joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4f00
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x38
lea eax, [ebp - 0x74]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x74]
call fcn.00576910
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
xor ecx, ecx
mov dword [ebp - 0x14], 0
movaps xmm0, xmmword [0x7e58b0]
movups xmmword [ebp - 0xd4], xmm0
mov dword [ebp - 0xd8], 0x57
movaps xmm0, xmmword [0x7e5750]
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0x84], 0xa1d4a6c6
movaps xmm0, xmmword [0x7e60b0]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x80], 0xd5d0c2
movaps xmm0, xmmword [0x7e5b90]
movups xmmword [ebp - 0xa4], xmm0
movaps xmm0, xmmword [str.8e_]
movups xmmword [ebp - 0x94], xmm0
nop
mov al, cl
sub al, 0x57
xor byte [ebp + ecx - 0xd4], al
inc ecx
mov eax, dword [ebp - 0xd8]
cmp ecx, eax
jb 0x587b40
mov byte [ebp + eax - 0xd4], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], 0
call fcn.00408e80
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 1
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x587b80
push dword [ebp - 0x7c]
sub ecx, edx
lea eax, [ebp - 0xd4]
add eax, ecx
lea ecx, [ebp - 0x24]
push 0x100
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00409380
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push esi
push eax
call fcn.00405710
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x3c]
push eax
call fcn.00588b80
add esp, 8
lea ecx, [ebp - 0x3c]
test al, al
setne byte [ebp - 0x75]
call fcn.00407a10
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x587bf9
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x587bf9
mov ecx, dword [ebp - 0x24]
xor edx, edx
call fcn.00405180
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x587c1e
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x587c1e
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [ebp - 0x6c]
test esi, esi
je 0x587c6a
mov ecx, dword [ebp - 0x64]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x587c60
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x587c60
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.0076e8f3
add esp, 8
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret
Function at 0x58b550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x10], 0xcb00c4
xor eax, eax
mov dword [ebp - 0xc], 0xc000c2
mov dword [ebp - 8], 0xdc0083
mov dword [ebp - 4], 0xb000da
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x10], cx
inc eax
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jb 0x58b580
push dword [ebp + 8]
xor eax, eax
mov word [ebp + ecx*2 - 0x10], ax
mov ecx, edx
call fcn.0063f8b0
mov esp, ebp
pop ebp
ret 4
Function at 0x591580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 9
xor ecx, ecx
mov dword [ebp - 0x24], 0xdf00e8
mov dword [ebp - 0x20], 0xc300df
mov dword [ebp - 0x1c], 0xda00de
mov dword [ebp - 0x18], 0xc200ce
mov dword [ebp - 0x14], 0xb200c5
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x5915e0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x591610
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x591680
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5916b0
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x591709
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x59174f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x592310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, 8
mov dword [ebp - 0x24], 0xc500fa
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x20], 0xd800cd
mov dword [ebp - 0x1c], 0xcf00da
mov dword [ebp - 0x18], 0xd500dd
mov dword [ebp - 0x14], 0xb1
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x592370
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5923a0
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x592410
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x592440
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x592499
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x5924df
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x592ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 9
xor ecx, ecx
mov dword [ebp - 0x24], 0xc400fc
mov dword [ebp - 0x20], 0xc200c2
mov dword [ebp - 0x1c], 0xda00de
mov dword [ebp - 0x18], 0xdc00ce
mov dword [ebp - 0x14], 0xb200dd
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x592d00
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x592d30
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x592da0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x592dd0
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x592e29
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x592e6f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x593d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 9
xor ecx, ecx
mov dword [ebp - 0x24], 0xc200fa
mov dword [ebp - 0x20], 0xde00ca
mov dword [ebp - 0x1c], 0xca00c8
mov dword [ebp - 0x18], 0xdc00eb
mov dword [ebp - 0x14], 0xb200dd
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x593d90
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x593dc0
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x593e30
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x593e60
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x593eb9
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x593eff
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x594440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, 8
mov dword [ebp - 0x24], 0xcf00fa
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x20], 0xda00d9
mov dword [ebp - 0x1c], 0xcd00c4
mov dword [ebp - 0x18], 0xc300ca
mov dword [ebp - 0x14], 0xb1
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x5944a0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5944d0
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x594540
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x594570
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x5945c9
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x59460f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x594d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], 7
xor ecx, ecx
mov dword [ebp - 0x20], 0xc600ea
mov dword [ebp - 0x1c], 0xdf00ca
mov dword [ebp - 0x18], 0xcb00de
mov dword [ebp - 0x14], 0xb000dc
nop
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x20], ax
inc ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
jb 0x594db0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x20], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x20]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x594de0
sub ecx, edx
lea eax, [ebp - 0x20]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x594e50
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x594e80
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x594ed9
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x594f1f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5961b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a623f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], 5
xor ecx, ecx
mov dword [ebp - 0x1c], 0xc200fa
mov dword [ebp - 0x18], 0xc000ce
mov dword [ebp - 0x14], 0xae00c1
nop word [eax + eax]
lea eax, [ecx + 0xa9]
xor word [ebp + ecx*2 - 0x1c], ax
inc ecx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
jb 0x596200
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x1c], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x596230
sub ecx, edx
lea eax, [ebp - 0x1c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xcf00fb
mov dword [ebp - 0x78], 0xc500cc
mov dword [ebp - 0x74], 0xda00de
mov dword [ebp - 0x70], 0xc900dd
mov dword [ebp - 0x6c], 0xd700e2
mov dword [ebp - 0x68], 0xc000d0
mov dword [ebp - 0x64], 0xd900dc
mov dword [ebp - 0x60], 0xcb00d9
mov dword [ebp - 0x5c], 0xb9
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x5962a0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5962d0
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83ff6c]
test eax, eax
jne 0x596329
push 0x28
call fcn.0076e8c3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048e020
mov byte [ebp - 4], 1
mov dword [0x83ff6c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048e3a0
mov esi, eax
add edi, 8
cmp edi, esi
je 0x59636f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret