joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a3108
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 4
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xdecac0cc
mov byte [ebp - 0x38], 0xbc
mov word [ebp - 0x37], cx
mov byte [ebp - 0x35], cl
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0x3c], al
inc ecx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
jb 0x583b21
mov byte [ebp + eax - 0x3c], 0
mov ecx, edx
lea eax, [ebp - 0x3c]
push eax
call fcn.00771630
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.007721f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae eax, ecx
cmp edx, 2
jne 0x583b8a
push edx
push 0x7d8160
push eax
call fcn.004090d0
add esp, 0xc
test eax, eax
jne 0x583b84
mov dword [edi], 1
jmp 0x583bb1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, ecx
cmp edx, 2
jne 0x583bb1
push edx
push 0x7d8168
push eax
call fcn.004090d0
add esp, 0xc
test eax, eax
jne 0x583bb1
mov dword [edi], 2
xor ecx, ecx
mov dword [ebp - 0x30], 0xded7d8d6
mov eax, 4
mov byte [ebp - 0x2c], 0xbc
mov dword [ebp - 0x34], eax
mov word [ebp - 0x2b], cx
mov byte [ebp - 0x29], cl
nop dword [eax]
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0x30], al
inc ecx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
jb 0x583bd0
mov ecx, dword [ebp - 0x44]
mov byte [ebp + eax - 0x30], 0
lea eax, [ebp - 0x30]
push eax
call fcn.00771630
lea ecx, [ebp - 0x60]
push ecx
mov ecx, eax
call fcn.007721f0
mov esi, eax
add edi, 4
cmp edi, esi
je 0x583c2e
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x60]
call fcn.00404490
xor ecx, ecx
mov dword [ebp - 0x30], 0xd3ced8c8
mov eax, 4
mov byte [ebp - 0x2c], 0xbc
mov dword [ebp - 0x34], eax
xor edx, edx
mov word [ebp - 0x2b], cx
mov byte [ebp - 0x29], cl
lea eax, [edx - 0x48]
xor byte [ebp + edx - 0x30], al
inc edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
jb 0x583c54
mov byte [ebp + eax - 0x30], cl
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x44]
push eax
call fcn.00771630
lea ecx, [ebp - 0x60]
push ecx
mov ecx, eax
call fcn.007721f0
mov edi, dword [ebp - 0x48]
mov esi, eax
add edi, 0x1c
cmp edi, esi
je 0x583cb4
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x60]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret 4
Function at 0x586ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a3760
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x38
lea eax, [ebp - 0x74]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x74]
call fcn.00575790
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
xor ecx, ecx
mov dword [ebp - 0x14], 0
movaps xmm0, xmmword [0x7e4070]
movups xmmword [ebp - 0xd4], xmm0
mov dword [ebp - 0xd8], 0x57
movaps xmm0, xmmword [0x7e36b0]
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0x84], 0x56255537
movaps xmm0, xmmword [0x7e3f60]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x80], 0xf242333
movaps xmm0, xmmword [0x7e3f70]
movups xmmword [ebp - 0xa4], xmm0
movaps xmm0, xmmword [0x7e36d0]
movups xmmword [ebp - 0x94], xmm0
nop
mov al, cl
sub al, 0x48
xor byte [ebp + ecx - 0xd4], al
inc ecx
mov eax, dword [ebp - 0xd8]
cmp ecx, eax
jb 0x586b80
mov byte [ebp + eax - 0xd4], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], 0
call fcn.00408e80
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 1
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x586bc0
push dword [ebp - 0x7c]
sub ecx, edx
lea eax, [ebp - 0xd4]
add eax, ecx
lea ecx, [ebp - 0x24]
push 0x100
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00409380
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push esi
push eax
call fcn.00405710
add esp, 4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x3c]
push eax
call fcn.00587bc0
add esp, 8
lea ecx, [ebp - 0x3c]
test al, al
setne byte [ebp - 0x75]
call fcn.00407a10
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x586c39
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x586c39
mov ecx, dword [ebp - 0x24]
xor edx, edx
call fcn.00405180
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x586c5e
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x586c5e
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [ebp - 0x6c]
test esi, esi
je 0x586caa
mov ecx, dword [ebp - 0x64]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x586ca0
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x586ca0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.0076d313
add esp, 8
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret
Function at 0x58a560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x10], 0xd800d5
xor eax, eax
mov dword [ebp - 0xc], 0xd700d3
mov dword [ebp - 8], 0xcf0092
mov dword [ebp - 4], 0xbf00cb
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x10], cx
inc eax
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jb 0x58a590
push dword [ebp + 8]
xor eax, eax
mov word [ebp + ecx*2 - 0x10], ax
mov ecx, edx
call fcn.0063eb80
mov esp, ebp
pop ebp
ret 4
Function at 0x590590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 9
xor ecx, ecx
mov dword [ebp - 0x24], 0xcc00f9
mov dword [ebp - 0x20], 0xd400ce
mov dword [ebp - 0x1c], 0xc900cf
mov dword [ebp - 0x18], 0xcd00df
mov dword [ebp - 0x14], 0xc100b4
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x5905f0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x590620
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xdc00ea
mov dword [ebp - 0x78], 0xd200dd
mov dword [ebp - 0x74], 0xc900cf
mov dword [ebp - 0x70], 0xc600cc
mov dword [ebp - 0x6c], 0xa40093
mov dword [ebp - 0x68], 0xb700a1
mov dword [ebp - 0x64], 0xaa00ad
mov dword [ebp - 0x60], 0xb400a8
mov dword [ebp - 0x5c], 0xc8
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x590690
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5906c0
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83df7c]
test eax, eax
jne 0x590719
push 0x28
call fcn.0076d2e3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048cfa0
mov byte [ebp - 4], 1
mov dword [0x83df7c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048d320
mov esi, eax
add edi, 8
cmp edi, esi
je 0x59075f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x591320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, 8
mov dword [ebp - 0x24], 0xd600eb
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x20], 0xcf00dc
mov dword [ebp - 0x1c], 0xdc00cb
mov dword [ebp - 0x18], 0xda00cc
mov dword [ebp - 0x14], 0xc0
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x591380
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5913b0
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xdc00ea
mov dword [ebp - 0x78], 0xd200dd
mov dword [ebp - 0x74], 0xc900cf
mov dword [ebp - 0x70], 0xc600cc
mov dword [ebp - 0x6c], 0xa40093
mov dword [ebp - 0x68], 0xb700a1
mov dword [ebp - 0x64], 0xaa00ad
mov dword [ebp - 0x60], 0xb400a8
mov dword [ebp - 0x5c], 0xc8
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x591420
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x591450
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83df7c]
test eax, eax
jne 0x5914a9
push 0x28
call fcn.0076d2e3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048cfa0
mov byte [ebp - 4], 1
mov dword [0x83df7c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048d320
mov esi, eax
add edi, 8
cmp edi, esi
je 0x5914ef
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x591cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 9
xor ecx, ecx
mov dword [ebp - 0x24], 0xd700ed
mov dword [ebp - 0x20], 0xd500d3
mov dword [ebp - 0x1c], 0xc900cf
mov dword [ebp - 0x18], 0xd300df
mov dword [ebp - 0x14], 0xc100ac
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x591d10
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x591d40
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xdc00ea
mov dword [ebp - 0x78], 0xd200dd
mov dword [ebp - 0x74], 0xc900cf
mov dword [ebp - 0x70], 0xc600cc
mov dword [ebp - 0x6c], 0xa40093
mov dword [ebp - 0x68], 0xb700a1
mov dword [ebp - 0x64], 0xaa00ad
mov dword [ebp - 0x60], 0xb400a8
mov dword [ebp - 0x5c], 0xc8
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x591db0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x591de0
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83df7c]
test eax, eax
jne 0x591e39
push 0x28
call fcn.0076d2e3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048cfa0
mov byte [ebp - 4], 1
mov dword [0x83df7c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048d320
mov esi, eax
add edi, 8
cmp edi, esi
je 0x591e7f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x592d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 9
xor ecx, ecx
mov dword [ebp - 0x24], 0xd100eb
mov dword [ebp - 0x20], 0xc900db
mov dword [ebp - 0x1c], 0xd900d9
mov dword [ebp - 0x18], 0xd300fa
mov dword [ebp - 0x14], 0xc100ac
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x592da0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x592dd0
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xdc00ea
mov dword [ebp - 0x78], 0xd200dd
mov dword [ebp - 0x74], 0xc900cf
mov dword [ebp - 0x70], 0xc600cc
mov dword [ebp - 0x6c], 0xa40093
mov dword [ebp - 0x68], 0xb700a1
mov dword [ebp - 0x64], 0xaa00ad
mov dword [ebp - 0x60], 0xb400a8
mov dword [ebp - 0x5c], 0xc8
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x592e40
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x592e70
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83df7c]
test eax, eax
jne 0x592ec9
push 0x28
call fcn.0076d2e3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048cfa0
mov byte [ebp - 4], 1
mov dword [0x83df7c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048d320
mov esi, eax
add edi, 8
cmp edi, esi
je 0x592f0f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x593450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, 8
mov dword [ebp - 0x24], 0xdc00eb
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x20], 0xcd00c8
mov dword [ebp - 0x1c], 0xde00d5
mov dword [ebp - 0x18], 0xcc00db
mov dword [ebp - 0x14], 0xc0
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x24], ax
inc ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
jb 0x5934b0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x24], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5934e0
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xdc00ea
mov dword [ebp - 0x78], 0xd200dd
mov dword [ebp - 0x74], 0xc900cf
mov dword [ebp - 0x70], 0xc600cc
mov dword [ebp - 0x6c], 0xa40093
mov dword [ebp - 0x68], 0xb700a1
mov dword [ebp - 0x64], 0xaa00ad
mov dword [ebp - 0x60], 0xb400a8
mov dword [ebp - 0x5c], 0xc8
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x593550
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x593580
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83df7c]
test eax, eax
jne 0x5935d9
push 0x28
call fcn.0076d2e3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048cfa0
mov byte [ebp - 4], 1
mov dword [0x83df7c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048d320
mov esi, eax
add edi, 8
cmp edi, esi
je 0x59361f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x593d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a4a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], 7
xor ecx, ecx
mov dword [ebp - 0x20], 0xd500fb
mov dword [ebp - 0x1c], 0xc800db
mov dword [ebp - 0x18], 0xd800cf
mov dword [ebp - 0x14], 0xbf00cd
nop
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x20], ax
inc ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
jb 0x593dc0
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp + eax*2 - 0x20], cx
xor eax, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x20]
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x593df0
sub ecx, edx
lea eax, [ebp - 0x20]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004044f0
mov dword [ebp - 4], 0
mov ecx, 0x10
mov dword [ebp - 0x80], ecx
xor eax, eax
mov dword [ebp - 0x7c], 0xdc00ea
mov dword [ebp - 0x78], 0xd200dd
mov dword [ebp - 0x74], 0xc900cf
mov dword [ebp - 0x70], 0xc600cc
mov dword [ebp - 0x6c], 0xa40093
mov dword [ebp - 0x68], 0xb700a1
mov dword [ebp - 0x64], 0xaa00ad
mov dword [ebp - 0x60], 0xb400a8
mov dword [ebp - 0x5c], 0xc8
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x7c], cx
inc eax
mov ecx, dword [ebp - 0x80]
cmp eax, ecx
jb 0x593e60
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp + ecx*2 - 0x7c], ax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 2]
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x593e90
sub ecx, edx
lea eax, [ebp - 0x7c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004044f0
mov byte [ebp - 4], 1
mov eax, dword [0x83df7c]
test eax, eax
jne 0x593ee9
push 0x28
call fcn.0076d2e3
add esp, 4
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 2
movups xmmword [eax], xmm0
mov ecx, eax
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
call fcn.0048cfa0
mov byte [ebp - 4], 1
mov dword [0x83df7c], eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.0048d320
mov esi, eax
add edi, 8
cmp edi, esi
je 0x593f2f
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0x40]
call fcn.00404490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret