joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5429e9
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
push 0x6229fc
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x542a20
xor eax, eax
jmp 0x542aa3
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x542a7d
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0xc], 0x400
jb 0x542a72
mov dword [ebp - 0xc], 0x3ff
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
jmp 0x542a94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x542aa3
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x545d14
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x11f0d28
call fcn.005460f9
add esp, 0xc
push 0x40
push 0x5f62ec
push 0x11f0d28
push 0x11f0d28
call fcn.00546016
add esp, 0x10
mov ecx, dword [ebp + 0x14]
and ecx, 0xff
test ecx, ecx
jne 0x545dcb
mov dword [ebp - 4], 0
jmp 0x545d65
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x10
jge 0x545dc9
push 0x20
mov eax, dword [0x622b64]
push eax
push 0x11f0d08
call fcn.005c5f60
add esp, 0xc
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x30
mov edx, dword [ebp + 0x10]
add edx, ecx
push edx
mov eax, dword [0x622b64]
push eax
call fcn.00545f19
add esp, 8
push 0x20
mov ecx, dword [0x622b60]
push ecx
mov edx, dword [0x622b64]
push edx
call fcn.00546068
add esp, 0xc
push 0x20
push 0x11f0d08
mov eax, dword [0x622b60]
push eax
call fcn.005c5f60
add esp, 0xc
jmp 0x545d5c
jmp 0x545e43
mov dword [ebp - 8], 0xf
jmp 0x545ddd
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jl 0x545e43
push 0x20
mov edx, dword [0x622b60]
push edx
push 0x11f0d08
call fcn.005c5f60
add esp, 0xc
mov eax, dword [ebp - 8]
imul eax, eax, 0x30
mov ecx, dword [ebp + 0x10]
add ecx, eax
push ecx
mov edx, dword [0x622b60]
push edx
call fcn.00545f19
add esp, 8
push 0x20
mov eax, dword [0x622b64]
push eax
mov ecx, dword [0x622b60]
push ecx
call fcn.00546068
add esp, 0xc
push 0x20
push 0x11f0d08
mov edx, dword [0x622b64]
push edx
call fcn.005c5f60
add esp, 0xc
jmp 0x545dd4
push 0x40
push 0x5f632c
push 0x11f0d28
push 0x11f0d28
call fcn.00546016
add esp, 0x10
push 0x40
push 0x11f0d28
mov eax, dword [ebp + 8]
push eax
call fcn.0054613d
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x545e73
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0x11f0cc8
call fcn.005460f9
add esp, 0xc
push 0x38
push str.91__
push 0x11f0cc8
push 0x11f0cc8
call fcn.00546016
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x545eb5
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jge 0x545f15
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x5f6424]
push eax
push 0x1c
mov ecx, dword [0x622b68]
push ecx
call fcn.005460aa
add esp, 0xc
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x5f6424]
push eax
push 0x1c
mov ecx, dword [0x622b6c]
push ecx
call fcn.005460aa
add esp, 0xc
push 0x30
push 0x5f63f4
push 0x11f0cc8
mov edx, dword [ebp - 4]
imul edx, edx, 0x30
mov eax, dword [ebp + 8]
add eax, edx
push eax
call fcn.00546016
add esp, 0x10
jmp 0x545eac
mov esp, ebp
pop ebp
ret

Function at 0x545f19
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push 0x30
push 0x5f636c
mov eax, dword [ebp + 8]
push eax
push 0x11f0c98
call fcn.00546016
add esp, 0x10
push 0x30
mov ecx, dword [ebp + 0xc]
push ecx
push 0x11f0c98
call fcn.00546068
add esp, 0xc
push 0x11f0c98
mov edx, dword [ebp + 8]
push edx
call fcn.00545f71
add esp, 8
push 0x20
push 0x5f639c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00546016
add esp, 0x10
pop ebp
ret

Function at 0x548c42
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x5f6638
push 0x40
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.005c5b80
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x44], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], 0x67452301
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], 0x98badcfe
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x58], 0x10325476
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x54941f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0x320
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x258
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x160], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x164], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x168], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x16c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x170], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x174], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x178], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x17c], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x5f663c
mov ecx, dword [ebp - 4]
mov dword [0x277c018], ecx
push 1
push 0
push 0
push 0x622cc0
push 0x622ccc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.0053a4dc
call fcn.0053ff06
call fcn.0053a837
push str.WYD.log
call fcn.00438310
add esp, 4
push str.W.Y.D
mov edx, dword [ebp - 4]
add edx, 0x20
push edx
call fcn.005c5b24
add esp, 8
mov eax, dword [ebp - 4]
mov dword [eax + 0x190], 1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x194], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x54d59f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x214], ecx
cmp dword [0x277c1ac], 0
jne 0x54d75e
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [0x277c1ac], 1
mov dword [0x277c1b4], 0
push 5
mov ecx, dword [0x277c1a8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x277c1a4], 0
je 0x54d75c
mov edx, dword [0x277c1a4]
push edx
call fcn.005d5490
add esp, 4
test eax, eax
je 0x54d613
mov dword [0x277c1ac], 0
jmp 0x54d7a8
push 0x100
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.005c5b80
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.005c5b80
add esp, 0xc
mov edx, dword [0x277c024]
add edx, 0x217a4
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.005c5b24
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
call fcn.005c5a20
add esp, 4
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x208], 0
jmp 0x54d68b
mov edx, dword [ebp - 0x208]
add edx, 1
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x20c]
jge 0x54d6bb
mov ecx, dword [ebp - 0x208]
mov dl, byte [ebp + ecx - 0x104]
sub dl, byte [ebp - 0x208]
mov eax, dword [ebp - 0x208]
mov byte [ebp + eax - 0x104], dl
jmp 0x54d67c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x277c024]
mov eax, dword [edx + 0x2179c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x10a2b38
push str._s_id_sserver_dEmpty_d
lea edx, [ebp - 0x204]
push edx
call fcn.005c5b24
add esp, 0x18
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [0x277c1a4]
push ecx
call fcn.005d5350
add esp, 8
push 0x230
push 0x320
mov edx, dword [0x277c1a4]
push edx
call fcn.005d5440
add esp, 0xc
cmp dword [0x6f0ab0], 0
je 0x54d74c
mov eax, dword [0x6f0ab0]
mov dword [ebp - 0x210], eax
mov ecx, dword [0x9a21cc]
mov edx, dword [ecx]
mov ecx, dword [0x9a21cc]
call dword [edx + 8]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + 0x8be9c], eax
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x54d7a8
mov ecx, dword [ebp - 0x214]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x277c1ac], 0
mov dword [0x277c1b4], 0
push 0
mov eax, dword [0x277c1a8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x277c1a4], 0
je 0x54d7a8
mov ecx, dword [0x277c1a4]
push ecx
call fcn.005d5320
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x54d7ae
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 0x20c], ecx
cmp dword [0x277c1ac], 0
jne 0x54d939
mov dword [0x277c1ac], 1
mov dword [0x277c1b4], 0
push 5
mov eax, dword [0x277c1a8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x277c1a4], 0
je 0x54d937
mov ecx, dword [0x277c1a4]
push ecx
call fcn.005d5490
add esp, 4
test eax, eax
je 0x54d81b
mov dword [0x277c1ac], 0
jmp 0x54d98d
push 0x100
push 0
lea edx, [ebp - 0x200]
push edx
call fcn.005c5b80
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x100]
push eax
call fcn.005c5b80
add esp, 0xc
mov ecx, dword [0x277c024]
add ecx, 0x217a4
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.005c5b24
add esp, 8
lea eax, [ebp - 0x100]
push eax
call fcn.005c5a20
add esp, 4
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], 0
jmp 0x54d893
mov ecx, dword [ebp - 0x204]
add ecx, 1
mov dword [ebp - 0x204], ecx
mov edx, dword [ebp - 0x204]
cmp edx, dword [ebp - 0x208]
jge 0x54d8c3
mov eax, dword [ebp - 0x204]
mov cl, byte [ebp + eax - 0x100]
sub cl, byte [ebp - 0x204]
mov edx, dword [ebp - 0x204]
mov byte [ebp + edx - 0x100], cl
jmp 0x54d884
mov eax, dword [0x277c024]
mov ecx, dword [eax + 0x2179c]
push ecx
lea edx, [ebp - 0x100]
push edx
push 0x10a4f38
push str._s_id_sserver_d
lea eax, [ebp - 0x200]
push eax
call fcn.005c5b24
add esp, 0x14
lea ecx, [ebp - 0x200]
push ecx
mov edx, dword [0x277c1a4]
push edx
call fcn.005d5350
add esp, 8
push 0x230
push 0x320
mov eax, dword [0x277c1a4]
push eax
call fcn.005d5440
add esp, 0xc
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x277c1b0], 1
jmp 0x54d98d
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x277c1ac], 0
mov dword [0x277c1b4], 0
push 0
mov edx, dword [0x277c1a8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x277c1a4], 0
je 0x54d983
mov eax, dword [0x277c1a4]
push eax
call fcn.005d5320
add esp, 4
mov dword [0x277c1b0], 0
mov esp, ebp
pop ebp
ret
Function at 0x54dfa9
Capabilities:
Accept command line arguments
Create process on windows
Get keyboard layout
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push edi
push 1
push 0
push 0
push str.Change.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 0x50c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x50b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x50c]
push ecx
call fcn.005c5b24
add esp, 8
push 0
lea edx, [ebp - 0x50c]
push edx
nop
nop
nop
nop
nop
add esp, 8
push str.With_Your_Destiny
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x54e020
xor eax, eax
jmp 0x54e1f3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
call fcn.00424395
and eax, 0xff
test eax, eax
je 0x54e04b
push 0x62316c
push 0x623140
call fcn.005c5b24
add esp, 8
jmp 0x54e05d
push 0x623170
push 0x623140
call fcn.005c5b24
add esp, 8
push 0
push 1
push 0
call fcn.004ba5ac
add esp, 0xc
push 0x1a0
call fcn.005c5dd3
add esp, 4
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0
je 0x54e09a
mov ecx, dword [ebp - 0x518]
call fcn.0054941f
mov dword [ebp - 0x524], eax
jmp 0x54e0a4
mov dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x10c], 1
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x54e0ff
push 1
call fcn.005c9354
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jge 0x54e112
push 1
call fcn.005c9354
push 0x623174
mov eax, dword [ebp + 0x10]
push eax
call fcn.005c5aa0
add esp, 8
test eax, eax
jne 0x54e131
mov dword [ebp - 0x10c], 0
push 0x623178
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005c5aa0
add esp, 8
test eax, eax
jne 0x54e150
mov dword [ebp - 0x10c], 1
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x108]
call dword [edx + 4]
test eax, eax
jne 0x54e174
xor eax, eax
jmp 0x54e1f3
mov eax, dword [ebp + 8]
push eax
call fcn.0042448f
add esp, 4
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x108]
call dword [edx + 0xc]
mov dword [ebp - 0x510], eax
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0x51c], ecx
cmp dword [ebp - 0x51c], 0
je 0x54e1de
push 1
mov edx, dword [ebp - 0x51c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x51c]
call dword [eax]
mov dword [ebp - 0x528], eax
jmp 0x54e1e8
mov dword [ebp - 0x528], 0
call fcn.004ba71e
mov eax, dword [ebp - 0x510]
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x58d92f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x58da50
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x58da34
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x58d986
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x58d964
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x58dd1c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x58de63
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x58de3e
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x58dd85
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x58dd5c
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x58df90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
mov edx, dword [esi + 0x20]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x58e0d6
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x58e0b1
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x58dff9
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x58dfd0
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x58e0df
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x58e229
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x58e204
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x58e148
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x58e11f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x58e232
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x20]
mov eax, dword [edx + 0x20]
push esi
mov esi, dword [edx + 0x1064]
push edi
mov edi, dword [edx + 0x1058]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x58e368
push ebx
mov edx, dword [edx + 0x1060]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x58e343
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x58e291
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1058]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1058]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x58e26d
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret