joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66d938
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x61], 1
mov dword [esp + 0x68], eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push ecx
mov edx, eax
xor edi, edi
mov dword [esp + 0x80], edi
push 0x3c
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call fcn.00615e1c
mov eax, 0x3c
sub eax, esi
push eax
lea ecx, [esp + esi + 0x38]
push edi
push ecx
call fcn.006135b0
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x38]
call fcn.0041bdd0
mov eax, dword [esp + 0x88]
add esp, 0x20
shr esi, 2
mov dword [eax + esi*4], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
mov edi, 8
xor ecx, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0xf
xor edx, edx
lea eax, [edi + 5]
mov ebx, 0xf
div ebx
mov eax, edi
mov edi, 0xf
mov esi, dword [esp + 0x68]
mov ebx, edx
xor edx, edx
div edi
mov eax, dword [esi + ebx*4]
mov edi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x14], edi
xor eax, dword [esi + edx*4]
mov edx, dword [esp + 0x10]
add edx, ecx
rol eax, 3
xor eax, edx
xor dword [ecx + esi], eax
add ecx, 4
sub dword [esp + 0x18], 1
jne 0x427c78
mov edi, 4
xor ecx, ecx
xor edx, edx
lea eax, [ecx + 0xe]
mov ebx, 0xf
div ebx
mov esi, dword [esp + 0x68]
inc ecx
mov eax, dword [esi + edx*4]
and eax, 0x1ff
mov edx, dword [eax*4 + 0x6ac100]
add edx, dword [esi + ecx*4 - 4]
rol edx, 9
mov dword [esi + ecx*4 - 4], edx
cmp ecx, ebx
jb 0x427cc3
sub edi, 1
jne 0x427cc1
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov eax, ecx
mov edi, 0xf
div edi
mov edi, dword [esp + 0x68]
mov eax, dword [ebx + 0xbc]
add ecx, 4
add esi, 4
mov edx, dword [edi + edx*4]
mov dword [esi + eax - 4], edx
cmp ecx, 0x28
jb 0x427d01
inc dword [esp + 0x10]
mov dword [esp + 0x1c], esi
cmp esi, 0xa0
jb 0x427c65
mov edi, 0x14
mov eax, dword [ebx + 0xbc]
mov ecx, dword [eax + edi]
add eax, edi
mov dword [esp + 0x1c], eax
mov edx, ecx
or edx, 3
mov esi, edx
not esi
mov eax, edx
shr eax, 1
xor eax, esi
lea ebx, [edx + edx]
xor ebx, esi
and eax, ebx
and eax, 0x7ffffffe
mov esi, eax
shr esi, 1
and eax, esi
mov esi, eax
shr esi, 2
and eax, esi
mov ebx, dword [esp + 0x20]
mov esi, eax
shr esi, 4
and eax, esi
lea esi, [eax + eax]
or eax, esi
and ecx, 3
lea esi, [eax*4]
or eax, esi
mov esi, dword [ecx*4 + 0x6ac524]
mov ecx, dword [esp + 0x1c]
mov cl, byte [ecx - 4]
rol esi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and esi, ecx
and esi, 0x7ffffffc
xor esi, edx
mov edx, dword [ebx + 0xbc]
mov dword [edi + edx], esi
add edi, 8
cmp edi, 0x94
jb 0x427d41
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x24]
cmp edi, eax
jne 0x427de1
mov ecx, dword [esp + 0x64]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42cff0
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x66de38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x42d022
lea ebp, [edi + 4]
jmp 0x42d024
xor ebp, ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0x70dac0
push str.Rounds
mov dword [esp + 0x20], 0x14
call eax
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov ebx, esi
call fcn.0042d550
lea ecx, [edi + 0x14]
lea esi, [ebx + ebx + 4]
push ecx
mov dword [edi + 0x10], ebx
call fcn.0042b5d0
mov ebx, dword [esp + 0x3c]
lea eax, [ebx + 3]
shr eax, 2
mov dword [esp + 0x3c], eax
cmp eax, 1
mov dword [esp + 0x40], 1
lea eax, [esp + 0x40]
jb 0x42d086
lea eax, [esp + 0x3c]
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
call fcn.004142c0
add esp, 4
test ebp, ebp
jne 0x42d0a5
xor eax, eax
mov dword [esp + 0x40], eax
jmp 0x42d0b9
lea edx, [ebp*4]
push edx
call fcn.004199b0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x38]
push ebx
push ecx
lea esi, [ebp*4]
push esi
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], 4
call fcn.00615e1c
mov edx, dword [esp + 0x50]
sub esi, ebx
push esi
xor esi, esi
add edx, ebx
push esi
push edx
call fcn.006135b0
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
call fcn.0041bdd0
mov ecx, dword [edi + 0x1c]
mov eax, 1
add esp, 0x20
mov dword [ecx], 0xb7e15163
cmp dword [edi + 0x18], eax
jbe 0x42d137
jmp 0x42d120
mov edx, dword [edi + 0x1c]
lea ecx, [edx + eax*4]
mov edx, dword [ecx - 4]
sub edx, 0x61c88647
inc eax
mov dword [ecx], edx
cmp eax, dword [edi + 0x18]
jb 0x42d120
mov eax, dword [edi + 0x18]
xor ebx, ebx
mov dword [esp + 0x38], eax
cmp eax, ebp
mov dword [esp + 0x3c], esi
lea eax, [esp + 0x14]
jb 0x42d150
lea eax, [esp + 0x38]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov dword [esp + 0x38], eax
test eax, eax
jbe 0x42d1aa
lea ecx, [ecx]
xor edx, edx
mov eax, esi
div dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
add eax, dword [esp + 0x3c]
xor edx, edx
add eax, ebx
rol eax, 3
mov dword [ecx], eax
mov ebx, eax
mov eax, esi
div ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
inc esi
lea ebp, [ecx + edx*4]
mov cl, bl
add cl, al
add eax, ebx
add eax, dword [ebp]
rol eax, cl
mov dword [ebp], eax
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
cmp esi, dword [esp + 0x38]
jb 0x42d160
mov edx, dword [esp + 0x40]
mov edi, edx
xor eax, eax
mov ecx, ebp
push edx
rep stosd dword es:[edi], eax
call fcn.00618e4e
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x42d2e0
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x66de38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x42d312
lea ebp, [edi + 4]
jmp 0x42d314
xor ebp, ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0x70dac0
push str.Rounds
mov dword [esp + 0x20], 0x10
call eax
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov ebx, esi
call fcn.0042d550
lea ecx, [edi + 0x14]
lea esi, [ebx + ebx + 2]
push ecx
mov dword [edi + 0x10], ebx
call fcn.0042b5d0
mov ebx, dword [esp + 0x3c]
lea eax, [ebx + 3]
shr eax, 2
mov dword [esp + 0x3c], eax
cmp eax, 1
mov dword [esp + 0x40], 1
lea eax, [esp + 0x40]
jb 0x42d376
lea eax, [esp + 0x3c]
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
call fcn.004142c0
add esp, 4
test ebp, ebp
jne 0x42d395
xor eax, eax
mov dword [esp + 0x40], eax
jmp 0x42d3a9
lea edx, [ebp*4]
push edx
call fcn.004199b0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x38]
push ebx
push ecx
lea esi, [ebp*4]
push esi
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], 4
call fcn.00615e1c
mov edx, dword [esp + 0x50]
sub esi, ebx
push esi
xor esi, esi
add edx, ebx
push esi
push edx
call fcn.006135b0
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
call fcn.0041bdd0
mov ecx, dword [edi + 0x1c]
mov eax, 1
add esp, 0x20
mov dword [ecx], 0xb7e15163
cmp dword [edi + 0x18], eax
jbe 0x42d427
jmp 0x42d410
mov edx, dword [edi + 0x1c]
lea ecx, [edx + eax*4]
mov edx, dword [ecx - 4]
sub edx, 0x61c88647
inc eax
mov dword [ecx], edx
cmp eax, dword [edi + 0x18]
jb 0x42d410
mov eax, dword [edi + 0x18]
xor ebx, ebx
mov dword [esp + 0x38], eax
cmp eax, ebp
mov dword [esp + 0x3c], esi
lea eax, [esp + 0x14]
jb 0x42d440
lea eax, [esp + 0x38]
mov eax, dword [eax]
lea eax, [eax + eax*2]
mov dword [esp + 0x38], eax
test eax, eax
jbe 0x42d49a
lea ecx, [ecx]
xor edx, edx
mov eax, esi
div dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
add eax, dword [esp + 0x3c]
xor edx, edx
add eax, ebx
rol eax, 3
mov dword [ecx], eax
mov ebx, eax
mov eax, esi
div ebp
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
inc esi
lea ebp, [ecx + edx*4]
mov cl, bl
add cl, al
add eax, ebx
add eax, dword [ebp]
rol eax, cl
mov dword [ebp], eax
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
cmp esi, dword [esp + 0x38]
jb 0x42d450
mov edx, dword [esp + 0x40]
mov edi, edx
xor eax, eax
mov ecx, ebp
push edx
rep stosd dword es:[edi], eax
call fcn.00618e4e
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x42e770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66e94b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x78]
xor ebx, ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x6c], 4
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov eax, dword [esp + 0x74]
mov byte [esp + 0x6c], 6
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 0x54], eax
cmp byte [esp + 0x80], bl
jne 0x42e845
push ebx
push 0x70f248
push 0x70ea28
push ebx
push eax
call fcn.00619cf3
add esp, 0x14
test eax, eax
je 0x42e845
push 0x87
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00417040
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x74], 7
call fcn.004176d0
push 0x6d946c
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], vtable.CryptoPP::InvalidArgument.0
call fcn.006143ad
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.BlockPaddingScheme
call fcn.0042f620
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x70], 8
call fcn.0042df40
mov byte [esp + 0x6c], 6
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x42e87e
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x64
ret 0x10
Function at 0x42f0c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x66e169
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], 2
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov byte [esp + 0x18], 4
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 0x24], eax
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00417560
mov eax, dword [esp + 0x34]
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 5
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00417560
mov eax, dword [esp + 0x2c]
cmp eax, ebx
mov byte [esp + 0x18], 6
jge 0x42f175
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x42f190
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
jmp 0x42f197
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x18

Function at 0x42f620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66ddb1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.0042f6c0
push eax
mov ecx, esi
call fcn.0042d720
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], 1
test ecx, ecx
je 0x42f6a2
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x42f990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66da28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
push str.:_Nonblocking_input_is_not_implemented_by_this_object.
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00416f00
add esp, 0xc
push eax
push 0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004176d0
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x42f9f6
mov edx, dword [esp + 8]
push edx
call fcn.00613a18
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BufferedTransformation::BlockingInputOnly.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 4
Function at 0x437b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66e8f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x70d8b0
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00613e6e
mov esp, ebp
pop ebp
ret 8

Function at 0x437c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66e8c0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x70d8b0
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00613e6e
mov esp, ebp
pop ebp
ret 8
Function at 0x43ebe0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x43ebf0
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x756b80], edx
mov dword [esi*8 + 0x756b84], eax
inc esi
cmp esi, 0x100
jl 0x43ebf0
mov dword [0x757388], edi
mov dword [0x75738c], edi
mov dword [0x757380], edi
mov dword [0x757384], edi
pop edi
pop esi
mov byte [0x7573a0], 1
pop ebx
ret

Function at 0x43ec70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x6a8dc0]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x756378], edx
mov dword [eax*8 + 0x75637c], ebp
inc eax
cmp eax, 0x100
mov dword [esp + 0x18], eax
jl 0x43ec80
pop edi
pop esi
pop ebp
mov byte [0x7573a1], 1
pop ebx
add esp, 0x10
ret
Function at 0x4403a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [eax]
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm1, xmmword [edi]
lea edx, [esi - 1]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x440407
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
jmp 0x4403e0
movdqa xmm1, xmmword [ecx]
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx + 0x10]
add ecx, 0x20
sub edx, 1
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x4403e0
movdqa xmm0, xmmword [eax]
shl esi, 4
movdqa xmm1, xmmword [esi + edi - 0x10]
lea ecx, [esi + edi]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x440440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x4404e6
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
sub ebx, 1
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x4404a0
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
shl ebx, 4
movdqa xmm0, xmmword [ebx + edi]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e100
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jbe 0x44e11e
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00452160
add esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x14]
jae 0x44e16b
mov edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x44e140
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret