joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e1f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6ad7c3
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x64], 1
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x5e20be
movdqu xmm1, xmmword [eax + 4]
movd esi, xmm1
movdqu xmmword [esp + 0x34], xmm1
mov eax, dword [eax + 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x44], eax
test esi, esi
jle 0x5e20be
movdqa xmm0, xmm1
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x5e20be
mov dword [esp + 0x58], eax
xor ebx, ebx
mov eax, dword [esp + 0x70]
xor edi, edi
movdqu xmmword [esp + 0x48], xmm1
test eax, eax
je 0x5e2015
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [eax]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], ecx
movdqu xmm0, xmmword [esp + 0x20]
movdqu xmmword [esp + 0x20], xmm0
cmp ebx, ecx
jge 0x5e20be
mov edi, dword [eax + 4]
mov ebp, dword [eax + 0xc]
cmp edi, ebp
jge 0x5e20be
push eax
lea ecx, [esp + 0x24]
call fcn.0058f6d0
test al, al
je 0x5e20be
mov eax, dword [esp + 0x18]
sub ebp, edi
sub eax, ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
movdqu xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x58], eax
movdqu xmmword [esp + 0x48], xmm0
mov eax, dword [esp + 0x3c]
movzx eax, byte [eax + 0x6d1fb4]
imul eax, esi
mov esi, dword [esp + 0x74]
mov ecx, esi
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00571a00
test al, al
je 0x5e20be
cmp dword [esi + 0x18], 0
jle 0x5e20af
cmp dword [esi + 0x1c], 0
jle 0x5e20af
push 0x6c
call fcn.00547bd8
add esp, 4
mov dword [esp + 0x1c], eax
mov byte [esp + 0x64], 2
test eax, eax
je 0x5e2081
push dword [esp + 0x78]
mov ecx, dword [esp + 0x70]
push dword [esi + 0x2c]
mov dword [esp + 0x74], 0
push ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.005e1cc0
jmp 0x5e2083
xor eax, eax
mov byte [esp + 0x64], 1
mov dword [esp + 0x14], eax
mov byte [esp + 0x64], 4
mov ecx, esi
push edi
push ebx
push dword [esp + 0x1c]
call fcn.00571af0
mov bl, 1
mov byte [esp + 0x64], bl
lea ecx, [esp + 0x14]
call fcn.005e1d70
jmp 0x5e20c0
push 0
push 0
mov ecx, esi
call fcn.005720a0
mov bl, al
jmp 0x5e20c0
xor bl, bl
mov dword [esp + 0x64], 0xffffffff
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x5e20d6
mov edx, dword [ecx]
push 1
call dword [edx]
mov al, bl
mov dword [esp + 0x6c], 0
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x5e2db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6ada38
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [str.skiapict]
lea ecx, [esp + 0x30]
mov edi, dword [esp + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x6d201c]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], 0x2b
call dword [eax + 0xc]
mov ecx, esi
movdqu xmm0, xmmword [eax]
mov dword [esp + 0x2c], 3
movdqu xmmword [esp + 0x1c], xmm0
call fcn.005e2c60
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x4c], 1
lea eax, [esp + 0x10]
push 8
push eax
mov ecx, edi
call fcn.005943f0
push dword [esp + 0x18]
mov ecx, edi
call fcn.00594960
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.00594800
push dword [esp + 0x2c]
mov ecx, edi
call fcn.00594960
mov ecx, edi
test esi, esi
je 0x5e2e7a
push 1
call fcn.005943c0
push edi
mov ecx, esi
call fcn.00619180
jmp 0x5e2e81
push 0
call fcn.005943c0
mov dword [esp + 0x4c], 0xffffffff
test esi, esi
je 0x5e2e95
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005472b9
add esp, 0x44
ret 4
Function at 0x5e2f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6ada7b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
mov dword [edi + 4], 0
mov dword [edi], 8
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [esp + 0x30], 0
mov dword [edi + 0x14], 1
mov dword [edi + 0x18], 0
mov byte [esp + 0x30], 1
mov esi, dword [0x74c9e0]
mov ebp, 1
cmp esi, 2
jae 0x5e302b
test esi, esi
jne 0x5e3012
mov ecx, ebp
mov edx, 0x74c9e0
xor eax, eax
lock cmpxchg dword [edx], ecx
mov esi, eax
test esi, esi
jne 0x5e3012
lea ecx, [esp + 0x17]
call fcn.005e3380
mov esi, eax
mov dword [0x74c9e0], esi
cmp esi, 1
jne 0x5e302b
jmp 0x5e3020
mov esi, dword [0x74c9e0]
cmp esi, 1
je 0x5e3020
lea ebx, [esi + 0xc]
or eax, 0xffffffff
mov dword [esp + 0x24], ebx
lock xadd dword [ebx], eax
test eax, eax
jg 0x5e3044
mov ecx, ebx
call fcn.005a8b40
mov byte [esp + 0x30], 2
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esi + 4]
jle 0x5e3081
lea ecx, [eax + 4]
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, ecx
mov dword [esi + 4], eax
shl eax, 2
push eax
push dword [esi]
call fcn.00570270
mov dword [esi], eax
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [esi]
mov dword [eax + ecx*4], edi
mov byte [esp + 0x30], 1
test ebx, ebx
je 0x5e30a7
lock xadd dword [ebx], ebp
test ebp, ebp
jns 0x5e30a7
push 1
mov ecx, ebx
call fcn.005a8af0
mov dword [esp + 0x30], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x5e54b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6abb18
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0
call fcn.00589920
mov dword [esp + 0x14], 0
mov edx, 1
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x30], eax
mov dword [esi], vtable.SkFilterShader.0
lea ecx, [eax + 4]
mov eax, edx
lock xadd dword [ecx], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x34], eax
add eax, 4
lock xadd dword [eax], edx
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x5e6a80
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x6adfab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], ebx
mov dword [ebx], vtable.SkBlitter.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x24]
mov dword [ebx], vtable.SkRasterBlitter.0
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebx + 0xc], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [ebx + 0x1c], xmm0
mov dword [esp + 0x1c], 2
mov eax, dword [esp + 0x28]
mov dword [ebx], vtable.SkARGB32_Blitter.0
mov eax, dword [eax + 0x34]
mov edi, eax
shr edi, 0x18
mov esi, eax
shr esi, 0x10
mov ecx, eax
and esi, 0xff
shr ecx, 8
mov dword [ebx + 0x34], edi
and ecx, 0xff
lea edx, [edi + 1]
mov dword [ebx + 0x2c], eax
imul esi, edx
shl edi, 8
imul ecx, edx
movzx eax, al
imul eax, edx
shr esi, 8
or edi, esi
mov dword [ebx + 0x38], esi
shr ecx, 8
shl edi, 8
or edi, ecx
shr eax, 8
shl edi, 8
or edi, eax
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x30], edi
mov dword [esp + 0x1c], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x5e6b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6adfd8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
push ebp
push edi
push esi
call fcn.005c07b0
mov dword [esp + 0x20], 0
mov dword [ebx], vtable.SkARGB32_Shader_Blitter.0
mov eax, dword [esi + 0xc]
shl eax, 2
push eax
call fcn.00570240
mov dword [ebx + 0x3c], eax
add esp, 4
mov ecx, dword [edi + 0xc]
mov dword [ebx + 0x38], ecx
test ecx, ecx
je 0x5e6be5
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [ebp]
mov ecx, ebp
xor esi, esi
call dword [eax + 4]
test al, 1
mov eax, 2
cmove esi, eax
push esi
call fcn.005f1c90
or esi, 1
mov dword [ebx + 0x40], eax
push esi
call fcn.005f1c90
mov ecx, dword [ebx + 0x38]
add esp, 8
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
test ecx, ecx
jne 0x5e6c2a
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 4]
test al, 1
je 0x5e6c4c
jmp 0x5e6c48
mov eax, dword [ecx]
lea edx, [esp + 0x30]
push edx
mov eax, dword [eax + 0x1c]
call eax
test al, al
je 0x5e6c4c
cmp dword [esp + 0x30], 1
jne 0x5e6c4c
mov dword [ebx + 0x44], 0x5e7cf0
mov byte [ebx + 0x48], 1
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 4]
shr eax, 3
and al, 1
mov byte [ebx + 0x49], al
mov dword [esp + 0x20], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x5e8150
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
imul edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
movsx esi, word [ebx]
lea ebp, [edx + eax*4]
mov dword [esp + 0x14], esi
add ebp, dword [ecx + 0xc]
test esi, esi
jle 0x5e823d
mov eax, dword [esp + 0x18]
push edi
lea ecx, [ecx]
movzx eax, byte [eax]
test eax, eax
je 0x5e8218
cmp eax, 0xff
jne 0x5e81b9
cmp esi, 0x12c
jle 0x5e81a7
mov ecx, esi
mov eax, 0xff000000
mov edi, ebp
rep stosd dword es:[edi], eax
jmp 0x5e8218
push esi
push 0xff000000
push ebp
call dword [0x73ec04]
add esp, 0xc
jmp 0x5e8218
mov ecx, eax
mov ebx, 0x100
shl ecx, 0x18
mov edi, esi
mov dword [esp + 0x14], ecx
sub ebx, eax
mov esi, ecx
lea ecx, [ecx]
mov ecx, dword [ebp + edi*4 - 4]
dec edi
mov edx, ecx
mov eax, ecx
and edx, 0xff00ff
shr eax, 8
imul edx, ebx
and eax, 0xffff00ff
shr ecx, 8
imul eax, ebx
and ecx, 0xff00ff
imul ecx, ebx
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor edx, ecx
add edx, esi
mov dword [ebp + edi*4], edx
test edi, edi
jg 0x5e81d0
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ebx, [ebx + esi*2]
add eax, esi
mov dword [esp + 0x20], ebx
lea ebp, [ebp + esi*4]
mov dword [esp + 0x1c], eax
movsx esi, word [ebx]
mov dword [esp + 0x18], esi
test esi, esi
jg 0x5e8180
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x5e8c70
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 0x10]
push ebp
mov ebp, ecx
test dl, dl
je 0x5e8d36
cmp dword [ebp + 0x34], 0
je 0x5e8d36
mov ecx, dword [ebp + 0x14]
imul ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [ebp + 0x30]
push esi
lea esi, [ecx + eax*4]
add esi, dword [ebp + 0xc]
cmp dl, 0xff
je 0x5e8cda
mov ecx, ebx
movzx edx, dl
mov eax, ebx
and ecx, 0xff00ff
inc edx
shr eax, 8
imul ecx, edx
and eax, 0xffff00ff
shr ebx, 8
imul eax, edx
and ebx, 0xff00ff
imul ebx, edx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ebx, ecx
push edi
mov eax, ebx
mov edi, 0xff
shr eax, 0x18
sub edi, eax
mov eax, dword [ebp + 0x14]
mov ebp, dword [esp + 0x1c]
dec ebp
mov dword [esp + 0x20], eax
js 0x5e8d33
mov ecx, dword [esi]
mov edx, ecx
and edx, 0xff00ff
mov eax, ecx
imul edx, edi
shr eax, 8
and eax, 0xffff00ff
shr ecx, 8
imul eax, edi
and ecx, 0xff00ff
imul ecx, edi
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor edx, ecx
add edx, ebx
mov dword [esi], edx
add esi, dword [esp + 0x20]
dec ebp
jns 0x5e8cf5
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x5e9a40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
sar ebp, 3
sub ecx, eax
push esi
push edi
mov dword [esp + 0x14], ecx
lea ecx, [ecx]
movzx edx, word [ecx + eax]
lea eax, [eax + 2]
movzx ecx, word [eax - 2]
mov edi, edx
mov esi, ecx
and edi, 0x7e0
shl edi, 0x10
and esi, 0x7e0
or edi, edx
shl esi, 0x10
or esi, ecx
and edi, 0xfffff81f
and esi, 0xfffff81f
dec ebx
sub edi, esi
imul edi, ebp
shr edi, 5
add edi, esi
mov ecx, edi
shr ecx, 0x10
xor ecx, edi
and ecx, 0x7e0
xor ecx, edi
mov word [eax - 2], cx
mov ecx, dword [esp + 0x14]
test ebx, ebx
jg 0x5e9a60
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5ea530
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
imul edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
lea esi, [edx + eax*2]
movsx edx, word [ebx]
add esi, dword [ecx + 0xc]
test edx, edx
jle 0x5ea586
push ebp
mov ebp, dword [esp + 0x18]
push edi
movzx eax, byte [ebp]
lea ebx, [ebx + edx*2]
add ebp, edx
lea edi, [edx + edx]
test eax, eax
je 0x5ea57b
cmp eax, 0xff
jne 0x5ea58b
lea eax, [edx + edx]
push eax
push 0
push esi
call fcn.00549c70
add esp, 0xc
add esi, edi
movsx edx, word [ebx]
test edx, edx
jg 0x5ea555
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
mov edi, 0x100
sub edi, eax
shr edi, 3
movzx eax, word [esi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [esi], ax
add esi, 2
dec edx
jne 0x5ea595
jmp 0x5ea57d

Function at 0x5ea5d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
imul edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [ecx + 0x34]
movsx esi, word [ebp]
lea eax, [edx + eax*2]
mov dword [esp + 0x10], edi
add eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x30]
mov dword [esp + 0x14], edx
test esi, esi
jle 0x5ea67b
push ebx
mov ebx, dword [esp + 0x1c]
movzx edx, byte [ebx]
lea ebp, [ebp + esi*2]
add ebx, esi
lea ecx, [esi + esi]
mov dword [esp + 0x1c], ebx
test edx, edx
je 0x5ea670
lea ecx, [edx + 1]
mov ebx, 0x20
imul ecx, edi
shr ecx, 0xb
mov edi, ecx
imul edi, dword [esp + 0x18]
sub ebx, ecx
nop
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, 2
dec esi
jne 0x5ea630
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
jmp 0x5ea672
add eax, ecx
movsx esi, word [ebp]
test esi, esi
jg 0x5ea604
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x5ea690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0xc]
push ebx
push ebp
movzx ebp, word [ecx + 0x3a]
push esi
push edi
mov edi, dword [esp + 0x20]
imul eax, edi
mov dword [esp + 0x20], ebp
lea esi, [eax + edx*2]
mov eax, dword [ecx + 0x30]
add esi, dword [ecx + 0xc]
mov dword [esp + 0x14], eax
xor eax, eax
cmp byte [ecx + 0x3e], al
movzx ecx, word [ecx + 0x3c]
setne al
mov dword [esp + 0x1c], ecx
xor edx, edi
mov dword [esp + 0x10], eax
test eax, edx
je 0x5ea6e4
movzx eax, cx
movzx ecx, bp
mov ebp, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
mov edx, dword [esp + 0x28]
movsx ebx, word [edx]
test ebx, ebx
jle 0x5ea7e3
lea edx, [edx + ebx*2]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x24]
movzx eax, byte [edx]
add edx, ebx
mov dword [esp + 0x24], edx
test eax, eax
je 0x5ea725
cmp eax, 0xff
jne 0x5ea77e
cmp dword [esp + 0x10], 0
je 0x5ea74d
push ebx
push ecx
push ebp
push esi
call fcn.005eb560
add esp, 0x10
lea esi, [esi + ebx*2]
test dword [esp + 0x10], ebx
je 0x5ea7cc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movzx ebp, ax
movzx ecx, cx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebp
jmp 0x5ea7d4
cmp ebx, 0x12c
jle 0x5ea770
mov eax, ebp
mov ecx, ebx
movzx edx, ax
mov edi, esi
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x5ea725
push ebx
push ebp
push esi
call dword [0x73ec00]
add esp, 0xc
jmp 0x5ea725
inc eax
mov ebp, 0x20
shr eax, 3
mov edx, ebx
mov edi, eax
imul edi, dword [esp + 0x14]
sub ebp, eax
movzx eax, word [esi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, ebp
add ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [esi], ax
add esi, 2
dec edx
jne 0x5ea792
jmp 0x5ea728
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
movsx ebx, word [edx]
test ebx, ebx
jg 0x5ea6f3
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x5ead90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, ecx
mov dword [esp + 8], ebp
cmp dword [ebx + 0x18], 0
jne 0x5eadbe
push dword [esp + 0x18]
lea eax, [ebp + 0xc]
push ebx
push eax
call fcn.005e9b60
add esp, 0xc
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x18]
mov eax, dword [ebp + 0x14]
push esi
push edi
mov esi, dword [edx + 4]
mov edi, esi
mov ecx, dword [edx]
sub edi, dword [ebx + 8]
imul eax, esi
lea eax, [eax + ecx*2]
add eax, dword [ebp + 0xc]
mov ebp, dword [ebx + 0x14]
imul edi, ebp
mov dword [esp + 0x20], ebp
mov ebp, dword [edx + 0xc]
sub ebp, esi
sub edi, dword [ebx + 4]
add edi, dword [ebx]
mov ebx, dword [edx + 8]
add edi, ecx
mov edx, dword [esp + 0x10]
sub ebx, ecx
mov dword [esp + 0x14], ebx
mov edx, dword [edx + 0x14]
lea ecx, [ebx + ebx]
sub edx, ecx
sub dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
movzx ecx, word [eax]
movzx edx, byte [edi]
mov esi, ecx
and esi, 0x7e0
inc edi
shl esi, 0x10
or esi, ecx
mov ecx, 0x100
sub ecx, edx
and esi, 0xfffff81f
shr ecx, 3
imul esi, ecx
shr esi, 5
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov word [eax], cx
add eax, 2
dec ebx
jne 0x5eae10
add eax, dword [esp + 0x1c]
add edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
dec ebp
jne 0x5eae10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x5eae70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ecx
cmp dword [ebp + 0x18], 0
jne 0x5eaea8
movzx eax, word [ebx + 0x38]
push eax
mov eax, 0x100
sub eax, dword [ebx + 0x34]
push eax
push dword [esp + 0x28]
lea eax, [ebx + 0xc]
push ebp
push eax
call fcn.005e9e80
add esp, 0x14
pop ebp
pop ebx
add esp, 0x10
ret 8
mov edx, dword [esp + 0x20]
mov eax, dword [ebx + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [edx + 4]
mov ecx, dword [edx]
mov dword [esp + 0x28], edi
mov edi, esi
sub edi, dword [ebp + 8]
imul edi, dword [ebp + 0x14]
imul eax, esi
sub edi, dword [ebp + 4]
add edi, dword [ebp]
mov ebp, dword [edx + 8]
add edi, ecx
sub ebp, ecx
mov dword [esp + 0x14], ebp
lea eax, [eax + ecx*2]
mov ebp, dword [edx + 0xc]
mov edx, dword [esp + 0x14]
sub ebp, esi
mov esi, dword [ebx + 0x14]
add eax, dword [ebx + 0xc]
mov dword [esp + 0x24], ebp
lea ecx, [edx + edx]
sub esi, ecx
mov ecx, dword [ebx + 0x30]
sub dword [esp + 0x28], edx
mov dword [esp + 0x1c], esi
mov esi, dword [ebx + 0x34]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
jmp 0x5eaf10
mov ebp, dword [esp + 0x18]
mov ebx, edx
movzx edx, byte [edi]
inc edi
movzx ecx, word [eax]
inc edx
imul edx, esi
mov esi, ecx
and esi, 0x7e0
shl esi, 0x10
or esi, ecx
mov ecx, 0x20
and esi, 0xfffff81f
shr edx, 0xb
sub ecx, edx
imul edx, ebp
imul esi, ecx
add esi, edx
shr esi, 5
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov esi, dword [esp + 0x10]
mov word [eax], cx
add eax, 2
dec ebx
jne 0x5eaf16
add eax, dword [esp + 0x1c]
add edi, dword [esp + 0x28]
dec dword [esp + 0x24]
mov edx, dword [esp + 0x14]
jne 0x5eaf10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x5eaf90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, ecx
cmp dword [ebx + 0x18], 0
jne 0x5eafbf
movzx eax, word [ebp + 0x38]
push eax
push dword [esp + 0x1c]
lea eax, [ebp + 0xc]
push ebx
push eax
call fcn.005ea070
add esp, 0x10
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x18]
mov eax, dword [ebp + 0x14]
push esi
push edi
mov esi, dword [edx + 4]
mov edi, dword [ebx + 0x14]
mov ecx, dword [edx]
mov dword [esp + 0x20], edi
mov edi, esi
sub edi, dword [ebx + 8]
imul edi, dword [ebx + 0x14]
imul eax, esi
sub edi, dword [ebx + 4]
add edi, dword [ebx]
mov ebx, dword [edx + 8]
add edi, ecx
sub ebx, ecx
lea eax, [eax + ecx*2]
mov dword [esp + 0x14], ebx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp + 0x14]
sub ecx, esi
add eax, dword [ebp + 0xc]
mov ebp, dword [ebp + 0x30]
mov dword [esp + 0x1c], ecx
lea ecx, [ebx + ebx]
sub edx, ecx
sub dword [esp + 0x20], ebx
mov dword [esp + 0x10], edx
movzx ecx, word [eax]
movzx esi, byte [edi]
mov edx, ecx
and edx, 0x7e0
inc esi
shl edx, 0x10
inc edi
or edx, ecx
shr esi, 3
and edx, 0xfffff81f
mov ecx, ebp
sub ecx, edx
imul esi, ecx
shr esi, 5
add esi, edx
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov word [eax], cx
add eax, 2
dec ebx
jne 0x5eb012
add eax, dword [esp + 0x10]
add edi, dword [esp + 0x20]
dec dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
jne 0x5eb012
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8