joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101afaf0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102bff3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
push esi
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x209], al
lea eax, [ebp - 0x148]
push ecx
push eax
mov dword [ebp - 0x210], edi
call fcn.101d11a0
mov eax, dword [ebp - 0x20c]
mov dword [ebp + esi - 0x148], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [esi + 4]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x148]
push eax
push esi
push edi
call fcn.101b0260
mov eax, dword [ebp - 0x18]
add esp, 0x20
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x18]
cmp eax, 1
jle 0x101afcf6
lea ecx, [ebp - 0x2c]
sub ebx, ecx
dec eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x20c], eax
lea ecx, [ecx]
cmp dword [ebp + 0xc], 0x40
mov edi, esi
mov esi, dword [ebp - 0x210]
jle 0x101afbe5
lea eax, [ebp - 0x208]
push eax
call fcn.101b0c60
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.101b2880
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.101b0af0
add esp, 0x18
lea esi, [ebp - 0x40]
mov edi, 0x14
push 0x41
lea eax, [ebp - 0x84]
push 0x36
push eax
call fcn.101d1720
push 0x41
lea eax, [ebp - 0xc8]
push 0x5c
push eax
call fcn.101d1720
add esp, 0x18
test edi, edi
jle 0x101afc42
mov eax, esi
lea edx, [ebp - 0x84]
neg eax
lea ebx, [ebp - 0xc8]
add edx, eax
add eax, ebx
mov dword [ebp - 0x214], eax
mov ebx, eax
mov cl, byte [esi]
lea eax, [edx + esi]
xor byte [eax], cl
lea eax, [ebx + esi]
xor byte [eax], cl
lea esi, [esi + 1]
sub edi, 1
jne 0x101afc28
mov ebx, dword [ebp - 0x218]
lea eax, [ebp - 0x1a8]
push eax
call fcn.101b0c60
push 0x40
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.101b2880
push 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.101b2880
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.101b0af0
lea eax, [ebp - 0x1a8]
push eax
call fcn.101b0c60
push 0x40
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.101b2880
push 0x14
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.101b2880
add esp, 0x40
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.101b0af0
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x2c]
add ecx, eax
lea edx, [ebx + ecx]
mov cl, byte [ecx]
xor byte [edx], cl
mov byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 0x14
jl 0x101afcd0
sub dword [ebp - 0x20c], 1
mov esi, dword [ebp + 0xc]
jne 0x101afba0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101b70aa
mov esp, ebp
pop ebp
ret
Function at 0x101b0260
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x102bff3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], ebx
cmp edi, 0x40
jle 0x101b02c8
lea eax, [ebp - 0x160]
push eax
call fcn.101b0c60
push edi
lea eax, [ebp - 0x160]
push esi
push eax
call fcn.101b2880
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101b0af0
add esp, 0x18
lea esi, [ebp - 0x18]
mov edi, 0x14
push 0x41
lea eax, [ebp - 0x5c]
push 0x36
push eax
call fcn.101d1720
push 0x41
lea eax, [ebp - 0xa0]
push 0x5c
push eax
call fcn.101d1720
add esp, 0x18
test edi, edi
jle 0x101b031a
lea edx, [ebp - 0x5c]
lea ebx, [ebp - 0xa0]
sub edx, esi
sub ebx, esi
lea esp, [esp]
mov cl, byte [esi]
lea eax, [edx + esi]
xor byte [eax], cl
lea eax, [ebx + esi]
xor byte [eax], cl
lea esi, [esi + 1]
sub edi, 1
jne 0x101b0300
mov ebx, dword [ebp - 0x164]
lea eax, [ebp - 0x100]
push eax
call fcn.101b0c60
push 0x40
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.101b2880
push dword [ebp + 0x14]
lea eax, [ebp - 0x100]
push dword [ebp - 0x168]
push eax
call fcn.101b2880
lea eax, [ebp - 0x100]
push eax
push ebx
call fcn.101b0af0
lea eax, [ebp - 0x100]
push eax
call fcn.101b0c60
push 0x40
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.101b2880
push 0x14
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.101b2880
add esp, 0x40
lea eax, [ebp - 0x100]
push eax
push ebx
call fcn.101b0af0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.101b70aa
mov esp, ebp
pop ebp
ret
Function at 0x101b03b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x102bff3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x19c], eax
push edi
cmp esi, 0x40
jle 0x101b0418
lea eax, [ebp - 0x194]
push eax
call fcn.101b3a10
lea eax, [ebp - 0x194]
push eax
push esi
push ebx
call fcn.101b4bf0
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.101b4af0
add esp, 0x18
lea ebx, [ebp - 0x58]
mov esi, 0x14
lea eax, [ebp - 0xdc]
push eax
call fcn.101b3a10
add esp, 4
xor edx, edx
test esi, esi
jle 0x101b0445
mov edi, ebx
lea eax, [ebp - 0x44]
sub edi, eax
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, esi
jl 0x101b0434
cmp esi, 0x40
jge 0x101b0469
mov ecx, 0x40
lea edi, [ebp - 0x44]
sub ecx, esi
add edi, esi
mov edx, ecx
mov eax, 0x36363636
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.101b4bf0
lea eax, [ebp - 0xdc]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x198]
call fcn.101b4bf0
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.101b4af0
lea eax, [ebp - 0x138]
push eax
call fcn.101b3a10
add esp, 0x24
xor edx, edx
test esi, esi
jle 0x101b04d1
lea eax, [ebp - 0x44]
sub ebx, eax
lea ebx, [ebx]
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [ebx + ecx]
xor al, 0x5c
mov byte [ecx], al
cmp edx, esi
jl 0x101b04c0
cmp esi, 0x40
jge 0x101b04f5
mov ecx, 0x40
lea edi, [ebp - 0x44]
sub ecx, esi
add edi, esi
mov edx, ecx
mov eax, 0x5c5c5c5c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.101b4bf0
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x6c]
push 0x14
push eax
call fcn.101b4bf0
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.101b4af0
mov eax, dword [ebp + 0x1c]
add esp, 0x20
pop edi
pop esi
pop ebx
cmp eax, 0x14
jle 0x101b053c
mov eax, 0x14
test eax, eax
jle 0x101b0553
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x19c]
call fcn.101d11a0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101b70aa
mov esp, ebp
pop ebp
ret
Function at 0x101b0570
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [0x102bff3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x304], eax
push edi
cmp esi, 0x40
jle 0x101b05e5
lea eax, [ebp - 0x2fc]
push eax
call fcn.101b52e0
lea eax, [ebp - 0x2fc]
push eax
lea eax, [esi*8]
push eax
push ebx
call fcn.101b4ca0
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x2fc]
push eax
call fcn.101b4e60
add esp, 0x18
lea ebx, [ebp - 0x84]
mov esi, 0x40
lea eax, [ebp - 0x1ac]
push eax
call fcn.101b52e0
add esp, 4
xor edx, edx
test esi, esi
jle 0x101b0612
mov edi, ebx
lea eax, [ebp - 0x44]
sub edi, eax
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, esi
jl 0x101b0601
cmp esi, 0x40
jge 0x101b0636
mov ecx, 0x40
lea edi, [ebp - 0x44]
sub ecx, esi
add edi, esi
mov edx, ecx
mov eax, 0x36363636
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x44]
push 0x200
push eax
call fcn.101b4ca0
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [ebp + 0x14]
shl eax, 3
push eax
push dword [ebp - 0x300]
call fcn.101b4ca0
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.101b4e60
lea eax, [ebp - 0x254]
push eax
call fcn.101b52e0
add esp, 0x24
xor edx, edx
test esi, esi
jle 0x101b06a2
lea eax, [ebp - 0x44]
sub ebx, eax
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [ebx + ecx]
xor al, 0x5c
mov byte [ecx], al
cmp edx, esi
jl 0x101b0691
cmp esi, 0x40
jge 0x101b06c6
mov ecx, 0x40
lea edi, [ebp - 0x44]
sub ecx, esi
add edi, esi
mov edx, ecx
mov eax, 0x5c5c5c5c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x44]
push 0x200
push eax
call fcn.101b4ca0
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0xc4]
push 0x200
push eax
call fcn.101b4ca0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.101b4e60
mov eax, dword [ebp + 0x1c]
add esp, 0x20
pop edi
pop esi
pop ebx
cmp eax, 0x40
jle 0x101b0719
mov eax, 0x40
test eax, eax
jle 0x101b0733
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x304]
call fcn.101d11a0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101b70aa
mov esp, ebp
pop ebp
ret
Function at 0x101cae10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022dd3b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102bff3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push edi
call fcn.101cea20
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x24]
mov dword [edi + 0x18], 0
mov ecx, esi
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.101cb1d0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101f45d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101f4296

Function at 0x101f45de
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101f4417

Function at 0x101fa102
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101f9dc2

Function at 0x1020221f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4397c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x43989b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x439836
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00439400
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x439804
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x439954
call fcn.00439848
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x4398f3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00439400
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4398ac
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x439954
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00439400
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x43994f
jmp 0x439954
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4399c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x439aa4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x439a3f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00439560
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x439a0d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x439b5d
call fcn.00439a51
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x439afc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00439690
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x439ab5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x439b5d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00439690
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x439b58
jmp 0x439b5d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43ac00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x43acea
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x43ac7d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0043a3c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x43ac43
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x43adb3
call fcn.0043ac8f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x43ad4a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0043a7e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x43acfb
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x43adb3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0043a7e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x43adae
jmp 0x43adb3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43bae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bafe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x43bb40
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bb5e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x43bba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bbc2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x43bc20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bc42
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x43bca0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bcca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x43bd30
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bd5a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x43bdc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43be1f
Function at 0x43be2e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43be10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x43bea0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x43beff

Function at 0x43bf0e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x43bef0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret