joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.005ae090
mov eax, dword [0x665ec0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x4c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
mov esi, dword [eax]
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x4c]
mov bh, byte [edi]
movzx eax, byte [edi + 1]
mov bl, byte [edi + 4]
movzx ecx, bh
shl ecx, 8
or ecx, eax
mov dword [esp + 0x1c], edi
movzx eax, byte [edi + 2]
shl eax, 8
mov dword [esp + 0x28], ecx
shl ecx, 0x10
or ecx, eax
movzx edx, bl
movzx eax, byte [edi + 3]
or ecx, eax
shl edx, 8
movzx eax, byte [edi + 5]
or edx, eax
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x1c]
mov edi, edx
shl edi, 0x10
mov byte [esp + 0x39], dl
mov dword [esp + 0x14], 0
movzx ecx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x28]
or edi, ecx
mov ecx, dword [esp + 0x34]
mov edx, edi
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
mov byte [esp + 0x34], bh
mov byte [esp + 0x37], cl
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], dl
test ebp, ebp
je 0x5312ac
mov edi, dword [esp + 0x44]
sub dword [esp + 0x10], edi
dec ebp
test esi, esi
jne 0x531255
push dword [esp + 0x30]
lea eax, [esp + 0x24]
push eax
call fcn.00530b00
mov ecx, dword [esp + 0x28]
add esp, 8
mov edx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x37], cl
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], dl
mov al, byte [esp + esi + 0x34]
inc esi
mov ebx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ebx + edi], al
inc edi
mov ebx, dword [esp + 0x14]
test ebp, ebp
jne 0x5311f5
test ebx, ebx
je 0x5312ac
mov ebx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 2], al
mov eax, edx
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 5], al
mov eax, edx
shr eax, 8
mov byte [ebx + 3], cl
mov byte [ebx + 6], al
mov byte [ebx + 7], dl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005ae073
add esp, 0x30
ret
Function at 0x534fa0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x534fb4
mov dword [esp + 0x18], fcn.005337e0
jmp fcn.00469bd0
mov dword [esp + 0x18], fcn.00532a70
jmp fcn.004698d0
Function at 0x5375a0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0052c710
add esp, 4
test eax, eax
jne 0x5375b4
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.004bbe80
Function at 0x53d670
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xa8
push 0
lea eax, [esi + 0x40]
push eax
call fcn.005afaf0
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
movzx eax, byte [edx]
mov dword [esi + 0xe4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ecx, 0xf3bcc908
mov dword [esi], ecx
xor eax, 0x6a09e667
mov dword [esi + 4], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
xor ecx, 0x84caa73b
mov dword [esi + 8], ecx
xor eax, 0xbb67ae85
mov dword [esi + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
xor ecx, 0xfe94f82b
mov dword [esi + 0x10], ecx
xor eax, 0x3c6ef372
mov dword [esi + 0x14], eax
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x1c]
xor ecx, 0x5f1d36f1
mov dword [esi + 0x18], ecx
xor eax, 0xa54ff53a
mov dword [esi + 0x1c], eax
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x24]
xor ecx, 0xade682d1
mov dword [esi + 0x20], ecx
xor eax, 0x510e527f
mov dword [esi + 0x24], eax
mov ecx, dword [edx + 0x28]
mov eax, dword [edx + 0x2c]
xor ecx, 0x2b3e6c1f
xor eax, 0x9b05688c
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x34]
xor ecx, 0xfb41bd6b
xor eax, 0x1f83d9ab
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
xor ecx, 0x137e2179
xor eax, 0x5be0cd19
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pop esi
ret
Function at 0x53ff20
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
lea eax, [esi + 0x20]
push eax
call fcn.005afaf0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret

Function at 0x540990
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.005afaf0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x5418b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.005ae090
mov eax, dword [0x665ec0]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa4]
test eax, eax
je 0x541a41
push ebx
push esi
mov esi, dword [esp + 0xb0]
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x14], eax
nop dword [eax + eax]
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ebx, byte [esi - 8]
movzx ecx, byte [esi - 4]
shl eax, 8
or ebx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [esi - 3]
shl eax, 8
or ecx, eax
mov dword [esp + 0x18], ebx
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edi]
and al, 0xdf
mov dword [esp + 0x10], ecx
or al, 0x40
mov dword [esp + 0x1c], ecx
mov byte [edi], al
movzx eax, byte [ebp]
and al, 0xbf
mov dword [esp + 0x24], ecx
or al, 0x20
push edi
mov byte [ebp], al
call fcn.0052af40
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.0052ad00
push 1
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0040dec0
push ebp
call fcn.0052af40
lea eax, [esp + 0x44]
push eax
push ebp
call fcn.0052ad00
push 1
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.0040dec0
mov eax, dword [esp + 0x40]
add esp, 0x30
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor eax, dword [esp + 0x24]
xor edx, ebx
xor ebx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, ebx
shr eax, 8
mov byte [edi + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, ecx
mov byte [edi], bl
shr ebx, 0x18
shr eax, 8
mov byte [edi + 5], al
mov eax, ecx
mov byte [edi + 3], bl
mov byte [edi + 4], cl
shr eax, 0x10
mov byte [edi + 6], al
mov eax, edx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp + 2], al
mov byte [edi + 7], cl
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 8
mov byte [ebp + 5], al
mov eax, ecx
mov byte [ebp], dl
shr edx, 0x18
mov byte [ebp + 4], cl
shr eax, 0x10
shr ecx, 0x18
sub dword [esp + 0x14], 1
mov byte [ebp + 3], dl
mov byte [ebp + 6], al
mov byte [ebp + 7], cl
jne 0x541900
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9c]
pop ebp
xor ecx, esp
call fcn.005ae073
add esp, 0x9c
ret
Function at 0x565210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.005ae090
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x565258
call fcn.004648b0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004649b0
push 0
push 0x78
push 4
call fcn.00464ac0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.00564f30
add esp, 4
test eax, eax
jne 0x565294
call fcn.004648b0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004649b0
push 0
push 0xb2
push 4
call fcn.00464ac0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004afab0
push esi
call fcn.004af8c0
push esi
mov dword [esp + 0x2c], eax
call fcn.004af8c0
push esi
mov ebp, eax
call fcn.004af8c0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x5653f6
test ebp, ebp
je 0x5653cd
test ebx, ebx
je 0x5653c4
push 4
push ebp
call fcn.0046fa60
push 4
push ebx
call fcn.0046fa60
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x5652fe
call fcn.0046f950
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x56530d
call fcn.0046f950
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x5653c0
test eax, eax
je 0x5653c0
push 4
push ecx
call fcn.0046fa60
push 4
push dword [esi + 0x24]
call fcn.0046fa60
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00582f50
add esp, 0x3c
test eax, eax
je 0x5653c0
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00582f50
add esp, 0x2c
test eax, eax
je 0x5653c0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00564ec0
add esp, 0x10
test eax, eax
js 0x5653c0
je 0x565360
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00564ec0
add esp, 0x10
test eax, eax
js 0x5653c0
je 0x565360
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.0046f200
add esp, 4
test ebx, ebx
je 0x5653da
push ebx
call fcn.0046f200
add esp, 4
push dword [esp + 0x20]
call fcn.0046f200
push esi
call fcn.004af7c0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x5653cd
jmp 0x5653c4
Function at 0x56ccb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.005ae090
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x56cec8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x56cea2
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x56ccf4
mov esi, dword [esp + 0x30]
jmp 0x56cea6
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0056c3f0
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x56cce0
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x573230
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.005ae090
mov eax, dword [0x665ec0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
push ebp
movups xmm0, xmmword [eax]
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x4c]
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edi
movups xmmword [esp + 0x1c], xmm0
test ebp, ebp
je 0x5732e9
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push dword [ecx]
call fcn.0045a440
add esp, 0x14
neg eax
sbb eax, eax
inc dword [esp + 0x1c]
inc eax
or esi, eax
mov dword [esp + 0x10], esi
mov esi, ebp
sub esi, ebx
cmp esi, 0x10
jbe 0x5732b3
mov esi, 0x10
jmp 0x5732b7
test esi, esi
je 0x5732da
lea edx, [edi + ebx]
mov edi, dword [esp + 0x50]
sub edi, dword [esp + 0x14]
xor eax, eax
mov cl, byte [edi + edx]
lea edx, [edx + 1]
xor cl, byte [esp + eax + 0x2c]
inc eax
mov byte [edx - 1], cl
cmp eax, esi
jb 0x5732c4
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add ebx, 0x10
mov ecx, dword [esp + 0x18]
cmp ebx, ebp
jb 0x573271
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.005ae073
add esp, 0x30
ret
Function at 0x573310
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c
call fcn.005ae090
mov eax, dword [0x665ec0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebp
mov ebp, dword [esp + 0x5c]
push esi
mov esi, dword [esp + 0x64]
push edi
mov edi, dword [esp + 0x5c]
mov eax, dword [edi + 0x198]
and eax, 0xfffffffb
mov dword [edi + 0x198], eax
test al, 0x20
jne 0x57334f
test al, 0x10
jne 0x5734fa
test esi, esi
je 0x5734fa
movups xmm0, xmmword [edi + 0x7c]
push ebx
push esi
push dword [esp + 0x68]
movups xmmword [esp + 0x40], xmm0
push ebp
psrldq xmm0, 0xc
movd eax, xmm0
shr eax, 0x18
or al, 0x80
mov byte [esp + 0x53], al
lea eax, [esp + 0x44]
push eax
push edi
call fcn.00573230
mov dword [esp + 0x28], eax
lea ebx, [edi + 0x98]
mov eax, dword [edi + 0x14]
mov ecx, 8
mul ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x5c], xmm0
mov dword [esp + 0x2c], eax
mov eax, esi
mov dword [esp + 0x30], edx
mul ecx
mov dword [esp + 0x34], eax
lea eax, [edi + 0x5c]
push eax
push ebx
mov dword [esp + 0x40], edx
call fcn.0058b620
mov ecx, dword [edi + 8]
add esp, 0x1c
test ecx, ecx
je 0x5733e1
mov eax, dword [edi + 0x14]
add eax, 0xf
and eax, 0xfffffff0
push eax
push ecx
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.0058b4c0
add esp, 0x10
mov eax, esi
and eax, 0xfffffff0
jbe 0x5733f8
push eax
push ebp
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.0058b4c0
add esp, 0x10
mov eax, esi
and eax, 0xf
je 0x573434
push eax
and esi, 0xfffffff0
lea eax, [esp + 0x2c]
add esi, ebp
xorps xmm0, xmm0
push esi
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x34], xmm0
call fcn.005af570
push 0x10
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.0058b4c0
add esp, 0x1c
push 0x10
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.0058b4c0
add esp, 0x10
lea eax, [esp + 0x49]
lea edx, [edi + 0x8d]
mov esi, 2
pop ebx
nop dword [eax]
movzx ecx, byte [edx - 1]
lea eax, [eax + 6]
xor byte [eax - 7], cl
lea edx, [edx + 6]
movzx ecx, byte [edx - 6]
xor byte [eax - 6], cl
movzx ecx, byte [edx - 5]
xor byte [eax - 5], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub esi, 1
jne 0x573460
and byte [esp + 0x53], 0x7f
lea eax, [esp + 0x44]
push 0x10
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [edi + 0x6c]
push eax
push dword [edi]
call fcn.0045a440
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp dword [esp + 0x10], ecx
setne cl
and eax, ecx
mov ecx, dword [edi + 0x198]
and ecx, 0xfffffffb
lea edx, [eax*4]
or edx, ecx
or edx, 0x10
mov dword [edi + 0x198], edx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005ae073
add esp, 0x4c
ret
mov ecx, dword [esp + 0x54]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005ae073
add esp, 0x4c
ret
Function at 0x573510
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x50
call fcn.005ae090
mov eax, dword [0x665ec0]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x5c]
push ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0xc], eax
push ebp
mov ebp, dword [esp + 0x68]
mov eax, dword [ebx + 0x198]
and eax, 0xfffffffb
mov dword [ebx + 0x198], eax
push edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], edi
test al, 0x20
jne 0x57355b
test al, 8
jne 0x5736fa
test ebp, ebp
je 0x5736fa
mov eax, dword [ebx + 0x14]
mov ecx, 8
mul ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x38], xmm0
push esi
mov dword [esp + 0x1c], eax
lea esi, [ebx + 0x98]
mov dword [esp + 0x20], edx
mov eax, ebp
mul ecx
mov dword [esp + 0x24], eax
lea eax, [ebx + 0x5c]
push eax
push esi
mov dword [esp + 0x30], edx
call fcn.0058b620
mov ecx, dword [ebx + 8]
add esp, 8
test ecx, ecx
je 0x5735bd
mov eax, dword [ebx + 0x14]
add eax, 0xf
and eax, 0xfffffff0
push eax
push ecx
lea eax, [esp + 0x44]
push eax
push esi
call fcn.0058b4c0
add esp, 0x10
mov eax, ebp
and eax, 0xfffffff0
jbe 0x5735d4
push eax
push edi
lea eax, [esp + 0x44]
push eax
push esi
call fcn.0058b4c0
add esp, 0x10
mov eax, ebp
and eax, 0xf
je 0x57360b
push eax
mov eax, ebp
xorps xmm0, xmm0
and eax, 0xfffffff0
add eax, edi
push eax
lea eax, [esp + 0x54]
push eax
movups xmmword [esp + 0x58], xmm0
call fcn.005af570
push 0x10
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x50]
push eax
push esi
call fcn.0058b4c0
add esp, 0x1c
push 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x44]
push eax
push esi
call fcn.0058b4c0
add esp, 0x10
lea eax, [esp + 0x3d]
lea edx, [ebx + 0x8d]
mov esi, 2
nop
movzx ecx, byte [edx - 1]
lea eax, [eax + 6]
xor byte [eax - 7], cl
lea edx, [edx + 6]
movzx ecx, byte [edx - 6]
xor byte [eax - 6], cl
movzx ecx, byte [edx - 5]
xor byte [eax - 5], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub esi, 1
jne 0x573630
and byte [esp + 0x4b], 0x7f
lea eax, [esp + 0x3c]
push 0x10
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea esi, [ebx + 0x6c]
push esi
push dword [ebx]
call fcn.0045a440
movups xmm0, xmmword [esi]
push ebp
push dword [esp + 0x2c]
movups xmmword [esp + 0x48], xmm0
mov edi, eax
lea eax, [esp + 0x48]
push dword [esp + 0x34]
psrldq xmm0, 0xc
movd ecx, xmm0
push eax
push ebx
shr ecx, 0x18
or cl, 0x80
mov byte [esp + 0x63], cl
call fcn.00573230
add esp, 0x28
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
test edi, edi
pop esi
setne cl
and eax, ecx
mov ecx, dword [ebx + 0x198]
and ecx, 0xfffffffb
pop edi
pop ebp
lea edx, [eax*4]
or edx, ecx
or edx, 8
mov dword [ebx + 0x198], edx
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005ae073
add esp, 0x50
ret
mov ecx, dword [esp + 0x58]
xor eax, eax
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.005ae073
add esp, 0x50
ret
Function at 0x573860
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
cmp dword [ebx + 0x84], 0xffffffff
je 0x573934
push dword [ebx]
call fcn.00463310
mov esi, eax
add esp, 4
test esi, esi
js 0x573934
mov eax, dword [esp + 0x14]
test eax, eax
je 0x573891
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x57392b
mov ecx, dword [ebx + 0x84]
push edi
cmp ecx, esi
jne 0x5738ca
test esi, esi
jle 0x573909
mov edx, ebp
lea ecx, [ebx + 4]
mov edi, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x5738b4
jmp 0x573909
mov eax, esi
mov byte [ecx + ebx + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x5738ea
dec eax
push eax
lea eax, [ebx + 0x65]
add eax, ecx
push 0
push eax
call fcn.005afaf0
add esp, 0xc
test esi, esi
jle 0x573909
mov edx, ebp
lea ecx, [ebx + 0x24]
mov edi, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x5738f5
push esi
push ebp
push ebp
push dword [ebx]
call fcn.00463c60
add esp, 0x10
pop edi
test eax, eax
jg 0x57392b
push esi
push ebp
call fcn.00401320
add esp, 8
xor eax, eax
pop ebp
pop esi
pop ebx
ret
pop ebp
pop esi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret