joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
inc ecx
or byte ds:[eax], bl
adc dword [edi - 0x44], esp
lahf
adc al, 0xb6
test dword [esi], ecx
salc
cmc
in eax, dx
mov ah, 0xe2
pop edi
xchg edi, eax
sbb ebp, edx
dec eax
mov ebp, 0x1371b036
and dword [ebp + 0x149c0db7], ebp
or eax, 0xb7563ee9
push ebp
out dx, al
je 0x414ae0
adc al, 0xd
jmp 0x55f8a125
in eax, dx
inc esp
dec eax
adc ah, byte [ecx]
cld
in al, dx
adc ah, byte [ecx]
jmp 0x414b05
mov bh, 0xed
ficom word [edi + esi*4]
in eax, dx
ficom word [edi + esi*4]
in eax, dx
fsubp st(3)
dec eax
adc ah, byte [ecx]
adc al, 0xb7
in eax, dx
fsubp st(3)
dec eax
adc ah, byte [ecx]
adc al, 0xb7
in eax, dx
ficom word [edi + esi*4]
in eax, dx
ficom word [edi + esi*4]
in eax, dx
ficom word [edi + esi*4]
outsb dx, byte [esi]
xor dl, byte [eax]
jo 0x414b18
jmp 0x414b62
cli
clc
pop ds
scasd eax, dword es:[edi]
ficomp word [0x14b6a24c]
invalid
push edi
invalid
Function at 0x6a628754
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
lea esi, [ecx - 2]
mov ebx, eax
mov ecx, esi
pxor mm7, mm7
pxor mm6, mm6
movq mm0, qword [ebx]
movq mm1, mm0
psllq mm0, 8
psrlq mm1, 8
psrlq mm0, 8
movq mm2, mm0
movq mm3, mm1
punpcklbw mm0, mm7
punpcklbw mm1, mm7
punpckhbw mm2, mm7
punpckhbw mm3, mm7
psubw mm0, mm1
psubw mm2, mm3
add ebx, edx
movq mm4, qword [ebx]
movq mm1, mm4
psllq mm4, 8
psrlq mm1, 8
psrlq mm4, 8
movq mm5, mm4
movq mm3, mm1
punpcklbw mm4, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
punpckhbw mm3, mm7
psubw mm4, mm1
psubw mm5, mm3
psubw mm0, mm4
psubw mm2, mm5
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm0
pcmpgtw mm1, mm2
pxor mm0, mm3
pxor mm2, mm1
psubw mm0, mm3
psubw mm2, mm1
paddw mm2, mm0
paddw mm6, mm2
add ebx, edx
movq mm0, qword [ebx]
movq mm1, mm0
psllq mm0, 8
psrlq mm1, 8
psrlq mm0, 8
movq mm2, mm0
movq mm3, mm1
punpcklbw mm0, mm7
punpcklbw mm1, mm7
punpckhbw mm2, mm7
punpckhbw mm3, mm7
psubw mm0, mm1
psubw mm2, mm3
psubw mm4, mm0
psubw mm5, mm2
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm4
pcmpgtw mm1, mm5
pxor mm4, mm3
pxor mm5, mm1
psubw mm4, mm3
psubw mm5, mm1
paddw mm5, mm4
paddw mm6, mm5
add ebx, edx
movq mm4, qword [ebx]
movq mm1, mm4
psllq mm4, 8
psrlq mm1, 8
psrlq mm4, 8
movq mm5, mm4
movq mm3, mm1
punpcklbw mm4, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
punpckhbw mm3, mm7
psubw mm4, mm1
psubw mm5, mm3
psubw mm0, mm4
psubw mm2, mm5
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm0
pcmpgtw mm1, mm2
pxor mm0, mm3
pxor mm2, mm1
psubw mm0, mm3
psubw mm2, mm1
paddw mm2, mm0
paddw mm6, mm2
add ebx, edx
sub ecx, 2
jne 0x6a6287df
movq mm0, mm6
punpcklwd mm0, mm7
punpckhwd mm6, mm7
paddd mm6, mm0
movq mm0, mm6
psrlq mm6, 0x20
paddd mm0, mm6
movd eax, mm0
pop ebx
pop esi
ret
Function at 0x6a6288a4
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov edi, ecx
lea esi, [ecx - 2]
mov ebx, eax
mov ecx, esi
pxor mm7, mm7
pxor mm6, mm6
movq mm0, qword [ebx]
movq mm1, qword [ebx + 1]
movq mm2, mm0
movq mm3, mm1
punpcklbw mm0, mm7
punpcklbw mm1, mm7
punpckhbw mm2, mm7
punpckhbw mm3, mm7
psubw mm0, mm1
psubw mm2, mm3
add ebx, edx
movq mm4, qword [ebx]
movq mm1, qword [ebx + 1]
movq mm5, mm4
movq mm3, mm1
punpcklbw mm4, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
punpckhbw mm3, mm7
psubw mm4, mm1
psubw mm5, mm3
psubw mm0, mm4
psubw mm2, mm5
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm0
pcmpgtw mm1, mm2
pxor mm0, mm3
pxor mm2, mm1
psubw mm0, mm3
psubw mm2, mm1
paddw mm2, mm0
paddw mm6, mm2
add ebx, edx
movq mm0, qword [ebx]
movq mm1, qword [ebx + 1]
movq mm2, mm0
movq mm3, mm1
punpcklbw mm0, mm7
punpcklbw mm1, mm7
punpckhbw mm2, mm7
punpckhbw mm3, mm7
psubw mm0, mm1
psubw mm2, mm3
psubw mm4, mm0
psubw mm5, mm2
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm4
pcmpgtw mm1, mm5
pxor mm4, mm3
pxor mm5, mm1
psubw mm4, mm3
psubw mm5, mm1
paddw mm5, mm4
paddw mm6, mm5
add ebx, edx
movq mm4, qword [ebx]
movq mm1, qword [ebx + 1]
movq mm5, mm4
movq mm3, mm1
punpcklbw mm4, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
punpckhbw mm3, mm7
psubw mm4, mm1
psubw mm5, mm3
psubw mm0, mm4
psubw mm2, mm5
pxor mm3, mm3
pxor mm1, mm1
pcmpgtw mm3, mm0
pcmpgtw mm1, mm2
pxor mm0, mm3
pxor mm2, mm1
psubw mm0, mm3
psubw mm2, mm1
paddw mm2, mm0
paddw mm6, mm2
add ebx, edx
sub ecx, 2
jne 0x6a62891c
movq mm0, mm6
punpcklwd mm0, mm7
punpckhwd mm6, mm7
paddd mm6, mm0
movq mm0, mm6
psrlq mm6, 0x20
paddd mm0, mm6
movd esi, mm0
add eax, 8
mov ecx, edi
call fcn.6a628754
add eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x6a65cc50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
pcmpeqb mm6, mm6
test edi, 1
je 0x6a65cc93
movq mm0, qword [ecx]
movq mm1, qword [edx]
add ecx, esi
add edx, 8
pxor mm0, mm6
pxor mm1, mm6
pavgb mm0, mm1
pxor mm0, mm6
movq qword [eax], mm0
add eax, ebx
dec edi
movq mm0, qword [ecx]
add ecx, esi
movq mm1, qword [ecx]
add ecx, esi
movq mm2, qword [edx]
movq mm3, qword [edx + 8]
pxor mm0, mm6
pxor mm1, mm6
pxor mm2, mm6
pxor mm3, mm6
pavgb mm0, mm2
pavgb mm1, mm3
pxor mm0, mm6
pxor mm1, mm6
movq qword [eax], mm0
add eax, ebx
movq qword [eax], mm1
add eax, ebx
movq mm0, qword [ecx]
add ecx, esi
movq mm1, qword [ecx]
add ecx, esi
movq mm2, qword [edx + 0x10]
movq mm3, qword [edx + 0x18]
pxor mm0, mm6
pxor mm1, mm6
pxor mm2, mm6
pxor mm3, mm6
pavgb mm0, mm2
pavgb mm1, mm3
pxor mm0, mm6
pxor mm1, mm6
movq qword [eax], mm0
add eax, ebx
movq qword [eax], mm1
add eax, ebx
add edx, 0x20
sub edi, 4
jne 0x6a65cc93
pop edi
pop esi
pop ebx
ret
Function at 0x6a65cd10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
pcmpeqb mm6, mm6
test edi, 1
je 0x6a65cd6b
movq mm0, qword [ecx]
movq mm1, qword [ecx + 8]
movq mm2, qword [edx]
movq mm3, qword [edx + 8]
pxor mm0, mm6
pxor mm1, mm6
pxor mm2, mm6
pxor mm3, mm6
pavgb mm0, mm2
pavgb mm1, mm3
pxor mm0, mm6
pxor mm1, mm6
add ecx, esi
add edx, 0x10
movq qword [eax], mm0
movq qword [eax + 8], mm1
add eax, ebx
dec edi
movq mm0, qword [ecx]
movq mm1, qword [ecx + 8]
add ecx, esi
movq mm2, qword [edx]
movq mm3, qword [edx + 8]
pxor mm0, mm6
pxor mm1, mm6
pxor mm2, mm6
pxor mm3, mm6
pavgb mm0, mm2
pavgb mm1, mm3
pxor mm0, mm6
pxor mm1, mm6
movq qword [eax], mm0
movq qword [eax + 8], mm1
add eax, ebx
movq mm0, qword [ecx]
movq mm1, qword [ecx + 8]
add ecx, esi
movq mm2, qword [edx + 0x10]
movq mm3, qword [edx + 0x18]
pxor mm0, mm6
pxor mm1, mm6
pxor mm2, mm6
pxor mm3, mm6
pavgb mm0, mm2
pavgb mm1, mm3
pxor mm0, mm6
pxor mm1, mm6
movq qword [eax], mm0
movq qword [eax + 8], mm1
add eax, ebx
add edx, 0x20
sub edi, 2
jne 0x6a65cd6b
pop edi
pop esi
pop ebx
ret
Function at 0x6a7f5fb0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov eax, dword [esi + 0x8a8]
test eax, eax
je 0x6a7f605c
mov dword [esi + 0x1600], 0
mov edi, dword [ebx + 0x29a2c]
test edi, edi
jne 0x6a7f6038
mov eax, dword [esi + 0x1600]
test eax, eax
jle 0x6a7f6009
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.6a82afa8
lea eax, [ebx + 0x11440]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6a804a6c
mov eax, dword [esi + 0x6b8]
mov dword [esp], eax
call fcn.6a8057a4
mov ecx, dword [ebx + 0x1c710]
test ecx, ecx
je 0x6a7f602f
add ebx, 0x2b670
mov dword [esp], ebx
call fcn.6a8057a4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x29a5c]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseSemaphore
sub esp, 0xc
jmp 0x6a7f5fe1
call fcn.6a805b00
lea eax, [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_QueryPerformanceCounter
push eax
mov eax, dword [ebx + 0x28960]
test eax, eax
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x1c8b8]
mov dword [esp], eax
je 0x6a7f60fc
call fcn.6a82afe0
lea eax, [esp + 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_QueryPerformanceCounter
push ebp
mov edi, dword [ebx + 0x29bb0]
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
sub edi, dword [esp + 0x30]
sbb ebp, dword [esp + 0x34]
lea eax, [esp + 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_QueryPerformanceFrequency
push eax
imul ecx, ebp, 0xf4240
mov eax, 0xf4240
mul edi
add edx, ecx
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6aa7e29c
mov edi, dword [esp + 0x1c]
add edi, eax
mov dword [ebx + 0x29bb0], edi
jmp 0x6a7f5fd7
call fcn.6a82a814
jmp 0x6a7f608a
Function at 0x6a7fd3b8
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov dword [ebx + 0x3ee0], 0
mov dword [ebx + 0x3ef0], 0
mov edx, dword [ebx + 0x31f8]
mov eax, dword [ebx + 0x3ee4]
cmp eax, edx
jle 0x6a7fd3e9
mov eax, edx
cmp eax, 8
jle 0x6a7fd5b8
mov eax, 8
mov dword [ebx + 0x3ee0], 1
dec eax
mov dword [ebx + 0x3eec], eax
shl eax, 2
mov dword [esp], eax
call fcn.6a7fb404
mov dword [ebx + 0x3f2c], eax
test eax, eax
je 0x6a7fd5c9
mov eax, dword [ebx + 0x3eec]
shl eax, 2
mov dword [esp], eax
call fcn.6a7fb404
mov dword [ebx + 0x3f30], eax
test eax, eax
je 0x6a7fd638
mov eax, dword [ebx + 0x3eec]
lea edx, [eax + eax*2]
lea edx, [edx + edx*4]
lea eax, [eax + edx*8]
shl eax, 5
mov dword [esp + 4], eax
mov dword [esp], 0x20
call fcn.6a7fb3d0
mov edx, eax
mov dword [ebx + 0x3f24], eax
test eax, eax
je 0x6a7fd60f
mov eax, dword [ebx + 0x3eec]
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*8]
shl ecx, 5
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x3eec]
lea eax, [eax + eax*2]
shl eax, 2
mov dword [esp], eax
call fcn.6a7fb404
mov dword [ebx + 0x3f28], eax
test eax, eax
je 0x6a7fd5ec
mov eax, dword [ebx + 0x3eec]
test eax, eax
jle 0x6a7fd576
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
xor esi, esi
lea edi, [esi*4]
mov ebp, dword [ebx + 0x3f30]
add ebp, edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
mov dword [ebp], eax
mov eax, dword [esp + 0x28]
add eax, dword [ebx + 0x3f28]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov ebp, dword [esp + 0x2c]
add ebp, dword [ebx + 0x3f24]
mov dword [eax + 8], ebp
mov ebp, dword [ebx + 0x3f2c]
add ebp, edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6a7fd278
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov dword [ebp], eax
inc esi
add dword [esp + 0x28], 0xc
add dword [esp + 0x2c], 0xf20
cmp dword [ebx + 0x3eec], esi
jg 0x6a7fd4cc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
mov dword [ebx + 0x3f34], eax
mov eax, dword [ebx + 0x3eec]
mov dword [ebx + 0x3ef0], eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 1
jg 0x6a7fd3f7
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.Failed_to_allocate_pbi__h_decoding_thread
mov dword [esp + 4], 2
lea eax, [ebx + 0xf00]
mov dword [esp], eax
call fcn.6a7fd350
jmp 0x6a7fd421
mov dword [esp + 8], str.Failed_to_allocate_pbi__de_thread_data
mov dword [esp + 4], 2
lea eax, [ebx + 0xf00]
mov dword [esp], eax
call fcn.6a7fd350
jmp 0x6a7fd4ac
mov dword [esp + 8], str.Failed_to_allocate_pbi__mb_row_di
mov dword [esp + 4], 2
lea eax, [ebx + 0xf00]
mov dword [esp], eax
call fcn.6a7fd350
mov edx, dword [ebx + 0x3f24]
jmp 0x6a7fd472
mov dword [esp + 8], str.Failed_to_allocate_pbi__h_event_start_decoding
mov dword [esp + 4], 2
lea eax, [ebx + 0xf00]
mov dword [esp], eax
call fcn.6a7fd350
jmp 0x6a7fd440
Function at 0x6a82e73c
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edx, dword [ebx + 0x1c7c8]
mov dword [esp + 0x1c], edx
mov ebp, dword [ebx + 0x1c7cc]
mov edi, dword [ebx + 0x20c60]
mov eax, dword [ebx + 0x1c8a8]
mov dword [esp], eax
call fcn.6a821494
mov edx, esi
not edx
add eax, edx
cmp ebp, 1
je 0x6a82e824
cmp ebp, 2
je 0x6a82e798
cmp esi, eax
jl 0x6a82e84d
jle 0x6a82e84f
mov ecx, eax
jmp 0x6a82e851
cmp edi, eax
jle 0x6a82e845
lea edx, [eax + 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
add esi, eax
lea ecx, [edi*4]
lea edx, [ebx + 0x2addc]
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
test edi, edi
jle 0x6a82e806
mov ebp, esi
mov edi, esi
sub edi, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub eax, esi
lea esi, [ebx + eax*4]
lea esi, [esi]
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x1c8a8]
mov dword [esp], eax
call fcn.6a8213f8
mov dword [esi + ebp*4 + 0x2add8], eax
dec ebp
cmp ebp, edi
jne 0x6a82e7e0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x40], edx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6a82d8d4
cmp edi, esi
jle 0x6a82e83a
mov dword [esp + 0x18], esi
mov edx, esi
inc edx
mov dword [esp + 0x14], edx
xor eax, eax
jmp 0x6a82e7af
lea eax, [edi - 1]
mov dword [esp + 0x18], eax
mov edx, eax
jmp 0x6a82e82e
lea eax, [edi - 1]
jmp 0x6a82e7a0
mov eax, esi
mov ecx, esi
lea edx, [edi - 1]
mov ebp, edx
shr ebp, 0x1f
add edx, ebp
sar edx, 1
cmp eax, edx
jle 0x6a82e863
mov eax, edx
mov edx, edi
shr edx, 0x1f
add edx, edi
sar edx, 1
mov dword [esp + 0x18], ecx
cmp ecx, edx
jle 0x6a82e878
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x18]
lea edx, [edx + eax + 1]
mov dword [esp + 0x14], edx
jmp 0x6a82e7af
Function at 0x6a82e8f0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov dword [esi + 0x22f8], 0x10
mov dword [esp], 0x6ac542a8
call sub.msvcrt.dll_getenv
test eax, eax
je 0x6a82e91d
cmp byte [eax], 0
jne 0x6a82e9f4
mov dword [esp], str.VPX_SIMD_CAPS_MASK
call sub.msvcrt.dll_getenv
test eax, eax
je 0x6a82e936
cmp byte [eax], 0
jne 0x6a82e9d4
mov ebx, 0xffffffff
xor eax, eax
mov edi, ebx
cpuid
xchg ebx, edi
test eax, eax
je 0x6a82e990
mov eax, 1
mov edi, ebx
cpuid
xchg ebx, edi
mov eax, edx
shr eax, 0x17
and eax, 1
test edx, 0x2000000
je 0x6a82e965
or eax, 2
and edx, 0x4000000
je 0x6a82e970
or eax, 4
test cl, 1
je 0x6a82e978
or eax, 8
test ch, 2
je 0x6a82e980
or eax, 0x10
and ecx, 0x80000
je 0x6a82e98b
or eax, 0x20
and eax, ebx
jmp 0x6a82e992
xor eax, eax
mov dword [esi + 0x2f40], eax
mov dword [esp], 0x6aad30e0
call sub.KERNEL32.dll_EnterCriticalSection
push edx
mov ecx, dword [0x6b33c560]
test ecx, ecx
jne 0x6a82e9be
call fcn.6a808698
mov dword [0x6b33c560], 1
mov dword [esp], 0x6aad30e0
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov ebx, eax
jmp 0x6a82e93b
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
jmp 0x6a82e992
Function at 0x6a83ec80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
movq mm7, qword [edx]
mov edi, esi
add edi, eax
movq mm2, qword [edi + eax*2]
movq mm1, qword [esi + eax*2]
movq mm6, mm1
psubusb mm1, mm2
psubusb mm2, mm6
por mm1, mm2
psubusb mm1, mm7
movq mm4, qword [esi + eax]
movq mm3, mm4
psubusb mm4, mm6
psubusb mm6, mm3
por mm4, mm6
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi]
movq mm0, mm4
psubusb mm4, mm3
psubusb mm3, mm0
por mm4, mm3
movq qword [esp], mm4
psubusb mm4, mm7
por mm1, mm4
neg eax
movq mm2, qword [esi + eax*4]
movq mm4, qword [edi + eax*4]
movq mm5, mm4
psubusb mm4, mm2
psubusb mm2, mm5
por mm4, mm2
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi + eax*2]
movq mm3, mm4
psubusb mm4, mm5
psubusb mm5, mm3
por mm4, mm5
psubusb mm4, mm7
por mm1, mm4
movq mm2, mm3
movq mm4, qword [esi + eax]
movq mm5, mm4
psubusb mm4, mm3
psubusb mm3, mm5
por mm4, mm3
movq qword [esp + 0x10], mm4
psubusb mm4, mm7
por mm1, mm4
movq mm3, qword [edi]
movq mm4, mm3
psubusb mm3, mm2
psubusb mm2, mm4
por mm2, mm3
pand mm2, qword [0x6ae58ff0]
psrlw mm2, 1
movq mm6, mm5
movq mm3, qword [esi]
psubusb mm5, mm3
psubusb mm3, mm6
por mm5, mm3
paddusb mm5, mm5
paddusb mm5, mm2
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
por mm1, mm5
pxor mm5, mm5
pcmpeqb mm1, mm5
mov edx, dword [ebp + 0x18]
movq mm7, qword [edx]
movq mm4, qword [esp]
psubusb mm4, mm7
movq mm3, qword [esp + 0x10]
psubusb mm3, mm7
paddb mm4, mm3
pcmpeqb mm4, mm5
pcmpeqb mm5, mm5
pxor mm4, mm5
movq mm2, qword [esi + eax*2]
movq mm7, qword [edi]
pxor mm2, qword [0x6ae59000]
pxor mm7, qword [0x6ae59000]
psubsb mm2, mm7
pand mm2, mm4
pxor mm6, qword [0x6ae59000]
pxor mm0, qword [0x6ae59000]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm1, mm2
movq mm2, mm1
paddsb mm1, qword [0x6ae59030]
paddsb mm2, qword [0x6ae59020]
pxor mm0, mm0
pxor mm5, mm5
punpcklbw mm0, mm2
punpckhbw mm5, mm2
psraw mm0, 0xb
psraw mm5, 0xb
packsswb mm0, mm5
movq mm2, mm0
pxor mm0, mm0
movq mm5, mm1
punpcklbw mm0, mm1
psraw mm0, 0xb
pxor mm1, mm1
punpckhbw mm1, mm5
psraw mm1, 0xb
movq mm5, mm0
packsswb mm0, mm1
paddsw mm5, qword [0x6ae59040]
paddsw mm1, qword [0x6ae59040]
psraw mm5, 1
psraw mm1, 1
packsswb mm5, mm1
pandn mm4, mm5
paddsb mm6, mm2
pxor mm6, qword [0x6ae59000]
movq qword [esi + eax], mm6
movq mm6, qword [esi + eax*2]
pxor mm6, qword [0x6ae59000]
paddsb mm6, mm4
pxor mm6, qword [0x6ae59000]
movq qword [esi + eax*2], mm6
psubsb mm3, mm0
pxor mm3, qword [0x6ae59000]
movq qword [esi], mm3
psubsb mm7, mm4
pxor mm7, qword [0x6ae59000]
movq qword [edi], mm7
add esi, 8
neg eax
dec ecx
jne 0x6a83ec9b
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0x6a83f86c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, 2
mov edx, dword [ebp + 0x10]
movq mm3, qword [edx]
mov edi, esi
add edi, eax
neg eax
movq mm1, qword [esi + eax*2]
movq mm0, qword [edi]
movq mm2, mm1
movq mm7, mm0
movq mm4, mm0
psubusb mm0, mm1
psubusb mm1, mm4
por mm1, mm0
pand mm1, qword [0x6ae58ff0]
psrlw mm1, 1
movq mm5, qword [esi + eax]
movq mm4, qword [esi]
movq mm0, mm4
movq mm6, mm5
psubusb mm5, mm4
psubusb mm4, mm6
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm1
psubusb mm5, mm3
pxor mm3, mm3
pcmpeqb mm5, mm3
pxor mm2, qword [0x6ae59000]
pxor mm7, qword [0x6ae59000]
psubsb mm2, mm7
pxor mm6, qword [0x6ae59000]
pxor mm0, qword [0x6ae59000]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm5, mm2
paddsb mm5, qword [0x6ae59030]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm1, mm5
psraw mm1, 0xb
psllw mm1, 8
por mm0, mm1
psubsb mm3, mm0
pxor mm3, qword [0x6ae59000]
movq qword [esi], mm3
psubsb mm5, qword [0x6ae59010]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x6ae59000]
movq qword [esi + eax], mm6
add esi, 8
neg eax
dec ecx
jne 0x6a83f87c
pop edi
pop esi
pop ebp
ret
Function at 0x6a83f972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [esi + eax*4 - 2]
mov ecx, 2
lea edi, [esi + eax]
movd mm0, dword [edi + eax*2]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm0
movd mm0, dword [esi + eax]
movd mm4, dword [esi]
punpcklbw mm4, mm0
movq mm5, mm4
punpcklwd mm4, mm6
punpckhwd mm5, mm6
neg eax
movd mm7, dword [esi + eax]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm7
movd mm1, dword [edi + eax*4]
movd mm0, dword [esi + eax*4]
punpcklbw mm0, mm1
movq mm2, mm0
punpcklwd mm0, mm6
punpckhwd mm2, mm6
movq mm1, mm0
punpckldq mm0, mm4
movq mm3, mm2
punpckhdq mm1, mm4
punpckldq mm2, mm5
punpckhdq mm3, mm5
movq mm6, mm0
movq mm7, mm3
psubusb mm7, mm6
psubusb mm6, mm3
por mm6, mm7
pand mm6, qword [0x6ae58ff0]
psrlw mm6, 1
movq mm5, mm1
movq mm4, mm2
psubusb mm5, mm2
psubusb mm4, mm1
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm6
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
pxor mm7, mm7
pcmpeqb mm5, mm7
movq qword [esp], mm0
movq qword [esp + 0x10], mm3
pxor mm0, qword [0x6ae59000]
pxor mm3, qword [0x6ae59000]
psubsb mm0, mm3
movq mm6, mm1
movq mm7, mm2
pxor mm6, qword [0x6ae59000]
pxor mm7, qword [0x6ae59000]
movq mm3, mm7
psubsb mm7, mm6
paddsb mm0, mm7
paddsb mm0, mm7
paddsb mm0, mm7
pand mm5, mm0
paddsb mm5, qword [0x6ae59030]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm7, mm5
psraw mm7, 0xb
psllw mm7, 8
por mm0, mm7
psubsb mm3, mm0
pxor mm3, qword [0x6ae59000]
psubsb mm5, qword [0x6ae59010]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x6ae59000]
movq mm0, qword [esp]
movq mm4, qword [esp + 0x10]
movq mm1, mm0
punpcklbw mm0, mm6
punpckhbw mm1, mm6
movq mm2, mm3
punpcklbw mm2, mm4
movq mm5, mm1
punpckhbw mm3, mm4
movq mm6, mm0
punpcklwd mm0, mm2
punpckhwd mm6, mm2
movd dword [esi + eax*4], mm0
punpcklwd mm1, mm3
psrlq mm0, 0x20
punpckhwd mm5, mm3
movd dword [edi + eax*4], mm0
movd dword [esi + eax*2], mm6
psrlq mm6, 0x20
movd dword [esi], mm1
movd dword [esi + eax], mm6
neg eax
movd dword [esi + eax*2], mm5
psrlq mm1, 0x20
movd dword [edi], mm1
psrlq mm5, 0x20
movd dword [edi + eax*2], mm5
lea esi, [esi + eax*8]
dec ecx
jne 0x6a83f993
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0x6a87da54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edx, dword [esp + 0xc]
jmp fcn.6a87d5c0

Function at 0x6a87da78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x10]
mov dword [esp + 4], edx
mov edx, dword [esp + 0xc]
jmp fcn.6a87d5c0