssl_record_methods_tls_pad.c
push ebp
call fcn.005db3a0
add esp, 0xc
mov ecx, eax
mov dword [edi], eax
test eax, eax
mov eax, 0
je 0x698365
mov dword [esp + 0x18], ecx
mov dword [esi], 1
lea eax, [esp + 0x5c]
neg eax
and eax, 0x3f
add eax, esp
add eax, 0x5c
mov edi, ebp
or edi, 0x100
xor ecx, ecx
mov esi, dword [esp]
mov dword [esp + 0x14], ebx
mov ebx, esi
sub ebx, edi
cmovb ebx, ecx
push ebp
push 0
mov dword [esp + 0x14], eax
push eax
call fcn.00786b68
add esp, 0xc
mov edx, 0
cmp ebx, esi
jae 0x6982c3
cmp esi, edi
cmovb edi, esi
mov eax, dword [esp + 4]
neg eax
mov dword [esp + 0x10], eax
xor ecx, ecx
xor edx, edx
xor esi, esi
nop dword [eax]
mov dword [esp + 8], esi
mov dword [esp], edi
mov esi, ebx
xor esi, dword [esp + 0x14]
mov edi, esi
not edi
dec esi
and esi, edi
mov edi, ebx
mov eax, dword [esp + 4]
xor edi, eax
mov ebp, dword [esp + 0x10]
add ebp, ebx
xor ebp, eax
or ebp, edi
sar esi, 0x1f
xor ebp, ebx
or ecx, esi
sar ebp, 0x1f
and ecx, ebp
mov ebp, dword [esp + 8]
and esi, ebp
mov eax, dword [esp + 0xf0]
movzx eax, byte [eax + ebx]
and al, cl
mov edi, dword [esp + 0xc]
or byte [edi + ebp], al
mov edi, ebp
mov ebp, dword [esp + 0x100]
or edx, esi
lea eax, [edi + 1]
mov esi, 0xfffffffe
sub esi, edi
mov edi, eax
sub edi, ebp
and esi, edi
mov edi, dword [esp]
sar esi, 0x1f
and esi, eax
inc ebx
dec edi
jne 0x698250
mov eax, dword [esp + 0x104]
movzx eax, al
mov dword [esp], eax
not eax
mov dword [esp + 8], eax
cmp ebp, 1
mov eax, ebp
adc eax, 0
mov dword [esp + 4], eax
xor ebp, ebp
nop word cs:[eax + eax]
mov ecx, edx
and ecx, 0xffffffdf
mov eax, edx
or eax, 0x20
test dl, 0x20
mov ebx, 0
mov esi, 0xff
cmove ebx, esi
mov esi, dword [esp + 0xc]
movzx ecx, byte [esi + ecx]
mov edi, ebx
and edi, ecx
movzx eax, byte [esi + eax]
not ebx
and ebx, eax
or ebx, edi
movzx ecx, byte [esp + ebp + 0x1c]
mov edi, dword [esp]
and edi, ebx
mov eax, dword [esp + 8]
and eax, ecx
or eax, edi
lea ebx, [edx + 1]
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp], al
mov eax, 0xfffffffe
sub eax, edx
mov ecx, ebx
sub ecx, dword [esp + 0x100]
and eax, ecx
sar eax, 0x1f
and eax, ebx
inc ebp
mov edx, eax
cmp dword [esp + 4], ebp
jne 0x6982f0
mov eax, 1
jmp 0x698365
xor eax, eax
add esp, 0xdc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x698370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, 1
setne cl
add ecx, esi
mov edi, dword [ebx]
xor eax, eax
cmp ecx, edi
ja 0x6983eb
mov ebp, dword [esp + 0x24]
cmp edx, 1
jne 0x6983d2
cmp dword [esp + 0x20], esi
jb 0x6983eb
cmp esi, 0x40
ja 0x6983eb
mov eax, 1
test esi, esi
je 0x6983eb
sub edi, esi
mov dword [ebx], edi
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x6983c2
add ebp, edi
mov dword [ecx], ebp
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x6983eb
mov dword [ecx], 0
jmp 0x6983eb
movzx edx, byte [ebp + edi - 1]
cmp dword [esp + 0x38], 0
je 0x6983f3
not esi
add edi, esi
sub edi, edx
mov dword [ebx], edi
mov eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add ecx, edx
mov ebx, ecx
xor ebx, edi
mov eax, edi
sub eax, ecx
xor eax, ecx
or eax, ebx
xor eax, edi
not eax
sar eax, 0x1f
cmp edi, 0x100
mov ecx, 0x100
cmovb ecx, edi
test edi, edi
mov dword [esp], edi
je 0x69842f
mov esi, edi
xor edi, edi
cmp esi, 4
jae 0x698436
mov esi, edx
mov ebp, ecx
jmp 0x6984f9
mov esi, edx
jmp 0x69852e
mov edi, ecx
and edi, 0x1fc
movd xmm1, eax
movaps xmm0, xmmword [0x9ad090]
movss xmm0, xmm1
mov dword [esp + 4], edx
movd xmm2, edx
pshufd xmm1, xmm2, 0
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0
lea eax, [esi + ebp]
add eax, 0xfffffffc
mov edx, ecx
mov ebp, ecx
and ebp, 0xfffffffc
neg ebp
movdqa xmm4, xmmword [0x9ad0a0]
xor ecx, ecx
por xmm1, xmmword [0x9ad0b0]
pxor xmm5, xmm5
movdqa xmm7, xmmword [0x9ad0c0]
movdqa xmm3, xmm4
pxor xmm3, xmmword [0x9ad0b0]
pcmpgtd xmm3, xmm1
movd xmm6, dword [eax + ecx]
punpcklbw xmm6, xmm5
pshuflw xmm6, xmm6, 0x1b
packuswb xmm6, xmm6
pxor xmm6, xmm2
punpcklbw xmm6, xmm5
punpcklwd xmm6, xmm5
pxor xmm6, xmmword [0x9ad0d0]
por xmm6, xmm3
pand xmm0, xmm6
paddd xmm4, xmm7
add ecx, 0xfffffffc
cmp ebp, ecx
jne 0x698490
pshufd xmm1, xmm0, 0xee
pand xmm1, xmm0
pshufd xmm0, xmm1, 0x55
pand xmm0, xmm1
movd eax, xmm0
mov ebp, edx
cmp edx, edi
mov esi, dword [esp + 4]
je 0x69852e
mov ecx, edi
not ecx
add ecx, dword [esp]
add ecx, dword [esp + 0x24]
nop word cs:[eax + eax]
movzx edx, byte [ecx]
mov ebx, esi
xor dl, bl
cmp edi, esi
movzx edx, dl
not edx
mov ebx, 0xffffffff
cmova edx, ebx
and eax, edx
inc edi
dec ecx
cmp ebp, edi
jne 0x698510
xor ecx, ecx
xor ebx, ebx
cmp al, 0xff
not esi
cmovne esi, ecx
sete bl
neg ebx
add esi, dword [esp]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
mov edx, dword [esp + 0x20]
push dword [esp + 0x3c]
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.00698110
add esp, 0x24
jmp 0x6983ee
Function at 0x698af0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x698b10
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x69bce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bcfe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x69bd40
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bd5e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x69bda0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bdc2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x69be10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69be32
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x69be80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69beaa
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x69bf10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bf3a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x69bfa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x69bfef

Function at 0x69bffe
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bfe0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x69c070
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x69c0bf

Function at 0x69c0ce
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69c0b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x69ebb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0069e660
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x69ec19
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x69ebe2
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret
Function at 0x6a1df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
test esi, esi
sete al
mov ebp, edx
test edx, edx
sete dl
or dl, al
jne 0x6a1e2b
movzx eax, byte [esi]
test byte [ecx + 5], 1
jne 0x6a1e43
shr al, 7
xor ecx, ecx
mov ebx, eax
mov edx, ebp
jmp 0x6a1f04
mov eax, 1
xor edx, edx
xor ebx, ebx
xor ecx, ecx
test edi, edi
jne 0x6a1f12
jmp 0x6a1fa7
mov cl, 0xff
mov bl, 1
cmp al, 0x80
mov edx, ebp
ja 0x6a1f04
xor ebx, ebx
neg al
jno 0x6a1f04
cmp edx, 2
jb 0x6a1f00
mov eax, 1
cmp edx, 9
jb 0x6a1ef0
lea ecx, [edx - 1]
mov edi, ecx
and edi, 0xfffffff8
lea eax, [edi + 1]
pxor xmm1, xmm1
mov edx, esi
xor esi, esi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax]
movd xmm3, dword [edx + esi + 1]
movd xmm4, dword [edx + esi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add esi, 8
cmp edi, esi
jne 0x6a1e90
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd ebx, xmm0
cmp ecx, edi
mov esi, edx
mov edx, ebp
mov edi, dword [esp + 0x20]
je 0x6a1efb
nop word cs:[eax + eax]
movzx ecx, byte [esi + eax]
or ebx, ecx
inc eax
cmp edx, eax
jne 0x6a1ef0
test ebx, ebx
setne bl
mov ecx, ebx
neg cl
movzx ebx, bl
lea eax, [edx + ebx]
test edi, edi
je 0x6a1fa7
mov edi, dword [edi]
test edi, edi
je 0x6a1fa7
mov dword [esp + 4], eax
mov byte [edi], cl
test edx, edx
je 0x6a1f9d
add edi, ebx
add esi, edx
add edi, edx
mov dword [esp], edx
mov edx, ecx
and dl, 1
movzx ebx, dl
mov edx, dword [esp]
test dl, 1
mov ebp, esi
jne 0x6a1f4a
mov eax, edx
cmp edx, 1
jne 0x6a1f68
jmp 0x6a1f9d
lea eax, [edx - 1]
movzx edx, byte [ebp - 1]
xor dl, cl
dec ebp
movzx edx, dl
add ebx, edx
mov edx, dword [esp]
mov byte [edi - 1], bl
dec edi
shr ebx, 8
cmp edx, 1
je 0x6a1f9d
neg eax
xor esi, esi
nop dword [eax]
movzx edx, byte [ebp + esi - 1]
xor dl, cl
movzx edx, dl
add edx, ebx
mov byte [edi + esi - 1], dl
shr edx, 8
movzx ebx, byte [ebp + esi - 2]
xor bl, cl
movzx ebx, bl
add ebx, edx
mov byte [edi + esi - 2], bl
shr ebx, 8
add esi, 0xfffffffe
cmp eax, esi
jne 0x6a1f70
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 4]
add dword [ecx], eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6a20a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6a20e1
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
mov edi, ebx
and edi, 0xffffff80
test edx, edx
je 0x6a20c1
mov dword [edx], edi
mov dword [esp], edi
cmp eax, 1
jne 0x6a2118
mov eax, 1
test ecx, ecx
je 0x6a2110
movzx edx, byte [esi]
cmp byte [esp], 0
je 0x6a20dd
neg dl
mov byte [ecx], dl
jmp 0x6a2110
call fcn.005b5b10
push str.c2i_ibuf
push 0xa0
push str.crypto_asn1_a_int.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.005b5d00
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edx, byte [esi]
test edx, edx
je 0x6a21bf
cmp edx, 0xff
jne 0x6a21fa
cmp eax, 9
jae 0x6a213d
xor edi, edi
mov edx, 1
jmp 0x6a21b0
lea ebp, [eax - 1]
mov dword [esp + 4], ebp
and ebp, 0xfffffff8
lea edx, [ebp + 1]
pxor xmm1, xmm1
xor edi, edi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [esi + edi + 1]
movd xmm4, dword [esi + edi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add edi, 8
cmp ebp, edi
jne 0x6a2160
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp + 4], ebp
je 0x6a21bb
nop dword [eax + eax]
movzx ebp, byte [esi + edx]
or edi, ebp
inc edx
cmp eax, edx
jne 0x6a21b0
test edi, edi
je 0x6a21fa
mov edi, eax
movzx edx, byte [esi + 1]
and dl, 0x80
cmp byte [esp], dl
mov eax, 0xffffffff
jne 0x6a21fe
call fcn.005b5b10
push str.c2i_ibuf
push 0xc1
push str.crypto_asn1_a_int.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0xdd
jmp 0x6a2104
mov edi, eax
xor eax, eax
add eax, edi
test ecx, ecx
je 0x6a2110
test eax, eax
je 0x6a210e
mov dh, bl
sar dh, 7
add esi, edi
add ecx, eax
shr ebx, 7
test al, 1
mov byte [esp], dh
jne 0x6a2230
mov edi, eax
cmp eax, 1
je 0x6a2110
jmp 0x6a224e
lea edi, [eax - 1]
mov dl, byte [esi - 1]
xor dl, dh
dec esi
movzx edx, dl
add ebx, edx
mov byte [ecx - 1], bl
dec ecx
shr ebx, 8
cmp eax, 1
je 0x6a2110
mov dword [esp + 4], eax
neg edi
xor ebp, ebp
movzx eax, byte [esp]
nop word [eax + eax]
movzx edx, byte [esi + ebp - 1]
xor dl, al
movzx edx, dl
add edx, ebx
mov byte [ecx + ebp - 1], dl
shr edx, 8
mov ah, byte [esi + ebp - 2]
xor ah, al
movzx ebx, ah
add ebx, edx
mov byte [ecx + ebp - 2], bl
shr ebx, 8
add ebp, 0xfffffffe
cmp edi, ebp
jne 0x6a2260
mov eax, dword [esp + 4]
jmp 0x6a2110
Function at 0x6a2e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea edi, [ecx - 1]
xor edx, edx
mov esi, ebx
nop word [eax + eax]
mov ecx, eax
mov byte [esp + edx + 0xf], al
mov ebp, ebx
shld ebp, eax, 0x18
shr esi, 8
dec edx
mov dword [esp + 0x14], edx
inc edi
mov edx, edi
mov edi, 0xff
cmp edi, eax
mov edi, edx
mov edx, dword [esp + 0x14]
mov eax, 0
sbb eax, ebx
mov eax, ebp
mov ebx, esi
jb 0x6a2eb0
test edx, edx
je 0x6a2fb6
mov eax, edx
neg eax
mov dword [esp + 4], eax
mov esi, edx
not esi
cmp dword [esp + 0x38], 0
je 0x6a2fcf
mov bl, 0xff
mov al, 1
cmp cl, 0x80
ja 0x6a2fd6
xor eax, eax
neg cl
jno 0x6a2fd6
cmp dword [esp + 4], 2
jb 0x6a2fb0
mov ebx, 1
cmp esi, 8
jb 0x6a2f97
lea eax, [esp + edx]
add eax, 0x15
mov ebp, esi
and ebp, 0xfffffff8
lea ebx, [ebp + 1]
pxor xmm1, xmm1
mov ecx, ebp
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [eax - 4]
movd xmm4, dword [eax]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add eax, 8
add ecx, 0xfffffff8
jne 0x6a2f50
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd eax, xmm0
cmp esi, ebp
je 0x6a2fab
lea ecx, [ebx + edx]
dec ecx
add ebx, edx
nop dword [eax]
movzx ebp, byte [esp + ecx + 0x11]
or eax, ebp
inc ecx
inc ebx
jne 0x6a2fa0
test eax, eax
setne al
mov ebx, eax
neg bl
jmp 0x6a2fd6
mov ecx, 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6a3070
mov byte [eax], 0
jmp 0x6a3070
shr cl, 7
xor ebx, ebx
mov eax, ecx
movzx eax, al
mov ecx, eax
sub ecx, edx
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x6a3070
mov dword [esp], ecx
mov byte [ebp], bl
mov dword [esp + 0x10], eax
add ebp, eax
mov ecx, ebx
and cl, 1
movzx ecx, cl
mov eax, dword [esp + 4]
test al, 1
jne 0x6a3014
lea edi, [esp + 0x10]
sub ebp, edx
mov esi, eax
cmp edx, 0xffffffff
jne 0x6a3035
jmp 0x6a306d
movzx eax, byte [esp + 0xf]
xor al, bl
movzx eax, al
add ecx, eax
mov eax, dword [esp + 0x10]
mov byte [edi + eax], cl
lea edi, [esp + 0xf]
add ebp, esi
shr ecx, 8
cmp edx, 0xffffffff
je 0x6a306d
neg esi
xor edx, edx
nop dword [eax]
movzx eax, byte [edi + edx - 1]
xor al, bl
movzx eax, al
add eax, ecx
mov byte [ebp + edx - 1], al
shr eax, 8
movzx ecx, byte [edi + edx - 2]
xor cl, bl
movzx ecx, cl
add ecx, eax
mov byte [ebp + edx - 2], cl
shr ecx, 8
add edx, 0xfffffffe
cmp esi, edx
jne 0x6a3040
mov ecx, dword [esp]
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret