joyce8/EMBER2024-capa huggingface dataset:
Function at 0x650420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov edi, dword [esp + 0x60]
mov ebp, dword [esp + 0x5c]
mov esi, edi
and esi, 0xf
je 0x650551
lea eax, [esi + 0x10]
sub edi, eax
mov dword [esp], ecx
je 0x650464
mov eax, dword [ecx + 0x70]
push edi
push edx
push ebp
push ecx
mov ebx, edx
call dword [eax + 4]
add esp, 0x10
test eax, eax
je 0x65054d
add ebx, edi
add ebp, edi
mov ecx, dword [esp]
mov edx, ebx
mov dword [esp + 4], edx
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [esp + 0x38], xmm0
lea eax, [edx + esi]
movups xmm0, xmmword [edx + esi]
movups xmmword [esp + 0x28], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x20], xmm0
mov ebx, ecx
mov ecx, dword [ecx + 0x70]
lea edx, [esp + 0x18]
push 0x10
push eax
push edx
push ebx
call dword [ecx + 4]
add esp, 0x10
test eax, eax
mov edi, dword [esp + 0x60]
je 0x65054d
add ebx, 0x20
lea eax, [esp + 8]
push esi
push dword [esp + 8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea eax, [esp + esi]
add eax, 8
lea ecx, [esp + esi]
add ecx, 0x18
mov edx, 0x10
sub edx, esi
push edx
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
cmp esi, 8
jb 0x650510
mov ecx, edi
and ecx, 7
mov eax, esi
sub eax, ecx
xor edx, edx
nop dword [eax]
movsd xmm0, qword [esp + edx + 8]
movsd xmm1, qword [esp + edx + 0x18]
xorps xmm1, xmm0
movlps qword [ebp + edx + 0x10], xmm1
add edx, 8
cmp eax, edx
jne 0x6504f0
test ecx, ecx
je 0x650522
nop
movzx ecx, byte [esp + eax + 0x18]
xor cl, byte [esp + eax + 8]
mov byte [ebp + eax + 0x10], cl
inc eax
cmp esi, eax
jne 0x650510
movups xmm0, xmmword [esp + 0x38]
movups xmmword [ebx], xmm0
mov ecx, dword [esp]
mov eax, dword [ecx + 0x70]
push 0x10
lea edx, [esp + 0xc]
push edx
push ebp
push ecx
call dword [eax + 4]
add esp, 0x10
test eax, eax
je 0x65054d
movups xmm0, xmmword [esp + 0x28]
movups xmmword [ebx], xmm0
jmp 0x650563
xor edi, edi
jmp 0x650563
mov eax, dword [ecx + 0x70]
push edi
push edx
push ebp
push ecx
call dword [eax + 4]
add esp, 0x10
test eax, eax
cmove edi, eax
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x653030
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
xorps xmm0, xmm0
movsd qword [eax + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0xd0], xmm0
movups xmmword [eax + 0xc0], xmm0
movups xmmword [eax + 0xb0], xmm0
movups xmmword [eax + 0xa0], xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x70], xmm0
movups xmmword [eax + 0x60], xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmm0, xmmword [0xa37a20]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0xa37a30]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0xa37a40]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [0xa37a50]
movups xmmword [eax + 0x30], xmm0
movzx edx, byte [ecx]
mov dword [eax + 0xe4], edx
mov edx, 0xf3bcc908
xor edx, dword [ecx]
mov esi, 0x6a09e667
xor esi, dword [ecx + 4]
mov dword [eax + 4], esi
mov dword [eax], edx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov esi, 0xbb67ae85
xor esi, dword [ecx + 0xc]
mov dword [eax + 0xc], esi
mov dword [eax + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov esi, 0x3c6ef372
xor esi, dword [ecx + 0x14]
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov esi, 0xa54ff53a
xor esi, dword [ecx + 0x1c]
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov esi, 0x510e527f
xor esi, dword [ecx + 0x24]
mov dword [eax + 0x24], esi
mov dword [eax + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov esi, 0x9b05688c
xor esi, dword [ecx + 0x2c]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov esi, 0x1f83d9ab
xor esi, dword [ecx + 0x34]
mov dword [eax + 0x34], esi
mov dword [eax + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov esi, 0x5be0cd19
xor esi, dword [ecx + 0x3c]
mov dword [eax + 0x3c], esi
mov dword [eax + 0x38], edx
mov eax, 1
pop esi
ret
Function at 0x653170
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
xorps xmm0, xmm0
movsd qword [esi + 0xe0], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0xd0], xmm0
movups xmmword [esi + 0xc0], xmm0
movups xmmword [esi + 0xb0], xmm0
movups xmmword [esi + 0xa0], xmm0
movups xmmword [esi + 0x90], xmm0
movups xmmword [esi + 0x80], xmm0
movups xmmword [esi + 0x70], xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmm1, xmmword [0xa37a20]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0xa37a30]
movups xmmword [esi + 0x10], xmm1
movups xmm1, xmmword [0xa37a40]
movups xmmword [esi + 0x20], xmm1
movups xmm1, xmmword [0xa37a50]
movups xmmword [esi + 0x30], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0xe4], edx
mov ebx, dword [ecx]
mov edx, 0x6a09e667
xor edx, dword [ecx + 4]
movzx edi, bh
xor ebx, 0xf3bcc908
mov dword [esi + 4], edx
mov dword [esi], ebx
mov edx, 0x84caa73b
xor edx, dword [ecx + 8]
mov ebx, 0xbb67ae85
xor ebx, dword [ecx + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
mov edx, 0xfe94f82b
xor edx, dword [ecx + 0x10]
mov ebx, 0x3c6ef372
xor ebx, dword [ecx + 0x14]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edx
mov edx, 0x5f1d36f1
xor edx, dword [ecx + 0x18]
mov ebx, 0xa54ff53a
xor ebx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], edx
mov edx, 0xade682d1
xor edx, dword [ecx + 0x20]
mov ebx, 0x510e527f
xor ebx, dword [ecx + 0x24]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], edx
mov edx, 0x2b3e6c1f
xor edx, dword [ecx + 0x28]
mov ebx, 0x9b05688c
xor ebx, dword [ecx + 0x2c]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], edx
mov edx, 0xfb41bd6b
xor edx, dword [ecx + 0x30]
mov ebx, 0x1f83d9ab
xor ebx, dword [ecx + 0x34]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], edx
mov edx, 0x137e2179
xor edx, dword [ecx + 0x38]
mov ebx, 0x5be0cd19
xor ebx, dword [ecx + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], edx
movups xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x70], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x80], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x90], xmm0
movups xmm0, xmmword [esp + 0x40]
movups xmmword [esi + 0xa0], xmm0
movups xmm0, xmmword [esp + 0x50]
movups xmmword [esi + 0xb0], xmm0
movups xmm0, xmmword [esp + 0x60]
movups xmmword [esi + 0xc0], xmm0
movups xmm0, xmmword [esp + 0x70]
movups xmmword [esi + 0xd0], xmm0
mov dword [esi + 0xe0], pe_nt_image_headers32
push pe_nt_image_headers32
push ebx
call fcn.005e9a90
add esp, 8
mov eax, 1
add esp, 0x80
pop esi
pop edi
pop ebx
ret
Function at 0x657d90
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
xorps xmm0, xmm0
movsd qword [ecx + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x60], xmm0
movups xmmword [ecx + 0x50], xmm0
movups xmmword [ecx + 0x40], xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [0xa37a60]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0xa37a70]
movups xmmword [ecx + 0x10], xmm0
movzx edx, byte [eax]
mov dword [ecx + 0x74], edx
mov edx, 0x6a09e667
xor edx, dword [eax]
mov dword [ecx], edx
mov edx, 0xbb67ae85
xor edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [eax + 0x14]
mov dword [ecx + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [eax + 0x18]
mov dword [ecx + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [eax + 0x1c]
mov dword [ecx + 0x1c], edx
mov eax, 1
ret

Function at 0x657e30
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
xorps xmm0, xmm0
movsd qword [esi + 0x70], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
movups xmmword [esi + 0x50], xmm0
movups xmmword [esi + 0x40], xmm0
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmm1, xmmword [0xa37a60]
movups xmmword [esi], xmm1
movups xmm1, xmmword [0xa37a70]
movups xmmword [esi + 0x10], xmm1
movzx edx, byte [ecx]
mov dword [esi + 0x74], edx
mov edx, dword [ecx]
movzx edi, dh
xor edx, 0x6a09e667
mov dword [esi], edx
mov edx, 0xbb67ae85
xor edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov edx, 0x3c6ef372
xor edx, dword [ecx + 8]
mov dword [esi + 8], edx
mov edx, 0xa54ff53a
xor edx, dword [ecx + 0xc]
mov dword [esi + 0xc], edx
mov edx, 0x510e527f
xor edx, dword [ecx + 0x10]
mov dword [esi + 0x10], edx
mov edx, 0x9b05688c
xor edx, dword [ecx + 0x14]
mov dword [esi + 0x14], edx
mov edx, 0x1f83d9ab
xor edx, dword [ecx + 0x18]
mov dword [esi + 0x18], edx
mov edx, 0x5be0cd19
xor edx, dword [ecx + 0x1c]
mov dword [esi + 0x1c], edx
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ebx, esp
push edi
push eax
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [esi + 0x30], xmm0
movups xmmword [esi + 0x40], xmm1
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esi + 0x50], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0x40
push 0x40
push ebx
call fcn.005e9a90
add esp, 8
mov eax, 1
add esp, 0x40
pop esi
pop edi
pop ebx
ret
Function at 0x66e130
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x66e33e
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x820
mov dword [esp + 8], edx
mov edi, dword [ecx + 0x44]
mov eax, dword [ecx + 0x54]
mov ebx, eax
shl eax, 0xa
mov dword [esp + 0x14], eax
add eax, edi
add eax, 0xfffffc00
lea edx, [esp + 0x18]
push 0x400
push eax
push edx
mov esi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 4], eax
cmp eax, 2
jb 0x66e297
mov edx, ebx
shl edx, 0xb
mov esi, dword [esp + 4]
imul esi, ebx
shl esi, 0xa
add esi, edi
lea eax, [esp + 0x18]
cmp eax, esi
lea esi, [edi + edx - 0x400]
setb cl
lea eax, [esp + 0x418]
cmp esi, eax
setb ch
and ch, cl
shr ebx, 0x15
and ebx, 1
or bl, ch
mov dword [esp + 0x10], ebx
lea ecx, [edi + edx]
add ecx, 0xfffffc30
add edx, edi
add edx, 0xfffffc08
mov edi, 1
jmp 0x66e1f3
inc edi
mov eax, dword [esp + 0x14]
add ecx, eax
add edx, eax
cmp edi, dword [esp + 4]
je 0x66e297
cmp byte [esp + 0x10], 0
je 0x66e230
xor esi, esi
nop dword [eax]
mov eax, dword [edx + esi*8 - 8]
mov ebx, dword [edx + esi*8 - 4]
xor dword [esp + esi*8 + 0x18], eax
xor dword [esp + esi*8 + 0x1c], ebx
mov eax, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [esp + esi*8 + 0x24], ebx
xor dword [esp + esi*8 + 0x20], eax
add esi, 2
cmp esi, 0x80
jne 0x66e200
jmp 0x66e1e0
xor esi, esi
nop word cs:[eax + eax]
movups xmm0, xmmword [ecx + esi*8 - 0x30]
movups xmm1, xmmword [ecx + esi*8 - 0x20]
movups xmm2, xmmword [esp + esi*8 + 0x18]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x28]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x18], xmm2
movups xmmword [esp + esi*8 + 0x28], xmm0
movups xmm0, xmmword [ecx + esi*8 - 0x10]
movups xmm1, xmmword [ecx + esi*8]
movups xmm2, xmmword [esp + esi*8 + 0x38]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x48]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x38], xmm2
movups xmmword [esp + esi*8 + 0x48], xmm0
add esi, 8
cmp esi, 0x80
jne 0x66e240
jmp 0x66e1e0
xor eax, eax
nop dword [eax]
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x420], edx
mov dword [esp + eax*8 + 0x41c], ecx
inc eax
cmp eax, 0x80
jne 0x66e2a0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 0x5c]
lea esi, [esp + 0x41c]
mov edx, dword [esp + 8]
push 0x400
push esi
push dword [edi + 4]
call fcn.0066e340
add esp, 0xc
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.005e9a90
add esp, 8
push 0x400
push esi
call fcn.005e9a90
add esp, 8
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x4c]
shl ecx, 0xa
cmp dword [edi + 0x40], 0
je 0x66e323
push 0x310
push str.providers_implementations_kdfs_argon2.c
push ecx
push eax
call fcn.005ddf30
jmp 0x66e334
push 0x313
push str.providers_implementations_kdfs_argon2.c
push ecx
push eax
call fcn.005dcd90
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x689020
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x14]
push 1
push ebx
call fcn.006069c0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.00606c90
add esp, 8
test eax, eax
je 0x6890a9
mov edi, eax
sub esp, 0x14
movaps xmm0, xmmword [0xa446b0]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x689084
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x689086
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00606d20
add esp, 0xc
push ebx
call fcn.00606990
add esp, 4
test eax, eax
jne 0x68912a
push 1
push ebx
call fcn.006069c0
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.00606c90
add esp, 8
test eax, eax
je 0x689121
mov edi, eax
mov eax, esp
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x689100
push edi
push esi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
cmove esi, eax
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x689102
xor esi, esi
lea eax, [esi*8]
push eax
push esi
push ebx
call fcn.00606d20
add esp, 0xc
push ebx
call fcn.00606990
add esp, 4
test eax, eax
jne 0x68912a
push ebx
call fcn.00606990
add esp, 4
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x699710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xdc
mov ebp, dword [esp + 0x100]
xor eax, eax
cmp edx, ebp
jb 0x699965
cmp ebp, 0x40
ja 0x699965
test ebp, ebp
je 0x699783
mov eax, dword [esp + 0xfc]
mov esi, dword [esp + 0xf8]
mov edi, dword [esp + 0xf4]
mov ebx, dword [ecx]
mov dword [esp + 4], ebx
sub ebx, ebp
mov dword [ecx], ebx
mov ecx, dword [esp + 0xf0]
cmp eax, 1
jne 0x699795
test edi, edi
je 0x69976b
add ecx, ebx
mov dword [edi], ecx
mov eax, 1
test esi, esi
je 0x699965
mov dword [esi], 0
jmp 0x699965
xor eax, eax
cmp dword [esp + 0x104], 0
setne al
jmp 0x699965
mov dword [esp], edx
lea eax, [esp + 0x1c]
push 0
push ebp
push eax
push dword [esp + 0x114]
call fcn.00605750
add esp, 0x10
test eax, eax
jle 0x699963
test edi, edi
je 0x699963
test esi, esi
je 0x699963
push 0xf5
push str.ssl_record_methods_tls_pad.c
push ebp
call fcn.005dc9b0
add esp, 0xc
mov ecx, eax
mov dword [edi], eax
test eax, eax
mov eax, 0
je 0x699965
mov dword [esp + 0x18], ecx
mov dword [esi], 1
lea eax, [esp + 0x5c]
neg eax
and eax, 0x3f
add eax, esp
add eax, 0x5c
mov edi, ebp
or edi, 0x100
xor ecx, ecx
mov esi, dword [esp]
mov dword [esp + 0x14], ebx
mov ebx, esi
sub ebx, edi
cmovb ebx, ecx
push ebp
push 0
mov dword [esp + 0x14], eax
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edx, 0
cmp ebx, esi
jae 0x6998c3
cmp esi, edi
cmovb edi, esi
mov eax, dword [esp + 4]
neg eax
mov dword [esp + 0x10], eax
xor ecx, ecx
xor edx, edx
xor esi, esi
nop dword [eax]
mov dword [esp + 8], esi
mov dword [esp], edi
mov esi, ebx
xor esi, dword [esp + 0x14]
mov edi, esi
not edi
dec esi
and esi, edi
mov edi, ebx
mov eax, dword [esp + 4]
xor edi, eax
mov ebp, dword [esp + 0x10]
add ebp, ebx
xor ebp, eax
or ebp, edi
sar esi, 0x1f
xor ebp, ebx
or ecx, esi
sar ebp, 0x1f
and ecx, ebp
mov ebp, dword [esp + 8]
and esi, ebp
mov eax, dword [esp + 0xf0]
movzx eax, byte [eax + ebx]
and al, cl
mov edi, dword [esp + 0xc]
or byte [edi + ebp], al
mov edi, ebp
mov ebp, dword [esp + 0x100]
or edx, esi
lea eax, [edi + 1]
mov esi, 0xfffffffe
sub esi, edi
mov edi, eax
sub edi, ebp
and esi, edi
mov edi, dword [esp]
sar esi, 0x1f
and esi, eax
inc ebx
dec edi
jne 0x699850
mov eax, dword [esp + 0x104]
movzx eax, al
mov dword [esp], eax
not eax
mov dword [esp + 8], eax
cmp ebp, 1
mov eax, ebp
adc eax, 0
mov dword [esp + 4], eax
xor ebp, ebp
nop word cs:[eax + eax]
mov ecx, edx
and ecx, 0xffffffdf
mov eax, edx
or eax, 0x20
test dl, 0x20
mov ebx, 0
mov esi, 0xff
cmove ebx, esi
mov esi, dword [esp + 0xc]
movzx ecx, byte [esi + ecx]
mov edi, ebx
and edi, ecx
movzx eax, byte [esi + eax]
not ebx
and ebx, eax
or ebx, edi
movzx ecx, byte [esp + ebp + 0x1c]
mov edi, dword [esp]
and edi, ebx
mov eax, dword [esp + 8]
and eax, ecx
or eax, edi
lea ebx, [edx + 1]
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp], al
mov eax, 0xfffffffe
sub eax, edx
mov ecx, ebx
sub ecx, dword [esp + 0x100]
and eax, ecx
sar eax, 0x1f
and eax, ebx
inc ebp
mov edx, eax
cmp dword [esp + 4], ebp
jne 0x6998f0
mov eax, 1
jmp 0x699965
xor eax, eax
add esp, 0xdc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x699970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, 1
setne cl
add ecx, esi
mov edi, dword [ebx]
xor eax, eax
cmp ecx, edi
ja 0x6999eb
mov ebp, dword [esp + 0x24]
cmp edx, 1
jne 0x6999d2
cmp dword [esp + 0x20], esi
jb 0x6999eb
cmp esi, 0x40
ja 0x6999eb
mov eax, 1
test esi, esi
je 0x6999eb
sub edi, esi
mov dword [ebx], edi
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x6999c2
add ebp, edi
mov dword [ecx], ebp
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x6999eb
mov dword [ecx], 0
jmp 0x6999eb
movzx edx, byte [ebp + edi - 1]
cmp dword [esp + 0x38], 0
je 0x6999f3
not esi
add edi, esi
sub edi, edx
mov dword [ebx], edi
mov eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add ecx, edx
mov ebx, ecx
xor ebx, edi
mov eax, edi
sub eax, ecx
xor eax, ecx
or eax, ebx
xor eax, edi
not eax
sar eax, 0x1f
cmp edi, 0x100
mov ecx, 0x100
cmovb ecx, edi
test edi, edi
mov dword [esp], edi
je 0x699a2f
mov esi, edi
xor edi, edi
cmp esi, 4
jae 0x699a36
mov esi, edx
mov ebp, ecx
jmp 0x699af9
mov esi, edx
jmp 0x699b2e
mov edi, ecx
and edi, 0x1fc
movd xmm1, eax
movaps xmm0, xmmword [0xa48890]
movss xmm0, xmm1
mov dword [esp + 4], edx
movd xmm2, edx
pshufd xmm1, xmm2, 0
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0
lea eax, [esi + ebp]
add eax, 0xfffffffc
mov edx, ecx
mov ebp, ecx
and ebp, 0xfffffffc
neg ebp
movdqa xmm4, xmmword [0xa488a0]
xor ecx, ecx
por xmm1, xmmword [0xa488b0]
pxor xmm5, xmm5
movdqa xmm7, xmmword [0xa488c0]
movdqa xmm3, xmm4
pxor xmm3, xmmword [0xa488b0]
pcmpgtd xmm3, xmm1
movd xmm6, dword [eax + ecx]
punpcklbw xmm6, xmm5
pshuflw xmm6, xmm6, 0x1b
packuswb xmm6, xmm6
pxor xmm6, xmm2
punpcklbw xmm6, xmm5
punpcklwd xmm6, xmm5
pxor xmm6, xmmword [0xa488d0]
por xmm6, xmm3
pand xmm0, xmm6
paddd xmm4, xmm7
add ecx, 0xfffffffc
cmp ebp, ecx
jne 0x699a90
pshufd xmm1, xmm0, 0xee
pand xmm1, xmm0
pshufd xmm0, xmm1, 0x55
pand xmm0, xmm1
movd eax, xmm0
mov ebp, edx
cmp edx, edi
mov esi, dword [esp + 4]
je 0x699b2e
mov ecx, edi
not ecx
add ecx, dword [esp]
add ecx, dword [esp + 0x24]
nop word cs:[eax + eax]
movzx edx, byte [ecx]
mov ebx, esi
xor dl, bl
cmp edi, esi
movzx edx, dl
not edx
mov ebx, 0xffffffff
cmova edx, ebx
and eax, edx
inc edi
dec ecx
cmp ebp, edi
jne 0x699b10
xor ecx, ecx
xor ebx, ebx
cmp al, 0xff
not esi
cmovne esi, ecx
sete bl
neg ebx
add esi, dword [esp]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
mov edx, dword [esp + 0x20]
push dword [esp + 0x3c]
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call fcn.00699710
add esp, 0x24
jmp 0x6999ee
Function at 0x69a0f0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x69a110
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret