joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57dc50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x57dca3
nop
add ecx, ecx
xor eax, eax
movss xmm1, dword [esi + ecx*4 + 8]
movss xmm0, dword [esi + ecx*4 + 4]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x57dc70
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x57dcb4
test al, 1
jne 0x57dcb4
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x57dcef
mov ecx, dword [esp + 0x20]
nop dword [eax]
movss xmm0, dword [ecx]
lea eax, [edx - 1]
sar eax, 1
cvtps2pd xmm0, xmm0
movss xmm2, dword [esi + eax*4]
cvtps2pd xmm1, xmm2
comisd xmm1, xmm0
jbe 0x57dce5
movss dword [esi + edx*4], xmm2
mov edx, eax
cmp ebx, eax
jl 0x57dcc0
mov eax, dword [ecx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x57dd00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, edx
push edi
lea edi, [ecx - 1]
sar edi, 1
cmp edx, edi
jge 0x57dd4e
nop dword [eax]
lea ecx, [eax + eax]
xor eax, eax
movsd xmm0, qword [esi + ecx*8 + 0x10]
comisd xmm0, xmmword [esi + ecx*8 + 8]
seta al
xor eax, 1
inc eax
add eax, ecx
movsd xmm0, qword [esi + eax*8]
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp eax, edi
jl 0x57dd20
mov ecx, dword [esp + 0x18]
cmp eax, edi
jne 0x57dd65
test cl, 1
jne 0x57dd65
movsd xmm0, qword [esi + ecx*8 - 8]
movsd qword [esi + edx*8], xmm0
lea edx, [ecx - 1]
cmp ebx, edx
jge 0x57dd98
mov ecx, dword [esp + 0x1c]
nop dword [eax]
lea eax, [edx - 1]
sar eax, 1
movsd xmm0, qword [esi + eax*8]
comisd xmm0, xmmword [ecx]
jbe 0x57dd8b
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp ebx, eax
jl 0x57dd70
movsd xmm0, qword [ecx]
pop edi
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
movsd xmm0, qword [eax]
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
Function at 0x5be1f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x18
test eax, eax
je 0x5be3ce
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
cmp edx, 1
jne 0x5be21d
cmp eax, 2
jne 0x5be214
xor ecx, ecx
jmp 0x5be227
cmp eax, 1
jne 0x5be227
mov ecx, eax
jmp 0x5be227
cmp edx, 2
jne 0x5be227
cmp eax, edx
cmove ecx, edx
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
cmp eax, 5
jne 0x5be2e2
mov ebp, dword [esp + 0x30]
xor edx, edx
cmp ecx, 2
sete dl
xor eax, eax
inc edx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x5be3ca
mov esi, dword [esp + 0x34]
nop word [eax + eax]
mov ebx, edx
cmp edx, eax
ja 0x5be2c8
lea ecx, [esi - 1]
mov dword [esp + 0x18], ecx
nop dword [eax]
mov eax, ecx
cmp eax, ebx
jl 0x5be2b3
mov edi, dword [ebp + eax*4]
mov esi, edi
mov ecx, dword [ebp + eax*4 - 4]
sub edi, dword [ebp + eax*4 - 4]
and ecx, 0xff800000
sub esi, ecx
xor edi, esi
and edi, 0x7fffff
xor edi, esi
mov dword [ebp + eax*4], edi
dec eax
cmp eax, ebx
jge 0x5be286
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jle 0x5be280
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
lea ebx, [esi*4]
add ebp, ebx
sub ecx, 1
mov dword [esp + 0x3c], ecx
jne 0x5be270
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp eax, 6
jne 0x5be3ca
mov edx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, 2
mov dword [esp + 0x3c], edx
sete bl
xor eax, eax
inc ebx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x24], ebx
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x5be3ca
mov esi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov ebp, ebx
cmp ebx, eax
ja 0x5be3b0
lea ecx, [esi - 1]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jl 0x5be397
nop
mov esi, dword [edx + ecx*8 - 4]
mov eax, esi
mov edi, dword [edx + ecx*8]
and eax, 0xfffff
mov ebx, dword [edx + ecx*8 + 4]
mov edx, edi
mov ebp, dword [esp + 0x3c]
sub edx, dword [ebp + ecx*8 - 8]
mov ecx, ebx
sbb ecx, eax
and esi, 0xfff00000
sub edi, 0
sbb ebx, esi
xor eax, eax
xor ebx, ecx
xor eax, edx
and ebx, 0xfff00000
mov edx, ebp
mov ebp, dword [esp + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], ebx
dec ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jge 0x5be340
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x5be336
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
lea ebp, [esi*8]
add edx, ebp
sub ecx, 1
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], ecx
jne 0x5be321
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x5cdd60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0086bdd0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x5cdde0
mov cl, byte [edi]
test cl, cl
je 0x5cdde0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x5cdd90
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x5cde90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0086bdd0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x5cdf13
mov cl, byte [edi]
test cl, cl
je 0x5cdf13
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x5cdec0
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x5d91c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0086bdd0
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x20]
push edi
mov ebp, dword [ebp]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x5d9208
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x5d9208
mov al, byte [ecx + ebp]
dec esi
xor al, byte [ebx]
inc ebp
mov byte [edi], al
inc ebx
inc edi
and ebp, 0xf
mov dword [esp + 0x14], ebp
jne 0x5d91f0
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x5d92a4
mov ebp, eax
mov ecx, esi
shr ecx, 4
push ebp
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push edi
cmovae edx, eax
push ebx
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [ebp + 0xc], eax
test edx, edx
jne 0x5d9286
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + ebp - 1]
dec edx
add eax, ecx
mov byte [edx + ebp], al
shr eax, 8
test edx, edx
jne 0x5d9270
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add edi, eax
add ebx, eax
cmp esi, 0x10
jae 0x5d9220
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x5d9302
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x5d92dd
push eax
call fcn.005d9340
add esp, 4
mov eax, dword [esp + 0x30]
sub ebx, eax
sub edi, eax
lea ecx, [eax + ebp]
add ebp, esi
nop word [eax + eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [edi + ecx - 1], al
sub esi, 1
jne 0x5d92f0
mov eax, dword [esp + 0x34]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x5e9b70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x5e9c86
push edi
cmp esi, 4
jb 0x5e9c61
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x5e9c04
cmp edi, ecx
jae 0x5e9c61
cmp edx, ebx
ja 0x5e9c0c
cmp edi, ebx
jae 0x5e9c61
cmp edx, ebp
ja 0x5e9c14
cmp edi, ebp
jae 0x5e9c61
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x5e9c22
cmp edi, ebx
jae 0x5e9c61
cmp ecx, ebp
ja 0x5e9c2a
cmp edi, ebp
jae 0x5e9c61
mov edi, esi
and edi, 0xfffffffc
nop
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movaps xmm0, xmm1
xorps xmm1, xmm3
xorps xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x5e9c30
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x5e9c85
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x5e9c61
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5e9fc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0086bdd0
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x5ea067
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x5ea050
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.005ea090
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x5ea003
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x5ea073
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.005ea090
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x5ea650
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.0086bdd0
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call fcn.005e9fc0
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x5ea6c1
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x5ea6b9
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x5ea6c3
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x5ea6c3
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x5ea701
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x5ea780
test esi, esi
je 0x5ea814
push esi
push ecx
push dword [esp + 0x40]
call fcn.0086d370
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x5ea6d4
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x5ea742
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x5ea73e
dec ecx
test ecx, ecx
jg 0x5ea730
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call fcn.005e9fc0
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x5ea6d4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x5ea790
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x5ea813
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x5ea7c5
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x668c40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
movzx eax, cl
and eax, 1
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x668c82
push ebx
add edi, esi
lea ebx, [edx + esi]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x668c62
pop ebx
pop edi
pop esi
ret
Function at 0x6ae870
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x6ae8ab
cmp esi, edx
jb 0x6ae8ab
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x6ae894
pop esi
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop dword [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [esi - 0x40]
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x6ae8c0
pop esi
ret
Function at 0x757ab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x89e883
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x9726c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi], 0x93c0d0
mov dword [esi + 4], 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
test ecx, ecx
jne 0x757b67
mov dword [esi + 0x14], 1
xor eax, eax
jmp 0x757b6f
mov eax, dword [ecx]
call dword [eax + 0x2d8]
mov edi, dword [esi + 0x18]
and edi, 2
mov ecx, edi
not ecx
and ecx, dword [esi + 0x18]
push ecx
push eax
lea eax, [ebp + 8]
push eax
call fcn.0075b520
add esp, 0xc
test eax, eax
je 0x757bc5
mov ecx, dword [esi + 8]
mov dword [esi + 0x10], eax
test ecx, ecx
je 0x757b9f
call fcn.0075ca80
jmp 0x757bac
mov al, byte [esi + 0x18]
not al
movzx eax, al
shr eax, 1
and eax, 1
push eax
push dword [esi + 0x10]
push 0x93c290
push dword [esi + 8]
call fcn.0075ef90
add esp, 0x10
jmp 0x757c4a
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [eax + 0x128], esi
test byte [esi + 0x14], 1
je 0x757c0b
push 0x40
call fcn.0086b05e
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x757bff
mov ecx, dword [ebp + 8]
push edi
push dword [ecx + 0x18]
mov ecx, eax
call fcn.0075c510
jmp 0x757c01
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 8], eax
push 8
call fcn.0086b05e
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x757c2e
mov ecx, eax
call fcn.00760a80
mov ecx, eax
jmp 0x757c30
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax + 0x24]
mov dword [ecx + 4], eax
mov dword [esi + 0x10], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x75c510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x89e8cd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x9726c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [ebp + 8]
shr eax, 1
not eax
mov dword [esi], 0x93d358
and eax, 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp + 0xc], ecx
mov dword [0x972458], eax
test ecx, ecx
jne 0x75c5da
and edx, 0xfffffffd
lea eax, [ebp + 0xc]
push edx
push eax
call fcn.00765460
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x75c5d7
test byte [esi + 0xc], 2
mov dword [esi + 8], ecx
jne 0x75c5e7
lea eax, [ecx + 0x7912]
cmp eax, 0x14
ja case.0x75c5d0.30992
movzx eax, byte [eax + 0x75c724]
jmp dword [eax*4 + 0x75c710]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
mov dword [ecx + 0x78], esi
mov dword [esi + 8], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x93d720
lea ecx, [ebp - 0x24]
call fcn.007845d0
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00785220
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.00784550
push 0x96aaa0
lea eax, [ebp - 0x50]
push eax
call fcn.0086d887
push 0x93d720
lea ecx, [ebp - 0x38]
call fcn.007848d0
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
call fcn.00785220
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00784800
push 0x96aaf8
lea eax, [ebp - 0x7c]
push eax
call fcn.0086d887
push 0x93d720
lea ecx, [ebp - 0x24]
call fcn.00784c80
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 2
call fcn.00785220
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.00784c00
push 0x96ab34
lea eax, [ebp - 0x50]
push eax
call fcn.0086d887
push 0x93d720
lea ecx, [ebp - 0x24]
call fcn.00784e40
push esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 3
call fcn.00785220
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.00784dc0
push 0x96ab70
lea eax, [ebp - 0x50]
push eax
call fcn.0086d887
push ecx
push 0x93d720
lea ecx, [ebp - 0x50]
call fcn.00784790
push esi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 4
call fcn.00785220
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x68]
call fcn.00784710
push 0x96abac
lea eax, [ebp - 0x68]
push eax
call fcn.0086d887
nop
sti
lds esi, [ebp]
xor al, dh
jne 7718680
imul eax, esi, 0xc6a00075
jne 7718688
xlatb
invalid
Function at 0x792830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
push esi
mov esi, dword [esp + 0x10]
add esi, edx
cmp edx, esi
jae 0x792851
movzx ecx, byte [edx]
inc edx
imul eax, eax, 0x1000193
xor eax, ecx
cmp edx, esi
jb 0x792841
pop esi
ret
Function at 0x7d8af0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xf4
mov eax, dword [0x9726c0]
xor eax, esp
mov dword [esp + 0xf0], eax
push esi
mov esi, dword [esp + 0x100]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10c]
push 0x40
push 0
push eax
call fcn.0086d370
push 0x40
lea eax, [esp + 0x88]
push 0x36
push eax
call fcn.0086d370
push 0x40
lea eax, [esp + 0xd4]
push 0x5c
push eax
call fcn.0086d370
mov eax, dword [esp + 0x124]
add esp, 0x24
movups xmm0, xmmword [eax]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], eax
xor eax, eax
movups xmmword [esp + 8], xmm0
nop
movups xmm1, xmmword [esp + eax + 8]
movups xmm0, xmmword [esp + eax + 0x78]
xorps xmm0, xmm1
movups xmmword [esp + eax + 0x78], xmm0
movups xmm0, xmmword [esp + eax + 0xb8]
xorps xmm0, xmm1
movups xmmword [esp + eax + 0xb8], xmm0
add eax, 0x10
cmp eax, 0x40
jl 0x7d8b60
lea eax, [esp + 8]
push eax
call fcn.00834970
push 0x40
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00836080
push dword [esp + 0x118]
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.00836080
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.00834860
lea eax, [esp + 0x2c]
push eax
call fcn.00834970
push 0x40
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00836080
push 0x14
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00836080
add esp, 0x40
lea eax, [esp + 8]
push eax
push edi
call fcn.00834860
mov ecx, dword [esp + 0x100]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.0086aede
add esp, 0xf4
ret