joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554e99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x10]
jne 0x554ecd
call fcn.004d8b7e
pop ecx
cmp eax, 0xffffffff
je 0x554ec9
push 1
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004ae9d3
add esp, 0xc
test eax, eax
jne 0x554ec9
mov eax, dword [ebp + 0xc]
pop ebp
ret
xor eax, eax
pop ebp
ret
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.004aef85
add esp, 0x10
pop ebp
ret

Function at 0x554f1f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.004aed1f
add esp, 0x10
pop ebp
ret

Function at 0x555043
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 8]
call fcn.004e3e7c
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x5550bb
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x5550bb
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00554ff5
pop ecx
pop ecx
test al, al
jne 0x5550bb
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x5550ac
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x5550ac
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x5550ae
mov edi, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
jmp 0x5550bd
xor eax, eax
pop esi
leave
ret
Function at 0x5651bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov ecx, dword [eax + 0x28]
imul ecx, dword [ebp + 0xc]
movsx esi, word [ebx]
push edi
mov dword [ebp + 0xc], esi
add ecx, dword [eax + 8]
mov eax, dword [ebp + 8]
lea edi, [ecx + eax*4]
test esi, esi
jle 0x565282
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x565263
cmp eax, 0xff
jne 0x565209
push esi
push 0xff000000
push edi
call fcn.00526a3e
add esp, 0xc
jmp 0x565263
mov ecx, eax
mov dword [ebp - 4], esi
shl ecx, 0x18
mov dword [ebp - 8], ecx
mov ecx, 0x100
sub ecx, eax
mov eax, 0xff00ff
mov dword [ebp + 8], ecx
mov ebx, ecx
dec esi
mov ecx, dword [edi + esi*4]
mov edx, ecx
and edx, eax
mov eax, ecx
imul edx, ebx
shr eax, 8
and eax, 0xffff00ff
shr ecx, 8
imul eax, ebx
shr edx, 8
xor edx, eax
mov eax, 0xff00ff
and ecx, eax
and edx, eax
imul ecx, ebx
xor edx, ecx
add edx, dword [ebp - 8]
mov dword [edi + esi*4], edx
test esi, esi
jg 0x565225
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea ebx, [ebx + esi*2]
add eax, esi
mov dword [ebp + 0x14], ebx
lea edi, [edi + esi*4]
mov dword [ebp + 0x10], eax
movsx esi, word [ebx]
mov dword [ebp + 0xc], esi
test esi, esi
jg 0x5651ea
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x565a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dl, byte [ebp + 0x14]
push esi
mov esi, ecx
test dl, dl
je 0x565b18
cmp dword [esi + 0x20], 0
je 0x565b18
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x14]
push ebx
mov ebx, 0xff
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
imul ecx, dword [ebp + 0xc]
push edi
mov edi, 0xff00ff
add ecx, dword [eax + 8]
mov eax, dword [ebp + 8]
lea ecx, [ecx + eax*4]
mov dword [ebp + 0x14], ecx
cmp dl, bl
je 0x565ac4
mov ecx, esi
movzx edx, dl
mov eax, esi
and ecx, edi
inc edx
shr eax, 8
imul ecx, edx
and eax, 0xffff00ff
shr esi, 8
imul eax, edx
and esi, edi
imul esi, edx
shr ecx, 8
xor ecx, eax
and ecx, edi
xor esi, ecx
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov eax, esi
shr eax, 0x18
sub ebx, eax
sub edi, 1
js 0x565b16
mov eax, 0xff00ff
mov ecx, dword [ecx]
mov edx, ecx
and edx, eax
mov eax, ecx
imul edx, ebx
shr eax, 8
and eax, 0xffff00ff
shr ecx, 8
imul eax, ebx
shr edx, 8
xor edx, eax
mov eax, 0xff00ff
and ecx, eax
and edx, eax
imul ecx, ebx
xor edx, ecx
mov ecx, dword [ebp + 0x14]
add edx, esi
mov dword [ecx], edx
add ecx, dword [ebp - 4]
sub edi, 1
mov dword [ebp + 0x14], ecx
jns 0x565ad8
pop edi
pop ebx
pop esi
leave
ret 0x10
Function at 0x566673
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
sar ebx, 3
sub eax, edi
mov dword [ebp + 8], eax
movzx ecx, word [eax + edi]
movzx eax, word [edi]
mov esi, ecx
mov edx, eax
and esi, 0x7e0
shl esi, 0x10
and edx, 0x7e0
or esi, ecx
shl edx, 0x10
or edx, eax
and esi, 0xfffff81f
and edx, 0xfffff81f
sub esi, edx
imul esi, ebx
shr esi, 5
add esi, edx
mov eax, esi
shr eax, 0x10
xor eax, esi
and eax, 0x7e0
xor eax, esi
mov word [edi], ax
lea edi, [edi + 2]
mov eax, dword [ebp + 0x14]
dec eax
mov dword [ebp + 0x14], eax
test eax, eax
mov eax, dword [ebp + 8]
jg 0x56668a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x566f2e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
and edx, 0xffffff00
movzx eax, cl
shl edx, 0xe
or edx, eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
shr eax, 3
mov esi, 0x100
shr ecx, 0x18
and eax, 0x1fe000
shl edx, 2
sub esi, ecx
push edi
mov edi, dword [ebp + 0xc]
or edx, eax
shr esi, 3
movzx eax, word [edi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, esi
add ecx, edx
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [edi], ax
lea edi, [edi + 2]
sub ebx, 1
jne 0x566f69
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x567116
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov edx, dword [eax + 0x28]
imul edx, dword [ebp + 0xc]
add edx, dword [eax + 8]
mov eax, dword [ebp + 8]
lea esi, [edx + eax*2]
mov eax, dword [ecx + 0x14]
movsx edx, word [edi]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 0xc], eax
test edx, edx
jle 0x5671cc
push ebx
mov ebx, dword [ebp + 0x10]
movzx ecx, byte [ebx]
lea edi, [edi + edx*2]
add ebx, edx
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], ebx
lea eax, [edx + edx]
test ecx, ecx
je 0x5671c2
lea eax, [ecx + 1]
imul eax, dword [ebp + 0xc]
push 0x20
shr eax, 0xb
mov ecx, eax
imul ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ebx, dword [ebp - 4]
pop ecx
sub ecx, eax
mov dword [ebp - 8], ecx
mov edi, ecx
movzx eax, word [esi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, edi
add ecx, ebx
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [esi], ax
add esi, 2
sub edx, 1
jne 0x567183
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
jmp 0x5671c4
add esi, eax
movsx edx, word [edi]
test edx, edx
jg 0x56714e
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x5671d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx + 0xc]
push ebx
mov bl, byte [ecx + 0x22]
push esi
mov edx, dword [eax + 0x28]
imul edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
mov byte [ebp + 0xb], bl
add edx, dword [eax + 8]
movzx eax, word [ecx + 0x1e]
mov dword [ebp - 4], eax
lea edi, [edx + esi*2]
mov edx, dword [ecx + 0x14]
movzx ecx, word [ecx + 0x20]
mov dword [ebp - 0x10], edx
xor edx, edx
test bl, bl
mov dword [ebp - 0xc], ecx
mov ebx, dword [ebp + 0x14]
setne dl
xor esi, dword [ebp + 0xc]
and esi, edx
mov dword [ebp - 0x18], edx
movsx ebx, word [ebx]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0x5672d3
movzx eax, ax
test esi, esi
movzx ecx, cx
cmove ecx, eax
mov eax, dword [ebp - 4]
movzx edx, cx
movzx ecx, ax
mov eax, dword [ebp - 0xc]
movzx eax, ax
cmove ecx, eax
mov dword [ebp + 0xc], edx
movzx eax, cx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
lea esi, [ebx + ebx]
add dword [ebp + 0x14], esi
movzx eax, byte [ecx]
add ecx, ebx
mov dword [ebp + 0x10], ecx
test eax, eax
je 0x56728d
cmp eax, 0xff
jne 0x5672da
cmp byte [ebp + 0xb], 0
push ebx
je 0x567280
push dword [ebp - 4]
push edx
push edi
call fcn.00567e6d
add esp, 0x10
jmp 0x56728a
push edx
push edi
call fcn.0052695f
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edi, esi
mov eax, dword [ebp - 4]
mov esi, ebx
and esi, dword [ebp - 0x18]
mov ebx, dword [ebp + 0x14]
movzx eax, ax
movzx ecx, dx
cmove ecx, eax
mov eax, dword [ebp - 4]
movsx ebx, word [ebx]
test esi, esi
movzx edx, cx
movzx ecx, ax
mov eax, dword [ebp + 0xc]
movzx eax, ax
cmove ecx, eax
mov dword [ebp - 8], ebx
movzx eax, cx
mov dword [ebp + 0xc], eax
mov eax, edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test ebx, ebx
jg 0x56724e
pop edi
pop esi
pop ebx
leave
ret 0x10
inc eax
mov dword [ebp - 0x14], ebx
shr eax, 3
push 0x20
mov esi, eax
imul esi, dword [ebp - 0x10]
pop ecx
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov edx, ecx
movzx eax, word [edi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, edx
add ecx, esi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [edi], ax
add edi, 2
sub ebx, 1
jne 0x5672f1
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
jmp 0x56728f
Function at 0x567887
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
jne 0x5678bb
movzx eax, word [ebx + 0x1c]
push eax
mov eax, 0x100
sub eax, dword [ebx + 0x18]
push eax
push dword [ebp + 0xc]
push ecx
push dword [ebx + 0xc]
call fcn.00566a8f
add esp, 0x14
jmp 0x56797f
mov ecx, dword [ebx + 0xc]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ecx + 0x28]
mov dword [ebp - 4], edi
mov eax, dword [esi + 4]
mov edx, dword [esi]
imul eax, edi
mov edi, dword [esi + 4]
lea eax, [eax + edx*2]
add eax, dword [ecx + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
sub edi, dword [eax + 8]
mov ecx, dword [eax + 0x14]
imul edi, ecx
mov dword [ebp + 0xc], ecx
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 4]
mov dword [ebp + 8], ecx
sub edi, dword [eax + 4]
add edi, dword [eax]
mov eax, dword [esi + 8]
add edi, edx
mov ecx, dword [ebx + 0x14]
sub eax, edx
mov edx, dword [ebx + 0x18]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], eax
add eax, eax
sub dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub dword [ebp + 0xc], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], edx
mov esi, eax
movzx ecx, byte [edi]
inc edi
movzx eax, word [ebx]
inc ecx
imul ecx, edx
mov edx, eax
and edx, 0x7e0
shl edx, 0x10
or edx, eax
and edx, 0xfffff81f
shr ecx, 0xb
push 0x20
pop eax
sub eax, ecx
imul ecx, dword [ebp - 0x14]
imul edx, eax
add edx, ecx
shr edx, 5
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, 0x7e0
xor eax, edx
mov edx, dword [ebp - 0xc]
mov word [ebx], ax
add ebx, 2
sub esi, 1
jne 0x567920
add ebx, dword [ebp - 4]
add edi, dword [ebp + 0xc]
sub dword [ebp + 8], 1
mov eax, dword [ebp - 8]
jne 0x56791e
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x567984
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp dword [edx + 0x18], 0
jne 0x5679af
movzx eax, word [ecx + 0x1c]
push eax
push dword [ebp + 0xc]
push edx
push dword [ecx + 0xc]
call fcn.00566c6a
add esp, 0x10
jmp 0x567a62
mov ecx, dword [ecx + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ecx + 0x28]
mov dword [ebp - 4], ebx
push edi
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [esi + 4]
imul eax, ebx
lea ebx, [eax + edx*2]
mov eax, dword [ebp + 8]
add ebx, dword [ecx + 8]
sub edi, dword [eax + 8]
mov ecx, dword [eax + 0x14]
imul edi, ecx
mov dword [ebp + 0xc], ecx
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 4]
mov dword [ebp + 8], ecx
sub edi, dword [eax + 4]
add edi, dword [eax]
mov eax, dword [esi + 8]
add edi, edx
sub eax, edx
mov dword [ebp - 8], eax
add eax, eax
sub dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
sub dword [ebp + 0xc], ecx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
mov esi, ecx
movzx eax, word [ebx]
movzx edx, byte [edi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 0xc]
and ecx, 0xfffff81f
inc edx
sub eax, ecx
shr edx, 3
imul edx, eax
shr edx, 5
add edx, ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, 0x7e0
xor eax, edx
inc edi
mov word [ebx], ax
add ebx, 2
sub esi, 1
jne 0x567a0c
add ebx, dword [ebp - 4]
add edi, dword [ebp + 0xc]
sub dword [ebp + 8], 1
mov ecx, dword [ebp - 8]
jne 0x567a0a
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x567aaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov eax, dword [edi + 0xc]
movzx edx, word [edi + 0x1c]
mov edi, dword [ebp + 0x14]
dec edi
mov dword [ebp + 8], edx
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
imul ecx, dword [ebp + 0xc]
add ecx, dword [eax + 8]
mov eax, dword [ebp - 8]
lea esi, [ecx + ebx*2]
movzx ecx, dx
cmp byte [eax + 0x22], 0
mov dword [ebp - 0xc], ecx
je 0x567b40
xor ebx, dword [ebp + 0xc]
movzx eax, word [eax + 0x20]
and ebx, 1
mov dword [ebp + 0x14], eax
test edi, edi
js 0x567b5c
movzx ecx, ax
test ebx, ebx
movzx eax, dx
cmove ecx, eax
mov eax, dword [ebp + 8]
movzx edx, cx
movzx ecx, ax
mov eax, dword [ebp + 0x14]
movzx eax, ax
cmove ecx, eax
mov dword [ebp + 0xc], edx
movzx ebx, cx
push dword [ebp + 0x10]
push ebx
push edx
push esi
call fcn.00567e6d
mov ecx, dword [ebp + 0xc]
add esp, 0x10
add esi, dword [ebp - 4]
sub edi, 1
movzx edx, bx
movzx ebx, cx
mov dword [ebp + 0xc], edx
jns 0x567b1c
jmp 0x567b5c
test edi, edi
js 0x567b5c
push dword [ebp + 0x10]
push ecx
push esi
call fcn.0052695f
add esi, dword [ebp - 4]
add esp, 0xc
sub edi, 1
mov ecx, dword [ebp - 0xc]
jns 0x567b44
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x567d38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [eax + 0x28]
mov dword [ebp - 4], edx
imul edx, dword [ebp + 0xc]
push edi
mov edi, dword [ecx + 0x14]
push 0x20
pop ebx
add edx, dword [eax + 8]
mov eax, dword [ebp + 8]
lea edx, [edx + eax*2]
movzx eax, byte [ebp + 0x14]
inc eax
imul eax, dword [ecx + 0x18]
shr eax, 0xb
imul edi, eax
sub ebx, eax
movzx eax, word [edx]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, ebx
add ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [edx], ax
add edx, dword [ebp - 4]
sub esi, 1
jne 0x567d6f
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x567dad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [eax + 0x28]
mov dword [ebp - 4], edx
imul edx, dword [ebp + 0xc]
push edi
mov edi, dword [ecx + 0x14]
push 0x20
pop ebx
add edx, dword [eax + 8]
mov eax, dword [ebp + 8]
lea edx, [edx + eax*2]
movzx eax, byte [ebp + 0x14]
inc eax
shr eax, 3
imul edi, eax
sub ebx, eax
movzx eax, word [edx]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, ebx
add ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [edx], ax
add edx, dword [ebp - 4]
sub esi, 1
jne 0x567de0
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x56cf68
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6e47f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edi
mov dl, byte [edi + 0xa1]
mov bl, byte [edi + 0xa0]
cmp bl, dl
movzx ecx, dl
mov edx, dword [edi + 0x64]
movzx eax, bl
cmovl ecx, eax
movsx eax, cl
mov dword [ebp - 0x2c], eax
jmp 0x56cfe8
mov bl, byte [edx + 0xa1]
mov bh, byte [edx + 0xa0]
cmp bl, bh
movzx eax, bh
movzx ecx, bl
cmovl ecx, eax
movsx eax, cl
cmp eax, dword [ebp - 0x2c]
jl 0x56d0a7
cmp bh, bl
movzx eax, bh
movzx ecx, bl
cmovl ecx, eax
mov eax, edx
mov edx, dword [edx + 0x64]
movsx ecx, cl
cmp dword [ebp - 0x2c], ecx
cmovle ecx, dword [ebp - 0x2c]
cmovle eax, esi
mov ebx, ecx
mov esi, eax
mov dword [ebp - 0x2c], ebx
cmp edx, edi
jne 0x56cfa1
mov dl, byte [esi + 0xa1]
mov cl, byte [esi + 0xa0]
cmp dl, cl
movzx eax, cl
movzx ebx, dl
mov ecx, esi
cmovl ebx, eax
mov dword [ebp - 0x2c], esi
movsx edi, bl
call fcn.0056d6ca
mov edx, eax
cmp edx, esi
je 0x56d05e
cmp byte [edx + 0xa3], 0
jne 0x56d05e
mov bl, byte [edx + 0xa0]
mov bh, byte [edx + 0xa1]
cmp bl, bh
movzx eax, bl
movzx ecx, bh
cmovl ecx, eax
lea eax, [edi + 1]
movsx ecx, cl
cmp eax, ecx
jl 0x56d0ab
movzx eax, bl
cmp bh, bl
movzx ecx, bh
mov esi, edx
cmovl ecx, eax
movsx edi, cl
mov ecx, edx
call fcn.0056d6ca
mov edx, eax
cmp edx, dword [ebp - 0x2c]
jne 0x56d016
mov ecx, esi
mov edi, esi
mov dword [ebp - 0x2c], ecx
mov edi, dword [edi + 0x64]
cmp byte [edi + 0xa3], 0
jne 0x56d102
push edi
mov ecx, esi
call fcn.0056d504
test al, al
je 0x56d0fe
mov ecx, dword [ebp - 0x2c]
mov esi, edi
cmp edi, ecx
jne 0x56d065
mov ebx, dword [edi + 0x64]
xor dl, dl
mov byte [ebp - 0x25], dl
test ebx, ebx
je 0x56d0f6
xorps xmm0, xmm0
cmp byte [ebx + 0xa5], 0
jne 0x56d0af
lea eax, [ebx + 0x78]
jmp 0x56d0d5
mov eax, edx
jmp 0x56d104
mov eax, esi
jmp 0x56d104
push ebx
lea eax, [ebx + 0x10]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.005ceed6
mov ecx, dword [ebp - 0x2c]
lea edi, [ebp - 0x24]
mov dl, byte [ebp - 0x25]
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
comisd xmm0, xmmword [eax]
setae al
test al, al
je 0x56d0e4
test dl, dl
jne 0x56d0fa
xor al, 1
or dl, al
mov byte [ebp - 0x25], dl
cmp ebx, ecx
je 0x56d0f6
mov ebx, dword [ebx + 0x64]
test ebx, ebx
jne 0x56d099
xor eax, eax
jmp 0x56d104
mov eax, ebx
jmp 0x56d104
mov eax, edi
jmp 0x56d104
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f7c1
leave
ret
Function at 0x58b585
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.0058b522
movss xmm0, dword [ebp + 0x14]
xor ecx, ecx
movss xmm1, dword [0x65f160]
addss xmm0, xmm0
mov al, byte [ebp + 0x18]
movaps xmm3, xmm1
mov byte [esi + 0x164], al
xorps xmm2, xmm2
mov eax, dword [esi + 0xfc]
mov dword [esi], vtable.GrConvolutionEffect.0
mulss xmm0, dword [ebp + 0x14]
mov dword [ebp + 0x14], ecx
lea edi, [eax*2 + 1]
movss dword [ebp + 0x18], xmm2
divss xmm3, xmm0
movss dword [ebp + 8], xmm3
test edi, edi
jle 0x58b667
lea eax, [esi + 0x100]
mov dword [ebp + 0x10], eax
mov eax, ecx
sub eax, dword [esi + 0xfc]
push ecx
push ecx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm0
xorps xmm1, xmmword [0x668fa0]
mulss xmm1, xmm0
xorps xmm0, xmm0
mulss xmm1, xmm3
cvtss2sd xmm0, xmm1
movsd qword [esp], xmm0
call fcn.00622df0
mov eax, dword [ebp + 0x10]
movss xmm2, dword [ebp + 0x18]
movss xmm3, dword [ebp + 8]
fstp dword [ebp + 0xc]
movss xmm0, dword [ebp + 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x14]
addss xmm2, xmm0
inc ecx
movss dword [eax], xmm0
add eax, 4
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x10], eax
movss dword [ebp + 0x18], xmm2
cmp ecx, edi
jl 0x58b5f6
movss xmm1, dword [0x65f160]
divss xmm1, xmm2
test edi, edi
jle 0x58b688
lea eax, [esi + 0x100]
movaps xmm0, xmm1
mulss xmm0, dword [eax]
movss dword [eax], xmm0
lea eax, [eax + 4]
sub edi, 1
jne 0x58b675
push 8
push dword [ebp + 0x1c]
lea eax, [esi + 0x168]
push eax
call fcn.004a1e00
add esp, 0xc
mov eax, esi
pop edi
pop esi
leave
ret 0x18
Function at 0x58cbc5
Capabilities:
Encode data using xor

Disassembly:
push 0xa4
mov eax, 0x647f6e
call fcn.0049fb2f
movss xmm0, dword [ebp + 0x28]
xorps xmm3, xmm3
movss xmm1, dword [0x65f160]
mulss xmm0, xmm0
movaps xmm2, xmm1
mov eax, dword [ebp + 8]
movaps xmm4, xmm1
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0xc]
addss xmm0, xmm0
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa8], eax
movss dword [ebp - 0x80], xmm3
divss xmm2, xmm0
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0xa4], esi
movss xmm0, dword [ebp + 0x2c]
mulss xmm0, xmm0
movss dword [ebp - 0xa0], xmm2
addss xmm0, xmm0
divss xmm4, xmm0
movss dword [ebp - 0x88], xmm4
test ecx, ecx
jle 0x58cd5e
mov eax, ecx
mov dword [ebp - 0x90], ecx
cdq
sub eax, edx
mov edx, ecx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x74]
neg edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x8c], edi
movd xmm1, edi
cvtdq2ps xmm1, xmm1
mulss xmm1, xmm1
mulss xmm1, xmm2
movss dword [ebp - 0x9c], xmm1
test esi, esi
jle 0x58cd3a
mov edi, dword [ebp - 0x78]
mov eax, esi
cdq
sub eax, edx
mov dword [ebp - 0x84], esi
sar eax, 1
neg eax
mov dword [ebp - 0x7c], eax
mov eax, ecx
mov esi, dword [ebp - 0x7c]
shl eax, 2
mov dword [ebp - 0x98], eax
movd xmm0, esi
cvtdq2ps xmm0, xmm0
push ecx
push ecx
mulss xmm0, xmm0
mulss xmm0, xmm4
addss xmm0, xmm1
xorps xmm0, xmmword [0x668fa0]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.00622df0
movss xmm3, dword [ebp - 0x80]
inc esi
movss xmm1, dword [ebp - 0x9c]
movss xmm4, dword [ebp - 0x88]
fstp dword [ebp - 0x7c]
movss xmm0, dword [ebp - 0x7c]
addss xmm3, xmm0
movss dword [edi], xmm0
add edi, dword [ebp - 0x98]
sub dword [ebp - 0x84], 1
pop ecx
pop ecx
movss dword [ebp - 0x80], xmm3
jne 0x58ccb1
movss xmm2, dword [ebp - 0xa0]
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x90]
inc edi
add eax, 4
sub edx, 1
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x90], edx
jne 0x58cc6f
movss xmm1, dword [0x65f160]
imul esi, ecx
xor edi, edi
divss xmm1, xmm3
mov eax, edi
test esi, esi
jle 0x58cd82
movss xmm0, dword [ebp + eax*4 - 0x74]
mulss xmm0, xmm1
movss dword [ebp + eax*4 - 0x74], xmm0
inc eax
cmp eax, esi
jl 0x58cd6d
push 0x1a0
call fcn.005432a7
pop ecx
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x58cdd9
push dword [ebp + 0x24]
movss xmm0, dword [ebp + 0x18]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push ecx
push ecx
movss dword [esp + 4], xmm0
lea ecx, [ebp - 0x74]
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
push dword [ebp - 0xa8]
mov ecx, eax
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.0058c9cd
mov edi, eax
mov eax, edi
call fcn.0049fad9
ret