joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dc8158d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6e3d0014]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6dc815f3
mov eax, dword [0x6e3d0014]
mov dword [0x6e3d000c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x6e3d0008], eax
mov eax, dword [0x6e3d0008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x6e3d0004], eax
nop
leave
ret

Function at 0x6dc8163a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6e3d0008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6e3d0008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
jmp 0x6dc816be
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6e3d0004]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6e3d000c]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [ebp - 0xc], 0x28
add dword [ebp - 0x10], 1
mov eax, dword [0x6e3d0008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6dc81678
nop
leave
ret

Function at 0x6dc81db0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6e3cf040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6dc81e10
Function at 0x6dc81e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6e3d0378]
test esi, esi
jle 0x6dc81efd
mov edi, dword [0x6e3d037c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6dc81e44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6dc81ef6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6dc81e30
mov dword [esp], eax
mov esi, eax
call fcn.6dc825b0
test eax, eax
mov edi, eax
je 0x6dc81f3a
mov esi, dword [0x6e3d037c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6dc826c0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6e3d037c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6dc81f1a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6dc81eef
sub eax, 0x40
and eax, 0xffffffbf
je 0x6dc81eef
mov eax, dword [esp + 0x20]
add ebx, dword [0x6e3d037c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6dc81f04
add dword [0x6e3d0378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6dc81e4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6dc81db0
mov eax, dword [0x6e3d037c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6dc81db0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6dc81db0
lea esi, [esi]

Function at 0x6dc82220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6e3d0388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6e3d0380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6dc82275
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6dc8226e
test esi, esi
je 0x6dc8226e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6dc82250
mov dword [esp], 0x6e3d0388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402350
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x4023c0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x4023a0
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00402400
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x451150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x89c0ce
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x9726c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x38], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], 0x964ba8
mov dword [esi + 0x14], 0
lea edi, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [edi], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.004508f0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [0x8a10ac]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4512da
call dword [0x8a115c]
mov ecx, dword [0x9731b0]
mov edi, eax
mov eax, dword [0x9731b4]
cmp ecx, 0x257edfd1
jne 0x45126d
cmp eax, 0xb2ab117a
je 0x45127c
cmp ecx, 0x257edfd0
jne 0x451283
cmp eax, 0xb2ab117a
jne 0x451283
test edi, edi
setne al
jmp 0x451293
mov eax, dword [0x9731a8]
mov ecx, 0x9731a8
push edi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x9731a8
mov dword [ebp - 0x34], 0x9641a8
mov dword [ebp - 0x30], 0x964128
mov dword [ebp - 0x2c], 0x66
mov dword [ebp - 0x28], 0x1a
test al, 1
je 0x4512d7
cmp eax, 1
jne 0x45137d
test edi, edi
jne 0x45137d
lea edi, [esi + 0x18]
cmp byte [ebx + 0x10], 0
je 0x45135b
lock inc dword [edi]
push 0xc
call fcn.0086b05e
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 7
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0086b05e
add esp, 4
mov dword [ebp - 0x3c], eax
xorps xmm0, xmm0
mov ecx, edi
movups xmmword [eax], xmm0
push 0
push eax
mov dword [eax], 0x964b2c
mov dword [eax + 0xc], esi
call fcn.00450d80
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x451358
push dword [eax + 4]
call dword [0x8a10d0]
push 0xc
push dword [ebp - 0x24]
call fcn.0086b2df
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0086aede
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
lea eax, [ebp - 0x34]
mov edx, 0x964210
push eax
lea ecx, [ebp - 0x20]
call fcn.00450890
int3
Function at 0x45cf20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x89bb70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x9726c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x959bd0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0086b05e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00856ef3
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0045ca90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45d3a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x89bb70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x9726c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x959dd0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0086b05e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00856ef3
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0045ca90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47f440
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
xorps xmm0, xmm0
push esi
mov eax, 1
movlpd qword [esp + 0x14], xmm0
xor cl, cl
movlpd qword [esp + 0x1c], xmm0
mov dword [esp + 0x24], 0
lea edx, [ebx - 1]
push edi
mov edi, dword [esp + 0x30]
cmp ebx, eax
jbe 0x47f4ea
cmp edx, 0x20
jb 0x47f4e0
and edx, 0x1f
mov ecx, ebx
sub ecx, edx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [eax + eax]
movups xmm0, xmmword [eax + edi]
xorps xmm2, xmm0
movups xmm0, xmmword [edi + eax + 0x10]
add eax, 0x20
xorps xmm1, xmm0
cmp eax, ecx
jb 0x47f490
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
xorps xmm1, xmm0
movd ecx, xmm1
cmp eax, ebx
jae 0x47f4f4
nop dword [eax]
xor cl, byte [edi + eax]
inc eax
cmp eax, ebx
jb 0x47f4e0
jmp 0x47f4f4
xor cl, cl
test ebx, ebx
je 0x47f582
cmp cl, byte [edi]
jne 0x47f582
push 0x28
push 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
call fcn.00870e8f
mov esi, eax
add esp, 8
test esi, esi
je 0x47f582
push ebx
push edi
push 0
call fcn.00852a50
xor ecx, ecx
mov dword [esi + 0x10], eax
lea eax, [esp + 0x18]
or ecx, ebx
push 1
push eax
mov dword [esi + 0x14], ecx
call fcn.004807f0
add esp, 0x14
test eax, eax
je 0x47f5ac
lea eax, [esp + 0xc]
push eax
call fcn.00480890
inc eax
push eax
mov dword [esi + 4], eax
call fcn.0087837e
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x47f58b
push dword [esi]
mov edi, dword [esi + 0x20]
call fcn.00877223
push dword [esi + 8]
call fcn.00877223
push esi
call fcn.00877223
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x47f561
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
xor edi, edi
cmp dword [esi + 4], edi
jbe 0x47f5ac
lea eax, [esp + 0xc]
push 8
push eax
call fcn.004807f0
mov ecx, dword [esi]
add esp, 8
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 4]
jb 0x47f592
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x4a95f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.004a9860
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 4], 1
nop dword [eax + eax]
movsd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 1
call fcn.0087d01d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
nop dword [eax + eax]
rdtsc
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
test eax, eax
jle 0x4a9667
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
add esp, 8
sub esi, 1
jne 0x4a9654
rdtsc
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.0086bff0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
movsd qword [ebp - 0xc], xmm0
call fcn.0086bff0
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
subsd xmm1, xmm0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
test eax, eax
je 0x4a96bc
push 1
sub esp, 8
movsd qword [esp], xmm1
push ebx
call dword [ebp - 8]
fstp qword [ebp - 0xc]
movsd xmm1, qword [ebp - 0xc]
add esp, 0x10
xorps xmm0, xmm0
comisd xmm0, xmm1
ja 0x4a9614
cmp dword [ebp - 0x10], 0
jne 0x4a96da
movsd xmm0, qword [ebp - 0x20]
comisd xmm0, xmm1
jbe 0x4a96df
movsd qword [ebp - 0x20], xmm1
mov dword [ebp - 0x10], 0
call fcn.0087d01d
sub eax, dword [ebp - 0x18]
movd xmm0, eax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x8af020]
test eax, eax
je 0x4a9721
push 1
sub esp, 8
movsd qword [esp], xmm0
push ebx
call dword [ebp - 8]
fstp qword [ebp - 0xc]
movsd xmm0, qword [ebp - 0xc]
add esp, 0x10
comisd xmm0, xmmword [0x8af018]
ja 0x4a973b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 8
jl 0x4a9640
movsd xmm0, qword [ebp - 0x20]
comisd xmm0, xmmword [0x8af028]
jae 0x4a9760
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
add eax, eax
mov dword [ebp - 4], eax
jne 0x4a9620
jmp 0x4a9614
push 0
push dword [ebp + 0xc]
call fcn.004a9860
movd xmm0, dword [ebp - 4]
add esp, 8
movsd xmm1, qword [ebp - 0x20]
cvtdq2pd xmm0, xmm0
pop edi
pop esi
pop ebx
divsd xmm1, xmm0
movsd qword [ebp - 0x30], xmm1
fld qword [ebp - 0x30]
mov esp, ebp
pop ebp
ret
Function at 0x57d7a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x57d7f7
nop dword [eax]
add ecx, ecx
movsx eax, byte [ecx + esi + 2]
movd xmm1, eax
movsx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x57d7c0
cmp ecx, edi
jne 0x57d80a
test bl, 1
jne 0x57d80a
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x57d849
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movsx eax, bl
movd xmm1, eax
movsx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x57d83f
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x57d812
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret

Function at 0x57d860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x57d8b7
nop dword [eax]
add ecx, ecx
movzx eax, byte [ecx + esi + 2]
movd xmm1, eax
movzx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x57d880
cmp ecx, edi
jne 0x57d8ca
test bl, 1
jne 0x57d8ca
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x57d909
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movzx eax, bl
movd xmm1, eax
movzx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x57d8ff
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x57d8d2
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
Function at 0x57d920
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x57d979
nop dword [eax]
add ecx, ecx
movsx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movsx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x57d940
cmp ecx, edi
jne 0x57d98e
test bl, 1
jne 0x57d98e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x57d9d1
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
movzx edi, word [esi + ecx*2]
movsx eax, di
movd xmm1, eax
movsx eax, word [ebx]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x57d9c5
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x57d996
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret

Function at 0x57d9f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x57da49
nop dword [eax]
add ecx, ecx
movzx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movzx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x57da10
cmp ecx, edi
jne 0x57da5e
test bl, 1
jne 0x57da5e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x57da9e
mov ebx, dword [esp + 0x20]
movzx eax, word [ebx]
lea ecx, [edx - 1]
sar ecx, 1
movd xmm0, eax
movzx edi, word [esi + ecx*2]
cvtdq2pd xmm0, xmm0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x57da92
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x57da66
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
Function at 0x57dab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x57db05
nop
add ecx, ecx
xor eax, eax
movd xmm1, dword [esi + ecx*4 + 8]
movd xmm0, dword [esi + ecx*4 + 4]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x57dad0
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x57db16
test al, 1
jne 0x57db16
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x57db51
mov edi, dword [esp + 0x20]
nop
movd xmm0, dword [edi]
lea eax, [edx - 1]
sar eax, 1
cvtdq2pd xmm0, xmm0
mov ecx, dword [esi + eax*4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x57db47
mov dword [esi + edx*4], ecx
mov edx, eax
cmp ebx, eax
jl 0x57db20
mov eax, dword [edi]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x57db60
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x57dbcd
nop dword [eax]
add ecx, ecx
mov eax, dword [esi + ecx*4 + 8]
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x8b6930]
mov eax, dword [esi + ecx*4 + 4]
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x8b6930]
xor eax, eax
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x57db80
cmp ecx, edi
jne 0x57dbe0
test bl, 1
jne 0x57dbe0
mov eax, dword [esi + ebx*4 - 4]
mov dword [esi + edx*4], eax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x57dc35
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov edi, dword [esi + ecx*4]
mov eax, edi
shr eax, 0x1f
movd xmm1, edi
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x8b6930]
mov eax, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x8b6930]
comisd xmm1, xmm0
jbe 0x57dc2b
mov dword [esi + edx*4], edi
mov edx, ecx
cmp ebp, ecx
jl 0x57dbe8
mov eax, dword [ebx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret