joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ea510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5ea5e7
xor eax, eax
nop word cs:[eax + eax]
mov dword [esp], eax
mov ebp, eax
shr ebp, 3
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + ebp]
mov ecx, dword [esp]
mov bh, cl
and bh, 7
mov dl, bh
xor dl, 7
movzx ecx, dl
mov esi, edx
bt eax, ecx
setb bl
shl bl, 7
mov edi, dword [esp + 0x38]
movups xmm0, xmmword [edi]
movups xmmword [esp + 4], xmm0
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x50]
add esp, 0xc
movzx eax, bl
xor bl, byte [edi]
cmp dword [esp + 0x40], 0
movzx ecx, bl
cmove ecx, eax
movdqu xmm2, xmmword [esp + 4]
movdqa xmm0, xmm2
psrldq xmm0, 1
movd xmm1, ecx
pslldq xmm1, 0xf
por xmm1, xmm0
psrlw xmm1, 7
pand xmm1, xmmword [0x9c66c0]
movdqa xmm0, xmm2
paddb xmm0, xmm2
por xmm0, xmm1
movdqu xmmword [edi], xmm0
mov edi, dword [esp + 0x2c]
movzx eax, byte [edi + ebp]
btr eax, esi
and bl, 0x80
movzx edx, bl
mov cl, bh
shr edx, cl
or edx, eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov byte [edi + ebp], dl
inc eax
cmp ecx, eax
jne 0x5ea530
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5ea5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [esp + 0x2c], 0
je 0x5ea6b2
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x3c], 0
lea ebp, [esp + 1]
je 0x5ea661
xor edi, edi
nop dword [eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [ebx]
xor al, byte [esi + edi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + edi], al
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ea620
jmp 0x5ea6b2
xor edi, edi
nop word cs:[eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [esi + edi]
movzx ecx, byte [ebx]
xor cl, al
mov edx, dword [esp + 0x28]
mov byte [edx + edi], cl
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ea670
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ee910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x5eea5b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x5ee971
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push str.crypto_modes_ocb128.c
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.005db4d0
add esp, 0x10
test eax, eax
je 0x5eea6d
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0x9c6740]
movdqa xmm1, xmmword [0x9c6750]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x5ee990
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5eea65
Function at 0x651a30
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
xorps xmm0, xmm0
movsd qword [eax + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0xd0], xmm0
movups xmmword [eax + 0xc0], xmm0
movups xmmword [eax + 0xb0], xmm0
movups xmmword [eax + 0xa0], xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x70], xmm0
movups xmmword [eax + 0x60], xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmm0, xmmword [0x9f53c0]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x9f53d0]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x9f53e0]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [0x9f53f0]
movups xmmword [eax + 0x30], xmm0
movzx edx, byte [ecx]
mov dword [eax + 0xe4], edx
mov edx, 0xf3bcc908
xor edx, dword [ecx]
mov esi, 0x6a09e667
xor esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov dword [eax], edx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov esi, 0xbb67ae85
xor esi, dword [ecx + 0xc]
mov dword [eax + 0xc], esi
mov dword [eax + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov esi, 0x3c6ef372
xor esi, dword [ecx + 0x14]
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov esi, 0xa54ff53a
xor esi, dword [ecx + 0x1c]
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov esi, 0x510e527f
xor esi, dword [ecx + 0x24]
mov dword [eax + 0x24], esi
mov dword [eax + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov esi, 0x9b05688c
xor esi, dword [ecx + 0x2c]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov esi, 0x1f83d9ab
xor esi, dword [ecx + 0x34]
mov dword [eax + 0x34], esi
mov dword [eax + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov esi, 0x5be0cd19
xor esi, dword [ecx + 0x3c]
mov dword [eax + 0x3c], esi
mov dword [eax + 0x38], edx
mov eax, 1
pop esi
ret
Function at 0x651b70
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
xorps xmm0, xmm0
movsd qword [esi + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0xd0], xmm0
movups xmmword [esi + 0xc0], xmm0
movups xmmword [esi + 0xb0], xmm0
movups xmmword [esi + 0xa0], xmm0
movups xmmword [esi + 0x90], xmm0
movups xmmword [esi + 0x80], xmm0
movups xmmword [esi + 0x70], xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmm1, xmmword [0x9f53c0]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0x9f53d0]
movups xmmword [esi + 0x10], xmm1
movups xmm1, xmmword [0x9f53e0]
movups xmmword [esi + 0x20], xmm1
movups xmm1, xmmword [0x9f53f0]
movups xmmword [esi + 0x30], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0xe4], edx
mov ebx, dword [ecx]
mov edx, 0x6a09e667
xor edx, dword [ecx + 4]
movzx edi, bh
xor ebx, 0xf3bcc908
mov dword [esi + 4], edx
mov dword [esi], ebx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov ebx, 0xbb67ae85
xor ebx, dword [ecx + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov ebx, 0x3c6ef372
xor ebx, dword [ecx + 0x14]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov ebx, 0xa54ff53a
xor ebx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov ebx, 0x510e527f
xor ebx, dword [ecx + 0x24]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov ebx, 0x9b05688c
xor ebx, dword [ecx + 0x2c]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov ebx, 0x1f83d9ab
xor ebx, dword [ecx + 0x34]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov ebx, 0x5be0cd19
xor ebx, dword [ecx + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], edx
movups xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x70], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x80], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x90], xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esi + 0xa0], xmm0
movups xmm0, xmmword [esp + 0x50]
movups xmmword [esi + 0xb0], xmm0
movups xmm0, xmmword [esp + 0x60]
movups xmmword [esi + 0xc0], xmm0
movups xmm0, xmmword [esp + 0x70]
movups xmmword [esi + 0xd0], xmm0
mov dword [esi + 0xe0], pe_nt_image_headers32
push pe_nt_image_headers32
push ebx
call fcn.005e8480
add esp, 8
mov eax, 1
add esp, 0x80
pop esi
pop edi
pop ebx
ret
Function at 0x656790
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
xorps xmm0, xmm0
movsd qword [ecx + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x60], xmm0
movups xmmword [ecx + 0x50], xmm0
movups xmmword [ecx + 0x40], xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [0x9f5400]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x9f5410]
movups xmmword [ecx + 0x10], xmm0
movzx edx, byte [eax]
mov dword [ecx + 0x74], edx
mov edx, 0x6a09e667
xor edx, dword [eax]
mov dword [ecx], edx
mov edx, 0xbb67ae85
xor edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [eax + 0x14]
mov dword [ecx + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [eax + 0x18]
mov dword [ecx + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [eax + 0x1c]
mov dword [ecx + 0x1c], edx
mov eax, 1
ret

Function at 0x656830
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
xorps xmm0, xmm0
movsd qword [esi + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmm1, xmmword [0x9f5400]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0x9f5410]
movups xmmword [esi + 0x10], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0x74], edx
mov edx, dword [ecx]
movzx edi, dh
xor edx, 0x6a09e667
mov dword [esi], edx
mov edx, 0xbb67ae85
xor edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [ecx + 8]
mov dword [esi + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [ecx + 0xc]
mov dword [esi + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [ecx + 0x10]
mov dword [esi + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [ecx + 0x14]
mov dword [esi + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [ecx + 0x18]
mov dword [esi + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], edx
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x40], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x50], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0x40
push 0x40
push ebx
call fcn.005e8480
add esp, 8
mov eax, 1
add esp, 0x40
pop esi
pop edi
pop ebx
ret
Function at 0x687a20
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x14]
push 1
push ebx
call fcn.006053c0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.00605690
add esp, 8
test eax, eax
je 0x687aa9
mov edi, eax
sub esp, 0x14
movaps xmm0, xmmword [0xa02050]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x687a84
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x687a86
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00605720
add esp, 0xc
push ebx
call fcn.00605390
add esp, 4
test eax, eax
jne 0x687b2a
push 1
push ebx
call fcn.006053c0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.00605690
add esp, 8
test eax, eax
je 0x687b21
mov edi, eax
mov eax, esp
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x687b00
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x687b02
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00605720
add esp, 0xc
push ebx
call fcn.00605390
add esp, 4
test eax, eax
jne 0x687b2a
push ebx
call fcn.00605390
add esp, 4
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x698110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xdc
mov ebp, dword [esp + 0x100]
xor eax, eax
cmp edx, ebp
jb 0x698365
cmp ebp, 0x40
ja 0x698365
test ebp, ebp
je 0x698183
mov eax, dword [esp + 0xfc]
mov esi, dword [esp + 0xf8]
mov edi, dword [esp + 0xf4]
mov ebx, dword [ecx]
mov dword [esp + 4], ebx
sub ebx, ebp
mov dword [ecx], ebx
mov ecx, dword [esp + 0xf0]
cmp eax, 1
jne 0x698195
test edi, edi
je 0x69816b
add ecx, ebx
mov dword [edi], ecx
mov eax, 1
test esi, esi
je 0x698365
mov dword [esi], 0
jmp 0x698365
xor eax, eax
cmp dword [esp + 0x104], 0
setne al
jmp 0x698365
mov dword [esp], edx
lea eax, [esp + 0x1c]
push 0
push ebp
push eax
push dword [esp + 0x114]
call fcn.00604150
add esp, 0x10
test eax, eax
jle 0x698363
test edi, edi
je 0x698363
test esi, esi
je 0x698363
push 0xf5
push str.ssl_record_methods_tls_pad.c
push ebp
call fcn.005db3a0
add esp, 0xc
mov ecx, eax
mov dword [edi], eax
test eax, eax
mov eax, 0
je 0x698365
mov dword [esp + 0x18], ecx
mov dword [esi], 1
lea eax, [esp + 0x5c]
neg eax
and eax, 0x3f
add eax, esp
add eax, 0x5c
mov edi, ebp
or edi, 0x100
xor ecx, ecx
mov esi, dword [esp]
mov dword [esp + 0x14], ebx
mov ebx, esi
sub ebx, edi
cmovb ebx, ecx
push ebp
push 0
mov dword [esp + 0x14], eax
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edx, 0
cmp ebx, esi
jae 0x6982c3
cmp esi, edi
cmovb edi, esi
mov eax, dword [esp + 4]
neg eax
mov dword [esp + 0x10], eax
xor ecx, ecx
xor edx, edx
xor esi, esi
nop dword [eax]
mov dword [esp + 8], esi
mov dword [esp], edi
mov esi, ebx
xor esi, dword [esp + 0x14]
mov edi, esi
not edi
dec esi
and esi, edi
mov edi, ebx
mov eax, dword [esp + 4]
xor edi, eax
mov ebp, dword [esp + 0x10]
add ebp, ebx
xor ebp, eax
or ebp, edi
sar esi, 0x1f
xor ebp, ebx
or ecx, esi
sar ebp, 0x1f
and ecx, ebp
mov ebp, dword [esp + 8]
and esi, ebp
mov eax, dword [esp + 0xf0]
movzx eax, byte [eax + ebx]
and al, cl
mov edi, dword [esp + 0xc]
or byte [edi + ebp], al
mov edi, ebp
mov ebp, dword [esp + 0x100]
or edx, esi
lea eax, [edi + 1]
mov esi, 0xfffffffe
sub esi, edi
mov edi, eax
sub edi, ebp
and esi, edi
mov edi, dword [esp]
sar esi, 0x1f
and esi, eax
inc ebx
dec edi
jne 0x698250
mov eax, dword [esp + 0x104]
movzx eax, al
mov dword [esp], eax
not eax
mov dword [esp + 8], eax
cmp ebp, 1
mov eax, ebp
adc eax, 0
mov dword [esp + 4], eax
xor ebp, ebp
nop word cs:[eax + eax]
mov ecx, edx
and ecx, 0xffffffdf
mov eax, edx
or eax, 0x20
test dl, 0x20
mov ebx, 0
mov esi, 0xff
cmove ebx, esi
mov esi, dword [esp + 0xc]
movzx ecx, byte [esi + ecx]
mov edi, ebx
and edi, ecx
movzx eax, byte [esi + eax]
not ebx
and ebx, eax
or ebx, edi
movzx ecx, byte [esp + ebp + 0x1c]
mov edi, dword [esp]
and edi, ebx
mov eax, dword [esp + 8]
and eax, ecx
or eax, edi
lea ebx, [edx + 1]
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp], al
mov eax, 0xfffffffe
sub eax, edx
mov ecx, ebx
sub ecx, dword [esp + 0x100]
and eax, ecx
sar eax, 0x1f
and eax, ebx
inc ebp
mov edx, eax
cmp dword [esp + 4], ebp
jne 0x6982f0
mov eax, 1
jmp 0x698365
xor eax, eax
add esp, 0xdc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x698370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, 1
setne cl
add ecx, esi
mov edi, dword [ebx]
xor eax, eax
cmp ecx, edi
ja 0x6983eb
mov ebp, dword [esp + 0x24]
cmp edx, 1
jne 0x6983d2
cmp dword [esp + 0x20], esi
jb 0x6983eb
cmp esi, 0x40
ja 0x6983eb
mov eax, 1
test esi, esi
je 0x6983eb
sub edi, esi
mov dword [ebx], edi
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x6983c2
add ebp, edi
mov dword [ecx], ebp
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x6983eb
mov dword [ecx], 0
jmp 0x6983eb
movzx edx, byte [ebp + edi - 1]
cmp dword [esp + 0x38], 0
je 0x6983f3
not esi
add edi, esi
sub edi, edx
mov dword [ebx], edi
mov eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add ecx, edx
mov ebx, ecx
xor ebx, edi
mov eax, edi
sub eax, ecx
xor eax, ecx
or eax, ebx
xor eax, edi
not eax
sar eax, 0x1f
cmp edi, 0x100
mov ecx, 0x100
cmovb ecx, edi
test edi, edi
mov dword [esp], edi
je 0x69842f
mov esi, edi
xor edi, edi
cmp esi, 4
jae 0x698436
mov esi, edx
mov ebp, ecx
jmp 0x6984f9
mov esi, edx
jmp 0x69852e
mov edi, ecx
and edi, 0x1fc
movd xmm1, eax
movaps xmm0, xmmword [0xa06230]
movss xmm0, xmm1
mov dword [esp + 4], edx
movd xmm2, edx
pshufd xmm1, xmm2, 0
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0
lea eax, [esi + ebp]
add eax, 0xfffffffc
mov edx, ecx
mov ebp, ecx
and ebp, 0xfffffffc
neg ebp
movdqa xmm4, xmmword [0xa06240]
xor ecx, ecx
por xmm1, xmmword [0xa06250]
pxor xmm5, xmm5
movdqa xmm7, xmmword [0xa06260]
movdqa xmm3, xmm4
pxor xmm3, xmmword [0xa06250]
pcmpgtd xmm3, xmm1
movd xmm6, dword [eax + ecx]
punpcklbw xmm6, xmm5
pshuflw xmm6, xmm6, 0x1b
packuswb xmm6, xmm6
pxor xmm6, xmm2
punpcklbw xmm6, xmm5
punpcklwd xmm6, xmm5
pxor xmm6, xmmword [0xa06270]
por xmm6, xmm3
pand xmm0, xmm6
paddd xmm4, xmm7
add ecx, 0xfffffffc
cmp ebp, ecx
jne 0x698490
pshufd xmm1, xmm0, 0xee
pand xmm1, xmm0
pshufd xmm0, xmm1, 0x55
pand xmm0, xmm1
movd eax, xmm0
mov ebp, edx
cmp edx, edi
mov esi, dword [esp + 4]
je 0x69852e
mov ecx, edi
not ecx
add ecx, dword [esp]
add ecx, dword [esp + 0x24]
nop word cs:[eax + eax]
movzx edx, byte [ecx]
mov ebx, esi
xor dl, bl
cmp edi, esi
movzx edx, dl
not edx
mov ebx, 0xffffffff
cmova edx, ebx
and eax, edx
inc edi
dec ecx
cmp ebp, edi
jne 0x698510
xor ecx, ecx
xor ebx, ebx
cmp al, 0xff
not esi
cmovne esi, ecx
sete bl
neg ebx
add esi, dword [esp]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
mov edx, dword [esp + 0x20]
push dword [esp + 0x3c]
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.00698110
add esp, 0x24
jmp 0x6983ee
Function at 0x69bce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne reloc.api_ms_win_crt_string_l1_1_0.dll_memset
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x69bd40
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bd5e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x69bda0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69bdc2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x69be10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69be32
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x69be80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne WSACleanup
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret