joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5479f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.004c03f0
mov dword [ebp - 8], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004ec910
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004eca80
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x547a9c
mov dword [ebp - 0x14], 0
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x547a76
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x547a6a
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
shl eax, 3
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ecaf0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004ec8b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x547aaa
mov eax, dword [ebp - 8]
jmp 0x547b5c
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ec910
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004eca80
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x547b45
mov dword [ebp - 0x18], 0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x547b1f
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x547b13
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x18]
shl ecx, 3
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ecaf0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ec8b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x547b50
mov eax, dword [ebp - 8]
jmp 0x547b5c
mov edx, dword [ebp + 8]
push edx
call fcn.004ec8b0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x550a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.004c03f0
cmp dword [ebp + 0x14], 0
jne 0x550ac8
push 0x9a
push str.crypto_asn1_a_int.c
push 0xde
push 0xe2
push 0xd
call fcn.004e9ee0
add esp, 0x14
xor eax, eax
jmp 0x550bfe
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax]
and ecx, 0x80
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
je 0x550ae5
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
cmp dword [ebp + 0x14], 1
jne 0x550b21
cmp dword [ebp + 8], 0
je 0x550b17
cmp dword [ebp - 8], 0
je 0x550b0d
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
xor edx, 0xff
add edx, 1
mov eax, dword [ebp + 8]
mov byte [eax], dl
jmp 0x550b17
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov eax, 1
jmp 0x550bfe
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
test edx, edx
jne 0x550b3b
mov dword [ebp - 4], 1
jmp 0x550b87
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax]
cmp ecx, 0xff
jne 0x550b87
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 1
jmp 0x550b62
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x14]
jae 0x550b7b
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
or edx, dword [ebp - 4]
mov dword [ebp - 4], edx
jmp 0x550b59
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x550bc1
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 1]
and edx, 0x80
cmp dword [ebp - 8], edx
jne 0x550bc1
push 0xbb
push str.crypto_asn1_a_int.c
push 0xdd
push 0xe2
push 0xd
call fcn.004e9ee0
add esp, 0x14
xor eax, eax
jmp 0x550bfe
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 4]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp - 4]
mov dword [ebp + 0x14], ecx
cmp dword [ebp + 8], 0
je 0x550bfb
mov edx, dword [ebp - 8]
neg edx
sbb edx, edx
and edx, 0xff
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005508f0
add esp, 0x10
mov eax, dword [ebp + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x55aa20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.004c03f0
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [ebp - 7], cl
movzx edx, byte [ebp - 7]
sar edx, 7
mov byte [ebp - 6], dl
mov dword [ebp - 4], 0
jmp 0x55aa57
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov cl, byte [ebp - 5]
mov byte [ebp - 7], cl
mov edx, dword [ebp + 0x10]
sub edx, 1
cmp dword [ebp - 4], edx
jge 0x55aa87
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov cl, byte [eax + 1]
mov byte [ebp - 5], cl
movzx edx, byte [ebp - 5]
sar edx, 7
movzx eax, byte [ebp - 7]
shl eax, 1
or eax, edx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
jmp 0x55aa48
movzx edx, byte [ebp - 7]
shl edx, 1
movzx eax, byte [ebp - 6]
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp + 0x10]
sub eax, 0x10
neg eax
sbb eax, eax
and eax, 0xffffff94
add eax, 0x87
and ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], dl
mov esp, ebp
pop ebp
ret
Function at 0x563010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004c03f0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004c3692
add esp, 0xc
test eax, eax
jg 0x56303d
or eax, 0xffffffff
jmp 0x563186
mov dword [ebp - 4], 0
jmp 0x56304f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x56306f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x56306f
jmp 0x563046
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x563083
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x5630a9
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
test eax, eax
jne 0x5630a9
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xff
jne 0x5630a9
jmp 0x56307a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x5630b9
or eax, 0xffffffff
jmp 0x563186
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jle 0x5630cc
mov eax, dword [ebp - 4]
shl eax, 3
jmp 0x563186
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7e
ja case.0x563103.1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x5631ac]
jmp dword [eax*4 + 0x56318c]
mov dword [ebp - 0xc], 7
jmp 0x56314e
mov dword [ebp - 0xc], 6
jmp 0x56314e
mov dword [ebp - 0xc], 5
jmp 0x56314e
mov dword [ebp - 0xc], 4
jmp 0x56314e
mov dword [ebp - 0xc], 3
jmp 0x56314e
mov dword [ebp - 0xc], 2
jmp 0x56314e
mov dword [ebp - 0xc], 1
jmp 0x56314e
or eax, 0xffffffff
jmp 0x563186
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
jne 0x563176
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
movzx ecx, byte [ebp - 5]
cmp edx, ecx
je 0x56317d
or eax, 0xffffffff
jmp 0x563186
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea eax, [eax + edx*8]
mov esp, ebp
pop ebp
ret
Function at 0x570f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x57105b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x570ff6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00570bc0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x570fc4
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x571114
call 0x571008
pop edx
lea ecx, [edx + 0x138]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x5710b3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00570bc0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x57106c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x571114
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00570bc0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x57110f
jmp 0x571114
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x571180
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x571264
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x5711ff
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00570d20
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5711cd
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x57131d
call 0x571211
pop edx
lea ecx, [edx + 0x12f]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x5712bc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00570e50
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x571275
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x57131d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00570e50
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x571318
jmp 0x57131d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x578c10
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004c03f0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x578c4c
push 0x52
push str.crypto_bio_b_sock2.c
push 0x87
push 0x8a
push 0x20
call fcn.004e9ee0
add esp, 0x14
xor eax, eax
jmp 0x578d9a
mov eax, dword [ebp + 0x10]
and eax, 8
neg eax
sbb eax, eax
neg eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054a390
add esp, 8
test eax, eax
jne 0x578c70
xor eax, eax
jmp 0x578d9a
mov edx, dword [ebp + 0x10]
and edx, 4
je 0x578ccf
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x578ccf
push 0x5c
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call fcn.004e9ee0
add esp, 0x14
push 0x5d
push str.crypto_bio_b_sock2.c
push 0x89
push 0x8a
push 0x20
call fcn.004e9ee0
add esp, 0x14
xor eax, eax
jmp 0x578d9a
mov edx, dword [ebp + 0x10]
and edx, 0x10
je 0x578d28
push 4
lea eax, [ebp - 4]
push eax
push 1
push 6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x578d28
push 0x65
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0xe
push 2
call fcn.004e9ee0
add esp, 0x14
push 0x66
push str.crypto_bio_b_sock2.c
push 0x8a
push 0x8a
push 0x20
call fcn.004e9ee0
add esp, 0x14
xor eax, eax
jmp 0x578d9a
mov edx, dword [ebp + 0xc]
push edx
call fcn.005453a0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00545380
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x578d95
push 0xffffffffffffffff
call fcn.00515aa0
add esp, 4
test eax, eax
jne 0x578d91
push 0x6e
push str.crypto_bio_b_sock2.c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
push 2
call fcn.004e9ee0
add esp, 0x14
push 0x6f
push str.crypto_bio_b_sock2.c
push 0x67
push 0x8a
push 0x20
call fcn.004e9ee0
add esp, 0x14
xor eax, eax
jmp 0x578d9a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57ad90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.004c03f0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x57adbe
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
and ecx, 2
je 0x57adbe
mov dword [ebp - 8], str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jmp 0x57adc5
mov dword [ebp - 8], str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], edx
jmp 0x57add6
mov eax, dword [ebp - 4]
sub eax, 3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x57af36
cmp dword [ebp - 4], 3
jl 0x57ae81
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
shl edx, 0x10
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
shl ecx, 8
or edx, ecx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 2]
or edx, ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
and ecx, 0x3f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov cl, byte [eax + ecx]
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x10]
shr eax, 6
and eax, 0x3f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
mov byte [ecx], al
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0x10]
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
jmp 0x57af1f
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
shl edx, 0x10
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 2
jne 0x57aea3
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
shl ecx, 8
or ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
and ecx, 0x3f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov cl, byte [eax + ecx]
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 4], 1
jne 0x57aeec
mov dword [ebp - 0x14], 0x3d
jmp 0x57aeff
mov eax, dword [ebp - 0x10]
shr eax, 6
and eax, 0x3f
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 0x14]
mov byte [eax], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x3d
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
add eax, 3
mov dword [ebp + 0x10], eax
jmp 0x57adcd
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x590fe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x590ffe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x591040
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x59105e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x5910a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5910c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x591120
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x591142
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x5911a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x5911ca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x591230
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x59125a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x5912c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x59131f

Function at 0x5913a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x5913ff
Function at 0x593fe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00593a80
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x594051
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x594016
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret