joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42066e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x43806c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00416e7d
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00416e7d
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4206e5
cmp word [ecx], dx
je 0x4206e5
mov eax, dword [0x42e174]
push edi
dec eax
push eax
push 0x42e060
call fcn.0042060d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x420758
cmp word [eax], dx
je 0x420758
mov eax, dword [edi]
test eax, eax
je 0x420709
cmp word [eax], dx
je 0x420709
lea eax, [ebp - 0x10]
push eax
call fcn.0041fff0
jmp 0x420712
lea eax, [ebp - 0x10]
push eax
call fcn.0042008b
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x420782
mov eax, dword [0x42e05c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42dd50
call fcn.0042060d
add esp, 0xc
test al, al
je 0x420782
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x42074d
cmp word [eax], di
je 0x42074d
lea eax, [ebp - 0x10]
push eax
call fcn.0041fff0
pop ecx
jmp 0x420784
lea eax, [ebp - 0x10]
push eax
call fcn.0042008b
jmp 0x42074a
mov eax, dword [edi]
test eax, eax
je 0x42076f
cmp word [eax], dx
je 0x42076f
lea eax, [ebp - 0x10]
push eax
call fcn.0041ffa5
pop ecx
jmp 0x420782
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x42084d
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00420492
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42084d
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x42084d
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x42084d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4207da
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004177be
test ebx, ebx
je 0x420848
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004177be
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42084d
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42084d
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00425426
add esp, 0x10
xor eax, eax
inc eax
jmp 0x42084f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a600
leave
ret
Function at 0x43215a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x432199
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x432199
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x432199
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x432199
cmp dword [ecx + 0x74], 0xe
jbe 0x432199
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x436890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4368bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4368bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x436c22
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441a18
push 0x441a10
push str.FlsAlloc
push 0x1f
call fcn.00436f05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436c56
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x436c5c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x436ca0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441a28
push 0x441a20
push str.FlsGetValue
push 0x21
call fcn.00436f05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436cd7
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x436cdf
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441a30
push 0x441a28
push str.FlsSetValue
push 0x22
call fcn.00436f05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436d19
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43a26d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43a30a
push ebx
push esi
call fcn.0043a30d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043a171
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43a2b7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43a309
push edi
push eax
call fcn.00438c7b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43a2d7
call fcn.0043813b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43a308
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043a171
add esp, 0x20
test eax, eax
jne 0x43a2f6
push edi
call fcn.0043813b
jmp 0x43a2fe
push ebx
call fcn.0043813b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403e81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x403eec
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff413ed1
cmp ebx, 0x40
jle 0x403e9e
add dh, al
mov edx, dword [ebp - 4]
call 0x14041c9
call int.0040d961
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x403e97
add bl, bl
jle 0x403f25
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac4072bd
add byte [ebp - 4], al
call fcn.00406f61
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x3f3f52
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x403f60
add byte [eax], al
jmp 0x403f32
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.00413fb5
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.00404339
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.004069a1
add byte [ecx], al
loopne 0x403fb1
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x44eb71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x44ebdc
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff45ebc1
cmp ebx, 0x40
jle 0x44eb8e
add dh, al
mov edx, dword [ebp - 4]
call 0x144eeb9
call fcn.00458651
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x44eb87
add bl, bl
jle 0x44ec15
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac451fad
add byte [ebp - 4], al
call fcn.00451c51
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0043ec42
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x44ec50
add byte [eax], al
jmp 0x44ec22
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.0045eca5
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.0044f029
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.00451691
add byte [ecx], al
loopne 0x44eca1
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x499711
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x49977c
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff4a9761
cmp ebx, 0x40
jle 0x49972e
add dh, al
mov edx, dword [ebp - 4]
call 0x1499a59
call int.004a31f1
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x499727
add bl, bl
jle 0x4997b5
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac49cb4d
add byte [ebp - 4], al
call fcn.0049c7f1
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004897e2
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x4997f0
add byte [eax], al
jmp 0x4997c2
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call int.004a9845
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.00499bc9
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.0049c231
add byte [ecx], al
loopne 0x499841
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x4e4371
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x4e43dc
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff4f43c1
cmp ebx, 0x40
jle 0x4e438e
add dh, al
mov edx, dword [ebp - 4]
call 0x14e46b9
call fcn.004ede51
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4e4387
add bl, bl
jle 0x4e4415
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac4e77ad
add byte [ebp - 4], al
call fcn.004e7451
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004d4442
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x4e4450
add byte [eax], al
jmp 0x4e4422
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.004f44a5
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.004e4829
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.004e6e91
add byte [ecx], al
loopne 0x4e44a1
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x52f2e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x52f34c
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff53f331
cmp ebx, 0x40
jle 0x52f2fe
add dh, al
mov edx, dword [ebp - 4]
call 0x152f629
call fcn.00538dc1
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x52f2f7
add bl, bl
jle 0x52f385
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac53271d
add byte [ebp - 4], al
call fcn.005323c1
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0051f3b2
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x52f3c0
add byte [eax], al
jmp 0x52f392
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.0053f415
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.0052f799
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.00531e01
add byte [ecx], al
loopne 0x52f411
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x57a0f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x57a15c
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff58a141
cmp ebx, 0x40
jle 0x57a10e
add dh, al
mov edx, dword [ebp - 4]
call 0x157a439
call fcn.00583bd1
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x57a107
add bl, bl
jle 0x57a195
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac57d52d
add byte [ebp - 4], al
call fcn.0057d1d1
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0056a1c2
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x57a1d0
add byte [eax], al
jmp 0x57a1a2
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.0058a225
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.0057a5a9
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.0057cc11
add byte [ecx], al
loopne 0x57a221
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x5c4cf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x5c4d5c
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff5d4d41
cmp ebx, 0x40
jle 0x5c4d0e
add dh, al
mov edx, dword [ebp - 4]
call 0x15c5039
call fcn.005ce7d1
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x5c4d07
add bl, bl
jle 0x5c4d95
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac5c812d
add byte [ebp - 4], al
call fcn.005c7dd1
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005b4dc2
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x5c4dd0
add byte [eax], al
jmp 0x5c4da2
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.005d4e25
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.005c51a9
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.005c7811
add byte [ecx], al
loopne 0x5c4e21
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x60fb81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dl, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
pop es
add byte [ebx + 0x4a7e40fb], al
sti
inc eax
jle 0x60fbec
lea eax, [ebp]
add ecx, ecx
mov edx, 0x1f000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
mov dh, 0
mov edx, 0x40
call 0xff61fbd1
cmp ebx, 0x40
jle 0x60fb9e
add dh, al
mov edx, dword [ebp - 4]
call 0x160fec9
call fcn.00619661
scasd eax, dword es:[edi]
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x60fb97
add bl, bl
jle 0x60fc25
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0xac612fbd
add byte [ebp - 4], al
call fcn.00612c61
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005ffc52
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
rol dword [eax], cl
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
popal
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4c], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec esp
add cl, ch
ja 0x60fc60
add byte [eax], al
jmp 0x60fc32
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
imul eax, dword [eax], 0xffffffbe
mov edx, edx
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xac
lea eax, [ebp - 4]
call fcn.0061fcb5
mov eax, dword [ebp + 8]
mov edi, dword [ecx]
mov edx, dword [ebp - 4]
call fcn.00610039
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
dec edx
add dl, dl
add al, byte [eax]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x1dd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
xchg esi, eax
add byte [ebp - 4], al
call fcn.006126a1
add byte [ecx], al
loopne 0x60fcb1
in eax, dx
pop ds
add dl, dh
add dh, ch
pop ecx
pop ebp
ret