joyce8/EMBER2024-capa huggingface dataset:
Function at 0x589da0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov esi, 0x20
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
add edx, ebx
test esi, esi
ja 0x589db7
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x589e10
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, 0xc6ef3720
mov esi, 0x20
lea ebx, [ebx]
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
sub edx, ebx
test esi, esi
ja 0x589e30
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret
Function at 0x589f60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x58a0e3
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x589f75
test edx, edx
je 0x58a10b
jmp 0x58a0f0
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + case.0x58aa90.1]
inc ecx
sub edx, 1
jne 0x58a0f0
not eax
pop esi
ret
Function at 0x594380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6673a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [0x70dfa0], esi
lea eax, [esp + 0xf]
push eax
lea ecx, [esp + 0x13]
xor edi, edi
push ecx
lea ecx, [esi + 0x6c]
mov dword [esp + 0x24], edi
mov dword [esi], 0x68e7c0
call fcn.005321f0
fldz
fst dword [esi + 0xc]
mov dword [esi + 4], edi
fst dword [esi + 0x10]
mov dword [esi + 8], edi
fst dword [esi + 0x14]
mov eax, esi
fld dword [0x68ac74]
fstp dword [esi + 0x18]
fld dword [0x674398]
fstp dword [esi + 0x1c]
fld1
fst dword [esi + 0x20]
fstp dword [esi + 0x24]
fst dword [esi + 0x28]
fst dword [esi + 0x2c]
mov dword [esi + 0x30], edi
fst dword [esi + 0x38]
mov dword [esi + 0x44], edi
fst dword [esi + 0x40]
mov dword [esi + 0x34], edi
mov dword [esi + 0x48], edi
fst dword [esi + 0x4c]
fst dword [esi + 0x54]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
fst dword [esi + 0x60]
fstp dword [esi + 0x68]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x596cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6675cb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0xa0
call fcn.00611363
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
mov dword [esp + 0x24], esi
cmp eax, esi
je 0x596d08
mov ecx, eax
call fcn.00594760
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.005944e0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ecx
push eax
mov ecx, 0x750674
mov dword [esp + 0x14], esi
call fcn.0050c7d0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x5a5630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x667a46
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x69013c
xor ebx, ebx
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], ebx
mov byte [esi + 8], bl
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x68]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
call fcn.005d05e0
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 1
mov dword [esi + 0x84], ebx
call fcn.005d05e0
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x54], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x5c02e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6628e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.0051acc0
mov ecx, dword [esp + 0x30]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.00595820
add esp, 0xc
test al, al
je 0x5c035e
add esi, 0x4c
lea edx, [esp + 8]
push esi
push edx
call fcn.00595de0
add esp, 8
lea ecx, [esp + 8]
call fcn.0052fd70
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
lea ecx, [esp + 8]
call fcn.0052fd70
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 4
Function at 0x5c2980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6691ae
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.005cc840
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], 0x692188
call fcn.0051acc0
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.0051acc0
mov ecx, esi
mov byte [esp + 0x14], 2
call fcn.005cc7f0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5d0480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x5d048f
mov edx, dword [eax + 4]
jmp 0x5d0492
lea edx, [eax + 4]
push esi
mov esi, dword [eax + 0x14]
add esi, edx
xor eax, eax
cmp edx, esi
jae 0x5d04b1
push edi
nop
movzx edi, byte [edx]
imul eax, eax, 0x1000193
inc edx
xor eax, edi
cmp edx, esi
jb 0x5d04a0
pop edi
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4
Function at 0x5d0e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x669aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edx
mov ebp, 4
jle 0x5d106b
mov dword [esp + 0x18], eax
jmp 0x5d0ef8
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edx + ebp]
add ebp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
cmp dword [ecx + 0x3c74], ebx
je 0x5d0f32
mov eax, dword [ecx + 0x3c7c]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x5d0f28
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x20]
jmp 0x5d0f3e
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x20]
jmp 0x5d0f3e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x30]
mov esi, dword [eax + 4]
mov edi, dword [eax]
cmp esi, ebx
je 0x5d1060
jmp 0x5d0f50
push 0xffffffffffffffff
lea eax, [esi + 4]
push ebx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.00418140
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x84], ebx
call fcn.004f7c80
add esp, 8
cmp dword [esp + 0x50], 0x10
mov byte [esp + 0x7c], 2
jb 0x5d0fa2
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00611358
add esp, 4
cmp dword [esp + 0x6c], 0x10
mov eax, dword [esp + 0x58]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
jae 0x5d0fc1
lea eax, [esp + 0x58]
mov edx, dword [esp + 0x68]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5d0fe4
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x5d0fd0
mov ebp, dword [esp + 0x2c]
cmp dword [esp + 0x1c], ecx
je 0x5d102c
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x5d1006
mov eax, dword [esp + 0x58]
push eax
call fcn.00611358
add esp, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x5d101a
lea esp, [esp]
mov eax, dword [edi + 4]
add edi, 4
cmp eax, ebx
je 0x5d1010
mov esi, edi
sub esi, eax
neg esi
sbb esi, esi
and esi, eax
jne 0x5d0f50
jmp 0x5d1060
mov ecx, dword [esi + 0x20]
call fcn.005d1fa0
mov ecx, dword [esp + 0x14]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.005d83a0
add ebp, eax
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x5d1060
mov edx, dword [esp + 0x58]
push edx
call fcn.00611358
add esp, 4
sub dword [esp + 0x18], 1
jne 0x5d0ef0
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.006117ae
add esp, 0x6c
ret 4
Function at 0x5d1490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebx + 4]
add ecx, 4
cmp dword [ecx + 0x18], 0x10
push edi
jb 0x5d14aa
mov eax, dword [ecx + 4]
jmp 0x5d14ad
lea eax, [ecx + 4]
mov ecx, dword [ecx + 0x14]
add ecx, eax
xor edi, edi
cmp eax, ecx
jae 0x5d14d0
jmp 0x5d14c0
movzx edx, byte [eax]
imul edi, edi, 0x1000193
inc eax
xor edi, edx
cmp eax, ecx
jb 0x5d14c0
cmp dword [esi], 0
je 0x5d14e3
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.005d1440
jmp 0x5d1513
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.005d7300
cmp dword [esi + 4], eax
lea ecx, [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jb 0x5d1501
mov eax, ecx
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, esi
call fcn.005d3000
mov ecx, esi
call fcn.005d2ab0
mov eax, edi
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
pop edi
lea ecx, [eax + edx*4]
mov edx, dword [ebx + 4]
mov dword [ebx + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov dword [ecx], edx
inc dword [esi + 0x10]
mov dword [esi + 0x18], ecx
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret 0xc

Function at 0x5d1550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x669b08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
cmp dword [ebx + 0x18], 0x10
jb 0x5d1588
mov eax, dword [ebx + 4]
jmp 0x5d158b
lea eax, [ebx + 4]
mov ecx, dword [ebx + 0x14]
add ecx, eax
xor ebp, ebp
cmp eax, ecx
jae 0x5d15a6
movzx edx, byte [eax]
imul ebp, ebp, 0x1000193
inc eax
xor ebp, edx
cmp eax, ecx
jb 0x5d1596
xor edx, edx
mov eax, ebp
div dword [esi + 4]
mov eax, dword [esi]
push ebx
mov ecx, esi
lea edi, [eax + edx*4]
push edi
call fcn.005d0570
mov ecx, eax
xor eax, eax
cmp ecx, eax
je 0x5d15d0
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
jmp 0x5d1643
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
call fcn.005d0710
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
push ecx
lea edx, [ebx + 4]
push edx
push 0
call fcn.005d0780
mov eax, dword [esi + 0x10]
add esp, 0xc
inc eax
push eax
mov ecx, esi
mov byte [esp + 0x21], 1
call fcn.005d1440
test al, al
je 0x5d1627
mov eax, ebp
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi]
lea edi, [ecx + edx*4]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], ebx
inc dword [esi + 0x10]
cmp edi, dword [esi + 0x18]
jae 0x5d1638
mov dword [esi + 0x18], edi
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ebx
mov byte [eax + 8], 1
mov dword [eax], edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x5d1ee0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x255]
push str._dungeon_
push esi
call fcn.00614709
add esp, 8
test eax, eax
je 0x5d1f0a
push eax
call fcn.006144ad
add esp, 4
pop edi
mov al, 1
pop esi
ret
cmp byte [edi + 0x364], 0
je 0x5d1f18
pop edi
xor al, al
pop esi
ret
push 0x68eb84
push esi
call fcn.00614709
mov esi, eax
add esp, 8
test esi, esi
je 0x5d1f13
push esi
push 1
push 4
push 0x692920
call fcn.0061661c
push esi
push 1
push 4
push 0x692924
call fcn.0061661c
push esi
push 1
push 4
add edi, 0x150
push edi
call fcn.0061661c
push esi
call fcn.006144ad
add esp, 0x34
pop edi
mov al, 1
pop esi
ret

Function at 0x5d2b00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x3c14], 0x20
je 0x5d2b0e
xor al, al
ret 4
cmp byte [ecx + 0x365], 0
jne 0x5d2b56
cmp dword [ecx + 0x3c18], 0x10
push esi
push edi
jb 0x5d2b2a
mov esi, dword [ecx + 0x3c04]
jmp 0x5d2b30
lea esi, [ecx + 0x3c04]
mov edx, dword [esp + 0xc]
xor eax, eax
xor dword [esi + eax*4], edx
mov edi, dword [ecx + 0x3c14]
inc eax
shr edi, 2
add edx, 0x1000193
cmp eax, edi
jne 0x5d2b36
pop edi
mov byte [ecx + 0x365], 1
pop esi
mov al, 1
ret 4
Function at 0x5d7590
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x66a330
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov esi, ecx
mov ecx, dword [esp + 0x78]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00418140
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x70], ebx
call fcn.005874d0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.005d7560
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x6c], 1
jae 0x5d762e
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5d7652
lea ebx, [ebx]
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x5d7640
xor ebx, ebx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.005d3e40
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp esi, ebx
jne 0x5d76b6
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5d768c
mov eax, dword [esp + 0x2c]
push eax
call fcn.00611358
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5d76af
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00611358
add esp, 4
xor al, al
jmp 0x5d7777
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x5d76c5
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
call fcn.00589f60
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [edi], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x10]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x18]
mov dword [ebp], edx
mov eax, dword [esi + 0x1c]
mov dword [ebp + 4], eax
mov edx, dword [esi + 0x20]
mov dword [ebp + 8], edx
mov eax, dword [esi + 0x24]
add esp, 8
mov dword [ebp + 0xc], eax
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5d7720
xor eax, eax
jmp 0x5d7730
xor dword [ebp + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5d7730
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5d7752
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00611358
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5d7775
mov edx, dword [esp + 0x48]
push edx
call fcn.00611358
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.006117ae
add esp, 0x5c
ret 0x10
Function at 0x5d77a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x66a368
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x705e7c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
push edi
mov eax, dword [0x705e7c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov esi, ecx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00418140
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 0
call fcn.005874d0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp edi, 0x10
jae 0x5d7830
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + eax]
xor ecx, ecx
cmp eax, edx
jae 0x5d7854
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x5d7840
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 0x20]
call fcn.005d3e40
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x5d788e
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jg 0x5d78a4
mov dword [ebp], 0
cmp edi, 0x10
jb 0x5d78a0
mov edx, dword [esp + 0x28]
push edx
call fcn.00611358
add esp, 4
xor al, al
jmp 0x5d78cf
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
jne 0x5d78b5
call fcn.006121a6
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0x30]
mov dword [ebp], ecx
cmp edi, 0x10
jb 0x5d78cd
mov edx, dword [esp + 0x28]
push edx
call fcn.00611358
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.006117ae
add esp, 0x40
ret 0xc
Function at 0x5dd7b2
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x5dd8f9
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x5dd858
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x5dd802
cmp ecx, 0x40010001
je 0x5dd802
cmp ecx, 0x40020001
je 0x5dd802
cmp ecx, 0x40030001
jne 0x5dd80d
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x5dd81f
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x5dd852
dec ecx
je 0x5dd84c
dec ecx
je 0x5dd846
dec ecx
je 0x5dd840
dec ecx
je 0x5dd83a
dec ecx
jne 0x5dd865
or dword [ebp - 4], 0xe
jmp 0x5dd865
or dword [ebp - 4], 0xc
jmp 0x5dd865
or dword [ebp - 4], 0xa
jmp 0x5dd865
or dword [ebp - 4], 8
jmp 0x5dd865
or dword [ebp - 4], 6
jmp 0x5dd865
or dword [ebp - 4], 2
jmp 0x5dd865
cmp ecx, 0x40030000
jne 0x5dd865
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x5dd875
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x5dd883
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x5dd891
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x5dd89f
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x5dd8b4
push 3
jmp 0x5dd8df
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x5dd8e5
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x5dd8d1
xor edx, edx
inc edx
jmp 0x5dd8e0
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x5dd8f1
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x5dd8a2
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x5dd906
mov eax, 0x8876086c
jmp 0x5dd910
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8