joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5622a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp + 0x10]
jne 0x5622db
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.005624ec
add esp, 0x10
jmp 0x56244b
mov eax, dword [ebp + 0x18]
push eax
call fcn.00557fc8
pop ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.00558058
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x56243e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [edx + 4]
mov edx, dword [ebp - 0xc]
add esi, dword [eax + 4]
add esi, 4
cmp esi, dword [edx + 8]
jg 0x562316
mov ecx, dword [ebp - 0xc]
jmp 0x562325
push esi
mov eax, dword [ebp - 0xc]
push eax
call fcn.005577a4
add esp, 8
mov ecx, eax
test ecx, ecx
je 0x56243e
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], esi
xor ebx, ebx
cmp esi, ebx
jle 0x562348
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edx + ebx*4], ecx
inc ebx
cmp esi, ebx
jg 0x562339
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5623e1
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
inc edx
cmp eax, edx
jne 0x56236c
xor eax, eax
jmp 0x562378
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4 + 4]
mov dword [ebp - 0x10], eax
xor ebx, ebx
jmp 0x5623d3
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx + ebx*4]
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x562392
xor edx, edx
jmp 0x56239b
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov edx, dword [ecx + ebx*4 + 4]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
push ecx
push eax
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00561e84
add esp, 0x14
xor eax, eax
lea edx, [ebp - 0x24]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, ebx
mov edi, dword [edx]
add ecx, eax
mov esi, dword [esi]
inc eax
add edx, 4
xor dword [esi + ecx*4], edi
cmp eax, 4
jl 0x5623b6
add ebx, 2
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
cmp ebx, edx
jl 0x56237f
add dword [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 4]
jg 0x562352
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
test eax, eax
jle 0x56241f
mov edx, eax
mov ecx, dword [ebp - 0xc]
shl edx, 2
add edx, dword [ecx]
add edx, 0xfffffffc
test eax, eax
jle 0x562419
mov ecx, dword [edx]
add edx, 0xfffffffc
test ecx, ecx
jne 0x562419
dec eax
test eax, eax
jg 0x56240b
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00561fa0
add esp, 0xc
test eax, eax
je 0x56243e
mov dword [ebp - 8], 1
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00558018
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x567294
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
dec ebx
mov eax, dword [ebp + 8]
lea edx, [ebx - 0x29]
cmp esi, edx
jle 0x5672ca
push 0x2d
push 0x622960
push 0x6e
push 0x79
push 4
call fcn.005833b4
add esp, 0x14
xor eax, eax
jmp 0x567424
cmp ebx, 0x29
jge 0x5672eb
push 0x33
push 0x622978
push 0x78
push 0x79
push 4
call fcn.005833b4
add esp, 0x14
xor eax, eax
jmp 0x567424
mov byte [eax], 0
lea edx, [eax + 1]
mov dword [ebp - 8], edx
add eax, 0x15
mov dword [ebp - 4], eax
push 0
call fcn.00587784
push eax
push 0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
call fcn.0058636c
add esp, 0x18
test eax, eax
jne 0x567323
xor eax, eax
jmp 0x567424
mov edi, ebx
sub edi, esi
mov eax, edi
add eax, 0xffffffd7
push eax
push 0
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call fcn.0050a57c
add esp, 0xc
mov ecx, dword [ebp - 4]
mov byte [ecx + edi - 0x15], 1
push esi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 4]
add edx, ebx
sub edx, esi
add edx, 0xffffffec
push edx
call fcn.0050a50c
add esp, 0xc
push 0x14
mov ecx, dword [ebp - 8]
push ecx
call fcn.005820fc
add esp, 8
test eax, eax
jg 0x567377
xor eax, eax
jmp 0x567424
push 0x49
push 0x622990
lea esi, [ebx - 0x14]
push esi
call fcn.00548a98
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5673ac
push 0x4c
push 0x6229a8
push 0x41
push 0x79
push 4
call fcn.005833b4
add esp, 0x14
xor eax, eax
jmp 0x567424
push 0x14
mov edx, dword [ebp - 8]
push edx
push esi
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00567738
add esp, 0x10
test eax, eax
jge 0x5673c7
xor eax, eax
jmp 0x567424
xor eax, eax
mov edx, dword [ebp - 4]
mov esi, edx
mov edx, dword [ebp - 0xc]
jmp 0x5673da
mov cl, byte [edx]
inc eax
xor byte [esi], cl
inc esi
inc edx
lea ecx, [ebx - 0x14]
cmp eax, ecx
jl 0x5673d3
add ebx, 0xffffffec
lea edx, [ebp - 0x20]
push ebx
mov eax, dword [ebp - 4]
push eax
push 0x14
push edx
call fcn.00567738
add esp, 0x10
test eax, eax
jge 0x5673ff
xor eax, eax
jmp 0x567424
xor eax, eax
mov edx, dword [ebp - 8]
mov ecx, edx
lea edx, [ebp - 0x20]
mov bl, byte [edx]
xor byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x14
jl 0x567409
mov eax, dword [ebp - 0xc]
push eax
call fcn.00548cb4
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56742c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0x5675e6
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x567466
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp + 0x14], eax
lea ebx, [eax - 0x14]
push 0x7c
push 0x6229c0
add eax, ebx
push eax
call fcn.00548a98
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x56749e
push 0x7f
push 0x6229d8
push 0x41
push 0x7a
push 4
call fcn.005833b4
add esp, 0x14
or eax, 0xffffffff
jmp 0x56760c
lea edi, [ebx + esi]
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call fcn.0050a57c
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp - 8]
add eax, edi
push eax
call fcn.0050a50c
add esp, 0xc
lea edx, [edi + 0x14]
mov dword [ebp - 4], edx
lea eax, [ebp - 0x28]
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0x14
push eax
call fcn.00567738
add esp, 0x10
test eax, eax
je 0x5674eb
or eax, 0xffffffff
jmp 0x56760c
xor eax, eax
lea edx, [ebp - 0x28]
mov dword [ebp - 0x10], edx
mov edx, edi
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp eax, 0x14
jl 0x5674f5
push 0x14
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
call fcn.00567738
add esp, 0x10
test eax, eax
je 0x567522
or eax, 0xffffffff
jmp 0x56760c
mov edx, esi
xor eax, eax
mov dword [ebp - 0x14], edx
cmp ebx, eax
mov ecx, dword [ebp - 4]
mov edx, ecx
jle 0x567542
mov cl, byte [edx]
mov edi, dword [ebp - 0x14]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x14]
inc edx
cmp ebx, eax
jg 0x567532
push 0
call fcn.00587784
push eax
lea eax, [ebp - 0x3c]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0058636c
add esp, 0x18
test eax, eax
jne 0x56756c
or eax, 0xffffffff
jmp 0x56760c
push 0x14
lea edx, [ebp - 0x3c]
push edx
push esi
call fcn.0050a858
add esp, 0xc
test eax, eax
jne 0x5675e6
cmp dword [ebp - 0xc], 0
jne 0x5675e6
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0x56759c
cmp byte [edx], 0
jne 0x56759c
inc eax
inc edx
cmp ebx, eax
jg 0x567591
cmp ebx, eax
je 0x5675e6
cmp byte [esi + eax], 1
jne 0x5675e6
inc eax
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0x5675cb
push 0xa8
push 0x6229f0
push 0x6d
push 0x7a
push 4
call fcn.005833b4
add esp, 0x14
or ebx, 0xffffffff
jmp 0x5675db
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0050a50c
add esp, 0xc
push esi
call fcn.00548cb4
pop ecx
mov eax, ebx
jmp 0x56760c
push 0xb5
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.005833b4
add esp, 0x14
test esi, esi
je 0x567609
push esi
call fcn.00548cb4
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x567da8
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x567dc3
mov cl, byte [eax]
cmp cl, 0x6a
je 0x567de4
cmp cl, 0x6b
je 0x567de4
push 0x72
push 0x622b6c
push 0x89
push 0x80
push 4
call fcn.005833b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x567e55
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x567e2b
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x567e2b
cmp dl, 0xbb
je 0x567e26
push 0x81
push 0x622b84
push 0x8a
push 0x80
push 4
call fcn.005833b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x567df5
sub esi, ecx
test ecx, ecx
jne 0x567e58
push 0x8a
push 0x622b9c
push 0x8a
push 0x80
push 4
call fcn.005833b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x567e82
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.005833b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0050a50c
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x57eabc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
call fcn.0050a72c
pop ecx
mov edi, eax
inc edi
push 0
push 0
push edi
push ebx
mov eax, 8
mov dword [ebp - 8], eax
push eax
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
mov dword [ebp - 4], eax
test eax, eax
jg 0x57eb25
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3ec
jne 0x57ebb3
push 0
push 0
push edi
push ebx
xor edx, edx
mov dword [ebp - 8], edx
push edx
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
mov dword [ebp - 4], eax
test eax, eax
jle 0x57ebb3
push 0
mov ecx, dword [ebp - 4]
add ecx, ecx
push ecx
call fcn.0050893a
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp - 0xc]
push edx
push edi
push ebx
mov ecx, dword [ebp - 8]
push ecx
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
test eax, eax
je 0x57ebce
push 8
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0050a72c
pop ecx
inc eax
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
test eax, eax
je 0x57ebce
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0050f960
add esp, 8
mov esi, eax
test eax, eax
jne 0x57ebce
call fcn.005153c4
cmp dword [eax], 2
je 0x57eba2
call fcn.005153c4
cmp dword [eax], 6
jne 0x57ebce
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.0050cd14
add esp, 8
mov esi, eax
jmp 0x57ebce
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x459
jne 0x57ebce
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.0050cd14
add esp, 8
mov esi, eax
test esi, esi
jne 0x57ec4f
push 0xa9
push 0x62bcad
call sub.KERNEL32.DLL_GetLastError
push eax
push 1
push 2
call fcn.005833b4
add esp, 0x14
push 0x62bcd1
mov eax, dword [ebp + 0xc]
push eax
push 0x62bccd
push ebx
push 0x62bcc5
push 5
call fcn.00583be0
add esp, 0x18
call fcn.005153c4
cmp dword [eax], 2
jne 0x57ec33
push 0xac
push 0x62bcd4
push 0x80
push 0x6d
push 0x20
call fcn.005833b4
add esp, 0x14
jmp 0x57ec4b
push 0xae
push 0x62bcec
push 2
push 0x6d
push 0x20
call fcn.005833b4
add esp, 0x14
xor eax, eax
jmp 0x57ec87
call fcn.0057ecd4
push eax
call fcn.0057dc78
pop ecx
mov ebx, eax
test eax, eax
jne 0x57ec6c
push esi
call fcn.0050c84c
pop ecx
xor eax, eax
jmp 0x57ec87
push 0
push ebx
call fcn.0057ddf8
add esp, 8
push esi
push 1
push 0x6a
push ebx
call fcn.0057e218
add esp, 0x10
mov eax, ebx
mov esp, ebp
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
pop ebp
ret
Function at 0x582a41
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, 0x10
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x582a3d
call fcn.00548398
test eax, eax
jg 0x582b73
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.DLL_CreateDCA
mov esi, eax
push esi
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [esp], eax
push 8
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x10], eax
push 0xa
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x14], eax
push ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov edi, eax
push edi
mov eax, dword [esp + 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [esp + 4], eax
lea edx, [esp + 0x18]
push edx
push 0x18
push edi
call sub.GDI32.DLL_GetObjectA
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x20]
movzx eax, word [esp + 0x28]
imul ecx, eax
mov dword [esp + 8], ecx
push 0x306
push str..crypto_rand_rand_win.c
mov edx, dword [esp + 0x10]
push edx
call fcn.00548a98
add esp, 0xc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x582b4d
xor ebp, ebp
jmp 0x582b38
push 0xcc0020
push ebp
push 0
push esi
push ebx
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
mov edx, dword [esp + 0x20]
push edx
call sub.GDI32.DLL_BitBlt
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
call sub.GDI32.DLL_GetBitmapBits
push 0
call fcn.00587784
push eax
push 0
lea edx, [esp + 0x3c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x20]
push eax
call fcn.0058636c
add esp, 0x18
push 0
push 0
push 0x14
lea edx, [esp + 0x3c]
push edx
call fcn.005820d4
add esp, 0x10
add ebp, ebx
mov ecx, dword [esp + 0x14]
sub ecx, ebx
cmp ebp, ecx
jl 0x582ad5
mov eax, dword [esp + 0xc]
push eax
call fcn.00548cb4
pop ecx
mov edx, dword [esp + 4]
push edx
mov ecx, dword [esp + 4]
push ecx
call sub.GDI32.DLL_SelectObject
mov edi, eax
push edi
call sub.GDI32.DLL_DeleteObject
mov eax, dword [esp]
push eax
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x585aa8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x585b88
cmp ecx, 3
jl 0x585b22
xor edx, edx
xor ebx, ebx
mov bl, byte [esi + 1]
mov dl, byte [esi]
shl ebx, 8
shl edx, 0x10
or edx, ebx
xor ebx, ebx
mov bl, byte [esi + 2]
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
mov ebx, edx
shr ebx, 0xc
inc eax
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
mov ebx, edx
shr ebx, 6
inc eax
and ebx, 0x3f
and edx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
inc eax
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
inc eax
jmp 0x585b76
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp ecx, 2
jne 0x585b38
xor ebx, ebx
mov bl, byte [esi + 1]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
mov ebx, edx
shr ebx, 0xc
inc eax
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
inc eax
cmp ecx, 1
jne 0x585b63
mov bl, 0x3d
jmp 0x585b6f
shr edx, 6
and edx, 0x3f
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
inc eax
mov byte [eax], 0x3d
inc eax
add dword [ebp - 4], 4
add esi, 3
sub ecx, 3
test ecx, ecx
jg 0x585ac4
mov byte [eax], 0
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x58a46c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 0x14], 1
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00589a0c
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x58a499
xor eax, eax
jmp 0x58a61a
lea edx, [ebp - 0x124]
push edx
call fcn.00552f74
pop ecx
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x58a4bf
xor edx, edx
mov dword [ebp + 0xc], edx
jmp 0x58a4d2
cmp dword [ebp + 0xc], 0xffffffff
jne 0x58a4d2
mov ecx, dword [ebp + 8]
push ecx
call fcn.0050a72c
pop ecx
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x58a608
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x58a4e9
mov esi, dword [ebp - 0x10]
jmp 0x58a4ec
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and al, 0xff
mov byte [ebp - 8], al
mov edx, dword [ebp - 0x14]
shr edx, 0x10
and dl, 0xff
mov byte [ebp - 7], dl
mov ecx, dword [ebp - 0x14]
shr ecx, 8
and cl, 0xff
mov byte [ebp - 6], cl
mov al, byte [ebp - 0x14]
and al, 0xff
mov byte [ebp - 5], al
push 0
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x124]
push edx
call fcn.00552cc8
add esp, 0x14
test eax, eax
je 0x58a585
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x124]
push edx
call fcn.00552ee8
add esp, 0xc
test eax, eax
je 0x58a585
push 4
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x124]
push eax
call fcn.00552ee8
add esp, 0xc
test eax, eax
je 0x58a585
push 0
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp - 0x124]
push ecx
call fcn.00552f04
add esp, 0xc
test eax, eax
jne 0x58a599
lea eax, [ebp - 0x124]
push eax
call fcn.00553010
pop ecx
xor eax, eax
jmp 0x58a61a
push esi
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050a50c
add esp, 0xc
mov edi, 1
cmp edi, dword [ebp + 0x18]
jge 0x58a5f5
lea eax, [ebp - 0x54]
push 0
push eax
lea ecx, [ebp - 0x54]
mov edx, dword [ebp - 0x10]
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00553048
add esp, 0x1c
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, eax
lea eax, [ebp - 0x54]
cmp esi, ecx
jle 0x58a5ef
mov bl, byte [eax]
xor byte [edx], bl
inc ecx
inc edx
inc eax
cmp esi, ecx
jg 0x58a5e4
inc edi
cmp edi, dword [ebp + 0x18]
jl 0x58a5b4
sub dword [ebp - 0xc], esi
inc dword [ebp - 0x14]
add dword [ebp - 4], esi
cmp dword [ebp - 0xc], 0
jne 0x58a4dc
lea eax, [ebp - 0x124]
push eax
call fcn.00553010
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58d898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x58d8b1
cmp dword [esi + 8], 0
jne 0x58d8b8
xor eax, eax
jmp 0x58d9ab
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x58d8d3
mov dword [ebp - 4], 1
jmp 0x58d930
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x58d8f1
cmp eax, 0x7f
jle 0x58d8f1
mov ebx, 1
xor ecx, ecx
jmp 0x58d92d
cmp dword [ebp - 8], 0
je 0x58d92d
cmp eax, 0x80
jle 0x58d907
mov ebx, 1
mov cl, 0xff
jmp 0x58d92d
cmp eax, 0x80
jne 0x58d92d
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x58d929
cmp byte [edx], 0
je 0x58d927
mov ebx, 1
mov cl, 0xff
jmp 0x58d92d
inc eax
inc edx
cmp eax, dword [esi]
jl 0x58d919
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x58d93b
mov eax, dword [ebp - 4]
jmp 0x58d9ab
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x58d947
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x58d951
mov byte [edx], 0
jmp 0x58d9a0
cmp dword [ebp - 8], 0
jne 0x58d969
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.0050a50c
add esp, 0xc
jmp 0x58d9a0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x58d97e
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x58d978
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x58d9a0
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x58d992
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x58d9b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x58d9ca
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x58d9e8
push 2
call fcn.0059d874
pop ecx
mov esi, eax
test eax, eax
jne 0x58d9df
xor eax, eax
jmp 0x58db32
mov dword [esi + 4], 2
jmp 0x58d9ed
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x63ff4c
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00548a98
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x58da24
mov eax, 0x41
jmp 0x58dafe
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x58da39
mov dword [esi + 4], 2
jmp 0x58dace
test byte [ebx], 0x80
je 0x58daa7
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x58da54
cmp dword [ebp + 0x10], 1
je 0x58da54
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x58da66
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x58da6f
test eax, eax
jne 0x58da60
test eax, eax
jne 0x58da88
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x58dace
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x58dace
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x58da97
jmp 0x58dace
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x58dabd
cmp dword [ebp + 0x10], 1
je 0x58dabd
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.0050a50c
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x58dadc
push eax
call fcn.00548cb4
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x58daf2
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x58db32
push 0x103
push 0x63ff62
push eax
push 0xc2
push 0xd
call fcn.005833b4
add esp, 0x14
test esi, esi
je 0x58db30
cmp dword [ebp + 8], 0
je 0x58db29
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x58db30
push esi
call fcn.0059d8c4
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret