joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b143c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b15b3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4b15cc
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00405360
push 0xffffffffffffffff
mov ecx, 0x4b15dc
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4b15f8
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x34], eax
mov ecx, 0x4b1618
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0055425c
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b1634
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00554148
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b1648
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00554148
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b1660
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00554148
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x4b167c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0055425c
mov byte [ebx + 0x48], al
mov ecx, 0x4b1690
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004a4f2c
mov byte [ebx + 0x49], al
push 0xffffffffffffffff
mov ecx, 0x4b16a4
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x4c], eax
push 0xffffffffffffffff
mov ecx, 0x4b16c4
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x50], eax
push 0
mov ecx, 0x4b16e8
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x54], eax
push 0
mov ecx, 0x4b1704
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x58], eax
push 0xff
mov ecx, 0x4b1720
mov edx, dword [ebx + 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
mov dword [ebx + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b15ba
lea eax, [ebp - 4]
call fcn.0040530c
ret
Function at 0x4ef9c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test dl, dl
je 0x4ef9dd
add esp, 0xfffffff0
call fcn.00404714
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov byte [ebx + 0x70], 1
mov byte [ebx + 0x6f], 1
mov eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [eax + 0x228]
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x6d], 0
test esi, esi
je 0x4efb22
lea eax, [ebx + 0x24]
mov edx, dword [esi + 4]
call fcn.00405360
lea eax, [ebx + 0x28]
mov edx, dword [esi + 8]
call fcn.00405360
movzx eax, byte [esi + 0xc]
mov byte [ebx + 0x71], al
push esi
lea edi, [ebx + 0x2c]
add esi, 0xd
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
lea edi, [ebx + 0x3c]
add esi, 0x1d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
lea edi, [ebx + 0x4c]
add esi, 0x38
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
movzx eax, byte [esi + 0x48]
mov byte [ebx + 0x6d], al
movzx eax, byte [esi + 0x49]
mov byte [ebx + 0x6e], al
mov edi, dword [esi + 0x30]
cmp edi, 0xffffffff
je 0x4efa89
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0xac]
cmp edi, dword [eax + 8]
jge 0x4efa89
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0xac]
mov edx, edi
call fcn.0041d16c
mov dword [ebx + 0x18], eax
jmp 0x4efaa2
xor eax, eax
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x14]
call fcn.00553c7c
push esi
lea edi, [esi + 0x1d]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov edi, dword [esi + 0x34]
cmp edi, 0xffffffff
je 0x4efacd
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0xac]
cmp edi, dword [eax + 8]
jge 0x4efacd
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0xac]
mov edx, edi
call fcn.0041d16c
mov dword [ebx + 0x1c], eax
jmp 0x4efad2
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x74], eax
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x78], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x7c], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x80], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x84], eax
cmp byte [ebx + 0x6d], 0
je 0x4efb0c
lea eax, [ebx + 0x3c]
call fcn.00553c90
test al, al
je 0x4efb0c
mov byte [ebx + 0x6d], 0
lea esi, [ebx + 0x2c]
lea edi, [ebx + 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0xa0]
mov dword [ebx + 0x14], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4efb39
call fcn.0040476c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53c6f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x53c868
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x398]
test eax, eax
je 0x53c838
cmp dword [eax + 0x440], 0
je 0x53c838
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [ebx + 0x338]
cmp eax, 0xc8
jbe 0x53c838
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebx + 0x338], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00463ea0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x53c76d
sub eax, 4
mov eax, dword [eax]
dec eax
jne 0x53c7ab
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00463ea0
mov eax, dword [ebp - 0x14]
call fcn.0040579c
push eax
mov eax, ebx
call fcn.0053d38c
push eax
push 0x18f
mov eax, dword [ebx + 0x398]
mov eax, dword [eax + 0x440]
call fcn.0046bfcc
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x53c7de
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00463ea0
mov eax, dword [ebp - 0x18]
call fcn.0040579c
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x398]
mov eax, dword [eax + 0x440]
call fcn.0046bfcc
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x53c838
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00463ea0
mov edx, esi
mov eax, ebx
call fcn.0053d398
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00463ea0
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x53c80d
sub eax, 4
mov eax, dword [eax]
mov edx, eax
mov eax, ebx
call fcn.0053ca08
mov eax, dword [ebp - 8]
test eax, eax
je 0x53c822
sub eax, 4
mov eax, dword [eax]
mov edx, esi
test edx, edx
je 0x53c82d
sub edx, 4
mov edx, dword [edx]
sub eax, edx
mov edx, eax
mov eax, ebx
call fcn.0053ca24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c86f
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405330
lea eax, [ebp - 0xc]
call fcn.0040530c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405330
ret
Function at 0x53c878
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040578c
xor eax, eax
push ebp
push 0x53c99e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x398]
test eax, eax
je 0x53c988
cmp dword [eax + 0x440], 0
je 0x53c988
cmp byte [ebx + 0x340], 0
je 0x53c900
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [ebx + 0x338]
cmp eax, 0x1f4
jb 0x53c8d9
lea eax, [ebx + 0x33c]
call fcn.0040530c
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebx + 0x338], eax
lea eax, [ebx + 0x33c]
mov edx, dword [ebp - 4]
call fcn.004055d8
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x33c]
call fcn.004053a4
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x53c90e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x53c978
mov eax, edx
test eax, eax
je 0x53c91d
sub eax, 4
mov eax, dword [eax]
dec eax
jne 0x53c94f
mov eax, dword [ebp - 4]
call fcn.0040579c
push eax
mov eax, ebx
call fcn.0053d38c
push eax
push 0x18f
mov eax, dword [ebx + 0x398]
mov eax, dword [eax + 0x440]
call fcn.0046bfcc
push eax
call sub.user32.dll_SendMessageA
jmp 0x53c97b
mov eax, dword [ebp - 4]
call fcn.0040579c
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x398]
mov eax, dword [eax + 0x440]
call fcn.0046bfcc
push eax
call sub.user32.dll_SendMessageA
jmp 0x53c97b
or eax, 0xffffffff
test eax, eax
jl 0x53c988
mov edx, eax
mov eax, ebx
call fcn.0053d398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c9a5
lea eax, [ebp - 4]
call fcn.0040530c
ret
Function at 0x54d244
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.0054df58
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0054d164
pop ecx
call fcn.00553bdc
test al, al
je 0x54d2ed
mov eax, dword [edi]
mov eax, dword [eax + 0x268]
cmp byte [eax + 0x60], 0
je 0x54d2ed
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.0046bfcc
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.0046bfcc
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x268]
cmp byte [eax + 0x61], 0
je 0x54d2d5
mov eax, dword [edi]
call fcn.0046bfcc
xor edx, edx
call fcn.00553c18
jmp 0x54d2ed
mov eax, dword [edi]
call fcn.0046bfcc
mov edx, dword [edi]
mov edx, dword [edx + 0x268]
movzx edx, byte [edx + 0x62]
call fcn.00553c18
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.0046bfcc
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.00463dc0
mov eax, dword [edi]
mov ebx, dword [eax + 0x268]
cmp byte [ebx + 0x61], 0
je 0x54d386
cmp byte [ebx + 0x60], 0
je 0x54d386
call fcn.00553bdc
test al, al
je 0x54d386
mov eax, dword [0x633788]
mov eax, dword [eax]
call fcn.0045b830
xor ebx, ebx
xor esi, esi
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, esi
cmp eax, 5
jbe 0x54d376
call sub.KERNEL32.DLL_GetTickCount_1
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x268]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x54d368
mov ebx, eax
mov eax, dword [edi]
call fcn.0046bfcc
mov edx, ebx
call fcn.00553c18
mov eax, dword [edi]
mov eax, dword [eax + 0x268]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x54d340
mov eax, dword [edi]
call fcn.0054e4a0
mov eax, dword [edi]
call fcn.0046bfcc
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55f034
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x55f062
mov eax, ebx
call fcn.0055fae8
cmp dword [ebx + 0x40], 0
je 0x55f05b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x55f0d3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x55f0c5
cmp dword [ebx + 8], 0
je 0x55f084
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x55f096
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x55f0c5
cmp dword [ebx + 8], 0
je 0x55f077
cmp eax, 3
je 0x55f0a9
dec eax
jne 0x55f077
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x55f077
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x55f077
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x55f0f1
cmp dword [ebx + 0x14], 0xcc
je 0x55f0f1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0055f0fc
pop ebx
ret

Function at 0x570f1c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x570f6d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x570f54
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x570f44
jmp 0x570f6d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x570f55
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x584e58
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4103e8]
call fcn.00406108
xor eax, eax
push ebp
push 0x584ff9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x623844], 0
jne 0x584eb3
mov ecx, dword [0x63302c]
mov dl, 1
mov eax, dword [0x408fe4]
call fcn.0040e274
call fcn.00404c64
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a40
mov eax, ebx
call fcn.00405d24
mov dword [ebp - 0x24], eax
mov esi, 0x585008
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004074f8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405d34
test eax, eax
jle 0x584f9c
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x584f88
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.0040557c
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x584f2e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405594
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x584f44
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405594
mov eax, dword [ebp - 0x54]
call fcn.0040579c
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.0040557c
mov eax, dword [ebp - 0x58]
call fcn.0040579c
push eax
push 1
push 0x400
call sub.KERNEL32.DLL_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x584f8a
xor eax, eax
test al, al
je 0x584f95
mov ebx, 0x15
jmp 0x584fa1
mov ebx, 0x10
jmp 0x584fa1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x623844]
call fcn.00584c7c
mov eax, dword [ebp - 4]
call fcn.00584c7c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x585000
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405330
lea eax, [ebp - 0xc]
mov edx, dword [0x4103e8]
call fcn.004061d8
ret
Function at 0x5874e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x6239f8]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x58750b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x5875cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x6239f8]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x587607
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x5876dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x6239f8]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x587727
add esp, 0xc
pop edi
pop esi
pop ebx
ret