joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10108299
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1016f640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107ac69c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x101082c5
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x101082f6
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x101082f4
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100c622d
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x101082f6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1012364c
mov esp, ebp
pop ebp
ret 8
Function at 0x10114cb5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x1016f640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
xor edi, edi
cmp dword [eax + 0x254], edi
je 0x10114d11
cmp dword [eax + 0x264], edi
je 0x10114df3
cmp byte [0x107ac69c], 0
push eax
push dword [eax + 0x250]
je 0x10114cfe
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10114d04
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x264], eax
jmp 0x10114df3
mov eax, dword [eax + 0x25c]
test eax, eax
je 0x10114e84
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy]
mov eax, dword [esi]
pop ecx
pop ecx
cmp dword [eax + 0x260], edi
je 0x10114d5d
lea eax, [ebp - 0x234]
push eax
call fcn.100c622d
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR120.dll_wcscat]
add esp, 0xc
mov ecx, dword [esi]
mov eax, 0x80
push 0x10
pop edx
test byte [ecx + 0x268], 1
cmovne eax, edx
mov dword [ecx], eax
cmp byte [0x107ac69c], 0
je 0x10114d8d
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10114daf
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.100c622d
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], edi
jne 0x10114ddb
mov dword [eax + 0x250], edi
mov eax, dword [esi]
xor ecx, ecx
inc ecx
mov dword [eax + 0x254], ecx
mov eax, dword [esi]
cmp dword [eax + 0x264], edi
jne 0x10114df3
mov dword [esi + 4], ecx
mov eax, dword [esi]
cmp dword [eax + 0x264], edi
je 0x10114e15
cmp byte [0x107ac69c], 0
jne 0x10114e15
push dword [eax + 0x258]
add eax, 0x2c
push eax
call fcn.100c622d
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [eax + 0x26c], ecx
xor ecx, ecx
mov ebx, dword [esi]
inc ecx
mov edi, dword [ebx + 0x26c]
shr edi, 4
and edi, ecx
je 0x10114e4d
push esi
xor edi, edi
call fcn.100c622d
cmp word [eax], 0x2e
je 0x10114e48
test byte [ebx + 0x268], 3
jne 0x10114e57
xor edi, edi
inc edi
jmp 0x10114e57
test byte [ebx + 0x268], 1
cmovne edi, ecx
cmp dword [ebx + 0x264], 0
je 0x10114e75
test edi, edi
jne 0x10114cce
test byte [ebx + 0x26c], 2
jne 0x10114cce
mov ecx, ebx
xor eax, eax
cmp dword [ecx + 0x264], eax
setne al
jmp 0x10114e86
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012364c
mov esp, ebp
pop ebp
ret 4
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402ee4
pop dword [ebp - 0x50]
mov eax, 0x402ee4
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3fd48df3
add dword [ebp - 0x60], 0xe7db758
mov dword [ebp - 0x5c], 0xf1053508
sub dword [ebp - 0x5c], 0xbed1e8c3
mov dword [ebp - 0x58], 0x6d080e1c
add dword [ebp - 0x58], 0xdf443612
mov dword [ebp - 0x54], 0xac8e1e72
add dword [ebp - 0x54], 0x5371e18e
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe890e30e
sub dword [ebp - 0x60], 0x741e79b8
mov dword [ebp - 0x5c], 0x131f57c8
add dword [ebp - 0x5c], 0x2e4d09ad
mov dword [ebp - 0x58], 0x54cfb3e6
sub dword [ebp - 0x58], 0xf160477a
mov dword [ebp - 0x54], 0x5432e9c4
add dword [ebp - 0x54], 0xabcd163c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x393d3
push 0
call eax
mov ecx, 0x61ab8609
sub ecx, 0x61ab3539
mov edx, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x50]
mov esi, 0x4730a649
sub esi, 0xccfddb71
add dword [ebp - 4], esi
mov edi, dword [ebx]
mov dword [ebp - 0x48], 0x31632fba
xor edi, esi
add dword [ebp - 0x14], esi
mov dword [edx], edi
sub dword [ebp - 4], edx
add edx, 4
add ebx, 0xa452c5b
sub ebx, 0xa452c57
loop 0x402ff1
add eax, 0xd6319b60
add eax, 0x29cf9ab3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3b219673
add ecx, 0xc51e698d
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x40dfde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40dfed
pop dword [ebp - 0xc]
mov eax, 0x55318259
sub eax, 0x54f0a26c
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x34d1c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xcc578dad
sub ecx, 0xcc574d1d
mov esi, eax
mov edi, 0x68e11880
add edi, 0x97631d80
add edi, dword [ebp - 0xc]
mov edx, 0x119c41f9
add edx, 0x35bae437
add dword [ebp - 8], 0x70974bd3
mov ebx, dword [edi]
add dword [ebp - 4], 0xce423ac7
add ebx, edx
xor dword [ebp - 4], 0x4f59831f
mov dword [esi], ebx
add dword [ebp - 4], 0xa0eb63ad
add esi, 4
add edi, 4
loop 0x40e047
add eax, 0xf458b6bb
add eax, 0xba83e58
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf624ebb0
add ecx, 0xa1b1450
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401220
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x430920], 0x24e1
mov eax, dword [0x430920]
sub eax, 0x24e1
mov dword [0x430920], eax
mov ecx, 1
test ecx, ecx
je 0x4012cb
mov edx, dword [0x430920]
cmp edx, dword [ebp + 0xc]
jb 0x401257
jmp 0x4012cb
cmp dword [0x430920], 0
jne 0x401275
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401275
xor eax, eax
jmp 0x4012cb
mov eax, dword [ebp + 8]
add eax, dword [0x430920]
mov ecx, dword [eax]
add ecx, dword [0x430920]
mov edx, dword [ebp + 8]
add edx, dword [0x430920]
mov dword [edx], ecx
mov dword [ebp - 4], 0x3cfb
mov eax, dword [0x430920]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x430920]
push eax
jmp section..htext
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Copy file
Extract resource via kernel32 functions
Get common file path
Get file size
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x337]
mov byte [ebp - 0x338], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x233]
mov byte [ebp - 0x234], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x401c73
mov edi, 0x401a5e
sub eax, edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], eax
mov eax, 0x401f55
sub eax, fcn.00401d39
mov byte [ebp - 0x1c], 0xa
mov dword [ebp - 0x20], eax
mov eax, 0x401a4d
sub eax, 0x40198b
mov byte [ebp - 0x1b], 0xa
mov dword [ebp - 0x28], eax
mov eax, 0x40193b
sub eax, int.00401690
mov byte [ebp - 0x1a], 0xa
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push str.RT_RCDATA
push 0x66
mov byte [ebp - 0x19], 0xa
mov byte [ebp - 0x18], 0xa
mov byte [ebp - 0x17], 0xa
mov byte [ebp - 0x16], 0xa
mov byte [ebp - 0x15], 0xa
mov dword [ebp - 8], ebx
call fcn.00401451
add esp, 0x10
cmp dword [ebp - 0x10], ebx
jne 0x4010d2
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
mov esi, 0x404314
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push 8
push eax
push section..data
call fcn.00402260
add esp, 0xc
test eax, eax
je 0x4011a0
push 8
lea eax, [ebp - 0x130]
push section..data
push eax
call fcn.00401f6a
push dword [ebp - 0x24]
lea eax, [ebp - 0x130]
push edi
push eax
call fcn.00401fe2
push dword [ebp - 0x20]
lea eax, [ebp - 0x130]
push fcn.00401d39
push eax
call fcn.00401fe2
push dword [ebp - 0x28]
lea eax, [ebp - 0x130]
push 0x40198b
push eax
call fcn.00401fe2
push dword [ebp - 0x2c]
lea eax, [ebp - 0x130]
push int.00401690
push eax
call fcn.00401fe2
push dword [ebp - 0x10]
lea eax, [ebp - 0x130]
push dword [ebp - 0x14]
push eax
call fcn.00401fe2
add esp, 0x48
lea eax, [ebp - 0x130]
push 0x100
push ebx
push eax
call fcn.00402200
call int.00401690
push str.rwbinru_dyd
call fcn.00401944
push eax
push dword [ebp - 0x14]
call fcn.00401d39
add esp, 0x18
mov dword [ebp - 4], ebx
call fcn.0040149a
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
mov byte [ecx + section..data], al
jl 0x4011a3
lea eax, [ebp - 0x1c]
push 8
push eax
push section..data
jmp loc.00408000
Function at 0x401451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147f
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x40149a
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ee
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ee
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f2
xor eax, eax
jmp 0x401504
cmp dword [ebp - 4], edi
je 0x401501
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x401944
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
xor esi, esi
call edi
test eax, eax
jbe 0x40197b
push ebx
mov ebx, ebp
sub ebx, 0x404418
mov al, byte [ebx + esi + 0x404418]
push ebp
xor al, 1
mov byte [esi + 0x404418], al
inc esi
call edi
cmp esi, eax
jb 0x401963
pop ebx
and byte [esi + 0x404418], 0
pop edi
pop esi
mov eax, 0x404418
pop ebp
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x5bbacc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x5bbb6c
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.0040a9b0
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.0040a404
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x5bbaf6
cmp byte [esp], 0
je 0x5bbb3b
mov eax, edi
call fcn.0040a404
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x5bbb78
mov eax, edi
call fcn.0040a404
push eax
mov eax, edi
call fcn.0040a404
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.004066d8
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.0040a9b0
jmp 0x5bbb78
mov eax, edi
mov edx, 0x5bbb8c
call fcn.0040a2c0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5bc8d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.0040a2c0
mov eax, ebx
call fcn.0040a418
mov eax, dword [ebx]
call fcn.0040a340
test eax, eax
jle 0x5bc909
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x5bc8fe
pop esi
pop ebx
ret

Function at 0x5c3034
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x5c3080
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.005c3eb4
test al, al
jne 0x5c3076
cmp word [edi], 0x5a4d
jne 0x5c3076
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x5c3076
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c308c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5cd32c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.004066d8
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x5cd488
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
Function at 0x5eeee4
Capabilities:
Encode data using xor

Disassembly:
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
add byte [eax], al
add byte [eax], al
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
sub ecx, 8
mov eax, esi
cmp ecx, 8
jae 0x5eeec4
test ecx, ecx
je 0x5eef9d
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
mov esi, dword [ebx + esi*4]
xor esi, eax
inc edx
mov eax, esi
dec ecx
jne 0x5eef84
xor eax, 0xffffffff
Function at 0x5f5b54
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [edi], cl
mov dh, 0x92
std
movsd dword es:[edi], dword [esi]
jbe 0x5f5b5e
shl edx, 0x10
or eax, edx
mov edx, dword [ebp - 0x24]
shr edx, 0x18
movzx edx, byte [edx + 0x76a5fd]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x24]
and eax, 0xff
movzx eax, byte [eax + 0x76a5fd]
mov edx, dword [ebp - 0x20]
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + 0x76a5fd]
shl edx, 8
or eax, edx
mov edx, dword [ebp - 0x1c]
shr edx, 0x10
and edx, 0xff
movzx edx, byte [edx + 0x76a5fd]
shl edx, 0x10
or eax, edx
mov edx, dword [ebp - 0x18]
shr edx, 0x18
movzx edx, byte [edx + 0x76a5fd]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
xor dword [edx], eax
sub dword [ebp - 0xc], 4
sub dword [ebp - 0x10], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jne 0x5f5bd9
mov esp, ebp
pop ebp
ret

Function at 0x5f5da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
and eax, 0xff
mov al, byte [eax + 0x76a4fd]
mov edx, dword [ebp - 0x10]
xor byte [edx], al
inc dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
shr eax, 8
and eax, 0xff
mov al, byte [eax + 0x76a4fd]
mov edx, dword [ebp - 0x10]
xor byte [edx], al
inc dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
shr eax, 0x10
and eax, 0xff
mov al, byte [eax + 0x76a4fd]
mov edx, dword [ebp - 0x10]
xor byte [edx], al
inc dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
shr eax, 0x18
mov al, byte [eax + 0x76a4fd]
mov edx, dword [ebp - 0x10]
xor byte [edx], al
mov dword [ebp - 0x14], 5
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4 - 0x24]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
xor dword [edx + ecx*4 - 0x20], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jne 0x5f5e0c
jmp 0x5f5e61

Function at 0x5f5e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x24]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
call fcn.004066d8
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x5f5f5f
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
Function at 0x601db8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x601e12
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x76d7fc]
mov edx, dword [ebp - 0x10]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x601de0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x601fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x602021
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.00601f14
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.00601e7c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x601fe6
mov esp, ebp
pop ebp
ret

Function at 0x60207c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x6020d4
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x602104
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.0040a8ec
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.00601e7c
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x6020e7
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00601f14
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.00601e7c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x602109
mov esp, ebp
pop ebp
ret