joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405680
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi], 0
jne 0x405697
mov dword [edi], esi
cmp dword [edi + 4], 0
jne 0x4056a4
mov dword [edi + 4], 0x400
mov eax, dword [edi + 8]
or eax, dword [edi + 0xc]
jne 0x4056c3
mov eax, dword [0x4519f0]
inc eax
mov dword [0x4519f0], eax
mov eax, dword [0x4519f0]
cdq
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
lea eax, [esi + 0xe0]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0xcc], 0xffffffff
jne 0x4056ec
mov ecx, esi
call fcn.00405610
test eax, eax
jne 0x405890
push 0
push 1
push 0x44bac0
push dword [esi + 0xcc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x405730
push str.hloop_post_event
push str._s:_hloop_post_event_failed__n
push 4
call fcn.00408d20
push eax
call fcn.004088a0
add esp, 0x10
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xd8], 0
jne 0x40578b
mov dword [esi + 0xdc], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0x10
lock inc dword [0x4519f4]
push 0x280
call fcn.0042e0e2
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4058a1
push 0x280
push 0
push ebx
call fcn.00429110
add esp, 0xc
mov dword [esi + 0xd0], ebx
mov ebx, dword [esi + 0xd4]
mov ecx, dword [esi + 0xd8]
cmp ebx, ecx
jne 0x405828
lea edx, [ecx + ecx]
mov eax, 0x10
test edx, edx
cmove edx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xd0]
lea ebx, [edx + edx*4]
mov dword [esp + 0x18], edx
shl ebx, 3
lock inc dword [0x4519f4]
test eax, eax
je 0x4057d8
lock inc dword [0x4519f8]
push ebx
push eax
call fcn.0042e0ed
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4057f4
push str.realloc_failed__n
jmp 0x4058a6
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jbe 0x405810
sub ebx, ecx
add eax, ecx
push ebx
push 0
push eax
call fcn.00429110
mov eax, dword [esp + 0x20]
add esp, 0xc
mov edx, dword [esi + 0xdc]
mov dword [esi + 0xd0], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0xd8], eax
jmp 0x40585e
mov edx, dword [esi + 0xdc]
lea eax, [edx + ebx]
cmp eax, ecx
jne 0x40585e
mov ecx, dword [esi + 0xd0]
lea eax, [ebx + ebx*4]
shl eax, 3
push eax
lea eax, [edx + edx*4]
lea eax, [ecx + eax*8]
push eax
push ecx
call fcn.00428b90
add esp, 0xc
mov dword [esi + 0xdc], 0
xor edx, edx
mov eax, dword [esi + 0xd4]
movups xmm0, xmmword [edi]
add eax, edx
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0xd0]
movups xmmword [eax + ecx*8], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + ecx*8 + 0x10], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [eax + ecx*8 + 0x20], xmm0
inc dword [esi + 0xd4]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.malloc_failed__n
push 2
call fcn.0042af55
add esp, 4
push eax
call fcn.00408180
add esp, 8
push 0xffffffffffffffff
call fcn.0042ec2b
int3
Function at 0x406890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
nop dword [eax]
inc eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [edi + 0x44]
push dword [edi + 0x30]
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
js 0x4069dc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1c
push eax
push dword [edi + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [edi]
mov edx, ebx
call fcn.00406210
mov ecx, dword [edi + 0xb4]
mov esi, eax
mov dword [esi + 0xb4], ecx
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0xf4]
test edx, edx
je 0x40690b
mov ecx, esi
call fcn.00408080
cmp dword [edi + 0x28], 0x1000000
jne 0x4069ab
cmp dword [esi + 0xf8], 0
jne 0x40699c
mov ebx, dword [edi + 0xfc]
test ebx, ebx
jne 0x406951
mov ebx, dword [0x451a14]
test ebx, ebx
jne 0x406951
call fcn.0040ae80
or dword [edi + 0x24], 0x8000
mov ebx, eax
mov dword [edi + 0xfc], ebx
test ebx, ebx
je 0x4069d5
push 0xd4
call fcn.0042e0e2
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x4069ce
push eax
call fcn.0040dc40
add esp, 4
lea ecx, [ebx + 0x2e4]
mov ebx, dword [ebp - 8]
push ecx
push ebx
call fcn.0040e1a0
push 0
push 0x40af90
push 0x40af50
push dword [ebp - 0xc]
push ebx
call fcn.0040e0d0
add esp, 0x1c
mov dword [esi + 0xf8], ebx
push esi
mov dword [esi + 0x28], 0x1000000
call fcn.00406710
jmp 0x4069b8
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x4069bb
push esi
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, 3
jl 0x4068a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0x412
jmp 0x406a01
mov esi, 0x411
jmp 0x406a01
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
je 0x406a4c
cmp esi, 0x2714
je 0x406a4c
push str.accept
call fcn.0042e567
add esp, 4
push 0
push pe_nt_image_headers32
push 0x451ac0
mov eax, esi
mov dword [edi + 0x34], esi
cdq
push 0
xor eax, edx
sub eax, edx
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [edi + 0x34]
push 0x451ac0
push dword [edi + 0x30]
push str.nio_accept
push str._s:_listenfd_d_accept_error:__s:_d_n
push 4
call fcn.00408d20
push eax
call fcn.004088a0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0x1c
lea eax, [ebp - 4]
push eax
push dword [esi + 0x44]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jns 0x406a8a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x406aff
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1c
push eax
push dword [esi + 0x40]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp dword [esi + 0x28], 0x1000000
jne 0x406b7c
mov eax, dword [esi + 0xf8]
test eax, eax
jne 0x406b5a
mov eax, dword [esi + 0xfc]
test eax, eax
jne 0x406aec
mov eax, dword [0x451a14]
test eax, eax
jne 0x406aec
call fcn.0040ae80
or dword [esi + 0x24], 0x8000
mov dword [esi + 0xfc], eax
test eax, eax
jne 0x406aec
mov eax, 0x411
jmp 0x406aff
mov edx, dword [esi + 0x30]
mov ecx, eax
call fcn.0040afd0
test eax, eax
jne 0x406b54
mov eax, 0x412
push 0
push pe_nt_image_headers32
mov dword [esi + 0x34], eax
push 0x451ac0
cdq
push 0
xor eax, edx
sub eax, edx
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [esi + 0x34]
push 0x451ac0
push dword [esi + 0x30]
push str.nio_connect
push str._s:_connfd_d_connect_error:__s:_d_n
push 3
call fcn.00408d20
push eax
call fcn.004088a0
add esp, 0x1c
mov ecx, esi
call fcn.004075b0
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xf8], eax
mov ecx, dword [esi + 0x100]
test ecx, ecx
je 0x406b6e
push ecx
push eax
call fcn.0040e0f0
add esp, 8
push esi
call fcn.004067c0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xd8]
test ecx, ecx
je 0x406b9f
call fcn.00406090
mov dword [esi + 0xd8], 0
mov dword [esi + 0xbc], 0
or dword [esi + 0x24], 0x10
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x406bb3
push esi
call eax
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406be0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi + 0x28]
cmp eax, 0x2000
jg 0x406c2e
je 0x406c03
cmp eax, 0x100
je 0x406c03
cmp eax, 0x1000
jne 0x406c3c
mov edx, dword [esi + 0x44]
mov eax, 0x1c
push ebx
mov ebx, 0x10
cmp word [edx], 2
cmove eax, ebx
push eax
push edx
push 0
push dword [ebp + 8]
push edi
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_sendto]
pop ebx
pop edi
pop esi
pop ebp
ret
cmp eax, 0x100000
je 0x406c65
cmp eax, 0x1000000
je 0x406c4f
push dword [ebp + 8]
push edi
push dword [esi + 0x30]
call fcn.004335ec
add esp, 0xc
pop edi
pop esi
pop ebp
ret
push dword [ebp + 8]
push edi
push dword [esi + 0xf8]
call fcn.0040feb0
add esp, 0xc
pop edi
pop esi
pop ebp
ret
push 0
push dword [ebp + 8]
push edi
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebp
ret
Function at 0x406fa0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x10
mov esi, dword [edi + 0x44]
cmp word [esi], 2
cmove edx, ecx
push edx
push esi
push dword [edi + 0x30]
call dword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
test ebx, ebx
jns 0x40703c
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x407082
push str.connect
call fcn.0042e567
add esp, 4
call esi
mov ecx, dword [edi]
lea edx, [esp + 0x10]
xorps xmm0, xmm0
mov dword [edi + 0x34], eax
mov eax, dword [edi + 0x2c]
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0x406420
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
call fcn.00405680
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jne 0x407082
mov eax, dword [edi + 0x2c]
lea edx, [esp + 0x10]
mov ecx, dword [edi]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0x406bc0
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
call fcn.00405680
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xbc]
mov ecx, 0x2710
test eax, eax
mov edx, 0x4065d0
push 1
cmovne ecx, eax
push ecx
mov ecx, dword [edi]
call fcn.00405ea0
mov dword [edi + 0xd8], eax
add esp, 8
mov dword [eax + 0x18], edi
mov eax, dword [edi + 0x24]
or eax, 0x80
cmp dword [edi + 0x30], 3
mov dword [edi + 0x24], eax
jge 0x4070c8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi]
test al, 2
jne 0x407104
mov eax, dword [0x4519f0]
inc eax
mov dword [0x4519f0], eax
mov eax, dword [0x4519f0]
cdq
mov dword [edi + 8], eax
mov eax, dword [edi + 0x24]
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], 0x406df0
test al, 2
jne 0x4070fe
or eax, 2
mov dword [edi + 0x24], eax
mov eax, dword [edi]
inc dword [eax + 0x40]
inc dword [esi + 0xb8]
test byte [edi + 0x24], 8
jne 0x407111
mov ecx, edi
call fcn.004079a0
test byte [edi + 0x38], 4
mov dword [edi + 0x10], 0x406df0
jne 0x407131
mov edx, dword [edi + 0x30]
mov ecx, esi
push 4
call fcn.00409220
add esp, 4
or dword [edi + 0x38], 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4097a0
Capabilities:
Convert ip address from string
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x44e024]
xor eax, esp
mov dword [esp + 0x19c], eax
push esi
push edi
mov edi, edx
mov esi, ecx
test edi, edi
je 0x409887
cmp byte [edi], 0
je 0x409887
mov ecx, 1
mov edx, 0x451a10
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4097f5
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esi + 4]
push eax
push edi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x409814
mov eax, 2
mov word [esi], ax
jmp 0x4098a7
lea eax, [esi + 8]
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x40982e
mov eax, 0x17
mov word [esi], ax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x4098b6
mov edi, dword [esp + 0xc]
test edi, edi
je 0x40989a
cmp dword [edi + 0x18], eax
je 0x40989a
cmp dword [edi + 0x10], eax
je 0x40989a
mov eax, edi
nop
cmp dword [eax + 4], 2
je 0x40986f
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x409860
mov eax, edi
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call fcn.00428b90
add esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x40989a
mov eax, 2
push 0
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 4], eax
movzx eax, word [esi]
cmp eax, 2
je 0x4098a7
cmp eax, 0x17
jne 0x4098b4
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
xor eax, eax
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
xor ecx, esp
call fcn.00427ca1
mov esp, ebp
pop ebp
ret
Function at 0x409980
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x44e024]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov eax, dword [ebp + 0xc]
mov ecx, 1
push ebx
push esi
mov dword [esp + 0x10], eax
mov edx, 0x451a10
push edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4099c8
lea eax, [esp + 0x28]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
mov dword [esp + 0x10], 0xffffffff
mov eax, 2
mov dword [esp + 0xc], 0x10
push 0x7f000001
or edi, 0xffffffff
movlpd qword [esp + 0x24], xmm0
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x1c], eax
xor eax, eax
push eax
push 1
push 2
mov word [esp + 0x26], ax
call ebx
mov esi, eax
test esi, esi
jns 0x409a21
mov eax, str.socket
jmp 0x409abf
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x409a3f
mov eax, str.bind
jmp 0x409abf
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x409a53
mov eax, str.listen
jmp 0x409abf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x409a6f
mov eax, str.getsockname
jmp 0x409abf
push 0
push 1
push 2
call ebx
mov edi, eax
test edi, edi
jns 0x409a84
mov eax, str.socket
jmp 0x409abf
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x409a9f
mov eax, str.connect
jmp 0x409abf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x409b02
mov eax, str.accept
push eax
call fcn.0042e567
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
add esp, 4
cmp esi, 0xffffffff
je 0x409ad6
push esi
call ebx
cmp edi, 0xffffffff
je 0x409ade
push edi
call ebx
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x409aea
push eax
call ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.00427ca1
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1bc]
mov dword [eax], edi
pop edi
mov dword [eax + 4], ebx
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00427ca1
mov esp, ebp
pop ebp
ret
Function at 0x4103b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0
push esi
call fcn.00429110
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.00428b90
sub esi, ebx
add esp, 0x18
add edi, esi
xor edx, edx
mov esi, dword [ebp + 0x18]
mov dword [ebp + 8], edi
cmp ebx, 4
jb 0x41040e
sub esi, edi
mov eax, 4
sub eax, edi
mov ecx, edi
mov edi, eax
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
add edx, 4
lea eax, [edi + ecx]
cmp eax, ebx
jbe 0x4103f5
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
mov ecx, ebx
sub ecx, edx
cmp edx, ebx
jae 0x4104d2
cmp ecx, 0x40
jb 0x4104bd
lea eax, [edx + edi]
mov dword [ebp + 0xc], eax
lea eax, [ebx - 1]
add eax, edi
mov dword [ebp + 8], eax
lea eax, [ebx - 1]
add eax, esi
cmp dword [ebp + 0xc], eax
ja 0x410443
lea eax, [edx + esi]
cmp dword [ebp + 8], eax
jae 0x4104bd
and ecx, 0x3f
mov eax, ebx
sub eax, ecx
mov ebx, esi
mov dword [ebp + 8], eax
lea ecx, [esi + 0x30]
lea eax, [edi + 0x10]
add ecx, edx
add eax, edx
sub ebx, edi
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
movups xmm0, xmmword [eax - 0x10]
add edx, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + esi - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edx, dword [ebp + 8]
jb 0x410464
mov esi, dword [ebp + 0x18]
mov dword [ebp + 0x1c], edx
cmp edx, ebx
jae 0x4104d2
sub esi, edi
lea eax, [edx + edi]
sub ebx, edx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub ebx, 1
jne 0x4104c4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x414da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x14
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp edx, 4
jb 0x414ded
mov eax, dword [ebp + 0x10]
mov edx, 4
sub edi, eax
sub ebx, eax
sub edx, eax
mov esi, eax
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x14]
nop
mov eax, dword [edi + esi]
add ecx, 4
xor eax, dword [esi]
mov dword [ebx + esi], eax
add esi, 4
mov eax, dword [ebp - 4]
add eax, esi
cmp eax, edx
jbe 0x414dd0
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, edx
sub eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, edx
jae 0x414f04
mov esi, dword [ebp + 0x10]
cmp eax, 0x40
jb 0x414ee9
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
lea eax, [ecx + esi]
mov dword [ebp - 8], eax
lea eax, [esi - 1]
add eax, edx
cmp dword [ebp - 4], eax
ja 0x414e2c
lea eax, [edx - 1]
add eax, ebx
cmp eax, dword [ebp - 8]
jae 0x414ee9
lea eax, [ecx + edi]
mov dword [ebp - 8], eax
lea eax, [edx - 1]
add eax, edi
cmp dword [ebp - 4], eax
ja 0x414e4a
lea eax, [edx - 1]
add eax, ebx
cmp eax, dword [ebp - 8]
jae 0x414ee9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], edx
and eax, 0x3f
sub dword [ebp - 4], eax
mov edx, edi
sub edx, esi
lea eax, [ebx + 0x20]
mov dword [ebp - 8], edx
add eax, ecx
mov edx, ebx
mov dword [ebp - 0xc], eax
sub edx, esi
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], edx
add eax, ecx
mov esi, dword [ebp - 0x10]
mov edx, edi
sub edx, ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + edi]
lea edx, [edx + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x40]
movups xmmword [edx - 0x60], xmm1
movups xmm1, xmmword [eax + ebx - 0x40]
mov ebx, dword [ebp - 0x14]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [eax + esi - 0x40], xmm1
movups xmm1, xmmword [ebx + edx - 0x40]
mov ebx, dword [ebp - 8]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [ecx + edi + 0x30]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [ebp - 4]
jb 0x414e81
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
cmp ecx, edx
jae 0x414f04
sub edi, esi
lea eax, [ecx + esi]
sub ebx, esi
sub edx, ecx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [ebx + eax - 1], cl
sub edx, 1
jne 0x414ef2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
je 0x41634c
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 8], eax
nop word [eax + eax]
mov cl, byte [eax + esi]
lea esi, [esi + 1]
mov al, byte [esi - 1]
movzx edx, al
movzx eax, cl
xor edx, eax
mov eax, dword [ebp + 8]
or edi, edx
sub ebx, 1
jne 0x416330
pop esi
mov eax, edi
movzx ecx, di
shr eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
Function at 0x416570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x416649
mov eax, ebx
sub eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [0x44eb3c]
mov edx, dword [0x44eb3c]
xor esi, ecx
xor edx, dword [ebp - 8]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44eb3c]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44eb3c]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44eb3c]
or esi, ecx
shr esi, 0x1f
xor eax, esi
lea esi, [ebx - 1]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
xor eax, eax
shr ecx, 0x1f
neg ecx
mov dword [ebp + 8], ecx
test esi, esi
je 0x41662d
mov dl, byte [eax + edi]
mov cl, byte [eax + edi + 1]
mov ebx, dword [0x44eb3c]
xor ebx, dword [ebp + 8]
not ebx
and bl, cl
movzx ecx, byte [ebp + 8]
and cl, dl
or bl, cl
mov byte [eax + edi], bl
inc eax
cmp eax, esi
jb 0x416603
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
movzx eax, byte [edi + ebx - 1]
and al, cl
mov ecx, dword [ebp - 4]
inc ecx
mov byte [edi + ebx - 1], al
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x4165a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416e30
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x443038
mov edx, edi
test eax, eax
je 0x416eb1
cmp dword [0x443038], 0
je 0x416eb1
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x416ea7
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x416e72
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x416e77
add edx, 4
add eax, 4
sub esi, 4
jae 0x416e61
cmp esi, 0xfffffffc
je 0x416ebb
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x416ea4
cmp esi, 0xfffffffd
je 0x416ebb
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x416ea4
cmp esi, 0xfffffffe
je 0x416ebb
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x416ea4
cmp esi, 0xffffffff
je 0x416ebb
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x416ebb
mov eax, dword [ebp + 8]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x416e50
pop edi
pop esi
mov eax, 0xffffffd2
pop ebx
pop ebp
ret
test edi, edi
je 0x416eb1
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x416fa0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x442fa8
mov edx, edi
test eax, eax
je 0x417021
cmp dword [0x442fa8], 0
je 0x417021
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x417017
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x416fe2
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x416fe7
add edx, 4
add eax, 4
sub esi, 4
jae 0x416fd1
cmp esi, 0xfffffffc
je 0x417028
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x417014
cmp esi, 0xfffffffd
je 0x417028
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x417014
cmp esi, 0xfffffffe
je 0x417028
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x417014
cmp esi, 0xffffffff
je 0x417028
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x417028
mov eax, dword [ebp + 8]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x416fc0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret