joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5acdef
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x1c], 2
push ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x20
pop ebx
je 0x5ace70
cmp dword [ebp + 0x10], 0
je 0x5ace3f
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push 0
call fcn.00572064
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x5ace3f
push 0x3b
push str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.00553208
add esp, 0x14
xor eax, eax
jmp 0x5ad01b
cmp dword [ebp + 0x14], 0
je 0x5ace6c
cmp edi, 0x40a
je 0x5ace65
cmp edi, 0x43f
je 0x5ace65
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5ace67
mov eax, ebx
cmp dword [ebp + 0x18], eax
je 0x5ace70
push 0x41
jmp 0x5ace22
push esi
push 0x46
mov esi, str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push esi
push 0x40
call fcn.005543fe
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x5acea3
push 0x48
push esi
push 0x41
push 0x10a
push 0x10
call fcn.00553208
add esp, 0x14
jmp 0x5acf6a
cmp dword [ebp + 0x1c], 0
jne 0x5acebd
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call fcn.007390e0
add esp, 0xc
jmp 0x5ad008
cmp edi, 0x40a
je 0x5acedd
cmp edi, 0x43f
je 0x5acedd
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5acedf
mov eax, ebx
push 0x50
push esi
push eax
call fcn.00554458
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], esi
test esi, esi
jne 0x5acf15
push 0x52
mov edi, str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push edi
push 0x41
push 0x10a
push 0x10
call fcn.00553208
mov eax, dword [ebp - 4]
add esp, 0x14
jmp 0x5acf5e
cmp dword [ebp + 0x1c], 2
jne 0x5acf99
cmp edi, 0x40a
je 0x5acf39
cmp edi, 0x43f
je 0x5acf39
xor ebx, ebx
cmp edi, 0x40b
setne bl
add ebx, 0x38
push ebx
push esi
call fcn.00554eb2
pop ecx
pop ecx
test eax, eax
jg 0x5acf71
push 0x57
mov edi, str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push edi
push esi
call fcn.00554453
mov eax, dword [ebp - 4]
add esp, 0xc
and dword [eax + 0x3c], 0
push 0x79
push edi
push eax
call fcn.0055429f
add esp, 0xc
xor eax, eax
jmp 0x5ad01a
cmp edi, 0x40a
jne 0x5acf88
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
jmp 0x5acfc4
cmp edi, 0x40b
jne 0x5acfc4
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x5acfc4
cmp edi, 0x40a
je 0x5acfb7
cmp edi, 0x43f
je 0x5acfb7
xor ebx, ebx
cmp edi, 0x40b
setne bl
add ebx, 0x38
push ebx
push dword [ebp + 0x14]
push esi
call fcn.007390e0
add esp, 0xc
mov eax, edi
sub eax, 0x40a
je 0x5acffd
sub eax, 1
je 0x5acff2
sub eax, 0x34
je 0x5acfe7
sub eax, 1
jne 0x5ad008
push esi
push dword [ebp - 4]
call fcn.005f7f2a
jmp 0x5ad006
push esi
push dword [ebp - 4]
call fcn.005eee80
jmp 0x5ad006
push esi
push dword [ebp - 4]
call fcn.005f669e
jmp 0x5ad006
push esi
push dword [ebp - 4]
call fcn.005ef219
pop ecx
pop ecx
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call fcn.00547513
xor eax, eax
add esp, 0xc
inc eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x5aef55
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00545956
pop ecx
cmp eax, 0x72
jne 0x5af042
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
mov ecx, eax
push esi
push edi
push dword [ebp + 0x18]
shr ecx, 1
and eax, 1
push dword [ebp + 0x14]
add eax, ecx
mov dword [ebp - 8], ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.0055b22d
push eax
call fcn.005aed58
add esp, 0x1c
test eax, eax
je 0x5aefd6
push 0x104
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push esi
call fcn.0055426d
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x5aefdd
push 0x105
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.00553208
add esp, 0x14
xor eax, eax
jmp 0x5af06a
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0xc]
push esi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call fcn.005474e9
push eax
call fcn.005aed58
add esp, 0x1c
test eax, eax
jne 0x5af017
push 0x10a
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.00554316
add esp, 0x10
jmp 0x5aefd6
test esi, esi
je 0x5af02c
mov ecx, ebx
mov edx, esi
sub ecx, edi
mov al, byte [ecx + edi]
xor byte [edi], al
inc edi
sub edx, 1
jne 0x5af021
push 0x10f
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.00554316
add esp, 0x10
jmp 0x5af067
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005aed58
add esp, 0x1c
test eax, eax
je 0x5aefd6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b9560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
push edi
test eax, eax
je 0x5b957d
test byte [eax + 0x5c], 2
mov edi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x5b9582
mov edi, 0x844850
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
test esi, esi
jle 0x5b9645
push ebx
mov ebx, dword [ebp + 0x10]
inc ebx
movzx ecx, byte [ebx - 1]
cmp esi, 3
jl 0x5b95e0
movzx eax, byte [ebx]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + edi]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + edi]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
and ecx, 0x3f
mov al, byte [eax + edi]
mov byte [edx + 2], al
lea eax, [edx + 3]
mov cl, byte [ecx + edi]
jmp 0x5b9628
shl ecx, 0x10
cmp esi, 2
jne 0x5b95f0
movzx eax, byte [ebx]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + edi]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
inc edx
and eax, 0x3f
mov dword [ebp + 0xc], edx
mov al, byte [eax + edi]
mov byte [edx], al
cmp esi, 1
jne 0x5b9614
mov al, 0x3d
jmp 0x5b961d
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + edi]
mov byte [edx + 1], al
mov cl, 0x3d
mov eax, dword [ebp + 0xc]
add eax, 2
mov byte [eax], cl
lea edx, [eax + 1]
mov ecx, dword [ebp - 4]
sub esi, 3
add ecx, 4
add ebx, 3
mov dword [ebp - 4], ecx
test esi, esi
jg 0x5b9595
pop ebx
pop edi
mov byte [edx], 0
mov eax, ecx
pop esi
leave
ret
Function at 0x5be938
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1048
push 0x845370
push edi
call fcn.007390e0
mov ebx, dword [ebp + 0x10]
add esp, 0xc
push 0x48
pop edx
cmp dword [ebp + 0xc], edx
cmovle edx, dword [ebp + 0xc]
add edx, ebx
xor esi, esi
movzx ecx, byte [ebx]
inc ebx
cmp ebx, edx
cmovae ebx, dword [ebp + 0x10]
shl ecx, 8
movzx eax, byte [ebx]
or ecx, eax
inc ebx
cmp ebx, edx
cmovae ebx, dword [ebp + 0x10]
shl ecx, 8
movzx eax, byte [ebx]
or ecx, eax
inc ebx
cmp ebx, edx
cmovae ebx, dword [ebp + 0x10]
shl ecx, 8
movzx eax, byte [ebx]
or ecx, eax
inc ebx
cmp ebx, edx
cmovae ebx, dword [ebp + 0x10]
xor dword [edi + esi*4], ecx
inc esi
cmp esi, 0x12
jl 0x5be967
xor esi, esi
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 8]
push edi
push eax
call fcn.005bf35d
mov eax, dword [ebp - 8]
mov dword [edi + ebx*4], eax
mov eax, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
pop ecx
pop ecx
cmp ebx, 0x12
jl 0x5be9b1
lea eax, [ebp - 8]
push edi
push eax
call fcn.005bf35d
mov eax, dword [ebp - 8]
mov dword [edi + esi*4 + 0x48], eax
mov eax, dword [ebp - 4]
mov dword [edi + esi*4 + 0x4c], eax
add esi, 2
pop ecx
pop ecx
cmp esi, 0x400
jl 0x5be9d2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5bf8e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push ebx
movzx ebx, byte [ecx]
push esi
lea esi, [ecx + 1]
shl ebx, 0x18
mov edx, esi
mov dword [ebp - 0x28], ecx
push edi
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x14], eax
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x24], esi
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x1c], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x18], edx
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x5bfa5e
mov ecx, dword [ebp + 8]
sub dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 0x10]
dec eax
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x5bfa07
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
call fcn.005bf35d
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edx, dword [ebp - 0x18]
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
pop ecx
shr eax, 8
inc dword [ebp - 0x14]
pop ecx
mov ecx, dword [ebp + 8]
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + edi - 0xc]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
mov eax, dword [ebp + 0x10]
inc edi
and edi, 7
mov dword [ebp + 8], ecx
test eax, eax
jne 0x5bf9af
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
je 0x5bfa5e
mov ecx, dword [ebp - 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
mov eax, ebx
shr eax, 8
mov byte [esi + 1], al
mov eax, edx
shr eax, 0x18
mov byte [esi + 2], bl
mov byte [esi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 4], al
mov eax, edx
shr eax, 8
mov byte [esi + 5], al
mov byte [esi + 6], dl
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
pop ebx
call fcn.007207bc
leave
ret
Function at 0x5c1eb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push ebx
movzx ebx, byte [ecx]
push esi
lea esi, [ecx + 1]
shl ebx, 0x18
mov edx, esi
mov dword [ebp - 0x28], ecx
push edi
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x14], eax
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x24], esi
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x1c], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x18], edx
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x5c2034
mov ecx, dword [ebp + 8]
sub dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 0x10]
dec eax
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x5c1fdd
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
call fcn.005c18af
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edx, dword [ebp - 0x18]
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
pop ecx
shr eax, 8
inc dword [ebp - 0x14]
pop ecx
mov ecx, dword [ebp + 8]
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + edi - 0xc]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
mov eax, dword [ebp + 0x10]
inc edi
and edi, 7
mov dword [ebp + 8], ecx
test eax, eax
jne 0x5c1f85
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
je 0x5c2034
mov ecx, dword [ebp - 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
mov eax, ebx
shr eax, 8
mov byte [esi + 1], al
mov eax, edx
shr eax, 0x18
mov byte [esi + 2], bl
mov byte [esi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 4], al
mov eax, edx
shr eax, 8
mov byte [esi + 5], al
mov byte [esi + 6], dl
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
pop ebx
call fcn.007207bc
leave
ret
Function at 0x5c3274
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x2e
push eax
mov dword [ebp - 0x40], eax
xorps xmm0, xmm0
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x32]
push eax
mov dword [ebp - 0x44], 0x1010040
movlpd qword [ebp - 0x3c], xmm0
call fcn.00739c90
push 0xa8
lea eax, [ebx + 0x40]
push 0
push eax
call fcn.00739c90
add esp, 0x18
mov esi, 0x848938
mov edi, ebx
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x44]
push 8
sub esi, ebx
pop edi
mov ecx, dword [esi + ebx]
mov edx, dword [esi + ebx + 4]
xor dword [ebx], ecx
lea ebx, [ebx + 8]
xor dword [ebx - 4], edx
sub edi, 1
jne 0x5c32d5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.007207bc
leave
ret
Function at 0x5c979f
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
lea edi, [ebp - 0x15]
mov word [ebp - 0x18], cx
mov byte [ebp - 0x16], cl
mov dword [ebp - 0x24], 0x1010020
stosd dword es:[edi], eax
push 0x54
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebx + 0x20]
push eax
call fcn.00739c90
add esp, 0xc
mov esi, 0x848978
mov edi, ebx
push 8
pop edx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x24]
sub esi, ebx
mov ecx, dword [esi + ebx]
xor dword [ebx], ecx
lea ebx, [ebx + 4]
sub edx, 1
jne 0x5c97f7
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.007207bc
leave
ret
Function at 0x5cc414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, ebx
push edi
mov edi, dword [ebp + 0x10]
shr eax, 3
mov dword [ebp - 8], eax
cmp edi, ebx
jb 0x5cc51b
push esi
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
test eax, eax
je 0x5cc503
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 7]
cdq
mov esi, eax
mov ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 6]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 5]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 4]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 3]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 2]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 1]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
add dword [ebp + 0xc], 8
shld ecx, esi, 8
movzx eax, byte [eax]
cdq
or ecx, edx
shl esi, 8
or esi, eax
push ecx
push esi
call fcn.005cba6f
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor dword [edi + ecx*8], eax
xor dword [edi + ecx*8 + 4], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x5cc447
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push esi
call fcn.005cbb69
mov eax, dword [ebp - 8]
sub edi, ebx
mov dword [ebp + 0x10], edi
pop ecx
cmp edi, ebx
jae 0x5cc435
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x5cc6f8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x5cc8c6
dec esi
lea edx, [eax + 0x14]
push ebx
lea ebx, [eax + 0xc]
shr esi, 3
push edi
mov edi, dword [ebp + 0xc]
inc esi
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], edx
movzx eax, byte [edi + 1]
movzx ecx, byte [edi]
lea edi, [edi + 8]
shl eax, 8
or ecx, eax
movzx eax, byte [edi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edi - 3]
shl eax, 8
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa4], ecx
movzx ecx, byte [edi - 4]
or ecx, eax
movzx eax, byte [edi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edi - 1]
shl eax, 0x18
or ecx, eax
mov al, byte [ebx]
and al, 0xdf
mov dword [ebp - 0x8c], ecx
or al, 0x40
mov dword [ebp - 0x98], ecx
mov byte [ebx], al
mov al, byte [edx]
and al, 0xbf
mov dword [ebp - 0xa0], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.005942ca
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.005940a3
push 1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.005915d5
mov ebx, dword [ebp - 0x90]
push ebx
call fcn.005942ca
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.005940a3
push 1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.005915d5
mov ecx, dword [ebp - 0x8c]
add esp, 0x30
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x88]
xor edx, ecx
xor ecx, dword [ebp - 0xa0]
mov ebx, dword [ebp - 0x9c]
xor ebx, eax
mov dword [ebp - 0x8c], ecx
xor eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp - 0x88]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x88]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0x94]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub esi, 1
jne 0x5cc736
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.007207bc
leave
ret
Function at 0x5d0bf7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x24]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
push edi
push eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x58], 1
call fcn.0054f2fe
mov dword [ebp - 0x5c], eax
pop ecx
test eax, eax
js 0x5d0dd6
call fcn.005f8719
mov edi, eax
mov dword [ebp - 0x68], edi
test edi, edi
je 0x5d0dd6
xor ebx, ebx
test esi, esi
jne 0x5d0c59
mov esi, 0x7dbcd8
mov ecx, ebx
jmp 0x5d0c6f
mov ecx, dword [ebp + 0xc]
cmp ecx, 0xffffffff
jne 0x5d0c6f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5d0c66
sub ecx, edx
push ebx
push dword [ebp - 0x54]
push ecx
push esi
push edi
call fcn.005f882d
add esp, 0x14
test eax, eax
je 0x5d0dcf
call fcn.005f8719
mov esi, eax
test esi, esi
je 0x5d0dcf
mov edx, dword [ebp + 0x20]
jmp 0x5d0db2
cmp edx, dword [ebp - 0x5c]
mov eax, edx
mov ecx, dword [ebp - 0x58]
cmovg eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x48], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x47], al
mov eax, ecx
shr eax, 8
push edi
push esi
mov byte [ebp - 0x46], al
mov byte [ebp - 0x45], cl
call fcn.005f867b
pop ecx
pop ecx
test eax, eax
je 0x5d0dbd
push dword [ebp + 0x14]
push dword [ebp - 0x60]
push esi
call fcn.005f8a78
add esp, 0xc
test eax, eax
je 0x5d0dbd
push 4
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.005f8a78
add esp, 0xc
test eax, eax
je 0x5d0dbd
push ebx
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.005f87a7
add esp, 0xc
test eax, eax
je 0x5d0dbd
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x50]
call fcn.007390e0
xor eax, eax
add esp, 0xc
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp + 0x18], eax
jle 0x5d0da1
push edi
push esi
call fcn.005f867b
pop ecx
pop ecx
test eax, eax
je 0x5d0dbd
push dword [ebp - 0x5c]
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.005f8a78
add esp, 0xc
test eax, eax
je 0x5d0dbd
push ebx
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.005f87a7
add esp, 0xc
test eax, eax
je 0x5d0dbd
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jle 0x5d0d93
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x44]
sub eax, edx
mov edi, ecx
mov dword [ebp - 0x64], eax
mov ecx, eax
mov al, byte [edx + ecx]
xor byte [edx], al
inc edx
sub edi, 1
jne 0x5d0d82
mov edi, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp eax, dword [ebp + 0x18]
jl 0x5d0d39
jmp 0x5d0da4
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp + 0x20]
sub edx, ecx
inc dword [ebp - 0x58]
add dword [ebp - 0x50], ecx
mov dword [ebp + 0x20], edx
test edx, edx
jne 0x5d0c9d
xor ebx, ebx
inc ebx
push esi
call fcn.005f86da
push edi
call fcn.005f86da
pop ecx
pop ecx
mov eax, ebx
jmp 0x5d0dd8
push edi
call fcn.005f86da
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret