joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4253d7
Capabilities:
Encode data using xor

Disassembly:
in al, dx
int 0xd1
xchg edx, eax
push esi
invalid
movsb byte es:[edi], byte [esi]
xchg edi, eax
invalid
lahf
dec esi
xchg dword [edi - 0x19], ecx
popfd
test bp, si
sbb eax, dword [eax]
sbb dword [ecx], ebx
jbe 0x42535e
sbb dword [esi - 0x7d], esi
jl 0x425373
fyl2xp1
dec ebp
push es
lodsd eax, dword [esi]
pop ds
mov edx, 0xb30656fb
scasd eax, dword es:[edi]
or eax, 0x18c64317
call 0x407d5fc6
xor edi, edx
dec ecx
or eax, dword [ebx - 0x6d]
sti
jne 0x4253d8
jmp 0x425419
dec ecx
dec ebx
xchg eax, edi
push 0x9aa3cec
cmp dword [edi + 0x4d], edx
inc edi
and edi, edi
push 0x1e
out 0xd8, eax
and byte [esi], cl
xchg ebp, ebp
push ebx
adc byte [0x63a4019], bh
jae 0x4253cc
sahf
mov bl, 0x88
sub esp, dword [edi + 0x27]
pushfd
add eax, 0x2f3676c7
cmp esp, dword [edi - 8]
mov al, 0xf5
xchg bl, bl
sub byte [edi], dh
dec ecx
dec ebx
enter 0x176a, 0xfffffffffffffff9
pop ebp
mov dl, 0xfa
cmovnp eax, ecx
add esi, dword [edi - 0x40]
jl 0x42546f
loope 0x42543a
shr ch, 0x8c
sbb byte [edx], al
dec ecx
cld
mov edx, 0xa3cbbef8
fdiv dword [bx + di + 0x3e]
sub ah, al
outsd dx, dword [esi]
and ebx, eax
xchg edx, eax
or byte [ebp + 0x56f27156], bh
sti
pop es
sti
lahf
cmp al, 0x1d
leave
std
cmp esp, edx
les edx, [esi + 0x143d711e]
cmc
pop ebx
cmp dword [ecx - 0x4fcb20f8], 0x20aa4daf
enter 0x5c7c, 0x6e
das
not dword [ecx]
mov ah, 0x8a
salc
invalid

Function at 0x4475ab
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.004689c9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4475f6
push 0x80004005
call fcn.0044637b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.004689c9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447626
push 0x80004005
call fcn.0044637b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004689c9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447653
push 0x80004005
call fcn.0044637b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
and byte [edx + 0x79], ch
Function at 0x45e48b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0047f8a9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e4d6
push 0x80004005
call fcn.0045d25b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0047f8a9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e506
push 0x80004005
call fcn.0045d25b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0047f8a9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e533
push 0x80004005
call fcn.0045d25b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0045dc8b
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0045dc8b
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4734fb
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
pop ds
dec esp
shr byte [0x5d496913], 1
daa
adc esp, dword [esi - 0x1fac2d6f]
mov ecx, 0xa55f1e82
pop edi
out 0x23, eax
inc ebp
or esp, esi
test eax, 0x3cdd2ef4
std
insb byte es:[edi], dx
inc ebx
add esp, dword [esi - 0xab1778c]
int1
and eax, 0x2f3c6745
push esi
iretd
stc
and al, 0xdf
mov byte [eax - 0x6e], cl
arpl word [ebp + 0x60], bp
jae 0x4734dd
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
jne 0x4734ea
jne 0x473401
push es
sub bl, byte [esp + 0x44ec3323]
loopne 0x4734f2
cld
xchg bl, cl
lds edi, [ebp - 0x3e8c3822]
mov esi, 0x90ebcda7
invalid
add esp, dword [0xf650a3c6]
imul esp, dword [ebx - 0x7dbca4a4]
test ecx, ecx
arpl word [esi - 0x5b9f7ac4], cx
or al, 0xd9
mov edx, 0x9e11a73f
mov esi, 0x6cbed441
adc ecx, dword [edx + 0x1989de5c]
out 0xf2, al
daa
pop ebx
dec edx
wait
bound esi, qword [ebx - 0x1e]
cmp al, 0xea
jae 0x473544
int 0xad
or al, 0x25
dec edi
jb 0x473465
cmpsd dword [esi], dword es:[edi]
in eax, dx
stosb byte es:[edi], al
mov esi, 0x2428a32a
xlatb
inc ebp
mov ebp, 0x73ef8afb
jae 0x47349e
mov dl, 0xae
scasb al, byte es:[edi]
mov byte es:[edx + 0x3f], bh
jg 0x473531
outsb dx, byte ds:[esi]
outsb dx, byte [esi]
and al, 0xda
je 0x473571
mov gs, word [edi + 0x71]
sbb byte [ecx + 0x4aafacdb], bh
sbb al, 0xd1
mov esi, 0xcc5f8ff3
sub eax, 0x241f5c2d
and dword [ecx + 0x50], ebp
mov esp, 0xb0c3e255
or byte [ebx + 0x39], 0xb
loope 0x4734a4
dec esi
jno 0x473527
mov byte [0x8a6f1edf], al
outsd dx, dword [esi]
mov byte [ebp - 0x5b], al
xchg edi, eax
dec ebp
loopne 0x4734eb
test al, 0x4b
inc edx
stosd dword es:[edi], eax
lds ebp, [ecx]
sbb ch, 0x79
dec edi
jb 0x4734d7
imul edx, dword [eax], 0x8462edd2
and dword ds:[edi + esi*4], edx
das
clc
sahf
dec ebx
dec ecx
les esi, [edi - 0x26397261]
mov ebx, 0x3c10bd6e
mov eax, dword [0x86171b36]
adc ah, cl
mov ecx, 0x7e1024d3
pop ds
jle 0x47357f
xor al, 0x7a
sub eax, 0x20819714
push edx
push es
jnp 0x47355e
mov byte [ebp - 0x52], dh
sbb dl, byte [esi + 0x47297c0]
push edx
cwde
xchg ebp, eax
rcl byte [edi - 0x67adfb8e], 0x95
xor bh, dh
std
sbb al, 0x85
sahf
ret 0x1391
Function at 0x48cbbb
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.004adfd9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc06
push 0x80004005
call fcn.0048b98b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.004adfd9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc36
push 0x80004005
call fcn.0048b98b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004adfd9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc63
push 0x80004005
call fcn.0048b98b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0048c3bb
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0048c3bb
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d5fb
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call fcn.004adfd9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d655
push 0x80004005
call fcn.0048b98b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.004adfd9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d688
push 0x80004005
call fcn.0048b98b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x13c], edi
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0048d53b
mov eax, dword [ebp - 0x134]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jne 0x48d726
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d6da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d6fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x134]
call fcn.0048c9bb
add esp, 8
push 5
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
call fcn.0048c58b
mov eax, dword [eax]
push 0x54ef60
Function at 0x4a3e7b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c5299
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ec6
push 0x80004005
call fcn.004a2c4b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c5299
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ef6
push 0x80004005
call fcn.004a2c4b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c5299
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f23
push 0x80004005
call fcn.004a2c4b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a367b
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a367b
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b462d
Capabilities:
Encode data using xor

Disassembly:
pop edi
inc esi
shl byte [ebx + 0x54], cl
adc eax, 0xf5497f81
invalid
js 0x4b45ce
dec eax
pop es
add al, byte [esi - 0x76]
or eax, 0x289d4b73
add ecx, 0xffffffe2
insb byte es:[edi], dx
xor al, 0x55
shl bl, 0xa3
das
cmp dl, cl
ret 0x818f
sub ebp, dword [edi + 0x2c]
test eax, 0xf02c03af
dec ecx
mov eax, dword [0x9c7a527f]
mov ch, byte [esi - 0xa]
jb 0x4b45f4
add eax, ebx
inc eax
cmp dword [ecx], 0x3f48cd7d
pop edx
dec edi
pop ecx
outsb dx, byte [esi]
imul eax, dword [esi - 0x1b6890f], 0xfa275a0c
movq qword [edi - 0x59], mm0
xor byte [ebx + 0x500a5d99], 0xe3
call 0xa25ee47f
add dword [ecx + 0x768ebc97], 0x27
mov ecx, 0xdde1f927
inc ecx
or dword [ecx], ebx
xor byte [ebx + 0x4ef32380], 0x85
push esp
invalid

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401700
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40170a
repz ret
jmp fcn.00401a30
Function at 0x40d7e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d7fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x40d840
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d85e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x40d8a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d8c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x40d920
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d942
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x40d9a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40d9ca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x40da30
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40da5a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x40dac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40db1f

Function at 0x40db2e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40db10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x40dba0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x40dbff

Function at 0x40dc0e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40dbf0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x410280
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4107a0
test edx, edx
je 0x4107a0
call fcn.00410297
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4107e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00410280
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x410851
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x410816
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x415440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x41551b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4154b6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00415080
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x415484
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4155d4
call fcn.004154c8
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x415573
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00415080
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x41552c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4155d4
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00415080
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4155cf
jmp 0x4155d4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x415724
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4156bf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004151e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x41568d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4157dd
call fcn.004156d1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x41577c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00415310
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x415735
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4157dd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00415310
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4157d8
jmp 0x4157dd
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret