joyce8/EMBER2024-capa huggingface dataset:
Function at 0x595af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jle 0x595b91
cmp ecx, 0x100
jle 0x595b0b
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp + 0x14]
push esi
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
push edi
mov edi, dword [ebp + 0xc]
shr edx, 8
test edi, edi
jle 0x595b8f
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea ecx, [eax*4]
mov dword [ebp + 0x18], ecx
push ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
or eax, 0xff000000
mov dword [esi], eax
add esi, dword [ebp + 0x18]
dec edi
jne 0x595b53
pop ebx
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x595ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
jle 0x595c36
cmp edx, 0x100
jle 0x595bbb
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 0x10]
push esi
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
push edi
mov edi, dword [ebp + 0xc]
shr ecx, 8
test edi, edi
jle 0x595c34
mov esi, dword [ebp + 8]
push ebx
mov edx, dword [esi]
mov eax, edx
not eax
mov ebx, eax
xor ebx, ecx
and eax, ecx
and ebx, 0xfefefe
lea eax, [ebx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, edx
or eax, ecx
sub ebx, eax
or ebx, 0xff000000
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x595bf6
pop ebx
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x595c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jle 0x595cd4
cmp ecx, 0x100
jle 0x595c5b
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp + 0x10]
push esi
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
push edi
mov edi, dword [ebp + 0xc]
shr edx, 8
test edi, edi
jle 0x595cd2
mov esi, dword [ebp + 8]
push ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
or eax, 0xff000000
mov dword [esi], eax
add esi, 4
dec edi
jne 0x595c96
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x595ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1c]
test edx, edx
jle 0x595d9a
cmp edx, 0x100
jle 0x595cfb
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 0x18]
push esi
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
mov eax, dword [ebp + 0x10]
shr ecx, 8
test eax, eax
jle 0x595d99
mov edx, dword [ebp + 0x14]
add edx, edx
add edx, edx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp + 8]
mov dword [ebp + 0x1c], eax
test edi, edi
jle 0x595d8f
lea ebx, [ebx]
mov esi, dword [edx]
mov eax, esi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, esi
or eax, ecx
sub ebx, eax
or ebx, 0xff000000
mov dword [edx], ebx
add edx, 4
dec edi
jne 0x595d50
mov edi, dword [ebp + 0xc]
add edx, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x595d46
pop edi
pop ebx
pop esi
pop ebp
ret 0x18

Function at 0x595da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jle 0x595e59
cmp ecx, 0x100
jle 0x595dbb
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp + 0x18]
push esi
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
mov eax, dword [ebp + 0x10]
shr edx, 8
test eax, eax
jle 0x595e58
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
add ecx, ecx
push ebx
add ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0x1c], eax
test edi, edi
jle 0x595e4e
lea ebx, [ebx]
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
or eax, 0xff000000
mov dword [esi], eax
add esi, 4
dec edi
jne 0x595e10
mov edi, dword [ebp + 0xc]
add esi, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x595e06
pop edi
pop ebx
pop esi
pop ebp
ret 0x18

Function at 0x595f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x595fab
mov ecx, dword [ebp + 0x18]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
push ebx
mov dword [ebp + 0x18], edx
lea edx, [ecx*4]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x1c], edx
mov edx, dword [ebp + 0xc]
push edi
mov dword [ebp + 0x14], eax
test esi, esi
jle 0x595f9d
mov edi, dword [ebp + 0x20]
add edi, edi
add edi, edi
mov edi, edi
mov eax, dword [edx]
mov ebx, eax
not ebx
xor ebx, eax
and ebx, 0xffffff
xor ebx, eax
mov dword [ecx], ebx
add ecx, 4
add edx, edi
dec esi
jne 0x595f80
mov esi, dword [ebp + 0x10]
add ecx, dword [ebp + 0x18]
add edx, dword [ebp + 0x1c]
dec dword [ebp + 0x14]
jne 0x595f73
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x5962a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x24]
test eax, eax
jle 0x5963d9
push ebx
push esi
cmp eax, 0x100
mov eax, dword [ebp + 0x14]
push edi
jl 0x59632d
test eax, eax
jle 0x5963d6
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x596319
mov dword [ebp + 0x24], eax
mov esi, dword [ebx]
mov eax, dword [edi]
mov ecx, esi
not ecx
call fcn.00410cb0
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add edi, 4
add ebx, eax
dec dword [ebp + 0x24]
jne 0x5962f1
add edi, dword [ebp + 0x14]
add ebx, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x5962e7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
test eax, eax
jle 0x5963d6
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp - 4], eax
mov ecx, 1
lea ecx, [ecx]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x5963cb
mov dword [ebp + 0x1c], eax
lea ebx, [ebx]
mov esi, dword [ebx]
mov eax, esi
not eax
mov ecx, eax
mov edx, eax
and ecx, 0xffff00ff
imul ecx, dword [ebp + 0x24]
and edx, 0xff00
imul edx, dword [ebp + 0x24]
and eax, 0xff00ff
imul eax, dword [ebp + 0x24]
xor ecx, edx
and ecx, 0xff0000
xor ecx, eax
mov eax, dword [edi]
shr ecx, 8
call fcn.00410cb0
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
mov ecx, 1
add edi, 4
add ebx, eax
sub dword [ebp + 0x1c], ecx
jne 0x596370
add edi, dword [ebp + 0x14]
add ebx, dword [ebp + 0x18]
sub dword [ebp - 4], ecx
jne 0x596360
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x5963e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x24]
test ebx, ebx
jle 0x596505
mov eax, dword [ebp + 0x14]
push esi
push edi
cmp ebx, 0x100
jl 0x596469
test eax, eax
jle 0x596503
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x596457
mov dword [ebp + 0xc], eax
mov esi, dword [ebx]
mov eax, dword [edi]
mov ecx, esi
call fcn.00410cb0
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add edi, 4
add ebx, eax
dec dword [ebp + 0xc]
jne 0x596431
add edi, dword [ebp + 0x14]
add ebx, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x596427
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
test eax, eax
jle 0x596503
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x5964f5
mov dword [ebp + 0x1c], eax
jmp 0x5964a0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov ecx, esi
and ecx, 0xffff00ff
imul ecx, ebx
mov edx, esi
and edx, 0xff00
imul edx, ebx
mov eax, esi
and eax, 0xff00ff
imul eax, ebx
xor ecx, edx
and ecx, 0xff0000
xor ecx, eax
mov eax, dword [edi]
shr ecx, 8
call fcn.00410cb0
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
add edi, 4
dec dword [ebp + 0x1c]
jne 0x5964a0
mov ecx, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
add dword [ebp + 0xc], ecx
dec dword [ebp + 0x24]
jne 0x596491
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
Function at 0x5966d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x24]
test edx, edx
jg 0x596704
mov edx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop ebp
ret 0x20
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x5967a3
mov ecx, dword [ebp + 0x18]
add ecx, ecx
add ecx, ecx
mov dword [ebp + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
add ecx, ecx
push ebx
add ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x10]
push edi
mov ecx, 1
test eax, eax
jle 0x596792
mov dword [ebp + 0x14], eax
jmp 0x596740
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, ecx
not eax
mov edi, eax
mov ebx, eax
and edi, 0xffff00ff
imul edi, edx
and ebx, 0xff00
and eax, 0xff00ff
imul ebx, edx
imul eax, edx
xor edi, ebx
and edi, 0xff0000
xor edi, eax
mov eax, dword [ebp + 0x20]
shr edi, 8
add edi, ecx
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
mov dword [esi], edi
mov ecx, 1
add esi, 4
sub dword [ebp + 0x14], ecx
jne 0x596740
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
add esi, dword [ebp + 0x24]
add dword [ebp + 0xc], edi
sub dword [ebp + 0x18], ecx
jne 0x596734
pop edi
pop esi
pop ebx
pop ebp
ret 0x20

Function at 0x5967b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x24]
cmp edx, 0x100
jl 0x5967e8
mov edx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop ebp
ret 0x20
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x596890
mov ecx, dword [ebp + 0x18]
add ecx, ecx
add ecx, ecx
mov dword [ebp + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
push ebx
add ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
add ecx, ecx
push edi
mov dword [ebp + 0x1c], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov edi, 1
jmp 0x596820
test eax, eax
jle 0x596882
mov dword [ebp + 0x14], eax
jmp 0x596830
mov eax, dword [esi]
mov edi, eax
and edi, 0xffff00ff
mov ebx, eax
imul edi, edx
and ebx, 0xff00
imul ebx, edx
xor edi, ebx
mov ebx, eax
and ebx, 0xff00ff
imul ebx, edx
and edi, 0xff0000
xor edi, ebx
and eax, 0xff000000
shr edi, 8
or edi, eax
mov eax, dword [ebp + 0x20]
add eax, eax
mov dword [ecx], edi
add eax, eax
mov edi, 1
add ecx, 4
add esi, eax
sub dword [ebp + 0x14], edi
jne 0x596830
mov eax, dword [ebp + 0x10]
add ecx, dword [ebp + 0x24]
add esi, dword [ebp + 0x1c]
sub dword [ebp + 0x18], edi
jne 0x596820
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
Function at 0x596910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x24]
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 1], al
mov eax, dword [ebp + 0x14]
mov edx, ecx
sar edx, 8
mov byte [ebp - 2], dl
test eax, eax
jle 0x596a34
mov edx, dword [ebp + 0x18]
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x1c]
push ebx
add edx, edx
push esi
mov esi, dword [ebp + 8]
add edx, edx
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x596a1f
movzx edx, byte [ebp - 1]
movzx ecx, cl
mov dword [ebp + 0x1c], ecx
movzx ecx, byte [ebp - 2]
mov dword [ebp + 8], edx
mov dword [ebp - 8], ecx
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
movzx ecx, bl
imul ecx, dword [ebp + 0x1c]
mov eax, 0x80808081
mul ecx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [ebp + 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
mov edi, dword [esi]
and ecx, 0xff
or ecx, edx
mov edx, ebx
and edx, 0xff00
imul edx, dword [ebp - 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov eax, edi
not eax
mov edx, eax
xor eax, ecx
and eax, 0xfefefe
and edx, ecx
lea eax, [eax + edx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov edx, eax
or eax, edi
or edx, ecx
sub eax, edx
xor eax, ebx
and eax, 0xffffff
xor eax, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
add esi, 4
dec dword [ebp + 0x14]
jne 0x596973
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp - 0x10]
add esi, dword [ebp - 0xc]
add dword [ebp + 0xc], eax
dec dword [ebp + 0x18]
jne 0x596951
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x596a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x24]
sub esp, 0x10
test eax, eax
je 0x596b71
mov ecx, eax
sar ecx, 0x10
mov byte [ebp - 1], cl
mov ecx, dword [ebp + 0x14]
mov edx, eax
sar edx, 8
mov byte [ebp - 2], dl
test ecx, ecx
jle 0x596b71
mov edx, dword [ebp + 0x18]
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x1c]
push ebx
add edx, edx
push esi
add edx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp + 0x18], ecx
lea esp, [esp]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x596b5c
movzx edx, byte [ebp - 1]
movzx eax, al
mov dword [ebp + 0x1c], eax
movzx eax, byte [ebp - 2]
mov dword [ebp + 8], edx
mov dword [ebp - 8], eax
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ecx]
movzx edx, bl
imul edx, dword [ebp + 0x1c]
mov eax, 0x80808081
mul edx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [ebp + 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
and ecx, 0xff
or ecx, edx
mov esi, dword [edi]
mov edx, ebx
and edx, 0xff00
imul edx, dword [ebp - 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov edx, ecx
mov eax, ecx
and eax, esi
xor edx, esi
and edx, 0xfefefe
lea eax, [edx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
sub ecx, eax
add ecx, esi
or ecx, eax
mov eax, dword [ebp + 0x20]
xor ecx, ebx
and ecx, 0xffffff
add eax, eax
xor ecx, ebx
add eax, eax
add dword [ebp + 0xc], eax
mov dword [edi], ecx
add edi, 4
dec dword [ebp + 0x14]
jne 0x596ab2
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
add dword [ebp + 0xc], ecx
dec dword [ebp + 0x18]
jne 0x596a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x596c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x24]
test eax, eax
jle 0x596e22
push ebx
push esi
push edi
cmp eax, 0x100
jl 0x596d48
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x596e1f
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp + 8]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov ecx, 1
test eax, eax
jle 0x596d34
mov dword [ebp + 0xc], eax
lea ebx, [ebx]
mov esi, dword [edx]
mov ecx, dword [edi]
mov eax, esi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or eax, esi
or ebx, ecx
sub eax, ebx
xor eax, ecx
and eax, 0xffffff
xor eax, ecx
mov dword [edx], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
mov ecx, 1
add edx, 4
add edi, eax
sub dword [ebp + 0xc], ecx
jne 0x596ce0
mov eax, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
add edi, dword [ebp + 0x18]
sub dword [ebp + 0x24], ecx
jne 0x596cd3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jle 0x596e1f
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
add edx, edx
add edx, edx
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0x1c]
add edx, edx
add edx, edx
mov dword [ebp + 0x18], edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov edx, 1
test ecx, ecx
jle 0x596e0d
mov dword [ebp + 0x1c], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov edi, dword [esi]
mov ecx, edx
and ecx, 0xffff00ff
imul ecx, eax
mov ebx, edx
and ebx, 0xff00
imul ebx, eax
xor ecx, ebx
mov ebx, edx
and ebx, 0xff00ff
imul ebx, eax
and ecx, 0xff0000
xor ecx, ebx
shr ecx, 8
mov eax, edi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or eax, edi
or ebx, ecx
sub eax, ebx
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x24]
mov edx, 1
add esi, 4
sub dword [ebp + 0x1c], edx
jne 0x596d80
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x18]
add esi, dword [ebp + 0x14]
add dword [ebp + 0xc], edi
sub dword [ebp - 4], edx
jne 0x596d75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x596e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jle 0x596fd0
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
cmp ecx, 0x100
jl 0x596ef8
test eax, eax
jle 0x596fcd
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x18], edx
mov ecx, 1
test eax, eax
jle 0x596ee4
mov dword [ebp + 0xc], eax
jmp 0x596e90
mov ecx, dword [edi]
mov edx, dword [esi]
mov ebx, ecx
xor ebx, edx
and ebx, 0xfefefe
mov eax, ecx
and eax, edx
lea eax, [ebx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, ecx
sub ebx, eax
add ebx, edx
or ebx, eax
mov eax, dword [ebp + 0x20]
xor ebx, ecx
and ebx, 0xffffff
xor ebx, ecx
add eax, eax
add eax, eax
mov dword [esi], ebx
mov ecx, 1
add esi, 4
add edi, eax
sub dword [ebp + 0xc], ecx
jne 0x596e90
mov eax, dword [ebp + 0x10]
add esi, dword [ebp + 0x14]
add edi, dword [ebp + 0x18]
sub dword [ebp + 0x24], ecx
jne 0x596e84
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
test eax, eax
jle 0x596fcd
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
add edx, edx
add edx, edx
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0x1c]
add edx, edx
add edx, edx
mov dword [ebp + 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, 1
test eax, eax
jle 0x596fbb
mov dword [ebp + 0x1c], eax
lea ecx, [ecx]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov esi, dword [edi]
mov eax, edx
and eax, 0xffff00ff
imul eax, ecx
mov ebx, edx
and ebx, 0xff00
imul ebx, ecx
xor eax, ebx
mov ebx, edx
and ebx, 0xff00ff
imul ebx, ecx
and eax, 0xff0000
xor eax, ebx
shr eax, 8
mov ebx, eax
mov ecx, eax
and ecx, esi
xor ebx, esi
and ebx, 0xfefefe
lea ecx, [ebx + ecx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, esi
or eax, ecx
mov ecx, dword [ebp + 0x24]
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
mov edx, 1
add edi, 4
sub dword [ebp + 0x1c], edx
jne 0x596f30
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
add dword [ebp + 0xc], esi
sub dword [ebp - 4], edx
jne 0x596f22
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x59d040
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x59d059
mov eax, dword [ecx + 8]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
mov ecx, dword [ecx + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x59f160
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
test edi, edi
je 0x59f1a3
cmp byte [ebp + 8], 0
je 0x59f183
cmp dword [edi + 0x1c], 0
je 0x59f183
mov ecx, dword [edi + 0x10]
push edi
call fcn.005ae360
mov eax, dword [edi + 0x18]
test eax, eax
jne 0x59f1ac
cmp dword [edi + 0x58], 0x10
lea eax, [edi + 0x44]
jb 0x59f195
mov eax, dword [eax]
push eax
push 0x640b78
call fcn.00422d30
add esp, 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [eax]
push 0
push 0x12
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
movzx eax, word [esp + 0x10]
mov dword [esi + 0x24], ecx
movzx ecx, word [esp + 0x12]
mov dword [esi + 0x20], edx
movzx edx, word [esp + 6]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [0x6923d8]
mov edx, dword [ecx]
lea ebx, [esi + 0x18]
push ebx
push eax
mov eax, dword [edx + 0x14]
push ecx
call eax
test eax, eax
js 0x59f1a3
push 0xffffffffffffffff
lea eax, [edi + 0x44]
push 0
push eax
lea ecx, [esi + 0x44]
call fcn.004018d0
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5a2880
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f8
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
push 0x80
lea edx, [esp + 0x1c]
push edx
push ecx
mov dword [esp + 0xc], 0x1f8
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], 0x402
mov dword [esp + 0x18], 7
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esp, ebp
pop ebp
ret