joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5be330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x875e1b
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x838]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
mov dword [esp + 0x14], esi
je 0x5be3ed
xor edi, edi
mov dword [esp + 0x10], edi
push 0x818
mov dword [esp + 0x844], edi
call fcn.007c8558
mov ebx, eax
mov dword [ebx], 0x818
mov dword [ebx + 0x10], edi
add esp, 4
mov dword [ebx + 0x14], edi
mov eax, dword [esi + 8]
push edi
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0x80
mov dword [ebx + 0xc], edi
mov eax, dword [ebx]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x1c]
push ecx
push eax
push ebx
push eax
push ebx
push 0x335004
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x5be413
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esp + 0x844], 0xffffffff
call fcn.007c8563
add esp, 4
xor al, al
mov ecx, dword [esp + 0x838]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.0080262b
mov esp, ebp
pop ebp
ret
lea esi, [ebx + 0x18]
mov ecx, 0x200
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [edx + edx*4]
mov edx, dword [esp + 0x14]
sub eax, ecx
mov al, byte [eax + edx + 0x10]
xor byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, 0x199
jl 0x5be423
push ebx
mov dword [esp + 0x844], 0xffffffff
call fcn.007c8563
add esp, 4
cmp dword [0x8bb3dc], 0
mov dword [esp + 0x10], 0
jle 0x5be3ed
mov ebx, 0x8bb9e0
mov edi, 1
lea esi, [esp + 0x31]
lea ebx, [ebx]
movzx edx, byte [esi + 4]
mov ecx, dword [esi]
lea eax, [esp + 0x1c]
push ebx
push eax
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], 0
call fcn.005c0510
mov ecx, dword [esp + 0x34]
movzx edx, byte [esp + 0x38]
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x38], dl
mov byte [esp + 0x39], 0
call fcn.005c0510
mov eax, dword [esp + 0x2c]
add esp, 0x10
cmp dword [esp + 0x24], eax
jne 0x5be4e4
mov dl, byte [esp + 0x20]
cmp dl, byte [esp + 0x28]
jne 0x5be4e4
mov cl, byte [esp + 0x21]
cmp cl, byte [esp + 0x29]
je 0x5be50d
inc edi
add esi, 5
cmp edi, 0x199
jl 0x5be480
mov eax, dword [esp + 0x10]
inc eax
add ebx, 6
mov dword [esp + 0x10], eax
cmp eax, dword [0x8bb3dc]
jl 0x5be471
jmp 0x5be3ed
mov ecx, dword [esp + 0x14]
mov dx, word [esp + 0x20]
mov dword [ecx + 0x11], eax
mov word [ecx + 0x15], dx
mov al, 1
jmp 0x5be3ef
Function at 0x5c0450
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
movzx eax, byte [ecx]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
movzx ebp, byte [esi + 0x55]
push edi
movzx edi, byte [esi + 0x54]
xor edi, eax
movzx eax, byte [ecx + 1]
xor ebp, eax
mov eax, dword [esi + 0x56]
xor eax, dword [ecx + 2]
lea edx, [esi + 0x800]
lea ecx, [eax + eax + 8]
and eax, 7
sub esi, 0xffffff80
or edi, 0x100
sub ecx, eax
xor ebx, ebx
mov dword [esp + 0x14], edx
cmp esi, edx
je 0x5c0502
jmp 0x5c04a0
movzx eax, byte [edi + 0x8bb5e0]
movzx edx, byte [ebp + 0x8bb4e0]
xor edx, eax
mov eax, ecx
shr eax, 3
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 8
xor eax, ecx
mov ebp, edi
and edi, 1
shr eax, 5
shl edi, 8
xor edi, edx
movzx edx, byte [edx + 0x8bb8e0]
and eax, 0xff
shl ecx, 8
or ecx, eax
movzx eax, byte [eax + 0x8bb7e0]
add ebx, edx
add ebx, eax
movzx eax, byte [esi]
mov dl, byte [eax + str.3s_ckv_6n.f]
xor dl, bl
mov byte [esi], dl
inc esi
shr ebp, 1
shr ebx, 8
cmp esi, dword [esp + 0x14]
jne 0x5c04a0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5c0b70
Capabilities:
Encode data using xor

Disassembly:
push ecx
movzx edx, byte [eax]
movzx ecx, byte [eax + 2]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
movzx esi, byte [eax + 1]
shl edx, 8
or edx, esi
shl edx, 8
mov esi, ecx
and esi, 0xfffffffc
or edx, esi
movzx esi, byte [eax + 3]
movzx eax, byte [eax + 4]
or edx, 4
shl esi, 9
add edx, edx
and ecx, 7
or esi, eax
or edx, ecx
or esi, 0x100
push edi
inc ebp
mov byte [esp + 0x13], 0
xor edi, edi
mov byte [esp + 0x18], 0
lea ecx, [ecx]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x15
xor cl, al
mov eax, edx
shr eax, 0x14
xor cl, al
mov eax, edx
shr eax, 0xc
xor cl, al
and cl, 1
movzx eax, cl
add edx, edx
or edx, eax
mov eax, esi
shr eax, 0x10
mov ebx, esi
shr ebx, 2
xor al, bl
and al, 1
movzx ebx, al
add esi, esi
or esi, ebx
test al, al
sete al
test cl, cl
sete cl
add al, cl
add al, byte [esp + 0x13]
mov cl, al
shr cl, 1
and cl, 1
mov byte [esp + 0x13], cl
and al, 1
mov ecx, edi
shl al, cl
inc edi
or byte [esp + 0x18], al
cmp edi, 8
jl 0x5c0bc0
mov al, byte [esp + 0x18]
dec ebp
mov byte [ebp], al
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x1c], eax
test eax, eax
jg 0x5c0bb6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x5c15e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
imul eax, ebx
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
push edi
lea edx, [esp + 0x14]
push edx
mov ecx, edi
push ecx
push eax
mov esi, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp esi, dword [esp + 0x10]
jne 0x5c1646
cmp edi, dword [esp + 0x14]
jne 0x5c1646
mov edx, dword [esp + 0x24]
imul ebp, ebx
mov eax, dword [esp + 0x1c]
push edi
lea ecx, [esp + 0x10]
push ecx
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c1646
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x5c2230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret
Function at 0x5c4ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8763a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x48b790]
mov ecx, dword [0x48b794]
mov edx, dword [0x48b798]
mov dword [esp + 8], eax
mov eax, dword [0x48b79c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
test eax, eax
jne 0x5c4f9f
xor esi, esi
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi], edx
mov edx, dword [esp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 8], ecx
add eax, 0xfffffff0
mov dword [esi + 0xc], edx
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c4f81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0080262b
add esp, 0x20
ret
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x5c4f27
push 0x8007000e
call fcn.004a8210
int3
Function at 0x5c5080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x8763d8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push ebx
push 0x146
push eax
call ebp
test eax, eax
jle 0x5c5235
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5c50ed
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, dword [esi + 0x20]
push ecx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.007d2dab
mov edx, dword [esi + 0x20]
push ebx
push ebx
push 0x31
push edx
mov edi, eax
call ebp
push eax
call fcn.007d307f
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x28]
mov ecx, edi
call eax
mov edx, dword [edi + 8]
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x146
push eax
call ebp
test eax, eax
jle 0x5c51a2
lea ecx, [esp + 0x18]
push ecx
push ebx
mov ecx, esi
call fcn.007d3ef5
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x20]
push edx
push ecx
push eax
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x14]
jle 0x5c518e
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x146
push eax
inc ebx
call ebp
cmp ebx, eax
jl 0x5c5157
mov edx, dword [edi]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 0x28]
push eax
mov ecx, edi
call edx
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 0x20]
push 0
push 0
push 0x1702
push edx
call ebp
push 0
push 0
mov edi, eax
mov eax, dword [esi + 0x20]
push 0x146
push eax
call ebp
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, edi
jle 0x5c51f0
push 2
call ebx
mov edi, eax
jmp 0x5c51f2
xor edi, edi
push 0x2d
call ebx
mov edx, dword [esi + 0x20]
lea ecx, [edi + eax*2]
mov eax, dword [esp + 0x14]
push 0
add eax, ecx
push eax
push 0x160
push edx
call ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x70], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c5235
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0080262b
add esp, 0x60
ret
Function at 0x5c5960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x876489
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x5c59ab
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ebx, dword [esp + 0x2c]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ebp
push 0x2710
push ecx
push edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], 1
call fcn.00803a40
push ebp
push 0x36ee80
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.00803a40
push 0
push 0xea60
push edi
push esi
mov ebp, eax
call fcn.00803a40
push 0
push 0x3c
push edx
push eax
call fcn.00809f10
push 0
push 0x3e8
push edi
push esi
mov dword [esp + 0x28], eax
call fcn.00803a40
push 0
push 0x3c
mov edi, eax
push edx
push edi
call fcn.00809f10
imul edi, edi, 0x3e8
sub esi, edi
push esi
push eax
mov eax, dword [esp + 0x20]
push eax
push ebp
push 0x42dcd4
push ebx
call fcn.004aa600
add esp, 0x18
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x5c5a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x8637c9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ebp
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x5c5aa9
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ebx, dword [esp + 0x28]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebp
add ecx, 0x4c4b40
push 0x989680
adc edx, ebp
push edx
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x24], 1
call fcn.00803a40
push ebp
push 0xe10
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.00803a40
push 0
push 0x3c
push edi
push esi
mov ebp, eax
call fcn.00803a40
push 0
push 0x3c
mov edi, eax
push edx
push edi
call fcn.00809f10
mov ecx, edi
shl ecx, 4
sub ecx, edi
add ecx, ecx
add ecx, ecx
sub esi, ecx
push esi
push eax
push ebp
push 0x415a6c
push ebx
call fcn.004aa600
add esp, 0x14
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5c6250
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x8765dd
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x43c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44c]
xor ebx, ebx
mov dword [esp + 0x444], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], ebx
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5c62bc
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov esi, 1
mov dword [esp + 0x444], ebx
mov dword [esp + 0x14], esi
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5c62f4
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
movzx ecx, word [esp + 0x450]
push ecx
lea edx, [esp + 0x14]
push 0x42df34
push edx
mov dword [esp + 0x450], esi
call fcn.004aa600
mov esi, dword [esp + 0x1c]
add esp, 0xc
push 0x104
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
push 0x104
lea ecx, [esp + 0x40]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x5c637e
lea eax, [esp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x5c6362
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
call fcn.004a8db0
lea eax, [esi - 0x10]
mov byte [esp + 0x444], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c63a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x43c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0080262b
add esp, 0x438
ret
Function at 0x5c8a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x60
mov eax, dword [ebp + 0xc]
movdqa xmm6, xmmword [0x42ec20]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
pxor xmm0, xmm0
pcmpeqb xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
add eax, 0x10
jmp 0x5c8a80
movdqa xmm0, xmmword [eax - 0x10]
movdqa xmm2, xmmword [eax + 0x90]
movdqa xmm3, xmm0
movdqa xmm1, xmm0
psrldq xmm0, 1
movdqa xmm4, xmm2
pslldq xmm4, 0xe
psrldq xmm3, 2
por xmm3, xmm4
pavgb xmm1, xmm3
movdqa xmm3, xmmword [eax + 0xa0]
pslldq xmm2, 0xf
por xmm0, xmm2
pavgb xmm1, xmm0
movdqa xmm0, xmmword [eax]
movdqa xmm4, xmm0
movdqa xmm2, xmm0
psrldq xmm0, 1
movdqa xmm5, xmm3
pslldq xmm5, 0xe
psrldq xmm4, 2
por xmm4, xmm5
pavgb xmm2, xmm4
movdqa xmm4, xmmword [eax + 0xb0]
pslldq xmm3, 0xf
por xmm0, xmm3
pavgb xmm2, xmm0
movdqa xmm0, xmmword [eax + 0x10]
movdqa xmm5, xmm0
movdqa xmm3, xmm0
movdqa xmm7, xmm4
pslldq xmm7, 0xe
psrldq xmm5, 2
por xmm5, xmm7
pavgb xmm3, xmm5
movdqa xmm5, xmmword [eax + 0xc0]
psrldq xmm0, 1
pslldq xmm4, 0xf
por xmm0, xmm4
pavgb xmm3, xmm0
movdqa xmm0, xmmword [eax + 0x20]
movdqa xmm7, xmm0
movdqa xmmword [esp], xmm5
psrldq xmm7, 2
movdqa xmm4, xmm0
pslldq xmm5, 0xe
por xmm7, xmm5
movdqa xmm5, xmmword [esp]
pavgb xmm4, xmm7
psrldq xmm0, 1
pxor xmm1, xmm6
pslldq xmm5, 0xf
por xmm0, xmm5
movdqa xmm5, xmmword [eax + 0x30]
pavgb xmm4, xmm0
movdqa xmm0, xmmword [eax + 0xd0]
movdqa xmmword [esp], xmm0
movdqa xmm0, xmm1
pxor xmm2, xmm6
pxor xmm4, xmm6
pcmpgtb xmm1, xmm4
movdqa xmmword [esp + 0x10], xmm1
pcmpgtb xmm0, xmm2
movdqa xmm1, xmm4
pcmpgtb xmm1, xmm2
movdqa xmm7, xmm1
pandn xmm1, xmmword [esp + 0x10]
pand xmm7, xmm0
movdqa xmmword [esp + 0x20], xmm7
movdqa xmm7, xmm1
movdqa xmm1, xmmword [esp + 0x20]
pxor xmm3, xmm6
pcmpgtb xmm2, xmm3
movdqa xmmword [esp + 0x50], xmm7
pand xmm1, xmm2
movdqa xmmword [esp + 0x30], xmm7
movdqa xmm7, xmmword [esp]
movdqa xmm2, xmm5
movdqa xmm3, xmm5
psrldq xmm2, 2
pslldq xmm7, 0xe
por xmm0, xmmword [esp + 0x10]
pandn xmm0, xmmword [esp + 0x40]
por xmm2, xmm7
pavgb xmm3, xmm2
movdqa xmm2, xmmword [esp]
pslldq xmm2, 0xf
psrldq xmm5, 1
por xmm5, xmm2
pavgb xmm3, xmm5
movdqa xmm5, xmmword [eax + 0x60]
pxor xmm3, xmm6
pcmpgtb xmm4, xmm3
movdqa xmm3, xmmword [esp + 0x30]
pand xmm3, xmm4
movdqa xmm4, xmmword [eax + 0x40]
pand xmm4, xmm0
movdqa xmm0, xmmword [eax + 0x50]
movdqa xmm2, xmm1
pandn xmm2, xmmword [esp + 0x20]
pand xmm0, xmm2
movdqa xmm2, xmmword [eax + 0x70]
pand xmm5, xmm1
movdqa xmm1, xmm3
pandn xmm1, xmmword [esp + 0x50]
pand xmm2, xmm1
movdqa xmm1, xmmword [eax + 0x80]
pand xmm1, xmm3
por xmm0, xmm5
por xmm2, xmm1
por xmm0, xmm2
por xmm0, xmm4
movdqa xmmword [ecx], xmm0
add eax, 0xa0
add ecx, 0x10
dec edx
jne 0x5c8a80
mov esp, ebp
pop ebp
ret
Function at 0x5c90f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
movq mm0, qword [ecx]
pavgb mm0, qword [ecx + 2]
pavgb mm0, qword [ecx + 1]
movq mm1, qword [ecx + 0x10]
pavgb mm1, qword [ecx + 0x12]
pavgb mm1, qword [ecx + 0x11]
movq mm2, qword [ecx + 0x20]
pavgb mm2, qword [ecx + 0x22]
pavgb mm2, qword [ecx + 0x21]
movq mm3, qword [ecx + 0x30]
pavgb mm3, qword [ecx + 0x32]
pavgb mm3, qword [ecx + 0x31]
movq mm4, qword [ecx + 0x40]
pavgb mm4, qword [ecx + 0x42]
pavgb mm4, qword [ecx + 0x41]
movq mm5, qword [0x42ec38]
pxor mm0, mm5
pxor mm1, mm5
pxor mm2, mm5
pxor mm3, mm5
pxor mm4, mm5
movq mm5, mm3
pcmpgtb mm5, mm1
pcmpgtb mm4, mm3
pcmpgtb mm2, mm1
pcmpgtb mm1, mm0
pcmpgtb mm3, mm0
movq mm6, mm1
pcmpeqb mm0, mm0
por mm6, mm3
pxor mm0, mm6
pand mm3, mm5
pandn mm5, mm1
pand mm4, mm3
pand mm2, mm5
pxor mm3, mm4
pxor mm5, mm2
pand mm0, qword [ecx + 0x50]
pand mm5, qword [ecx + 0x60]
pand mm2, qword [ecx + 0x70]
pand mm3, qword [ecx + 0x80]
pand mm4, qword [ecx + 0x90]
por mm0, mm5
por mm2, mm3
por mm0, mm4
por mm0, mm2
movq qword [edx], mm0
movq mm0, qword [ecx + 8]
movq mm5, qword [ecx + 0xa0]
movq mm6, mm0
psrlq mm0, 0x10
movq mm7, mm5
psllq mm5, 0x30
por mm0, mm5
psrlq mm6, 8
psllq mm7, 0x38
por mm6, mm7
pavgb mm0, qword [ecx + 8]
pavgb mm0, mm6
movq mm1, qword [ecx + 0x18]
movq mm5, qword [ecx + 0xb0]
movq mm6, mm1
psrlq mm1, 0x10
movq mm7, mm5
psllq mm5, 0x30
por mm1, mm5
psrlq mm6, 8
psllq mm7, 0x38
por mm6, mm7
pavgb mm1, qword [ecx + 0x18]
pavgb mm1, mm6
movq mm2, qword [ecx + 0x28]
movq mm5, qword [ecx + 0xc0]
movq mm6, mm2
psrlq mm2, 0x10
movq mm7, mm5
psllq mm5, 0x30
por mm2, mm5
psrlq mm6, 8
psllq mm7, 0x38
por mm6, mm7
pavgb mm2, qword [ecx + 0x28]
pavgb mm2, mm6
movq mm3, qword [ecx + 0x38]
movq mm5, qword [ecx + 0xd0]
movq mm6, mm3
psrlq mm3, 0x10
movq mm7, mm5
psllq mm5, 0x30
por mm3, mm5
psrlq mm6, 8
psllq mm7, 0x38
por mm6, mm7
pavgb mm3, qword [ecx + 0x38]
pavgb mm3, mm6
movq mm4, qword [ecx + 0x48]
movq mm5, qword [ecx + 0xe0]
movq mm6, mm4
psrlq mm4, 0x10
movq mm7, mm5
psllq mm5, 0x30
por mm4, mm5
psrlq mm6, 8
psllq mm7, 0x38
por mm6, mm7
pavgb mm4, qword [ecx + 0x48]
pavgb mm4, mm6
movq mm5, qword [0x42ec38]
pxor mm0, mm5
pxor mm1, mm5
pxor mm2, mm5
pxor mm3, mm5
pxor mm4, mm5
movq mm5, mm3
pcmpgtb mm5, mm1
pcmpgtb mm4, mm3
pcmpgtb mm2, mm1
pcmpgtb mm1, mm0
pcmpgtb mm3, mm0
movq mm6, mm1
pcmpeqb mm0, mm0
por mm6, mm3
pxor mm0, mm6
pand mm3, mm5
pandn mm5, mm1
pand mm4, mm3
pand mm2, mm5
pxor mm3, mm4
pxor mm5, mm2
pand mm0, qword [ecx + 0x58]
pand mm5, qword [ecx + 0x68]
pand mm2, qword [ecx + 0x78]
pand mm3, qword [ecx + 0x88]
pand mm4, qword [ecx + 0x98]
por mm0, mm5
por mm2, mm3
por mm0, mm4
por mm0, mm2
movq qword [edx + 8], mm0
add ecx, 0xa0
add edx, 0x10
dec eax
jne 0x5c90fc
emms
ret 0xc
Function at 0x5c9720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
shl eax, 4
add esi, 0x10
add edi, 0x10
mov dword [esp + 0x14], eax
add ecx, 2
jmp 0x5c9750
movzx eax, byte [esi - 3]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx edx, byte [esi]
mov dword [esp + 0x30], eax
movzx eax, byte [edi - 3]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi]
movzx ebx, byte [esi - 1]
mov dword [esp + 0x3c], eax
movzx eax, byte [edi + 1]
mov dword [esp + 0x34], edx
movzx edx, byte [esi + 2]
mov dword [esp + 0x38], eax
movzx eax, byte [edi + 2]
movzx ebp, byte [esi - 2]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
movzx edx, byte [edi - 2]
mov dword [esp + 0x10], edx
movzx edx, byte [edi - 1]
mov dword [esp + 0x24], edx
mov eax, ebx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov byte [ecx - 2], al
mov eax, ebp
sub eax, dword [esp + 0x3c]
inc esi
cdq
xor eax, edx
sub eax, edx
mov byte [ecx - 1], al
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x38]
inc edi
cdq
xor eax, edx
sub eax, edx
mov byte [ecx], al
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x10]
add ecx, 0xa
cdq
xor eax, edx
sub eax, edx
mov byte [ecx - 9], al
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x1c]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x3c]
mov byte [ecx - 8], al
mov eax, dword [esp + 0x34]
lea edx, [edx + eax + 1]
mov eax, dword [esp + 0x38]
sar edx, 1
mov byte [ecx - 7], dl
lea edx, [eax + ebx + 1]
mov eax, dword [esp + 0x20]
sar edx, 1
mov byte [ecx - 6], dl
lea edx, [eax + ebp + 1]
mov eax, dword [esp + 0x24]
sar edx, 1
mov byte [ecx - 5], dl
mov edx, dword [esp + 0x30]
lea eax, [eax + edx + 1]
mov edx, dword [esp + 0x10]
sar eax, 1
mov byte [ecx - 4], al
mov eax, dword [esp + 0x28]
lea edx, [edx + eax + 1]
sar edx, 1
dec dword [esp + 0x14]
mov byte [ecx - 3], dl
jne 0x5c9750
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret