joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df790
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4df7e7
nop dword [eax]
add ecx, ecx
movsx eax, byte [ecx + esi + 2]
movd xmm1, eax
movsx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x4df7b0
cmp ecx, edi
jne 0x4df7fa
test bl, 1
jne 0x4df7fa
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4df839
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movsx eax, bl
movd xmm1, eax
movsx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x4df82f
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x4df802
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret

Function at 0x4df850
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4df8a7
nop dword [eax]
add ecx, ecx
movzx eax, byte [ecx + esi + 2]
movd xmm1, eax
movzx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x4df870
cmp ecx, edi
jne 0x4df8ba
test bl, 1
jne 0x4df8ba
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4df8f9
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movzx eax, bl
movd xmm1, eax
movzx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x4df8ef
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x4df8c2
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
Function at 0x4df910
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4df969
nop dword [eax]
add ecx, ecx
movsx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movsx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x4df930
cmp ecx, edi
jne 0x4df97e
test bl, 1
jne 0x4df97e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4df9c1
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
movzx edi, word [esi + ecx*2]
movsx eax, di
movd xmm1, eax
movsx eax, word [ebx]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x4df9b5
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x4df986
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret

Function at 0x4df9e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4dfa39
nop dword [eax]
add ecx, ecx
movzx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movzx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x4dfa00
cmp ecx, edi
jne 0x4dfa4e
test bl, 1
jne 0x4dfa4e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4dfa8e
mov ebx, dword [esp + 0x20]
movzx eax, word [ebx]
lea ecx, [edx - 1]
sar ecx, 1
movd xmm0, eax
movzx edi, word [esi + ecx*2]
cvtdq2pd xmm0, xmm0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x4dfa82
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x4dfa56
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
Function at 0x4dfaa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x4dfaf5
nop
add ecx, ecx
xor eax, eax
movd xmm1, dword [esi + ecx*4 + 8]
movd xmm0, dword [esi + ecx*4 + 4]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x4dfac0
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x4dfb06
test al, 1
jne 0x4dfb06
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x4dfb41
mov edi, dword [esp + 0x20]
nop
movd xmm0, dword [edi]
lea eax, [edx - 1]
sar eax, 1
cvtdq2pd xmm0, xmm0
mov ecx, dword [esi + eax*4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x4dfb37
mov dword [esi + edx*4], ecx
mov edx, eax
cmp ebx, eax
jl 0x4dfb10
mov eax, dword [edi]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x4dfb50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4dfbbd
nop dword [eax]
add ecx, ecx
mov eax, dword [esi + ecx*4 + 8]
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x6bc110]
mov eax, dword [esi + ecx*4 + 4]
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x6bc110]
xor eax, eax
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x4dfb70
cmp ecx, edi
jne 0x4dfbd0
test bl, 1
jne 0x4dfbd0
mov eax, dword [esi + ebx*4 - 4]
mov dword [esi + edx*4], eax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4dfc25
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov edi, dword [esi + ecx*4]
mov eax, edi
shr eax, 0x1f
movd xmm1, edi
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x6bc110]
mov eax, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x6bc110]
comisd xmm1, xmm0
jbe 0x4dfc1b
mov dword [esi + edx*4], edi
mov edx, ecx
cmp ebp, ecx
jl 0x4dfbd8
mov eax, dword [ebx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4dfc40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x4dfc93
nop
add ecx, ecx
xor eax, eax
movss xmm1, dword [esi + ecx*4 + 8]
movss xmm0, dword [esi + ecx*4 + 4]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x4dfc60
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x4dfca4
test al, 1
jne 0x4dfca4
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x4dfcdf
mov ecx, dword [esp + 0x20]
nop dword [eax]
movss xmm0, dword [ecx]
lea eax, [edx - 1]
sar eax, 1
cvtps2pd xmm0, xmm0
movss xmm2, dword [esi + eax*4]
cvtps2pd xmm1, xmm2
comisd xmm1, xmm0
jbe 0x4dfcd5
movss dword [esi + edx*4], xmm2
mov edx, eax
cmp ebx, eax
jl 0x4dfcb0
mov eax, dword [ecx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x4dfcf0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, edx
push edi
lea edi, [ecx - 1]
sar edi, 1
cmp edx, edi
jge 0x4dfd3e
nop dword [eax]
lea ecx, [eax + eax]
xor eax, eax
movsd xmm0, qword [esi + ecx*8 + 0x10]
comisd xmm0, xmmword [esi + ecx*8 + 8]
seta al
xor eax, 1
inc eax
add eax, ecx
movsd xmm0, qword [esi + eax*8]
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp eax, edi
jl 0x4dfd10
mov ecx, dword [esp + 0x18]
cmp eax, edi
jne 0x4dfd55
test cl, 1
jne 0x4dfd55
movsd xmm0, qword [esi + ecx*8 - 8]
movsd qword [esi + edx*8], xmm0
lea edx, [ecx - 1]
cmp ebx, edx
jge 0x4dfd88
mov ecx, dword [esp + 0x1c]
nop dword [eax]
lea eax, [edx - 1]
sar eax, 1
movsd xmm0, qword [esi + eax*8]
comisd xmm0, xmmword [ecx]
jbe 0x4dfd7b
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp ebx, eax
jl 0x4dfd60
movsd xmm0, qword [ecx]
pop edi
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
movsd xmm0, qword [eax]
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
Function at 0x5201c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x18
test eax, eax
je 0x52039e
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
cmp edx, 1
jne 0x5201ed
cmp eax, 2
jne 0x5201e4
xor ecx, ecx
jmp 0x5201f7
cmp eax, 1
jne 0x5201f7
mov ecx, eax
jmp 0x5201f7
cmp edx, 2
jne 0x5201f7
cmp eax, edx
cmove ecx, edx
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
cmp eax, 5
jne 0x5202b2
mov ebp, dword [esp + 0x30]
xor edx, edx
cmp ecx, 2
sete dl
xor eax, eax
inc edx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x52039a
mov esi, dword [esp + 0x34]
nop word [eax + eax]
mov ebx, edx
cmp edx, eax
ja 0x520298
lea ecx, [esi - 1]
mov dword [esp + 0x18], ecx
nop dword [eax]
mov eax, ecx
cmp eax, ebx
jl 0x520283
mov edi, dword [ebp + eax*4]
mov esi, edi
mov ecx, dword [ebp + eax*4 - 4]
sub edi, dword [ebp + eax*4 - 4]
and ecx, 0xff800000
sub esi, ecx
xor edi, esi
and edi, 0x7fffff
xor edi, esi
mov dword [ebp + eax*4], edi
dec eax
cmp eax, ebx
jge 0x520256
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jle 0x520250
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
lea ebx, [esi*4]
add ebp, ebx
sub ecx, 1
mov dword [esp + 0x3c], ecx
jne 0x520240
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp eax, 6
jne 0x52039a
mov edx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, 2
mov dword [esp + 0x3c], edx
sete bl
xor eax, eax
inc ebx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x24], ebx
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x52039a
mov esi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov ebp, ebx
cmp ebx, eax
ja 0x520380
lea ecx, [esi - 1]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jl 0x520367
nop
mov esi, dword [edx + ecx*8 - 4]
mov eax, esi
mov edi, dword [edx + ecx*8]
and eax, 0xfffff
mov ebx, dword [edx + ecx*8 + 4]
mov edx, edi
mov ebp, dword [esp + 0x3c]
sub edx, dword [ebp + ecx*8 - 8]
mov ecx, ebx
sbb ecx, eax
and esi, 0xfff00000
sub edi, 0
sbb ebx, esi
xor eax, eax
xor ebx, ecx
xor eax, edx
and ebx, 0xfff00000
mov edx, ebp
mov ebp, dword [esp + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], ebx
dec ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jge 0x520310
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x520306
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
lea ebp, [esi*8]
add edx, ebp
sub ecx, 1
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], ecx
jne 0x5202f1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x536490
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0067c7e0
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x20]
push edi
mov ebp, dword [ebp]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x5364d8
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x5364d8
mov al, byte [ecx + ebp]
dec esi
xor al, byte [ebx]
inc ebp
mov byte [edi], al
inc ebx
inc edi
and ebp, 0xf
mov dword [esp + 0x14], ebp
jne 0x5364c0
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x536574
mov ebp, eax
mov ecx, esi
shr ecx, 4
push ebp
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push edi
cmovae edx, eax
push ebx
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [ebp + 0xc], eax
test edx, edx
jne 0x536556
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + ebp - 1]
dec edx
add eax, ecx
mov byte [edx + ebp], al
shr eax, 8
test edx, edx
jne 0x536540
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add edi, eax
add ebx, eax
cmp esi, 0x10
jae 0x5364f0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x5365d2
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x5365ad
push eax
call fcn.00536610
add esp, 4
mov eax, dword [esp + 0x30]
sub ebx, eax
sub edi, eax
lea ecx, [eax + ebp]
add ebp, esi
nop word [eax + eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [edi + ecx - 1], al
sub esi, 1
jne 0x5365c0
mov eax, dword [esp + 0x34]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x53b980
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x53ba96
push edi
cmp esi, 4
jb 0x53ba71
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x53ba14
cmp edi, ecx
jae 0x53ba71
cmp edx, ebx
ja 0x53ba1c
cmp edi, ebx
jae 0x53ba71
cmp edx, ebp
ja 0x53ba24
cmp edi, ebp
jae 0x53ba71
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x53ba32
cmp edi, ebx
jae 0x53ba71
cmp ecx, ebp
ja 0x53ba3a
cmp edi, ebp
jae 0x53ba71
mov edi, esi
and edi, 0xfffffffc
nop
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movaps xmm0, xmm1
xorps xmm1, xmm3
xorps xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x53ba40
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x53ba95
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x53ba71
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x53bdd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0067c7e0
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x53be77
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x53be60
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.0053bea0
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x53be13
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x53be83
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.0053bea0
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x53c460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.0067c7e0
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call fcn.0053bdd0
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x53c4d1
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x53c4c9
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x53c4d3
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x53c4d3
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x53c511
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x53c590
test esi, esi
je 0x53c624
push esi
push ecx
push dword [esp + 0x40]
call fcn.0067ddd0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x53c4e4
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x53c552
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x53c54e
dec ecx
test ecx, ecx
jg 0x53c540
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call fcn.0053bdd0
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x53c4e4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x53c5a0
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x53c623
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x53c5d5
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x53e0d0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x75cad4], 2
push esi
push edi
mov edi, 1
je 0x53e127
mov edx, 0x75cad4
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x53e101
cmp eax, 1
je 0x53e0e5
cmp dword [0x75cad4], 2
jne 0x53e141
jmp 0x53e127
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x53e020
push 0
push 0
mov dword [0x75cad0], eax
call fcn.0054b6b0
add esp, 0xc
mov dword [0x75cad4], 2
push 0x97
push str.crypto_threads_win.c
push 0x34
call fcn.0052b720
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x53e146
pop edi
xor eax, eax
pop esi
ret
push ebx
push ebp
lea ebx, [esi + 0x20]
call fcn.00556f50
mov dword [ebx], eax
call fcn.00556c90
mov dword [esi + 0x28], eax
call fcn.00556c90
mov dword [esi + 0x30], eax
call fcn.00556f50
mov dword [esi + 0x24], eax
lea ebp, [esi + 0x2c]
call fcn.00556f50
mov dword [ebp], eax
call fcn.00556f50
cmp dword [esp + 0x14], edi
push 0x85
cmovge edi, dword [esp + 0x18]
inc edi
mov dword [ebx], eax
push str.crypto_threads_win.c
lea eax, [edi*8]
push eax
call fcn.0052b720
add esp, 0xc
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
lea edi, [esi + 0x24]
test eax, eax
je 0x53e1c9
cmp dword [esi + 0x28], 0
je 0x53e1c9
cmp dword [esi + 0x30], 0
je 0x53e1c9
cmp dword [ebx], 0
je 0x53e1c9
cmp dword [edi], 0
je 0x53e1c9
cmp dword [ebp], 0
jne 0x53e212
push 0xa9
push str.crypto_threads_win.c
push eax
call fcn.0052b520
lea eax, [esi + 0x28]
push eax
call fcn.00556c30
lea eax, [esi + 0x30]
push eax
call fcn.00556c30
push edi
call fcn.00556f10
push ebp
call fcn.00556f10
push ebx
call fcn.00556f10
push 0xaf
push str.crypto_threads_win.c
push esi
call fcn.0052b520
add esp, 0x2c
xor esi, esi
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret