joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fca0
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x55fcd6
mov dword [esi], str.TtdecompressBlockCacheD
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov ebx, dword [esp + 0x38]
xor edx, edx
mov eax, dword [esp + 0x3c]
mov edi, dword [ebx + 0x2c]
div edi
mov ecx, dword [ebx + 0x28]
mov edx, edi
mov ebp, eax
cmp edi, ecx
jle 0x55fcf4
mov edx, ecx
xor ebp, ebp
mov esi, edi
imul esi, ebp
lea eax, [esi + edx]
cmp eax, ecx
jle 0x55fd04
mov edx, ecx
sub edx, esi
mov eax, dword [esp + 0x44]
mov ecx, dword [ebx + 0x6c]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 0x31]
mov byte [esp + 0x20], al
movzx eax, byte [ebx + 0x30]
mov byte [esp + 0x21], al
mov eax, dword [ebx + 0x38]
push dword [esp + 0x40]
add eax, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], eax
sub esp, 0x20
mov eax, dword [ebx + 0x3c]
add eax, ecx
mov dword [esp + 0x3c], edi
movups xmm0, xmmword [esp + 0x38]
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0x40]
add eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 0x64]
imul eax, ebp
add eax, dword [ebx + 0x44]
add eax, ecx
mov dword [esp + 0x54], eax
mov eax, esp
movups xmmword [eax], xmm0
movups xmm0, xmmword [esp + 0x48]
movups xmmword [eax + 0x10], xmm0
call fcn.0055fc00
add esp, 0x24
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x55fda2
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x38]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x55fe00
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x55fe34
mov dword [esi], str.TtcacheD
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push dword [esp + 0x1c]
mov eax, dword [ebx]
call dword [eax + 0x40]
mov esi, dword [esp + 0x24]
mov ebp, eax
mov ebx, dword [ebx + 0x2c]
imul ebx, dword [esp + 0x20]
mov ecx, dword [esi]
shl ebx, 2
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push ebx
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [esi]
cmp byte [eax], 0
mov eax, dword [ecx]
jne 0x55fe90
push ebx
push ebp
call dword [eax + 0xc]
mov ecx, dword [esi]
mov edi, eax
push ebx
push ebp
mov eax, dword [ecx]
test edi, edi
jne 0x55fee2
call dword [eax + 0x10]
mov ecx, dword [esi]
mov edi, eax
mov eax, dword [ecx]
test edi, edi
jne 0x55fe97
call dword [eax + 0x30]
xor edi, edi
jmp 0x55fef1
push ebx
push ebp
lea edx, [esp + 0x2c]
push edx
call dword [eax + 0x18]
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push ebx
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x30]
push dword [esp + 0x20]
push edi
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.0055fca0
mov ecx, dword [esi]
add esp, 0x10
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi]
lea edx, [esp + 0x20]
push ebx
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x55feea
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x18]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x30]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 0xc]
jae 0x55ff20
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], ecx
lea ecx, [esi + 0xc]
mov dword [ebx + 4], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x561260
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x2c]
mov eax, ecx
shr eax, 8
mov byte [esp + 8], al
movzx eax, cl
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push ebx
push eax
push dword [esp + 0x30]
mov byte [esp + 0x15], cl
call fcn.005812e0
add esp, 8
mov ebx, eax
mov dword [esp + 4], ebx
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebx + 0x7f]
and ecx, 0xffffff80
mov ebx, dword [eax + 0xc]
lea edx, [ebx + ecx]
cmp ecx, dword [eax + 8]
jg 0x5612ba
cmp edx, dword [eax + 0x10]
ja 0x5612ba
mov dword [eax + 0xc], edx
jmp 0x5612c4
push ecx
mov ecx, eax
call fcn.0046a3c0
mov ebx, eax
mov eax, dword [esp + 0x40]
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [esp + 0x30], edi
jbe 0x5613b1
mov ecx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x50]
mov eax, dword [esp + 0x40]
movss xmm0, dword [eax + edi*4]
mov eax, dword [esp + 0x44]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [eax + edi*4]
mov eax, dword [esp + 0x48]
movss dword [esp + 0x1c], xmm0
test eax, eax
je 0x56130e
mov al, byte [eax + edi]
jmp 0x561312
mov al, byte [esp + 0x3d]
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.005812e0
movzx esi, byte [esp + 0x20]
add esp, 8
mov dword [esp + 0x10], eax
mov ecx, esi
or eax, 0xffffffff
mov dword [esp + 0x24], esi
shl eax, cl
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x20]
divss xmm0, dword [esp + 0x1c]
call fcn.006081c0
mov edx, 1
mov dword [esp + 0x28], eax
mov ecx, esi
shl edx, cl
cmp eax, edx
jne 0x561366
dec eax
mov dword [esp + 0x28], eax
push dword [esp + 0x10]
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x28]
push ebx
push eax
push esi
call fcn.00581820
push dword [esp + 0x48]
add esi, eax
lea eax, [esp + 0x2c]
push ebp
push eax
push ebx
mov dword [esp + 0x34], esi
call fcn.005814c0
push dword [esp + 0x58]
push ebp
call fcn.00581bb0
mov ecx, dword [esp + 0x60]
inc edi
add esp, 0x28
lea ebp, [ebp + ecx*4]
cmp edi, dword [esp + 0x34]
jb 0x5612e3
pop ebp
mov esi, dword [esp + 0xc]
push dword [0x884adc]
add esi, 0x7f
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
pop edi
cmp esi, dword [eax + 8]
pop esi
jg 0x5613e9
lea ecx, [edx + ebx]
cmp ecx, dword [eax + 0xc]
jne 0x5613e9
cmp dword [eax + 0x14], ebx
je 0x5613e9
mov dword [eax + 0xc], ebx
pop ebx
add esp, 0x20
ret
push edx
push ebx
mov ecx, eax
call fcn.0046a590
pop ebx
add esp, 0x20
ret
Function at 0x561400
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
sub esp, 0x20
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x561434
mov dword [esi], str.TtdecompressBlockCacheW
rdtsc
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov esi, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
push dword [esp + 0x34]
movzx eax, byte [esi + 0x31]
mov edi, dword [esi + 0x64]
sub esp, 0x1c
mov ecx, dword [esi + 0x2c]
mov byte [esp + 0x34], al
movzx eax, byte [esi + 0x30]
mov byte [esp + 0x35], al
mov eax, dword [esi + 0x38]
add eax, edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x3c]
add eax, edi
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x40]
add eax, edi
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x50]
div ecx
mov ecx, dword [esi + 0x54]
movups xmm0, xmmword [esp + 0x2c]
lea eax, [ecx + eax*4]
mov ecx, dword [eax + edi]
mov eax, esp
add ecx, dword [esi + 0x5c]
add ecx, edi
movups xmmword [eax], xmm0
movq xmm0, qword [esp + 0x3c]
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], ecx
call fcn.00561260
add esp, 0x20
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x5614e1
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
add esp, 0x20
ret
Function at 0x561540
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x561574
mov dword [esi], str.TtcacheW
rdtsc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push dword [esp + 0x1c]
mov eax, dword [ebx]
call dword [eax + 0x40]
mov esi, dword [esp + 0x24]
mov ebp, eax
mov ebx, dword [ebx + 0x2c]
imul ebx, dword [esp + 0x20]
mov ecx, dword [esi]
shl ebx, 2
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push ebx
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [esi]
cmp byte [eax], 0
mov eax, dword [ecx]
jne 0x5615d0
push ebx
push ebp
call dword [eax + 0xc]
mov ecx, dword [esi]
mov edi, eax
push ebx
push ebp
mov eax, dword [ecx]
test edi, edi
jne 0x561622
call dword [eax + 0x10]
mov ecx, dword [esi]
mov edi, eax
mov eax, dword [ecx]
test edi, edi
jne 0x5615d7
call dword [eax + 0x30]
xor edi, edi
jmp 0x561631
push ebx
push ebp
lea edx, [esp + 0x2c]
push edx
call dword [eax + 0x18]
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push ebx
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x30]
push dword [esp + 0x20]
push edi
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00561400
mov ecx, dword [esi]
add esp, 0x10
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi]
lea edx, [esp + 0x20]
push ebx
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x56162a
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x18]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x30]
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 0xc]
jae 0x561660
mov dword [esi], 0x77f5ec
rdtsc
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], ecx
lea ecx, [esi + 0xc]
mov dword [ebx + 4], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x569020
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.00568f00
mov eax, dword [esp + 8]
test al, 1
je 0x569072
test al, 4
jne 0x569067
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x56904a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x56a850
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub esp, 8
push esi
push edi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [esp + 0x20]
mov edi, dword [eax + 0xc]
lea esi, [edx + edx*2]
shl esi, 4
add esi, 0x7f
and esi, 0xffffff80
lea ecx, [edi + esi]
cmp esi, dword [eax + 8]
jg 0x56a886
cmp ecx, dword [eax + 0x10]
ja 0x56a886
mov dword [eax + 0xc], ecx
jmp 0x56a894
push esi
mov ecx, eax
call fcn.0046a3c0
mov edx, dword [esp + 0x20]
mov edi, eax
test edx, edx
jle 0x56a98b
mov ecx, dword [esp + 0x18]
mov edx, edi
sub edx, ecx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x20]
lea eax, [ecx + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 8]
mov ecx, edi
nop dword [eax]
movaps xmm5, xmmword [eax]
movaps xmm3, xmmword [eax - 0x10]
movaps xmm6, xmm5
movaps xmm4, xmm3
shufps xmm6, xmm5, 0xff
mulps xmm4, xmm5
movaps xmm2, xmm3
shufps xmm2, xmm3, 0xc9
movaps xmm1, xmm3
shufps xmm1, xmm3, 0xd2
movaps xmm0, xmm4
shufps xmm0, xmm4, 0x55
addss xmm0, xmm4
shufps xmm4, xmm4, 0xaa
addss xmm4, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xd2
mulps xmm2, xmm0
movaps xmm0, xmm5
shufps xmm0, xmm5, 0xc9
mulps xmm1, xmm0
shufps xmm4, xmm4, 0
mulps xmm4, xmm5
subps xmm2, xmm1
mulps xmm2, xmm6
mulps xmm6, xmm6
addps xmm6, xmmword [0x7195c0]
mulps xmm6, xmm3
addps xmm6, xmm4
addps xmm2, xmm6
addps xmm2, xmm2
movaps xmmword [ecx], xmm2
xorps xmm2, xmmword [0x719130]
movaps xmmword [ecx], xmm2
movaps xmm0, xmmword [eax]
xorps xmm0, xmmword [0x719d70]
movaps xmmword [edx + eax], xmm0
movaps xmm1, xmmword [eax + 0x10]
add eax, 0x30
movaps xmm0, xmm1
unpckhps xmm0, xmmword [0x719330]
shufps xmm1, xmm0, 0xc4
rcpps xmm2, xmm1
movaps xmm0, xmm2
mulps xmm0, xmm1
mulps xmm0, xmm2
addps xmm2, xmm2
subps xmm2, xmm0
andps xmm2, xmmword [0x719150]
movaps xmmword [ecx + 0x20], xmm2
add ecx, 0x30
sub dword [esp + 0xc], 1
jne 0x56a8c0
mov edx, dword [esp + 0x20]
push dword [esp + 0x24]
push edx
push dword [esp + 0x24]
push edi
push dword [esp + 0x24]
call fcn.0056a9e0
add esp, 0x14
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
jg 0x56a9ce
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x56a9ce
cmp dword [eax + 0x14], edi
je 0x56a9ce
mov dword [eax + 0xc], edi
pop edi
pop esi
add esp, 8
ret
push edx
push edi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
add esp, 8
ret

Function at 0x56d3a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0056cd80
mov eax, dword [esp + 8]
test al, 1
je 0x56d3f5
test al, 4
jne 0x56d3e7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x98
cmp ax, cx
je 0x56d3ca
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x98
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x57e4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
cmp dword [ebp + 8], 0
push esi
push edi
jle 0x57e63a
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, edi
sub esi, eax
lea ecx, [eax + 0x10]
mov dword [esp + 0xc], ecx
mov eax, dword [ebp + 0xc]
movaps xmm4, xmmword [eax + 0x10]
movaps xmm2, xmmword [eax]
movaps xmm5, xmm4
movaps xmm3, xmm2
shufps xmm5, xmm4, 0xff
mulps xmm3, xmm4
movaps xmm6, xmm2
shufps xmm6, xmm2, 0xc9
movaps xmm1, xmm2
shufps xmm1, xmm2, 0xd2
movaps xmm0, xmm3
shufps xmm0, xmm3, 0x55
addss xmm0, xmm3
shufps xmm3, xmm3, 0xaa
addss xmm3, xmm0
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xd2
mulps xmm6, xmm0
movaps xmm0, xmm4
shufps xmm0, xmm4, 0xc9
mulps xmm1, xmm0
shufps xmm3, xmm3, 0
mulps xmm3, xmm4
subps xmm6, xmm1
movaps xmm1, xmmword [eax + 0x20]
movaps xmm0, xmm1
unpckhps xmm0, xmmword [0x719330]
shufps xmm1, xmm0, 0xc4
mulps xmm6, xmm5
mulps xmm5, xmm5
addps xmm5, xmmword [0x7195c0]
mulps xmm5, xmm2
rcpps xmm2, xmm1
addps xmm5, xmm3
movaps xmm3, xmmword [edi]
movaps xmm0, xmm2
movaps xmm4, xmm3
mulps xmm0, xmm1
addps xmm6, xmm5
mulps xmm0, xmm2
addps xmm2, xmm2
addps xmm6, xmm6
subps xmm2, xmm0
xorps xmm6, xmmword [0x719130]
movaps xmmword [esp + 0x10], xmm6
andps xmm2, xmmword [0x719150]
movaps xmmword [esp + 0x20], xmm6
movaps xmm6, xmmword [0x719d70]
xorps xmm6, xmmword [eax + 0x10]
mulps xmm4, xmm6
movaps xmm1, xmm6
movaps xmmword [esp + 0x40], xmm2
movaps xmm5, xmm6
movaps xmm2, xmm6
shufps xmm1, xmm6, 0xd2
shufps xmm2, xmm6, 0xc9
movaps xmm0, xmm4
shufps xmm5, xmm6, 0xff
shufps xmm0, xmm4, 0x55
addss xmm0, xmm4
movaps xmmword [esp + 0x30], xmm6
shufps xmm4, xmm4, 0xaa
addss xmm4, xmm0
movaps xmm0, xmm3
shufps xmm0, xmm3, 0xd2
mulps xmm2, xmm0
movaps xmm0, xmm3
shufps xmm0, xmm3, 0xc9
mulps xmm1, xmm0
shufps xmm4, xmm4, 0
mulps xmm4, xmm6
subps xmm2, xmm1
mulps xmm2, xmm5
mulps xmm5, xmm5
addps xmm5, xmmword [0x7195c0]
mulps xmm5, xmm3
addps xmm5, xmm4
addps xmm2, xmm5
addps xmm2, xmm2
addps xmm2, xmmword [esp + 0x10]
lea eax, [esi + ecx]
movaps xmmword [ecx - 0x10], xmm2
push eax
lea eax, [esp + 0x34]
push eax
call fcn.004782a0
movaps xmm0, xmmword [edi + 0x20]
add edi, 0x30
mov ecx, dword [esp + 0xc]
mulps xmm0, xmmword [esp + 0x40]
movaps xmmword [ecx + 0x10], xmm0
add ecx, 0x30
sub dword [ebp + 8], 1
mov dword [esp + 0xc], ecx
jne 0x57e4d6
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57f0c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x20]
xor edx, edx
push esi
push edi
mov dword [esp + 0xc], 0
mov esi, dword [ebp + 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], connect
mov dword [esp + 0x1c], esi
test esi, esi
je 0x57f132
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [esi*2 + 0x7f]
and ecx, 0xffffff80
mov edx, dword [eax + 0xc]
lea edi, [edx + ecx]
cmp ecx, dword [eax + 8]
jg 0x57f11e
cmp edi, dword [eax + 0x10]
ja 0x57f11e
mov dword [eax + 0xc], edi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x10]
jmp 0x57f136
push ecx
mov ecx, eax
call fcn.0046a3c0
mov edx, eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x10]
jmp 0x57f136
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
or esi, 0x80000000
mov dword [esp + 0x18], eax
mov ax, word [esp + 0x30]
mov dword [esp + 0x14], esi
movzx edi, ax
push ebx
mov bx, word [esp + 0x30]
test ax, ax
jle 0x57f1ab
nop dword [eax + eax]
cmp di, bx
je 0x57f1ab
and esi, 0x3fffffff
cmp edx, esi
jne 0x57f187
push 2
lea eax, [esp + 0x14]
push eax
push 0x7d8954
call fcn.00467c00
mov edx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [esp + 0x10]
movsx ecx, di
mov word [eax + edx*2], di
mov edx, dword [esp + 0x14]
mov eax, dword [ebp + 0xc]
inc edx
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], edx
movzx edi, word [eax + ecx*2]
test di, di
jg 0x57f160
mov ebp, dword [esp + 0x28]
test di, di
setns al
mov byte [ebp], al
test al, al
je 0x57f24a
and esi, 0x3fffffff
cmp edx, esi
jne 0x57f1e2
push 2
lea eax, [esp + 0x14]
push eax
push 0x7d8954
call fcn.00467c00
mov edx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [esp + 0x10]
mov word [eax + edx*2], bx
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
inc edx
mov dword [esp + 0x14], edx
mov edi, edx
mov eax, dword [ebx + 8]
and eax, 0x3fffffff
cmp eax, edx
jge 0x57f221
add eax, eax
cmp edx, eax
push 2
cmovl edx, eax
push edx
push ebx
push 0x7d8954
call fcn.00467b80
mov edx, dword [esp + 0x24]
add esp, 0x10
xor esi, esi
mov dword [ebx + 4], edi
test edi, edi
jle 0x57f24a
lea edx, [edi + edi]
nop dword [eax]
mov eax, dword [esp + 0x10]
lea edx, [edx - 2]
mov ecx, dword [ebx]
mov ax, word [edx + eax]
mov word [ecx + esi*2], ax
inc esi
cmp esi, edi
jl 0x57f230
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
xor eax, eax
cmp edi, dword [esp + 0x10]
push dword [0x884adc]
cmove edx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], edx
lea esi, [eax*2 + 0x7f]
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
pop ebx
cmp esi, dword [eax + 8]
jg 0x57f293
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x57f293
cmp dword [eax + 0x14], edi
je 0x57f293
mov dword [eax + 0xc], edi
jmp 0x57f29c
push edx
push edi
mov ecx, eax
call fcn.0046a590
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], 0
test ecx, ecx
js 0x57f2c7
mov edx, dword [0x7d8954]
and ecx, 0x3fffffff
add ecx, ecx
push ecx
push dword [esp + 0x10]
mov ecx, 0x7d8954
call dword [edx + 0x10]
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x14
ret
Function at 0x582160
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
push esi
push edi
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [esp + 0x1c]
mov esi, dword [eax + 0xc]
lea ecx, [edi*4 + 0x7f]
and ecx, 0xffffff80
mov dword [esp + 0xc], ecx
lea edx, [esi + ecx]
cmp ecx, dword [eax + 8]
jg 0x582198
cmp edx, dword [eax + 0x10]
ja 0x582198
mov dword [eax + 0xc], edx
jmp 0x5821a2
push ecx
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
push ebx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x1c]
cmp edi, 4
jl 0x5821fc
lea ebx, [edi - 4]
lea edx, [ebp + 0xc]
shr ebx, 2
sub ebp, esi
lea ecx, [esi + 4]
inc ebx
mov dword [esp + 0x24], ebp
lea eax, [ebx*4]
mov dword [esp + 0x10], eax
nop dword [eax]
mov eax, dword [edx - 0xc]
lea ecx, [ecx + 0x10]
mov dword [ecx - 0x14], eax
lea edx, [edx + 0x10]
mov eax, dword [ecx + ebp - 0x10]
mov dword [ecx - 0x10], eax
mov eax, dword [edx - 0x14]
mov dword [ecx - 0xc], eax
mov eax, dword [edx - 0x10]
mov dword [ecx - 8], eax
sub ebx, 1
jne 0x5821d0
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp eax, edi
jge 0x58221e
mov edx, edi
lea ecx, [esi + eax*4]
sub ebp, esi
sub edx, eax
nop dword [eax]
mov eax, dword [ecx + ebp]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edx, 1
jne 0x582210
sar edi, 1
xor ecx, ecx
mov dword [esp + 0x24], edi
cmp edi, 4
jl 0x582292
mov edx, dword [esp + 0x20]
lea eax, [edi - 4]
shr eax, 2
lea ebp, [esi + edi*4]
add edx, 8
lea ebx, [esi + 8]
inc eax
mov edi, eax
lea ecx, [eax*4]
nop dword [eax + eax]
mov eax, dword [ebx - 8]
lea ebp, [ebp + 0x10]
mov dword [edx - 8], eax
lea ebx, [ebx + 0x10]
mov eax, dword [ebp - 0x10]
lea edx, [edx + 0x20]
mov dword [edx - 0x24], eax
mov eax, dword [ebx - 0x14]
mov dword [edx - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [edx - 0x1c], eax
mov eax, dword [ebx - 0x10]
mov dword [edx - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebx - 0xc]
mov dword [edx - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [edx - 0xc], eax
sub edi, 1
jne 0x582250
mov edi, dword [esp + 0x24]
cmp ecx, edi
jge 0x5822b5
mov ebx, dword [esp + 0x20]
lea eax, [ecx + edi]
lea edx, [esi + eax*4]
mov eax, dword [esi + ecx*4]
lea edx, [edx + 4]
mov dword [ebx + ecx*8], eax
mov eax, dword [edx - 4]
mov dword [ebx + ecx*8 + 4], eax
inc ecx
cmp ecx, edi
jl 0x5822a0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 0x14]
pop ebp
pop ebx
lea edx, [ecx + 0xf]
and edx, 0xfffffff0
cmp ecx, dword [eax + 8]
jg 0x5822e8
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x5822e8
cmp dword [eax + 0x14], esi
je 0x5822e8
pop edi
mov dword [eax + 0xc], esi
pop esi
add esp, 8
ret
push edx
push esi
mov ecx, eax
call fcn.0046a590
pop edi
pop esi
add esp, 8
ret
Function at 0x588f30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
call fcn.00589350
xor edi, edi
mov dword [esp + 8], eax
test eax, eax
jle 0x588f84
nop word [eax + eax]
push edi
mov ecx, esi
call fcn.00588e60
mov ecx, dword [esp + 0x18]
mov esi, eax
push edi
call fcn.00588e90
fstp dword [esp + 0xc]
movss xmm0, dword [esp + 0xc]
inc edi
xorps xmm0, xmmword [0x719730]
movss dword [esi], xmm0
mov esi, dword [esp + 0x14]
cmp edi, dword [esp + 8]
jl 0x588f50
pop edi
pop esi
add esp, 8
ret

Function at 0x589140
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
push edi
call fcn.00589350
xor edi, edi
mov dword [esp + 8], eax
test eax, eax
jle 0x589186
push edi
mov ecx, esi
call fcn.00588e60
mov ecx, dword [esp + 0x10]
mov esi, eax
push edi
call fcn.00588e60
movss xmm0, dword [esi]
inc edi
xorps xmm0, xmmword [0x719730]
mov esi, dword [esp + 0x10]
movss dword [eax], xmm0
cmp edi, dword [esp + 8]
jl 0x589158
pop edi
pop esi
pop ecx
ret