joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487254
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x487240
sub esp, 0x324
mov eax, dword [0x93e25c]
push ebx
mov dword [esp + 0x324], eax
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x9749e0]
mov edx, dword [esi + 0x4c]
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, 0x2fe
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [edx]
mov edx, dword [esp + 0x334]
mov eax, dword [ecx]
push edx
mov dword [esp + 0x24], esi
call dword [eax + 0x3c]
mov ecx, dword [esi + 0x4c]
mov ebp, eax
mov eax, dword [ecx]
mov al, byte [eax + 0x33]
cmp al, bl
mov dword [esp + 0x24], ebp
mov byte [esi + 0x33], al
je 0x4872dc
cmp dword [esp + 0x18], ebx
je 0x4872c2
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.005d8be0
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x320]
call fcn.006cedd0
add esp, 0x324
ret 4
cmp dword [esi + 0x5c], 2
push edi
lea edi, [esi + 0x8c]
jne 0x487318
mov ecx, dword [ecx + 4]
mov edx, dword [ecx]
lea eax, [esp + 0x10]
push eax
call dword [edx + 0x3c]
mov ecx, dword [esi + 0x4c]
mov edx, dword [ecx + 4]
mov edi, eax
mov al, byte [edx + 0x33]
cmp al, bl
mov byte [esi + 0x33], al
je 0x487318
lea ecx, [esp + 0x10]
call fcn.00409de5
xor eax, eax
jmp 0x4873c2
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x4873a5
mov ecx, dword [ebp + 4]
cmp eax, ecx
ja 0x4873a5
cmp eax, 1
mov edx, dword [ebp]
lea ebx, [ecx + edx]
jne 0x48734b
cmp edx, ebx
mov eax, dword [edi]
mov al, byte [eax]
je 0x487375
lea ecx, [ecx]
cmp byte [edx], al
jne 0x487375
inc edx
cmp edx, ebx
jne 0x487340
jmp 0x487375
mov ecx, dword [edi]
sub ebx, eax
cmp edx, ebx
mov dword [esp + 0x2c], ecx
ja 0x487373
mov edi, dword [esp + 0x2c]
mov ecx, eax
mov esi, edx
xor ebp, ebp
repe cmpsb byte [esi], byte es:[edi]
jne 0x48736b
add edx, eax
cmp edx, ebx
jbe 0x487357
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add ebx, eax
mov eax, dword [ebp]
cmp edx, eax
jne 0x487387
lea ecx, [esp + 0x10]
call fcn.00409de5
jmp 0x4873c0
sub ebx, edx
push ebx
sub edx, eax
push edx
add esi, 0x78
push ebp
mov ecx, esi
call fcn.004014bf
lea ecx, [esp + 0x10]
call fcn.00409de5
mov eax, esi
jmp 0x4873c2
cmp dword [esp + 0x1c], ebx
je 0x4873c0
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.005d8be0
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x330]
pop edi
pop esi
pop ebp
pop ebx
call fcn.006cedd0
add esp, 0x324
ret 4
Function at 0x49dcb0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x93e25c]
mov dword [esp + 0x10c], eax
mov eax, dword [0x972d70]
test eax, eax
mov dword [esp], 0
jne 0x49dd62
lea eax, [esp]
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplicationMySQL
push reloc.WSOCK32.dll_bind
mov dword [0x972d70], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x104
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49dd10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.EventMessageFile
push eax
call esi
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.TypesSupported
push edx
mov dword [esp + 0x20], 7
call esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x10c]
call fcn.006cedd0
add esp, 0x110
ret

Function at 0x49ee60
Capabilities:
Access the windows event log

Disassembly:
push ecx
add eax, 0xfffffffb
cmp ecx, eax
mov dword [esp], edx
jae 0x49ee6d
mov eax, ecx
push esi
add eax, edx
push str._r_n_r_n
push eax
call fcn.0062b5e0
add esp, 8
call fcn.0049dcb0
push str.MySQL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x49ef1b
mov eax, dword [esp + 0xc]
sub eax, 0
je 0x49eef7
dec eax
je 0x49eed0
dec eax
jne 0x49ef14
push 0
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0xc0000064
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
pop ecx
ret
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0xc0000064
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
pop ecx
ret
push 0
lea edx, [esp + 8]
push edx
push 0
push 1
push 0
push 0xc0000064
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
pop ecx
ret
Function at 0x4b1830
Capabilities:
Terminate process

Disassembly:
sub esp, 0x204
mov eax, dword [0x93e25c]
push 0
push 0x974350
push 0x974350
mov dword [esp + 0x20c], eax
call fcn.005e2220
push 0
push 0x974350
push 0x974350
call fcn.005e9dd0
push 0x974350
call fcn.0062b6a0
mov cl, byte [eax - 1]
add esp, 0x1c
cmp cl, 0x5c
je 0x4b1880
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push esi
push 0
push 0x974718
push 0x974718
call fcn.005e2220
push 0
push 0x973f60
push 0x973f60
call fcn.005e2220
push 0x73a01c
push 0x974350
push 0x974350
call fcn.005e9c70
push 0x974350
push 0x974718
push 0x974718
call fcn.005e9c70
push 0x974718
push 0x9736f8
push 0x9736f8
call fcn.005e9c70
mov eax, str.share
call fcn.004b1720
mov esi, eax
push esi
call fcn.005e9b30
add esp, 0x40
test eax, eax
je 0x4b190d
push 0x1ff
lea eax, [esp + 8]
push esi
push eax
call fcn.0062b670
add esp, 0xc
jmp 0x4b1927
push 0
push esi
push 0x974350
lea ecx, [esp + 0x10]
push 0x1ff
push ecx
call fcn.0062b600
add esp, 0x14
lea edx, [esp + 4]
push 0
push edx
mov eax, edx
push eax
call fcn.005e2220
lea ecx, [esp + 0x10]
push ecx
push 0x973f60
push 0x973f60
call fcn.005e9c70
mov eax, dword [0x976ba4]
mov esi, 0x9734d8
add esp, 0x18
cmp eax, esi
je 0x4b1975
push 0
push str.charsets_
lea edx, [esp + 0xc]
push edx
push 0x1ff
push esi
call fcn.0062b600
add esp, 0x14
lea eax, [esp + 4]
push eax
push esi
push esi
call fcn.005e9c70
push 0
push esi
push esi
call fcn.005e2220
mov ecx, dword [0x973058]
push ecx
push 0x974640
mov dword [0x976ba4], esi
call fcn.005def00
add esp, 0x20
test al, al
pop esi
je 0x4b19b0
push 1
call fcn.006cf0c8
mov eax, dword [0x975c08]
test eax, eax
jne 0x4b19e1
push 8
push 0x974640
call fcn.005df040
add esp, 4
push eax
call fcn.005d8c40
add esp, 8
test eax, eax
mov dword [0x975c08], eax
jne 0x4b19e1
push 1
call fcn.006cf0c8
mov eax, dword [0x974bb8]
test eax, eax
je 0x4b1a16
push 0
push eax
lea edx, [esp + 8]
push edx
call fcn.005e2220
mov eax, dword [0x974bb8]
push eax
call fcn.005d8be0
lea ecx, [esp + 0x10]
push 8
push ecx
call fcn.005d8c40
add esp, 0x18
mov dword [0x974bb8], eax
mov ecx, dword [esp + 0x200]
call fcn.006cedd0
add esp, 0x204
ret

Function at 0x4b1d30
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [0x93e25c]
push esi
push 0x10
push 0x201
push 0x1b4
push 0x9736f8
mov dword [esp + 0x2c], eax
call fcn.005ded30
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x4b1dac
lea eax, [esp + 4]
push 0xa
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
call fcn.0062f2c0
lea ecx, [esp + 0x10]
mov byte [eax], 0xa
sub eax, ecx
push 0x14
inc eax
push eax
mov edx, ecx
push edx
push esi
call fcn.005debc0
add esp, 0x1c
test eax, eax
push 0
push esi
jne 0x4b1da4
call fcn.005dc1d0
mov ecx, dword [esp + 0x24]
add esp, 8
pop esi
call fcn.006cedd0
add esp, 0x1c
ret
call fcn.005dc1d0
add esp, 8
push str.Cant_start_server:_cant_create_PID_file
call fcn.00408486
add esp, 4
push 1
call fcn.006cf0c8
int3
Function at 0x4b40e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x974a68]
push 0x10
push 0x20
push eax
call fcn.005db4e0
add esp, 0xc
test eax, eax
mov dword [0x8410fc], eax
jne 0x4b4102
push 1
call fcn.006cf0c8
mov ecx, dword [0x973f18]
test ecx, ecx
jne 0x4b4115
mov ecx, dword [eax + 0x14]
mov dword [0x973f18], ecx
call fcn.004b16b0
mov edx, dword [0x976bd8]
push str.MySQL_Community_Edition__GPL_
push str.ia32
push str.Win32
push 0x973f20
push edx
push str._s__Ver__s_for__s_on__s___s__n
call fcn.006d1d9e
push str.Copyright__C__2000_MySQL_AB__by_Monty_and_others_nThis_software_comes_with_ABSOLUTELY_NO_WARRANTY._This_is_free_software__nand_you_are_welcome_to_modify_and_redistribute_it_under_the_GPL_license_n_nStarts_the_MySQL_database_server_n
call fcn.006d1e04
mov eax, dword [0x976bd8]
push eax
push str.Usage:__s__OPTIONS__n
call fcn.006d1d9e
mov al, byte [0x974b89]
add esp, 0x24
test al, al
jne 0x4b4173
push str._nFor_more_help_options__several_pages___use_mysqld___verbose___help_n
call fcn.006d1e04
add esp, 4
ret
push str.NT_and_Win32_specific_options:_n____install_____________________Install_the_default_service__NT__n____install_manual______________Install_the_default_service_started_manually__NT__n____install_service_name________Install_an_optional_service__NT__n____install_manual_service_name_Install_an_optional_service_started_manually__NT__n____remove______________________Remove_the_default_service_from_the_service_list__NT__n____remove_service_name_________Remove_the_service_name_from_the_service_list__NT__n____enable_named_pipe___________Only_to_be_used_for_the_tdefault_server__NT__n____standalone__________________Dummy_option_to_start_as_a_standalone_server__NT_
call fcn.006d1e04
push 0x73a01c
call fcn.006d1e04
push 0x81f954
push 0x73a4c0
call fcn.005da0a0
push 0x73a01c
call fcn.006d1e04
call fcn.004b1830
call fcn.004b0ae0
push 0x81f968
call fcn.005ea510
push 0x81f968
call fcn.005ea750
push str._nTo_see_what_values_a_running_MySQL_server_is_using__type_nmysqladmin_variables_instead_of_mysqld___verbose___help._n
call fcn.006d1e04
add esp, 0x20
ret
Function at 0x4b5c20
Capabilities:
Terminate process

Disassembly:
push 0x4b15f0
call fcn.005ea150
push 0xe
push str.______:__
push 0x974938
call fcn.0062b670
push 0x4b4940
push 0x81f968
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [0x841328], 0x4b1690
call fcn.005eab30
add esp, 0x20
test eax, eax
je 0x4b5c6b
push eax
call fcn.006cf0c8
mov al, byte [0x974a48]
test al, al
je 0x4b5c81
push str.this_binary_does_not_contain_NDBCLUSTER_storage_engine
call fcn.00409269
add esp, 4
mov al, byte [0x973b58]
test al, al
je 0x4b5c97
push str.this_binary_does_not_contain_ISAM_storage_engine
call fcn.00409269
add esp, 4
mov al, byte [0x974a30]
test al, al
je 0x4b5cad
push str.this_binary_does_not_contain_BDB_storage_engine
call fcn.00409269
add esp, 4
mov al, byte [0x974bbc]
test al, al
jne 0x4b5cbf
mov al, byte [0x974b98]
test al, al
je 0x4b5cd5
mov eax, dword [0x974948]
test eax, eax
jne 0x4b5cd5
push str.options___log_slow_admin_statements_and___log_queries_not_using_indexes_have_no_effect_if___log_slow_queries_is_not_set
call fcn.00409269
add esp, 4
mov eax, dword [esp + 4]
test eax, eax
jle 0x4b5d04
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [0x976bd8]
push eax
push ecx
push str._s:_Too_many_arguments__first_extra_is__s_._nUse___help_to_get_a_list_of_available_options_n
push 0x93e408
call fcn.006cf108
add esp, 0x10
push 1
call fcn.006cf0c8
mov al, byte [0x974b88]
test al, al
je 0x4b5d19
call fcn.004b40e0
push 0
call fcn.006cf0c8
mov al, byte [0x977879]
test al, al
jne 0x4b5d33
mov byte [0x977877], 1
mov dword [0x973298], 2
mov al, byte [0x974b90]
test al, al
je 0x4b5d54
mov edx, dword [0x973ee4]
and edx, 0xfffffeff
or edx, 0x600
mov dword [0x973ee4], edx
push 2
push 0
call fcn.00409a0c
call fcn.004b1830
mov al, byte [0x974b91]
mov ecx, dword [0x9730d0]
mov edx, dword [0x9730d4]
test al, al
sete al
mov byte [0x976572], al
mov byte [0x977874], al
mov eax, dword [0x973158]
mov dword [0x8411a8], eax
mov eax, dword [0x9730ac]
push eax
mov dword [0x840f28], ecx
mov dword [0x840f2c], edx
call fcn.005e20c0
mov ecx, eax
mov al, byte [0x974b93]
mov edx, 1
shl edx, cl
add esp, 0xc
test al, al
mov dword [0x840f1c], edx
je 0x4b5dc8
or dword [0x974b00], 0x400
mov al, byte [0x974b98]
test al, al
je 0x4b5ddb
or dword [0x974b00], 0x1000
push edi
push 0x9731d0
xor edi, edi
call fcn.004b0e40
add esp, 4
test eax, eax
jne 0x4b5e1b
push 0x9731d8
mov edi, 2
call fcn.004b0e40
add esp, 4
test eax, eax
jne 0x4b5e1b
push 0x9731d4
mov edi, 1
call fcn.004b0e40
add esp, 4
test eax, eax
je 0x4b5e22
push 1
call fcn.006cf0c8
pop edi
ret
Function at 0x4b7590
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push eax
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esi + 1]
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call sub.WSOCK32.dll_select
test eax, eax
jge 0x4b75d5
xor eax, eax
add esp, 0x10c
ret
je 0x4b75f2
lea eax, [esp + 8]
push eax
push esi
call sub.WSOCK32.dll___WSAFDIsSet
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 0x10c
ret
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 0x10c
ret
Function at 0x4d64a8
Capabilities:
Terminate process

Disassembly:
jmp 0x4d64a0
push ecx
push 0
push 0x7d0
push 0
push 0x975bd8
call fcn.005e87a0
add esp, 0x10
test al, al
je 0x4d64d4
push str.Badly_out_of_memory__please_check_your_system_status_n
push 0x93e408
call fcn.006cf108
add esp, 8
push 1
call fcn.006cf0c8
mov ecx, dword [0x9749e0]
push ebx
push esi
mov esi, dword [esp + 0x10]
mov dword [0x975bfc], 1
mov eax, dword [ecx + 0x20]
push edi
movzx edi, byte [esi]
mov bl, byte [edi + eax + 1]
mov dl, 8
test dl, bl
je 0x4d650d
jmp 0x4d6500
movzx edi, byte [esi + 1]
mov bl, byte [edi + eax + 1]
inc esi
test dl, bl
jne 0x4d6500
mov eax, dword [ecx + 0x68]
push 0
mov ebx, 4
push ebx
push 0x76c4e0
push ebx
push esi
push ecx
call dword [eax + 4]
add esp, 0x18
test eax, eax
jne 0x4d653c
push 0x975bd8
call fcn.005e8a50
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
cmp byte [esi], 0
je 0x4d65a6
lea ecx, [esp + 0xc]
push ecx
push bind
push 0
push 0xa
push esi
call fcn.00632640
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4d65a6
mov eax, dword [esp + 0xc]
cmp eax, 0x7d0
jge 0x4d6577
push eax
push 0x975bd8
call fcn.005e8840
add esp, 8
mov edx, dword [0x9749e0]
mov ecx, dword [edx + 0x20]
mov al, byte [esi]
movzx edx, al
test byte [edx + ecx + 1], bl
jne 0x4d65a1
jmp 0x4d6590
test al, al
je 0x4d65a6
mov al, byte [esi + 1]
inc esi
movzx edx, al
test byte [edx + ecx + 1], bl
je 0x4d6590
cmp byte [esi], 0
jne 0x4d6541
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x5150d7
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5150d0
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x515120
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.004054fc
fmul qword [0x73b9d0]
add esp, 4
call fcn.006cfba0
xor dword [esi + 0x230], eax
movzx eax, byte [edi]
mov cl, byte [esi + eax + 0x130]
xor cl, byte [esi + 0x230]
mov byte [edi], cl
mov ecx, dword [esi + 0x230]
xor ecx, eax
inc edi
dec ebx
mov dword [esi + 0x230], ecx
jne 0x5150e1
pop edi
pop esi
pop ebx
ret 8

Function at 0x515147
Capabilities:
Encode data using xor

Disassembly:
jmp 0x515140
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
mov esi, ecx
jbe 0x515196
push edi
mov edi, dword [esp + 0x10]
push esi
call fcn.004054fc
fmul qword [0x73b9d0]
add esp, 4
call fcn.006cfba0
mov ecx, dword [esi + 0x230]
xor ecx, eax
mov dword [esi + 0x230], ecx
mov eax, ecx
movzx ecx, byte [edi]
xor ecx, eax
mov al, byte [ecx + esi + 0x30]
mov byte [edi], al
movzx edx, al
mov eax, dword [esi + 0x230]
xor eax, edx
inc edi
dec ebx
mov dword [esi + 0x230], eax
jne 0x515151
pop edi
pop esi
pop ebx
ret 8
Function at 0x578410
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ecx
call ebx
mov dword [esi + 0x18], eax
test eax, eax
mov eax, dword [esi]
je 0x578502
push ebp
push eax
push edi
call fcn.0062b5e0
mov ebp, eax
mov eax, dword [esi + 0xc]
add esp, 8
cmp eax, 2
jne 0x57847f
push str._clear
push ebp
call fcn.0062b5e0
mov eax, dword [esi + 0x14]
add esp, 8
push edi
push eax
call ebx
test eax, eax
mov dword [esi + 0x24], eax
jne 0x578463
pop ebp
mov eax, edi
pop ebx
ret
push str._add
push ebp
call fcn.0062b5e0
mov eax, dword [esi + 0x14]
add esp, 8
push edi
push eax
call ebx
test eax, eax
mov dword [esi + 0x28], eax
je 0x57845e
push str._deinit
push ebp
call fcn.0062b5e0
mov eax, dword [esi + 0x14]
add esp, 8
push edi
push eax
call ebx
push str._init
push ebp
mov dword [esi + 0x20], eax
call fcn.0062b5e0
mov eax, dword [esi + 0x14]
add esp, 8
push edi
push eax
call ebx
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x5784ff
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x5784ff
cmp dword [esi + 0xc], 2
je 0x5784ff
mov al, byte [0x97327c]
test al, al
je 0x57845e
mov ecx, dword [0x9798bc]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx + 0x47c]
test eax, eax
je 0x5784ff
mov edx, dword [0x974690]
mov eax, dword [edx + 0x1fc]
push edi
push eax
call fcn.00409269
add esp, 8
xor eax, eax
pop ebp
pop ebx
ret
Function at 0x5a9940
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [ecx + 0x10]
mov ecx, dword [ecx + 4]
lea ecx, [ecx + ecx*2]
lea ecx, [ebx + ecx*8]
cmp ebx, ecx
push ebp
mov eax, 1
mov ebp, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ecx
jae 0x5a9abb
push esi
push edi
jmp 0x5a9980
mov ebp, dword [esp + 0x14]
nop
mov edi, dword [esp + 0x24]
movzx edx, word [ebx + 0x10]
mov cl, byte [ebx + 0x14]
mov esi, edi
add edi, edx
test cl, cl
mov dword [esp + 0x24], edi
je 0x5a99c5
mov cl, byte [esi]
inc edi
test cl, cl
mov dword [esp + 0x24], edi
je 0x5a99c4
lea edx, [eax + eax]
or edx, 1
xor eax, edx
mov dword [esp + 0x10], eax
cmp byte [ebx + 0x12], 0xf
jne 0x5a9aa6
add edi, 2
mov dword [esp + 0x24], edi
jmp 0x5a9aa6
inc esi
mov cl, byte [ebx + 0x12]
cmp cl, 1
jne 0x5a9a18
mov edi, dword [ebx]
mov ecx, dword [edi + 0x58]
cmp ecx, 1
mov ebp, edx
jbe 0x5a99f9
xor edx, edx
mov eax, ebp
div ecx
mov ebx, dword [edi + 0x64]
push eax
lea eax, [esi + ebp]
push eax
push esi
push edi
call dword [ebx + 0x10]
add esp, 0x10
cmp ebp, eax
jbe 0x5a99f5
mov ebp, eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [edi + 0x68]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push edi
call dword [ecx + 0x24]
mov eax, dword [esp + 0x24]
add esp, 0x14
jmp 0x5a9aa6
cmp cl, 0xf
jne 0x5a9a78
mov edi, dword [ebx]
mov ecx, dword [edi + 0x58]
cmp ecx, 1
movzx ebp, word [esi]
jbe 0x5a9a4e
mov eax, edx
xor edx, edx
div ecx
mov ebx, dword [edi + 0x64]
lea ecx, [esi + ebp + 2]
lea edx, [esi + 2]
push eax
push ecx
push edx
push edi
call dword [ebx + 0x10]
add esp, 0x10
cmp ebp, eax
jbe 0x5a9a4a
mov ebp, eax
mov ebx, dword [esp + 0x20]
mov eax, dword [edi + 0x68]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
add esi, 2
push esi
push edi
call dword [eax + 0x24]
mov eax, dword [esp + 0x38]
add esp, 0x14
add eax, 2
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
jmp 0x5a9aa6
cmp esi, edi
jae 0x5a9aa6
lea esp, [esp]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0x3f
add ecx, ebp
imul ecx, edx
mov edx, eax
shl edx, 8
add ecx, edx
xor eax, ecx
add ebp, 3
inc esi
cmp esi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebp
jb 0x5a9a80
mov ecx, dword [esp + 0x18]
add ebx, 0x18
cmp ebx, ecx
mov dword [esp + 0x20], ebx
jb 0x5a997b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x5a9ad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x18]
push edi
mov edi, dword [ecx + 0x10]
mov ecx, dword [ecx + 4]
lea ecx, [ecx + ecx*2]
lea ecx, [edi + ecx*8]
cmp edi, ecx
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp + 8], 4
mov dword [esp + 0x14], ecx
jae 0x5a9c52
push ebx
push ebp
push esi
mov esi, dword [edi + 4]
mov ebx, dword [esp + 0x2c]
movzx edx, word [edi + 0x10]
mov cl, byte [edi + 0x14]
add esi, ebx
test cl, cl
lea ebp, [edx + esi]
mov dword [esp + 0x28], ebp
je 0x5a9b3c
mov ebp, dword [edi + 8]
test byte [ebx + ebp], cl
je 0x5a9b38
lea edx, [eax + eax]
or edx, 1
xor eax, edx
mov dword [esp + 0x10], eax
jmp 0x5a9c40
mov ebp, dword [esp + 0x28]
mov cl, byte [edi + 0x12]
cmp cl, 1
jne 0x5a9b9c
mov ebx, dword [edi]
mov ebp, dword [ebx + 0x58]
cmp ebp, 1
mov dword [esp + 0x28], ebx
mov ecx, edx
jbe 0x5a9b7d
mov eax, dword [ebx + 0x64]
mov dword [esp + 0x18], eax
mov eax, ecx
xor edx, edx
div ebp
add ecx, esi
push eax
mov eax, dword [esp + 0x1c]
push ecx
push esi
push ebx
call dword [eax + 0x10]
mov ecx, eax
movzx eax, word [edi + 0x10]
add esp, 0x10
cmp ecx, eax
jbe 0x5a9b7d
mov ecx, eax
mov eax, dword [ebx + 0x68]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
push edx
push ecx
push esi
push ebx
call dword [eax + 0x24]
mov eax, dword [esp + 0x24]
add esp, 0x14
jmp 0x5a9c40
cmp cl, 0xf
jne 0x5a9c12
movzx eax, byte [edi + 0x15]
cmp eax, 1
mov ebx, dword [edi]
mov dword [esp + 0x18], eax
jne 0x5a9bb5
movzx ebp, byte [esi]
jmp 0x5a9bb8
movzx ebp, word [esi]
mov ecx, dword [ebx + 0x58]
cmp ecx, 1
mov dword [esp + 0x28], ebp
jbe 0x5a9bf4
mov eax, dword [ebx + 0x64]
mov dword [esp + 0x1c], eax
mov eax, edx
xor edx, edx
div ecx
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [eax + ebp]
add ecx, esi
push ecx
add eax, esi
push eax
mov eax, dword [esp + 0x28]
push ebx
call dword [eax + 0x10]
add esp, 0x10
cmp ebp, eax
jbe 0x5a9bf0
mov ebp, eax
mov eax, dword [esp + 0x18]
mov edx, dword [ebx + 0x68]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push ebp
add eax, esi
push eax
push ebx
call dword [edx + 0x24]
mov eax, dword [esp + 0x24]
add esp, 0x14
jmp 0x5a9c40
cmp esi, ebp
jae 0x5a9c40
movzx ebx, byte [esi]
mov ecx, dword [esp + 0x14]
mov edx, eax
and edx, 0x3f
add edx, ecx
imul edx, ebx
mov ebx, eax
shl ebx, 8
add edx, ebx
xor eax, edx
add ecx, 3
inc esi
cmp esi, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jb 0x5a9c16
mov ecx, dword [esp + 0x20]
add edi, 0x18
cmp edi, ecx
jb 0x5a9b04
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14
ret