joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1040
call fcn.00526390
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
test byte [esi], 1
jne 0x4b83a5
mov word [esi], 0
jmp 0x4b83b2
mov ecx, dword [esi + 8]
mov byte [ecx], 0
mov dword [esi + 4], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov edi, dword [eax]
mov eax, esp
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat32i64]
add esp, 8
cmp eax, 0xffffffff
je 0x4b83ef
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, 1
sbb ecx, 0
jl 0x4b83ef
mov ecx, esi
push eax
call fcn.0051fe90
lea ebx, [esp + 0x3c]
jmp 0x4b840b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x4b8433
push 0x1000
push ebx
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b8400
test eax, eax
jle 0x4b842e
mov ecx, esi
push eax
push ebx
call fcn.00520110
jmp 0x4b840b
sete al
jmp 0x4b8435
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4b86f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov esi, eax
test eax, eax
jne 0x4b8745
jmp 0x4b87b5
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
mov dword [eax], 5
call edi
cmp dword [eax], 4
jne 0x4b87b5
mov dword [esp + 8], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [esp]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b8730
mov ecx, dword [esp + 8]
cmp ecx, 0xffffffff
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
je 0x4b873e
add ebx, ecx
mov eax, esi
sub eax, ecx
add dword [esp], ecx
adc dword [esp + 4], 0
test ecx, ecx
jg 0x4b8716
test esi, esi
sete al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ba4c0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
movzx eax, byte [0x9b57c0]
test al, al
je 0x4ba5c2
push dword [0x9b57bc]
push dword [0x9b57b8]
push esi
push edi
call fcn.006730b0
add esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
and eax, 2
add eax, 2
push 0
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x4ba56e
mov ebx, eax
mov edx, dword [esp + 0xc]
sub edi, edx
sbb esi, 0
mov eax, dword [ebp + 0x1c]
test al, 2
mov eax, 4
mov ecx, 0xf001f
cmove ecx, eax
mov eax, dword [ebp + 0x18]
add eax, edx
push eax
push edi
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4ba5ac
mov edi, eax
push 0x10
call fcn.0051c3d0
add esp, 4
mov esi, eax
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
jmp 0x4ba5b5
xor esi, esi
cmp dword [ebp + 0x18], 0
jne 0x4ba5b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x4ba5b5
push 0x10
call fcn.0051c3d0
add esp, 4
mov esi, eax
mov dword [eax], 0x87c278
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp 0x4ba5b5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x9b57c0
call fcn.004cc400
add esp, 4
test eax, eax
je 0x4ba4e4
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
mov dword [0x9b57b8], eax
mov dword [0x9b57bc], 0
push 0x9b57c0
call fcn.004cc570
add esp, 4
jmp 0x4ba4e4
Function at 0x4c6120
Capabilities:
Encode data using xor

Disassembly:
push esi
lea eax, [edx + 0xf]
test edx, edx
cmovns eax, edx
cmp edx, 0x10
jl 0x4c61f0
mov edx, dword [esp + 8]
sar eax, 4
lea esi, [edx + 2]
movd xmm0, esi
pshufd xmm0, xmm0, 0
movd xmm1, edx
pshufd xmm1, xmm1, 0
add ecx, 0x30
movdqa xmm2, xmmword [0x87cc60]
pxor xmm0, xmm2
nop dword [eax]
movdqu xmm3, xmmword [ecx - 0x30]
movdqu xmm4, xmmword [ecx - 0x20]
movdqa xmm5, xmm3
psubd xmm5, xmm1
pxor xmm3, xmm2
movdqa xmm6, xmm0
pcmpgtd xmm6, xmm3
pandn xmm6, xmm5
movdqu xmmword [ecx - 0x30], xmm6
movdqa xmm3, xmm4
psubd xmm3, xmm1
pxor xmm4, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm4
pandn xmm5, xmm3
movdqu xmmword [ecx - 0x20], xmm5
movdqu xmm3, xmmword [ecx - 0x10]
movdqa xmm4, xmm3
psubd xmm4, xmm1
pxor xmm3, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm3
pandn xmm5, xmm4
movdqu xmmword [ecx - 0x10], xmm5
movdqu xmm3, xmmword [ecx]
movdqa xmm4, xmm3
psubd xmm4, xmm1
pxor xmm3, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm3
pandn xmm5, xmm4
movdqu xmmword [ecx], xmm5
add ecx, 0x40
dec eax
jne 0x4c6160
pop esi
ret
Function at 0x4c7410
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [ecx + 0x2a4]
mov ebp, dword [ecx + 0x2a8]
mov eax, dword [ecx + 0x290]
mov edx, dword [ecx + 0x294]
mov edi, dword [ecx + 0x2b0]
mov dword [esp + 0x24], edi
mov edi, dword [ecx + 0x2ac]
mov dword [esp + 0x1c], edi
mov edi, dword [ecx + 0x810]
mov ebx, dword [edi + 0x11f0]
mov dword [esp + 0xc], ebx
movsd xmm0, qword [edi + 0x11e8]
mov edi, ebp
sub edi, esi
sar edi, 3
shl edx, 4
movsd qword [esp + 4], xmm0
lea ebx, [eax + edx]
mov dword [esp + 0x20], ebx
cmp ebp, esi
je 0x4c75c3
mov dword [esp + 0x14], ecx
cmp edi, 2
mov ebp, 1
mov dword [esp + 0x18], edi
cmovae ebp, edi
add eax, edx
add eax, 0xc
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x28], ebp
jmp 0x4c74c6
movsd xmm0, qword [esp + 4]
movsd qword [esp + 8], xmm0
add edx, 0xfffffffd
mov dword [esp + 4], edx
add ebx, dword [esp]
inc edi
add eax, 0x10
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x4c75b9
mov ebp, dword [esi + edi*8]
movzx ecx, word [esi + edi*8 + 4]
mov dword [esp], ecx
mov dword [eax - 8], ecx
movzx edx, word [esi + edi*8 + 6]
lea ecx, [edx + 3]
mov dword [eax - 4], ecx
mov dword [eax], 0
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x2cc]
jne 0x4c7520
mov ecx, dword [ecx + 0x2c8]
cmp ecx, 2
je 0x4c7512
cmp ecx, 1
jne 0x4c7520
mov ecx, dword [esp]
or ecx, 0x10000
mov dword [esp], ecx
mov dword [eax - 8], ecx
jmp 0x4c7520
add edx, 0x10003
mov dword [eax - 4], edx
nop dword [eax + eax]
mov edx, dword [esi + edi*8]
cmp edx, 3
ja 0x4c7540
mov dword [eax], edx
cmp dword [esp], 0
je 0x4c757a
mov ebp, dword [esp + edx*4]
jmp 0x4c7543
add ebp, 0xfffffffd
mov dword [eax - 0xc], ebp
mov edx, dword [esi + edi*8]
lea ebp, [edx - 1]
cmp ebp, 3
jae 0x4c74a0
xor ecx, ecx
cmp word [esi + edi*8 + 4], 0
sete cl
add ebp, ecx
je 0x4c74b3
cmp ebp, 3
jne 0x4c7586
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], ecx
lea edx, [ecx - 1]
jmp 0x4c7592
cmp edx, 3
jne 0x4c75b3
mov ebp, dword [esp + 4]
dec ebp
jmp 0x4c7543
mov edx, dword [esp + ebp*4 + 4]
mov ecx, dword [esp + 4]
mov dword [esp + 0x10], ecx
cmp ebp, 2
lea ecx, [esp + 0xc]
lea ebp, [esp + 8]
cmovae ecx, ebp
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
jmp 0x4c74af
mov ebp, dword [esp + edx*4 + 4]
jmp 0x4c7543
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x4c75c7
xor ebx, ebx
xor ebp, ebp
add ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
sub eax, ebx
shl ebp, 4
mov edx, dword [esp + 0x20]
mov dword [edx + ebp + 4], eax
mov dword [edx + ebp + 0xc], 0
mov dword [edx + ebp], 0
mov dword [edx + ebp + 8], 0
mov eax, dword [ecx + 0x294]
add eax, edi
inc eax
mov dword [ecx + 0x294], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x525180
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
push ecx
call fcn.005258a0
add esp, 4
test al, al
jne 0x525165
push esi
call fcn.00525970
add esp, 4
test eax, eax
jne 0x52516a
mov dword [esi], 0
pop esi
ret
mov eax, 0x16
push str.thread::detach_failed
push eax
call fcn.00524f20
nop word cs:[eax + eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
xorps xmm0, xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x24], 0x6eff40
mov dword [esp + 0x28], 0x9bbee4
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], esp
mov dword [esp + 0x30], 0x5251fc
mov dword [esp + 0x10], 1
lea eax, [esp + 0xc]
push eax
call fcn.006f0ec0
add esp, 4
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x54]
lea eax, [esp + 0xc]
push eax
call fcn.006f0f20
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5258b0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push 8
call fcn.0051c3d0
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
push 0
push 0
push eax
push 0x525900
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x5258f1
xor eax, eax
pop esi
pop edi
pop ebx
ret
pop esi
pop edi
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x525e30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call fcn.005fe788
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.006f5040
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]
Function at 0x525e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x9b66e0]
test eax, eax
jle 0x525fa0
mov edx, dword [0x9b66e4]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x525ec1
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x525f3a
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x525eb0
mov dword [esp], esi
call fcn.006f51a0
test eax, eax
mov edi, eax
je 0x525fc7
lea esi, [ebx + ebx*4]
mov ebx, dword [0x9b66e4]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.006f5290
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x9b66e4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x525fa7
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x525f42
add dword [0x9b66e0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x525f33
cmp eax, 0x80
je 0x525f33
cmp eax, 8
je 0x525f33
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x9b66e4]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x525f33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00525e30
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x525ecb
mov eax, dword [0x9b66e4]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00525e30
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00525e30
mov esi, esi
lea edi, [edi]

Function at 0x5270a0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
jmp fcn.00526aa0
Function at 0x554f90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push dword [esp + 8]
push dword [eax + 8]
call dword [eax]
add esp, 8
test eax, eax
je 0x554fa5
ret
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]

Function at 0x555c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x8c8
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x30]
push 0x888
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esp + 0x8bc], 0x7ff00000
mov dword [esp + 0x8b8], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebx]
mov dl, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
cmp eax, ecx
jne 0x555cf4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ecx + 4]
setne dl
test esi, esi
je 0x555e47
mov eax, 0xffffffff
mov ebx, 0xffffffff
mov ecx, dword [esp + 0x10]
shl ebx, cl
not ebx
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0xc]
add cl, 2
mov ebx, 1
shl ebx, cl
mov ecx, dword [esp + 0xc]
shl eax, cl
add ebx, 0xfffffff0
mov dword [esp + 0x18], ebx
not eax
mov dword [esp + 0x1c], eax
add edi, 0xe
xorpd xmm1, xmm1
mov byte [esp + 7], dl
jmp 0x555d73
movzx edx, byte [esp + 7]
movzx eax, cx
mov ecx, eax
and ecx, 0x3ff
inc dword [esp + ecx*4 + 0x30]
inc dword [esp + 0x8b0]
shr eax, 0xa
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
addsd xmm1, xmm0
add edi, 0x10
dec esi
je 0x555e4b
test dword [edi - 0xa], 0x1ffffff
je 0x555d69
movzx eax, word [edi - 2]
cmp eax, 0x80
jb 0x555d69
movzx ecx, word [edi]
test dl, dl
je 0x555d45
movzx eax, cx
mov ecx, eax
and ecx, 0x3ff
mov edx, dword [ebp + 8]
mov edx, dword [edx + 4]
lea ebx, [edx + 0x10]
cmp ecx, ebx
jb 0x555de7
shr eax, 0xa
mov dword [esp + 0x24], eax
sub ecx, edx
add ecx, 0xfffffff0
mov dword [esp + 8], ebx
mov ebx, ecx
and ebx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x10]
bt ecx, eax
mov eax, dword [edi - 6]
setb dl
or edx, 2
mov ecx, dword [esp + 0x24]
shl edx, cl
add eax, edx
add eax, 0xfffffffc
mov ecx, dword [esp + 0x10]
shl eax, cl
add ebx, dword [esp + 8]
add ebx, eax
mov ecx, ebx
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x10]
ja 0x555e82
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
lea edx, [eax + 0x10]
cmp edx, ecx
ja 0x555d40
add ecx, dword [esp + 0x18]
sub ecx, eax
mov dword [esp + 8], edx
bsr edx, ecx
xor edx, 0xffffffe0
add edx, 0x1f
mov ebx, ecx
and ebx, dword [esp + 0x1c]
xor eax, eax
bt ecx, edx
setb al
add ebx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub edx, ecx
lea eax, [eax + edx*2]
add eax, 0xfffe
shl eax, cl
add ebx, eax
shl edx, 0xa
or ebx, edx
mov ecx, ebx
jmp 0x555d40
xorpd xmm1, xmm1
movsd qword [esp + 0x10], xmm1
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.00717470
add esp, 4
fstp qword [esp + 0x28]
movsd xmm0, qword [esp + 0x10]
addsd xmm0, qword [esp + 0x28]
movsd qword [esi], xmm0
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x555e7a
Function at 0x599fd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x80
je 0x599fe9
cmp eax, 0x100
je 0x599fe9
cmp eax, 0xc0
jne 0x599fee
jmp fcn.00599be0
mov eax, 0xfffffffe
ret

Function at 0x59cdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x38]
lea ecx, [ebp - 0x10]
mov eax, 0xffffffff
cmp ecx, 0x7fffffe7
ja 0x59cece
mov ecx, ebp
and ecx, 7
jne 0x59cece
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
test eax, eax
mov esi, 0x8bf020
cmovne esi, eax
lea eax, [edi + 8]
push ebp
push dword [esp + 0x38]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov eax, edi
add esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
movsd xmm0, qword [esi]
movsd qword [esp], xmm0
mov edx, ebp
shr edx, 3
xor ecx, ecx
mov ebp, 1
mov ebx, esp
nop word cs:[eax + eax]
mov dword [esp + 0x10], ecx
xor edi, edi
nop word cs:[eax + eax]
movsd xmm0, qword [eax + edi*8 + 8]
movsd qword [esp + 8], xmm0
push dword [esp + 0x28]
push ebx
push ebx
mov esi, ebx
mov ebx, edx
call fcn.00599480
mov edx, ebx
mov ebx, esi
add esp, 0xc
lea eax, [edi + ebp]
xor byte [esp + 7], al
xor byte [esp + 6], ah
mov ecx, eax
shr ecx, 0x10
xor byte [esp + 5], cl
shr eax, 0x18
xor byte [esp + 4], al
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 8]
movsd qword [eax + edi*8 + 8], xmm0
inc edi
cmp edx, edi
jne 0x59ce60
mov ecx, dword [esp + 0x10]
inc ecx
add ebp, edx
cmp ecx, 6
jne 0x59ce50
movsd xmm0, qword [esp]
movsd qword [eax], xmm0
mov eax, dword [esp + 0x38]
add eax, 8
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x59cee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x50]
mov eax, 0xffffffff
cmp edi, 0x18
jl 0x59cff6
mov ecx, edi
and ecx, 7
jne 0x59cff6
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
movsd xmm0, qword [eax]
movsd qword [esp], xmm0
add eax, 8
lea ecx, [edi - 8]
mov dword [esp + 0x10], ecx
push ecx
push eax
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
shr edi, 3
lea eax, [edi + edi*2]
lea ebx, [eax + eax]
add ebx, 0xfffffffa
mov eax, 1
sub eax, edi
mov dword [esp + 0x14], eax
mov eax, 5
mov esi, esp
mov dword [esp + 0x18], edi
nop dword [eax]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
nop dword [eax + eax]
xor byte [esp + 7], bl
xor byte [esp + 6], bh
mov eax, ebx
shr eax, 0x10
xor byte [esp + 5], al
mov eax, ebx
shr eax, 0x18
xor byte [esp + 4], al
movsd xmm0, qword [ebp + edi*8 - 0x10]
movsd qword [esp + 8], xmm0
push dword [esp + 0x40]
push esi
push esi
call fcn.00599820
add esp, 0xc
movsd xmm0, qword [esp + 8]
movsd qword [ebp + edi*8 - 0x10], xmm0
dec edi
dec ebx
cmp edi, 1
jne 0x59cf60
mov eax, dword [esp + 0x1c]
dec eax
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x14]
cmp eax, 6
mov edi, dword [esp + 0x18]
jb 0x59cf50
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov eax, 0x8bf020
cmovne eax, ecx
lea ecx, [esp + 0x24]
push 8
push eax
push ecx
call sym.adb.exe_CRYPTO_memcmp
add esp, 0xc
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
or eax, dword [esp + 0x10]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x59d900
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x10], 1
jne 0x59d91c
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00599480
add esp, 0xc
ret
jmp fcn.00599820
Function at 0x59e010
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [ecx]
test eax, eax
je 0x59e05d
test esi, esi
je 0x59e05d
nop word cs:[eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp]
inc ebp
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
inc esi
and esi, 0xf
je 0x59e05f
cmp eax, 1
mov eax, ecx
jne 0x59e040
jmp 0x59e05f
mov ecx, eax
mov eax, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x59e127
mov dword [esp], ecx
push eax
push edi
push edi
call fcn.00599480
add esp, 0xc
cmp esi, 0xf
ja 0x59e0bc
mov eax, dword [edi + esi]
xor eax, dword [ebp + esi]
mov dword [ebx + esi], eax
cmp esi, 0xb
ja 0x59e0bc
mov eax, dword [edi + esi + 4]
xor eax, dword [ebp + esi + 4]
mov dword [ebx + esi + 4], eax
cmp esi, 7
ja 0x59e0bc
mov eax, dword [edi + esi + 8]
xor eax, dword [ebp + esi + 8]
mov dword [ebx + esi + 8], eax
cmp esi, 3
ja 0x59e0bc
mov eax, dword [edi + esi + 0xc]
xor eax, dword [ebp + esi + 0xc]
mov dword [ebx + esi + 0xc], eax
mov ecx, dword [esp]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
xor esi, esi
cmp ecx, 0x10
mov eax, dword [esp + 0x24]
jb 0x59e127
nop word cs:[eax + eax]
push eax
push edi
push edi
mov edi, ecx
call fcn.00599480
mov ecx, edi
mov edi, dword [esp + 0x34]
add esp, 0xc
mov eax, dword [edi]
xor eax, dword [ebp]
mov dword [ebx], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
xor eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
xor eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x24]
add ecx, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
cmp ecx, 0xf
ja 0x59e0e0
test ecx, ecx
je 0x59e14c
push eax
push edi
push edi
mov edi, ecx
call fcn.00599480
mov edx, edi
add esp, 0xc
test dl, 1
jne 0x59e150
mov eax, edx
mov edi, dword [esp + 0x28]
cmp edx, 1
jne 0x59e170
jmp 0x59e192
mov ecx, esi
jmp 0x59e192
mov edi, dword [esp + 0x28]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
lea eax, [edx - 1]
mov byte [ebx + esi], cl
inc esi
mov ecx, esi
cmp edx, 1
je 0x59e192
nop word [eax + eax]
movzx ecx, byte [edi + esi]
xor cl, byte [ebp + esi]
mov byte [ebx + esi], cl
movzx edx, byte [edi + esi + 1]
xor dl, byte [ebp + esi + 1]
lea ecx, [esi + 2]
mov byte [ebx + esi + 1], dl
mov esi, ecx
add eax, 0xfffffffe
jne 0x59e170
mov eax, dword [esp + 0x2c]
mov dword [eax], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret