joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5de021
Capabilities:
Check os version
Encode data using base64

Disassembly:
add esp, 4
xor eax, eax
jb 0x5d9361
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x5cde96
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x5de035
jge 0x5de064
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.005dd8dc

Function at 0x5dea17
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0x5c7b63
ret
pop dword [esp - 4]
mov byte [esi + 0xba], cl
shr ebp, 0x40
mov cl, cl
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
call fcn.005e693a
stc
add esp, 0x3c
shr eax, 0x40
js 0x5d493f
jns 0x5ca1e7
xchg esi, eax
into
or dword [edi], 0xffffff89
push edx
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
jns 0x5d493f
fcomp st(1)
shl si, 0x20
mov dx, word [ebp + 0x10]
jno 0x5de9ec
jo 0x5ca201
dec esp
fisttp qword [edi]
and ch, 0x47
add dword [eax], eax
jo 0x5de9ec
and eax, 0x3b24f782
mov esi, eax
push 0x5eabe8
ret
jne 0x5be52a
shl dl, 0x20
je 0x5de9e4
sal ch, 0x4e
je 0x5be52a
or byte [edx], 0xeb
jmp 0x5de9ed
push eax
xchg bl, dl
mov edx, edx
xchg dl, bl
mov ax, ax
jne 0x5ccc01
je 0x5dea02
cli
xchg esi, eax
je 0x5ccc01
fld dword [ecx + 0x6a]
add byte [ebp + 0x3e68d855], cl
ja 0x5dea6e
add bl, al
and eax, 0x24448f7d
cld
push 0x9c40244c
push edx
call fcn.005bb922
jne 0x5d29d5
je 0x5dea32
loopne 0x5dea4d
jae 0x5de9d6
je 0x5d29d5
invalid
or al, 0x85
inc esp
sbb eax, 0xe3820f00
mov cl, 0xfe
dec dword [ebp + 0x3326ff36]
invalid
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
call fcn.005e9208
xor cl, 4
in eax, 0x5b
add byte [ebx + 0xa005db5], al
sbb dword [ebp], ebx
nop
ljmp 0xfd4c
Function at 0x5e0db0
Capabilities:
Check os version
Encode data using base64

Disassembly:
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
sbb word [ebx], ax
call fcn.005e8c9e
add eax, 0x870f5677
pop edi
jg 0x5b1971
add byte [esi + 2], dh
jbe 0x5b1975
insb byte es:[edi], dx
push cs
jbe 0x5c98d0
add eax, 0x85e8bf6
js 0x5cfc21
jns 0x5b198c
and byte [ebx - 0x76f0bbb8], bl
invalid
jns 0x5cfc21
sar eax, 2
sub edi, ebx
add eax, esi
pop ebx
lea esi, [eax + edi]
pop edi
mov esi, esi
lea eax, [esi - 0xb2408]
pop esi
jmp 0x5d191f
and eax, 0xc4a9a313
ja 0x5c0d27
call fcn.005bc6bb
inc eax
js 0x5deba0
jns 0x5c98e0
mov ch, 0xc3
jns 0x5deba0
and eax, 0x16478aee
shl al, 0x20
ja 0x5cceab
jbe 0x5cfc2d
jbe 0x5cceab
cld
or ah, byte [esi - 0x3f]
loop 0x5d0f22
mov eax, dword [esi + 4]
jmp 0x5b195a
cpuid
ret
pop ebp
ret
xchg edi, eax
sbb esi, edx
jbe 0x5d9348
fldenv [ebx + 0x83826ff]
shr ch, 0x40
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov al, byte [ebp + eax]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
jmp dword [esi]
mov ecx, dword [esi + 4]
mov bx, bx
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
shr word [ebx], cl
jmp dword [esi]
clc
lodsb al, byte [esi]
call fcn.005cde80
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
jmp 0x5deba1
push eax
push esi
mov esi, dword [ebp + 0xc]
jmp 0x5deba9
push esi
call fcn.005e4496
mov dh, dh
push esi
call fcn.005bc6bb
add eax, 0x17
add esp, 0x14
cmp eax, 0x104
jae 0x5e7801
lea esi, [esi]
jb 0x5debd7
sub bh, byte [0x176ad405]
push 0x17
push str.hlrus_license_file.alf
jmp 0x5b45e4
pop dword [esp - 4]
je 0x5e7758
jne 0x5e0dbf
pop ebx
out 0x6e, al
xor eax, eax
jb 0x5d6a79
pop esi
mov esp, ebp
jne 0x5e7751
je 0x5e0dd4
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x5e7751
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x5e77ad
je 0x5e776a
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x5d6a82
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x5d935a
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x5e777b
jge 0x5e77a6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
xchg ecx, edx
xchg edx, ecx
mov eax, edx
shr bl, 0x40
shr eax, 0x1f
add edx, eax
shr ah, 0x40
mov eax, ecx
shr eax, 0x40
mov edi, edx
shl bl, 0x20
cdq
and edx, 3
jb 0x5d0efc
jmp fcn.005dd8dc
cmp al, 2
mov esi, esi
call 0x5ec1c0
invalid
add eax, edx
sar ebx, 2
jne 0x5c0817
je 0x5e77f1
shr bl, 0x70
clc
je 0x5c0817
invalid
pop edi
xor eax, eax
jb 0x5c0d20
push edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e315a
Capabilities:
Check os version

Disassembly:
push 0x5be189
ret
and eax, 0x3326ff3b
mov bl, 0x66
mov esi, esi
mov eax, dword [esi + 4]
lea esi, [esi + 8]
seto byte [ebp + eax]
jmp dword [esi]
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x5c32f4
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x5b3f39
je 0x5cee89
push cs
sub byte [eax], ch
jmp 0x5ae2a0
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x5cee35
shr edi, 0x40
je 0x5e3173
push ebx
out dx, al
je 0x5cee35
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]
Function at 0x5e7a0d
Capabilities:
Query environment variable

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jb 0x5bc58b
xchg bh, dl
xchg dl, bh
js 0x5d049e
jns 0x5b8a17
fiadd dword [edi + 0x6a]
sbb cl, ch
xor eax, 0xf70001a7
test al, 0x68
iretd
mov bp, bp
mov eax, dword [0x77c721]
test eax, eax
jb 0x5badd0
jne 0x5e7a31
je 0x5e7a29
dec esp
push ecx
jecxz 0x5e7a62
mov eax, dword [0x77c530]
ret
push 0x58
push 0x77c4d8
push 0x77c715
shr ah, 0x40
mov dword [0x77c721], 0
shl si, 0x20
ja 0x5b89f9
jbe 0x5e7a5a
nop
cpuid
ret
jbe 0x5b89f9
mov dword [esi - 0x7f], 0x5176f1
add byte [edi], cl
or byte [esi], 0x9e
cld
dec dword [edi]
test dword [eax], esp
adc ch, bh
jmp dword [esi - 0x77]

Function at 0x5e7ce9
Capabilities:
Check os version
Encode data using xor

Disassembly:
pop dword [esp - 4]
je 0x5e7d2d
jne 0x5e7cf8
iretd
cmp ax, 0x100
je 0x5e7d2d
jne 0x5e7d07
stc
invalid
cmp ax, 0x12c
xchg edx, ebx
xchg ebx, edx
je 0x5e7d2d
push esi
pop esi
jne 0x5e7d1d
mov edi, 0x662af420
cmp eax, 0x850f0028
cmp ax, 0x28
jne 0x5bfc94
insd dword es:[edi], dx
jg 0x5e7d23
push dword [esp + eax + 0x7e]
add dword [ebp + 0x5b], edx
je 0x5e7d2d
jle 0x5e7d2c
push ebp
pop ebx
mov ecx, dword [edi]
push ecx
call fcn.005d87c0
ja 0x5c1c06
jbe 0x5e7d42
cpuid
nop
ret
jbe 0x5c1c06
xor al, 0x89
jmp dword [esi]
Function at 0x5ed25c
Capabilities:
Check os version
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
shl ch, 0x20
mov ecx, dword [esi]
add esi, 8
and ecx, ecx
jae 0x5b6f8e
rol esp, 6
jae 0x5b6f9e
jae 0x5da953
cmp dword [edi + 0x25000239], 0xffffffde
mov si, si
xor eax, 0x850f5fe6
xchg edx, eax
scasb al, byte es:[edi]
std
push dword [esp + eax + 0x7f]
add esp, eax
je 0x5b4e01
fmul dword [ebx - 0x683a08c0]
adc ch, byte [eax + edi*2 + 0x38c3f766]
xlatb
jne 0x5c7ff1
je 0x5d9f95
fmul qword [edi]
mov byte [0x56840fc3], al
je 0x5c7ff1
loopne 0x5d9f98
invalid
fnstenv [ebp - 0x71]
inc esp
and al, 0xfc
stosw word es:[edi], ax
lea esi, [esi + 4]
lea ebx, [ebx]
push edi
pop edi
mov dword [ebp + 0x4c], edi
jmp dword [esi]
stc
jb 0x5da958
push esi
pop esi
jmp dword [esi]
and eax, 0x24448f97
cld
jmp 0x5bd08f
pop dword [esp - 4]
jne 0x5cd8ba
shl ax, 0x20
je 0x5ed26f
add edi, dword [ecx + 0x6870fb5]
popfd
cld
push dword [esi + 4]
ja 0x5b6f7b
jbe 0x5ed27b
jae 0x5ed28d
leave
pop ebx
jbe 0x5b6f7b
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
add esi, 8
shr dx, 0x40
shr ax, 0x40
shl eax, cl
add edx, 0xdfcce240
sub edx, 0xdfcce240
add edi, eax
test ecx, 0x80000000
jb 0x5d9f66
add byte [esi - 0x3f], ah
ljmp 0xd340
shl cl, 0x20
jne 0x5d5146
je 0x5ed2c1
movsb byte es:[edi], byte [esi]
sahf
and eax, 0x40e9c0ed
shr cl, 0x40
mov ecx, dword [esi]
add esi, 4
test ecx, 0x1000
jb 0x5eab5c
jne 0x5c9c2d
je 0x5ed2e3
or ch, al
sbb cl, byte [edi]
test byte [ecx + ecx*8 - 3], al
invalid
je 0x5c9c2d
Function at 0x5f4a20
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x5f4a44
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x5f4a5e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.006079a0
add esp, 0xc
cmp si, 0xfc
jbe 0x5f4aa9
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.00604790
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x5f4b57
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x5f4ad9
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x5f4af5
jmp 0x5f4c1a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.006079a0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.006079a0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x5f4b91
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x5f4bb0
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.00607980
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.006047e0
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x5f4d80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x5f4dac
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.005f4a20
add esp, 0xc
test ax, ax
jne 0x5f4ef8
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x5f4df4
cmp eax, 1
je 0x5f4e6e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x5f4e15
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.006047e0
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00604940
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x5f4e2b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x5f4e56
mov eax, dword [esp + 8]
jmp 0x5f4edf
mov eax, dword [esp + 0x188]
test eax, eax
je 0x5f4e8f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.006047e0
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00604940
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x5f4ea5
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x5f4ecd
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.00607980
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x5f56f0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x5f5757
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x77d5c8]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x77d5c8]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x77d5c8]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x77d5c8]
dec esi
jne 0x5f5703
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5f5760
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x5f5782
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x5f5880
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x5f5839
mov ecx, 3
cmp ecx, 1
jne 0x5f5847
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x5f5869
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x5f585e
mov byte [esi], 0x3d
jmp 0x5f5869
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x5f5790
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x5f5eb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x5f5ee8
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x5f5ed0
pop esi
pop ebx
ret
Function at 0x5f6180
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x5f6203
pop esi
pop ebx
ret

Function at 0x5f7e40
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x5f7e91
mov dl, byte [edi]
mov eax, edi
dec edi
mov cl, bl
mov bl, dl
add dl, dl
shr bl, 7
or dl, cl
mov byte [eax], dl
mov ax, si
dec si
test ax, ax
jne 0x5f7e75
test bl, bl
je 0x5f7e9c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x5f7e67
xor si, si
test ebp, ebp
je 0x5f7ec9
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x5f7eb2
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x5f8660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x5f868a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x5f8679
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x5f86cc
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x5f86ab
test cl, cl
je 0x5f86d3
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x5f8698
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x5fc440
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x5fc470
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x5fc562
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x5fc532
cmp dword [esp + 0x1c], 2
push 0
jbe 0x5fc513
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.005fc610
add esp, 0xc
cmp dword [0x77da90], 0
jne 0x5fc5fd
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x5fc4e4
jmp 0x5fc540
push 0
push esi
call fcn.005fc610
add esp, 0xc
cmp dword [0x77da90], 0
je 0x5fc540
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.005fc930
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x5fc497
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x5fc578
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x5fc56a
cmp dword [esp + 0x1c], 2
jbe 0x5fc593
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.005fc930
add esp, 8
jmp 0x5fc5b8
cmp dword [esp + 0x1c], 1
jne 0x5fc5a7
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.005fc610
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x5fc5f0
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x5fc5d7
mov dl, byte [esi + ecx - 8]
lea eax, [esi + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x18]
jb 0x5fc5c7
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x5fc930
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
mov eax, dword [esi]
add esi, 8
mov ebp, 0xc
add dword [edx + 4], eax
mov ecx, dword [esi - 4]
add dword [edx], ecx
mov ebx, dword [edx]
mov edi, dword [edx + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add esi, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [esi - 8]
mov dword [edx + 4], eax
mov edi, dword [edx]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [esi - 4]
dec ebp
mov dword [edx], ebx
jne 0x5fc94e
pop ebp
pop edi
pop esi
pop ebx
ret