joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e16b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x53c
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x538], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x53c], edi
test esi, esi
jne 0x5e16f1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
push ebx
push 0x793d74
push edi
call fcn.0060fed0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x5e171e
push 0x62
push str.....crypto_rand_randfile.c
push 0x79
push 0x6f
push 0x24
call fcn.005e34c0
push edi
jmp 0x5e186e
lea eax, [ebp - 0x534]
push eax
push ebx
call fcn.006e4e03
add esp, 4
push eax
call fcn.006ed582
add esp, 8
test eax, eax
jns 0x5e1777
push 0x69
push str.....crypto_rand_randfile.c
push 0x71
push 0x6f
push 0x24
call fcn.005e34c0
push edi
push str.Filename
push 2
call fcn.005e2af0
push ebx
call fcn.006e4d89
add esp, 0x24
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
test esi, esi
jns 0x5e1791
test dword [ebp - 0x52e], 0x8000
mov esi, 0x100
cmovne esi, dword [ebp - 0x520]
push 0
push ebx
call fcn.006eee1b
add esp, 8
nop dword [eax]
test esi, esi
jle 0x5e17b4
cmp esi, 0x500
mov eax, 0x400
cmovle eax, esi
jmp 0x5e17b9
mov eax, 0x500
push ebx
push eax
lea eax, [ebp - 0x504]
push 1
push eax
call fcn.006eb820
push ebx
mov edi, eax
call fcn.006ed5cf
add esp, 0x14
test eax, eax
je 0x5e17f1
call fcn.006e7083
cmp dword [eax], 4
jne 0x5e17f1
push ebx
call fcn.006eed75
add esp, 4
test edi, edi
je 0x5e17a0
jmp 0x5e17f5
test edi, edi
je 0x5e1830
movd xmm0, edi
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.006d13f0
lea eax, [ebp - 0x504]
movsd qword [esp], xmm0
push edi
push eax
call fcn.005db930
add dword [ebp - 0x538], edi
add esp, 0x10
test esi, esi
jle 0x5e17b4
sub esi, edi
test esi, esi
jg 0x5e17a4
lea eax, [ebp - 0x504]
push 0x500
push eax
call fcn.004019e0
push ebx
call fcn.006e4d89
add esp, 0xc
call fcn.005dbaf0
test eax, eax
jne 0x5e1891
push 0xa6
push str.....crypto_rand_randfile.c
push 0x76
push 0x6f
push 0x24
call fcn.005e34c0
push dword [ebp - 0x53c]
push str.Filename
push 2
call fcn.005e2af0
add esp, 0x20
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x538]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x5ee430
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.006d13f0
cmp dword [0x7cb060], 0
jne 0x5ee580
push ebx
push esi
push edi
push 0x30
push 0x7cb000
push str.OPENSSL_ia32cap
mov dword [0x7cb060], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x5ee55a
movzx esi, word [0x7cb000]
xor eax, eax
mov ecx, 2
cmp esi, 0x7e
cmove eax, ecx
add eax, 0x7cb000
push eax
call fcn.005ee9c0
add esp, 4
mov edi, eax
mov ebx, edx
cmp esi, 0x7e
jne 0x5ee4c8
push 0x7cdd10
mov esi, edi
call fcn.004016c0
not edi
not ebx
and esi, 0x1000000
add esp, 4
and edi, eax
and ebx, edx
or esi, 0
je 0x5ee4e3
and ebx, 0xedfff7fd
jmp 0x5ee4e3
cmp word [0x7cb000], 0x3a
jne 0x5ee4e3
push 0x7cdd10
call fcn.004016c0
add esp, 4
mov edi, eax
mov ebx, edx
movzx eax, word [0x7cb000]
mov ecx, 0x7cb000
test ax, ax
je 0x5ee505
add ecx, 2
cmp ax, 0x3a
je 0x5ee51b
movzx eax, word [ecx]
test ax, ax
jne 0x5ee4f4
mov dword [0x7cdd18], 0
mov dword [0x7cdd1c], 0
jmp 0x5ee56b
movzx esi, word [ecx]
xor eax, eax
cmp esi, 0x7e
mov edx, 2
cmove eax, edx
add eax, ecx
push eax
call fcn.005ee9c0
add esp, 4
cmp esi, 0x7e
jne 0x5ee54d
not eax
not edx
and dword [0x7cdd18], eax
and dword [0x7cdd1c], edx
jmp 0x5ee56b
mov dword [0x7cdd18], eax
mov dword [0x7cdd1c], edx
jmp 0x5ee56b
push 0x7cdd10
call fcn.004016c0
add esp, 4
mov edi, eax
mov ebx, edx
or edi, 0x400
mov dword [0x7cdd14], ebx
mov dword [0x7cdd10], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f0840
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x114
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x110], eax
cmp edi, 0x10
je 0x5f087b
cmp edi, 0xc
je 0x5f087b
cmp edi, 8
mov ecx, 0x10
cmovne edi, ecx
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax], edi
mov dword [ebp - 0x108], ebx
lea esi, [edx - 8]
test esi, esi
js 0x5f0900
add esi, 8
shr esi, 3
lea eax, [esi*8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax]
shl ecx, 8
or edx, ecx
movzx ecx, byte [eax + 2]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [eax + 3]
shl ecx, 0x18
or edx, ecx
movzx ecx, byte [eax + 5]
mov dword [ebp + ebx*4 - 0x104], edx
movzx edx, byte [eax + 4]
shl ecx, 8
or edx, ecx
movzx ecx, byte [eax + 6]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [eax + 7]
shl ecx, 0x18
add eax, 8
or edx, ecx
mov dword [ebp + ebx*4 - 0x100], edx
add ebx, 2
sub esi, 1
jne 0x5f08a5
mov edx, dword [ebp + 0xc]
jmp 0x5f0903
mov eax, dword [ebp + 0x10]
mov ecx, edx
sub ecx, dword [ebp - 0x108]
je 0x5f097b
mov ecx, edx
xor esi, esi
and ecx, 7
xor edx, edx
add eax, ecx
dec ecx
cmp ecx, 7
ja case.default.0x5f091e
jmp dword [ecx*4 + 0x5f0a64]
movzx edx, byte [eax - 1]
dec eax
shl edx, 0x18
movzx ecx, byte [eax - 1]
dec eax
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [eax - 1]
dec eax
shl ecx, 8
or edx, ecx
movzx ecx, byte [eax - 1]
dec eax
or edx, ecx
movzx esi, byte [eax - 1]
dec eax
shl esi, 0x18
movzx ecx, byte [eax - 1]
dec eax
shl ecx, 0x10
or esi, ecx
movzx ecx, byte [eax - 1]
dec eax
shl ecx, 8
or esi, ecx
movzx eax, byte [eax - 1]
or esi, eax
mov dword [ebp + ebx*4 - 0x100], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp + ebx*4 - 0x104], esi
mov ebx, dword [ebp - 0x110]
lea eax, [edx + 3]
cdq
lea edi, [edi*2 + 2]
and edx, 3
mov ecx, 1
add edx, eax
sar edx, 2
mov dword [ebx + 4], 0xb7e15163
cmp edi, ecx
jle 0x5f09b5
mov eax, dword [ebx + ecx*4]
sub eax, 0x61c88647
mov dword [ebx + ecx*4 + 4], eax
inc ecx
cmp ecx, edi
jl 0x5f09a4
cmp edi, edx
mov eax, edx
cmovg eax, edi
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x10c], ecx
xor ebx, ebx
mov dword [ebp - 0x108], ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0x114], eax
test eax, eax
jle 0x5f0a52
nop dword [eax + eax]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + ebx*4 + 4]
add eax, ecx
mov ecx, dword [ebp - 0x110]
add eax, dword [ebp - 0x108]
rol eax, 3
mov dword [ebp - 0x108], eax
mov dword [ecx + ebx*4 + 4], eax
mov ecx, dword [ebp - 0x10c]
add ecx, eax
mov eax, dword [ebp + esi*4 - 0x104]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x108]
rol eax, cl
lea ecx, [esi + 1]
mov dword [ebp + esi*4 - 0x104], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebx + 1]
xor ebx, ebx
cmp eax, edi
cmovl ebx, eax
xor esi, esi
cmp ecx, edx
cmovl esi, ecx
sub dword [ebp - 0x114], 1
mov ecx, dword [ebp - 0x10c]
jne 0x5f09e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x5f0d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 0x28], eax
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x14], 0
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [ebp - 0x20], ebx
movzx eax, byte [edx + 5]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 0xc], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, edx
shr eax, 8
mov byte [ebp - 7], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 0x18
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 5], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov esi, dword [edi]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 8], dl
test eax, eax
je 0x5f0eaf
mov edi, dword [ebp + 8]
sub dword [ebp - 0x10], edi
nop dword [eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x5f0e46
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.00401cc0
mov ebx, dword [ebp - 0x20]
add esp, 8
mov edx, dword [ebp - 0x1c]
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, edx
shr eax, 8
mov byte [ebp - 7], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 0x18
inc dword [ebp - 0x14]
mov byte [ebp - 0xc], bl
mov byte [ebp - 8], dl
mov byte [ebp - 5], al
mov al, byte [ebp + esi - 0xc]
inc esi
mov ecx, dword [ebp - 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
test eax, eax
jne 0x5f0df0
test ecx, ecx
je 0x5f0e99
mov edi, dword [ebp - 0x28]
mov eax, ebx
shr eax, 8
mov byte [edi], bl
mov byte [edi + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [edi + 3], bl
shr eax, 8
mov byte [edi + 4], dl
mov byte [edi + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [edi], esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x5f5b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x5f5b45
xor eax, eax
pop edi
pop ebp
ret
push ebx
push esi
push dword [edi]
call fcn.005d99e0
mov ecx, dword [ebp + 0x10]
add esp, 4
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x5f5bf9
mov ecx, dword [edi + 0x84]
cmp ecx, esi
jne 0x5f5b96
test esi, esi
jle 0x5f5bd7
mov edx, ebx
lea ecx, [edi + 4]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5f5b80
jmp 0x5f5bd4
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x5f5bb4
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.006d4310
add esp, 0xc
test esi, esi
jle 0x5f5bd7
mov edx, ebx
lea ecx, [edi + 0x24]
mov ebx, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5f5bc0
mov ebx, dword [ebp + 0xc]
push esi
push ebx
push ebx
push dword [edi]
call fcn.005da0e0
add esp, 0x10
test eax, eax
jne 0x5f5bf9
push esi
push ebx
call fcn.004019e0
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x5f6400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.006d13f0
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
cmp edx, ebx
je 0x5f6548
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
push esi
lea esi, [eax - 1]
not eax
shr eax, 0x1f
shr esi, 0x1f
and esi, eax
mov eax, dword [ebx + 4]
xor eax, ecx
dec esi
and eax, esi
mov dword [ebp - 8], esi
xor ecx, eax
mov dword [edx + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, esi
and eax, esi
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [edx + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, esi
mov esi, dword [ebp + 0x14]
and eax, 4
xor ecx, eax
mov dword [edx + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
test esi, esi
jle 0x5f6547
push edi
cmp esi, 4
jb 0x5f651e
mov ecx, dword [ebx]
mov edi, dword [edx]
lea edx, [esi - 1]
mov dword [ebp - 4], ecx
lea edx, [ecx + edx*4]
mov dword [ebp + 0x10], edx
lea edx, [esi - 1]
lea edx, [edi + edx*4]
cmp ecx, edx
mov edx, dword [ebp + 0xc]
ja 0x5f64ac
cmp dword [ebp + 0x10], edi
jae 0x5f651e
cmp ecx, ebx
ja 0x5f64b5
cmp dword [ebp + 0x10], ebx
jae 0x5f651e
cmp ecx, edx
ja 0x5f64be
cmp dword [ebp + 0x10], edx
jae 0x5f651e
lea ecx, [esi - 1]
lea ecx, [edi + ecx*4]
cmp edi, ebx
ja 0x5f64cc
cmp ecx, ebx
jae 0x5f651e
cmp edi, edx
ja 0x5f64d4
cmp ecx, edx
jae 0x5f651e
mov ecx, esi
and ecx, reloc.WS2_32.dll_closesocket
jns 0x5f64e3
dec ecx
or ecx, 0xfffffffc
inc ecx
mov dword [ebp + 0x10], esi
sub dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 4]
nop dword [eax]
movups xmm3, xmmword [ecx + eax*4]
movups xmm2, xmmword [edi + eax*4]
movaps xmm1, xmm3
pxor xmm1, xmm2
pand xmm1, xmm4
movaps xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [edi + eax*4], xmm0
movups xmmword [ecx + eax*4], xmm1
add eax, 4
cmp eax, dword [ebp + 0x10]
jl 0x5f64f0
cmp eax, esi
jge 0x5f6546
mov ecx, dword [edx]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [ebp - 8]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
mov edx, dword [ebp + 0xc]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [ebp + 0x14]
jl 0x5f6522
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5fa5a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.006d13f0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
xor edi, edi
call fcn.005dc240
mov ebx, eax
push ebx
push esi
call fcn.005dc120
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
je 0x5fa62b
push 0xf0000040
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5fa604
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.005dc190
push esi
call fcn.005dc2e0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x5fa62b
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push esi
call fcn.005dc240
mov ebx, eax
push ebx
push esi
call fcn.005dc120
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
je 0x5fa69a
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5fa680
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.005dc190
push esi
call fcn.005dc2e0
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x5fa622
push esi
call fcn.005dc2e0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x603a70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00603c90
add esp, 0xc
test eax, eax
js 0x603c82
mov eax, dword [esi + 0xf0]
push ebx
push edi
xor ebx, ebx
lea edi, [eax*4]
test edi, edi
jle 0x603af9
mov eax, dword [ebp + 0x10]
lea esi, [esi + edi*4]
add esi, 8
add eax, 8
nop
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x603ab0
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0xf0]
mov ebx, 1
cmp eax, ebx
jle 0x603c7e
lea edi, [esi + 4]
nop dword [eax]
movzx eax, byte [edi + 0xd]
lea edi, [edi + 0x10]
mov edx, dword [edi - 4]
inc ebx
movzx ecx, byte [eax*4 + 0x72c6a8]
mov eax, edx
shr eax, 0x18
mov ecx, dword [ecx*4 + 0x72daa8]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72d2a8]
movzx eax, byte [edi - 2]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72d6a8]
movzx eax, dl
mov edx, dword [edi]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72dea8]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi - 4], ecx
movzx ecx, byte [eax*4 + 0x72c6a8]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x72d6a8]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72daa8]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72d2a8]
movzx eax, dl
mov edx, dword [edi + 4]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72dea8]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi], ecx
movzx ecx, byte [eax*4 + 0x72c6a8]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x72d6a8]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72daa8]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72d2a8]
movzx eax, dl
mov edx, dword [edi + 8]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72dea8]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi + 4], ecx
movzx ecx, byte [eax*4 + 0x72c6a8]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x72d6a8]
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72daa8]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72d2a8]
movzx eax, dl
movzx eax, byte [eax*4 + 0x72c6a8]
xor ecx, dword [eax*4 + 0x72dea8]
mov dword [edi + 8], ecx
cmp ebx, dword [esi + 0xf0]
jl 0x603b10
pop edi
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x6045f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006d13f0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp + 0x10], ecx
mov edi, dword [edi]
test edi, edi
je 0x60462f
mov edx, dword [ebp + 0x1c]
test esi, esi
je 0x60462f
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and edi, 0xf
jne 0x604618
cmp esi, 0x10
jb 0x6046a8
mov edx, dword [ebp + 0x1c]
mov eax, ecx
sub eax, edx
xor edi, edi
mov dword [ebp - 8], eax
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], edi
mov edi, ebx
mov dword [ebp - 4], eax
sub edi, edx
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp + 0x10], ecx
jmp 0x604664
mov edx, dword [ebp + 0x1c]
push dword [ebp + 0x14]
push edx
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.00604860
mov eax, dword [ebp + 0x1c]
add esp, 0x10
mov edx, 4
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x604681
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
sub dword [ebp - 4], 1
jne 0x604661
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x6046e4
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.00604860
mov eax, dword [ebp + 0x1c]
add esp, 0x10
mov edx, dword [ebp + 0x10]
sub ebx, eax
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub esi, 1
jne 0x6046d2
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6046f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.006d13f0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp - 4], edx
mov edi, dword [edi]
mov dword [ebp - 8], edi
test edi, edi
je 0x60473a
mov ecx, dword [ebp + 0x1c]
nop dword [eax + eax]
test esi, esi
je 0x60473a
mov al, byte [edi + ecx]
dec esi
xor al, byte [edx]
inc edi
mov byte [ebx], al
inc edx
inc ebx
mov dword [ebp - 4], edx
and edi, 0xf
mov dword [ebp - 8], edi
jne 0x604720
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
bswap ecx
mov dword [ebp + 0x10], ecx
cmp esi, 0x10
jb 0x6047d5
mov edi, eax
mov eax, ecx
mov ecx, esi
shr ecx, 4
neg eax
add dword [ebp + 0x10], ecx
cmp dword [ebp + 0x10], ecx
push edi
push dword [ebp + 0x14]
cmovae eax, ecx
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp + 0x10], ecx
push dword [ebp - 0xc]
cmovae eax, dword [ebp + 0x10]
push ebx
push edx
mov dword [ebp + 0x10], eax
call dword [ebp + 0x24]
mov ecx, dword [ebp + 0x10]
add esp, 0x14
mov eax, ecx
bswap eax
mov dword [edi + 0xc], eax
test ecx, ecx
jne 0x6047b5
mov edx, 0xc
mov eax, 1
nop dword [eax + eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x6047a0
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
shl eax, 4
sub esi, eax
add edx, eax
add ebx, eax
mov dword [ebp - 4], edx
cmp esi, 0x10
jae 0x604753
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
test esi, esi
je 0x604846
mov ecx, dword [ebp + 0x1c]
xorps xmm0, xmm0
push eax
push dword [ebp + 0x14]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [ebp + 0x24]
mov ecx, dword [ebp + 0x10]
add esp, 0x14
mov eax, dword [ebp + 0x18]
add ecx, 1
bswap ecx
mov dword [eax + 0xc], ecx
jne 0x604825
mov edx, 0xc
mov ecx, 1
mov edi, eax
nop dword [eax]
movzx eax, byte [edx + edi - 1]
dec edx
add ecx, eax
mov byte [edx + edi], cl
shr ecx, 8
test edx, edx
jne 0x604810
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x1c]
sub ebx, eax
mov edx, dword [ebp - 4]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x604834
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret