joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546aae
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x1c
mov eax, 0x66b0f9
call fcn.006425cf
mov esi, ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0xc], eax
mov ebx, dword [edi + 0x10]
add ebx, ebx
push ebx
call fcn.0047fb2e
cmp dword [edi + 0x14], 8
jb 0x546ae8
mov edi, dword [edi]
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x546b42
cmp dword [esi], 0
jne 0x546b06
call fcn.006189f0
mov dword [eax], 0x16
jmp 0x546b3d
test edi, edi
je 0x546b1c
cmp eax, ebx
jb 0x546b1c
push ebx
push edi
push dword [esi]
call fcn.0060e770
add esp, 0xc
jmp 0x546b42
push eax
push 0
push dword [esi]
call fcn.0060ecf0
add esp, 0xc
test edi, edi
je 0x546af9
cmp dword [ebp - 0x10], ebx
jae 0x546b42
call fcn.006189f0
mov dword [eax], 0x22
call fcn.006188f2
mov eax, dword [esi + 4]
mov ecx, eax
sub ecx, dword [esi]
and ecx, 0xf
je 0x546b5d
sub eax, dword [esi]
sub eax, ecx
mov ecx, esi
add eax, 0x10
push eax
call fcn.0047fb2e
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0
push eax
push dword [esi]
call dword [sym.imp.CRYPT32.dll_CryptProtectMemory]
test eax, eax
je 0x546b7b
mov eax, esi
call fcn.0064259d
ret 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.004cb4ab
push 0x7543a8
lea eax, [ebp - 0x28]
push eax
call fcn.00610b04
int3

Function at 0x546bb1
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x1c
mov eax, 0x66b130
call fcn.006425cf
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push 0x18
cmp eax, dword [esi + 4]
jne 0x546bf0
call fcn.005fa585
pop ecx
mov ecx, eax
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x546c43
call fcn.005fa585
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
shr ecx, 1
push ecx
push dword [esi]
mov ecx, eax
call fcn.004965e5
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 1
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x546c26
mov eax, dword [edi]
push ebx
push ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
je 0x546c4b
push ebx
push dword [esi + 0xc]
mov ecx, edi
call fcn.00462137
mov eax, dword [ebp + 8]
mov dword [eax], edi
call fcn.0064259d
ret 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.004cb4ab
push 0x7543a8
lea eax, [ebp - 0x28]
push eax
call fcn.00610b04
int3
Function at 0x549434
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x66b8a9
call fcn.006425cf
mov esi, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ecx
push 0x1c
call fcn.005fa585
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov edi, ebx
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], 0x549fc4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, 0xffffffff
jne 0x54947e
or eax, ecx
or ecx, ecx
jmp 0x549480
mov eax, esi
mov edi, dword [ebp - 0x14]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.DLL_StartThreadpoolIo]
push ebx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x10], esi
jne 0x5494bb
cmp eax, 0x3e5
je 0x549538
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.DLL_CancelThreadpoolIo]
or edi, 0xffffffff
cmp dword [ebp - 0x10], 1
jne 0x5494f0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push esi
push eax
push ebx
push dword [ecx + 0x3c]
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
or edi, 0xffffffff
test eax, eax
cmovne edi, dword [ebp - 0x10]
cmp edi, 0xffffffff
jne 0x54952c
mov eax, dword [ebp - 0x18]
sub esp, 0x14
mov edx, dword [ebp - 0x1c]
mov ecx, esp
mov eax, dword [eax]
mov esi, dword [eax + 8]
call fcn.004cb4ab
lea ecx, [ebp - 0x20]
call fcn.00549e98
add esp, 0x14
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call dword [0x670300]
mov ecx, dword [ebp - 0x18]
call esi
lea eax, [ebp - 0x20]
push eax
call fcn.005fd120
pop ecx
push 0x1c
push ebx
mov esi, edi
call fcn.005fa352
pop ecx
pop ecx
mov eax, esi
call fcn.0064259d
ret
Function at 0x54a805
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x66bb8b
call fcn.006425cf
mov dword [ebp - 0x14], edx
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov edi, esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
push 3
pop ecx
mov dword [ebp - 0x20], 1
cmp edi, ecx
jb 0x54a8fa
xor edx, edx
mov eax, edi
div ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov cl, byte [edx + 1]
mov bl, byte [edx]
mov bh, byte [edx + 2]
mov byte [ebp - 0xd], cl
movzx ecx, bl
shr ecx, 2
movsx cx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, cx
mov ecx, esi
push eax
call fcn.00461576
and bl, 3
shl bl, 4
movzx ecx, bl
mov bl, byte [ebp - 0xd]
movzx eax, bl
shr eax, 4
or ecx, eax
movsx ax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, esi
movzx eax, ax
push eax
call fcn.00461576
movzx esi, bh
and bl, 0xf
shl bl, 2
mov eax, esi
shr eax, 6
movzx ecx, bl
or ecx, eax
movsx ax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [ebp - 0x18]
movzx eax, ax
push eax
call fcn.00461576
and esi, 0x3f
movsx ax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [ebp - 0x18]
mov ecx, esi
movzx eax, ax
push eax
call fcn.00461576
mov edx, dword [ebp - 0x14]
sub edi, 3
add edx, 3
sub dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], edx
jne 0x54a859
sub edi, 1
je 0x54a961
sub edi, 1
jne 0x54a9aa
mov bl, byte [edx]
mov ecx, esi
mov bh, byte [edx + 1]
movzx eax, bl
shr eax, 2
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, ax
push eax
call fcn.00461576
and bl, 3
movzx eax, bh
shr eax, 4
shl bl, 4
movzx ecx, bl
or ecx, eax
movsx ax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, esi
movzx eax, ax
push eax
call fcn.00461576
and bh, 0xf
shl bh, 2
movzx eax, bh
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, ax
push eax
jmp 0x54a99a
mov bl, byte [edx]
mov ecx, esi
movzx eax, bl
shr eax, 2
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, ax
push eax
call fcn.00461576
and bl, 3
mov ecx, esi
shl bl, 4
movzx eax, bl
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, ax
push eax
call fcn.00461576
push 0x3d
mov ecx, esi
call fcn.00461576
push 0x3d
mov ecx, esi
call fcn.00461576
mov eax, esi
call fcn.0064259d
ret
Function at 0x54c2a2
Capabilities:
Receive http response

Disassembly:
push 0x58
mov eax, 0x66bf8e
call fcn.00642602
mov edi, ecx
mov eax, dword [edi + 8]
mov esi, dword [eax + 0x218]
test esi, esi
jne 0x54c319
push esi
push dword [edi + 0x48]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x54c3d8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push str.WinHttpQueryDataAvaliable
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044ea89
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov edx, esi
lea ecx, [ebp - 0x40]
call fcn.0054ad55
pop ecx
push eax
push esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.005478e2
lea ecx, [ebp - 0x40]
call fcn.004511a7
lea ecx, [ebp - 0x28]
call fcn.004511a7
jmp 0x54c3d8
cmp edx, esi
jae 0x54c333
cmp byte [ebp + 8], 0
jne 0x54c333
push dword [edi + 0x2c]
push dword [edi + 0x28]
call fcn.00547871
jmp 0x54c3d8
lea eax, [ebp - 0x64]
push eax
call fcn.00547c75
push esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 2
call fcn.004be6f3
test eax, eax
jne 0x54c36a
lea ecx, [edi + 0x90]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
cmp esi, eax
jbe 0x54c368
push esi
lfence
call fcn.0047fb2e
xor eax, eax
mov dword [edi + 0x8c], eax
test eax, eax
jne 0x54c37a
mov eax, dword [edi + 0x90]
push 0
push esi
push eax
push dword [edi + 0x48]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x54c3d0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x7149fc
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044ea89
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
mov edx, esi
lea ecx, [ebp - 0x58]
call fcn.0054ad55
pop ecx
push eax
push esi
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.005478e2
lea ecx, [ebp - 0x58]
call fcn.004511a7
lea ecx, [ebp - 0x28]
call fcn.004511a7
lea ecx, [ebp - 0x64]
call fcn.004bea35
call fcn.006425b1
ret
Function at 0x54ef46
Capabilities:
Hash data via bcrypt

Disassembly:
push 0x4c
mov eax, 0x66c546
call fcn.00642602
mov edi, ecx
mov dword [ebp - 0x50], edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
xor ebx, ebx
mov dword [ebp - 0x4c], eax
inc ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ebx
call fcn.004cbac0
mov edx, esi
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
call fcn.004cbac0
push 8
xor esi, esi
mov byte [ebp - 4], 2
push esi
push str.SHA1
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x54f026
push esi
lea eax, [ebp - 0x50]
push eax
push 4
lea eax, [ebp - 0x4c]
push eax
push str.HashDigestLength
push dword [ebp - 0x48]
call dword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
js 0x54f026
push dword [ebp - 0x4c]
mov ecx, edi
call fcn.0047fb2e
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push esi
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push eax
push esi
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
js 0x54f026
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x44]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
js 0x54f026
push esi
push dword [ebp - 0x4c]
push dword [edi]
push dword [ebp - 0x44]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
cmp dword [ebp - 0x44], esi
je 0x54f034
push dword [ebp - 0x44]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
cmp dword [ebp - 0x48], esi
je 0x54f043
push esi
push dword [ebp - 0x48]
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
lea ecx, [ebp - 0x28]
call fcn.004511a7
lea ecx, [ebp - 0x40]
call fcn.004511a7
mov eax, edi
call fcn.006425b1
ret
Function at 0x5503e6
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebx, ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x10], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x10], edi
mov esi, edi
cmp edi, ebp
jge 0x550440
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.005503b7
movzx eax, al
xor eax, 1
imul ecx, edi, 0x18
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.00450ad2
mov edi, esi
cmp esi, ebp
jl 0x550409
mov eax, dword [esp + 0x1c]
cmp esi, ebp
jne 0x55045f
test al, 1
jne 0x55045f
imul eax, eax, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.00450ad2
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x10], edi
jge 0x550490
push dword [esp + 0x20]
lea esi, [edi - 1]
sar esi, 1
imul ebp, esi, 0x18
add ebp, ebx
push ebp
call fcn.005503b7
test al, al
je 0x550490
imul ecx, edi, 0x18
push ebp
add ecx, ebx
call fcn.00450ad2
mov edi, esi
cmp dword [esp + 0x10], esi
jl 0x550465
push dword [esp + 0x20]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.00450ad2
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x55b210
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.005fab70
mov eax, dword [0x758f44]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x38]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], 0
push 0x20
push edi
push edi
push edi
mov esi, 1
mov dword [esp + 0x20], edi
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x38], xmm0
call fcn.005551d0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x55b267
push 0x2d
jmp 0x55b340
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.00554ac0
add esp, 8
call fcn.00555980
mov edi, eax
test edi, edi
je 0x55b33c
call fcn.00555e50
test eax, eax
je 0x55b33c
push 0
push eax
push edi
call fcn.00555580
add esp, 0xc
test eax, eax
jne 0x55b2a8
xor esi, esi
jmp 0x55b359
push dword [esp + 0x44]
push ebp
push edi
call fcn.00555780
add esp, 0xc
test eax, eax
jne 0x55b2c1
xor esi, esi
jmp 0x55b359
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.005553b0
add esp, 0xc
test eax, eax
jne 0x55b2dc
xor esi, esi
jmp 0x55b359
cmp dword [esp + 0x14], 0x20
je 0x55b2e7
xor esi, esi
jmp 0x55b359
mov edx, dword [esp + 0x10]
lea ebp, [esp + 0x37]
xor ecx, ecx
lea eax, [edx + 0x1f]
cmp edx, ebp
ja 0x55b313
lea ebp, [esp + 0x18]
cmp eax, ebp
jb 0x55b313
mov al, byte [esp + ecx + 0x18]
xor byte [edx + ecx], al
inc ecx
cmp ecx, 0x20
jge 0x55b359
mov edx, dword [esp + 0x10]
jmp 0x55b300
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
sub edx, eax
mov ecx, 2
lea eax, [eax + 0x10]
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [edx + eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
sub ecx, esi
jne 0x55b322
jmp 0x55b359
xor esi, esi
push 0x36
push str.cryptoececdsa_sign.c
push 0xa8
push 0x12f
push 0x10
call fcn.00560730
add esp, 0x14
mov eax, dword [esp + 0x10]
test eax, eax
je 0x55b36b
push eax
push ebx
call fcn.00554a30
add esp, 8
test edi, edi
je 0x55b378
push edi
call fcn.00555960
add esp, 4
test ebx, ebx
je 0x55b385
push ebx
call fcn.00555050
add esp, 4
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005f9dd5
add esp, 0x2c
ret
Function at 0x563110
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x563130
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00563340
add esp, 0xc
test eax, eax
js 0x563339
mov eax, dword [ebp + 0xf0]
push ebx
push esi
push edi
lea edi, [eax*4]
xor ebx, ebx
test edi, edi
jle 0x5631b6
lea esi, [ebp + 8]
lea esi, [esi + edi*4]
lea eax, [ebp + 8]
nop dword [eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x563170
mov eax, dword [ebp + 0xf0]
mov edi, 1
cmp eax, edi
jle 0x563334
lea esi, [ebp + 4]
movzx eax, byte [esi + 0xd]
lea esi, [esi + 0x10]
mov edx, dword [esi - 4]
inc edi
movzx ecx, byte [eax*4 + 0x6738f0]
mov eax, edx
shr eax, 0x18
mov ecx, dword [ecx*4 + 0x674cf0]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6744f0]
movzx eax, byte [esi - 2]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6748f0]
movzx eax, dl
mov edx, dword [esi]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6750f0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi - 4], ecx
movzx ecx, byte [eax*4 + 0x6738f0]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6748f0]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x674cf0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6744f0]
movzx eax, dl
mov edx, dword [esi + 4]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6750f0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi], ecx
movzx ecx, byte [eax*4 + 0x6738f0]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6748f0]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x674cf0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6744f0]
movzx eax, dl
mov edx, dword [esi + 8]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6750f0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi + 4], ecx
movzx ecx, byte [eax*4 + 0x6738f0]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6748f0]
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x674cf0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6744f0]
movzx eax, dl
movzx eax, byte [eax*4 + 0x6738f0]
xor ecx, dword [eax*4 + 0x6750f0]
mov dword [esi + 8], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x5631c6
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x563b70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1c
call fcn.005fab70
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
test esi, esi
je 0x563d2a
push ebx
mov ebx, dword [esp + 0x30]
push edi
cmp esi, 0x10
jb 0x563c09
mov eax, esi
shr eax, 4
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
nop dword [eax + eax]
sub ebp, dword [esp + 0x10]
mov edi, ebx
sub edi, dword [esp + 0x10]
mov edx, 4
nop
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x563bc0
push dword [esp + 0x3c]
push ebx
push ebx
call dword [esp + 0x50]
mov eax, dword [esp + 0x1c]
mov ebp, ebx
sub esi, 0x10
add eax, 0x10
add esp, 0xc
mov dword [esp + 0x10], eax
add ebx, 0x10
mov ecx, esi
sub dword [esp + 0x38], 1
jne 0x563bb0
mov dword [esp + 0x38], ecx
test ecx, ecx
je 0x563d19
jmp 0x563c11
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov esi, ebx
mov dword [esp + 0x14], ebp
sub dword [esp + 0x14], eax
lea ecx, [eax + 1]
sub esi, eax
lea edi, [ebx + 2]
mov dword [esp + 0x20], esi
xor edx, edx
mov esi, 1
sub esi, eax
mov dword [esp + 0x24], esi
mov esi, 2
sub esi, eax
mov eax, ebp
sub eax, ebx
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, ebx
not eax
mov dword [esp + 0x1c], eax
cmp edx, esi
jae 0x563cc8
mov al, byte [ecx - 1]
xor al, byte [edx + ebp]
mov byte [edi - 2], al
mov eax, dword [esp + 0x1c]
add eax, edi
cmp eax, esi
jae 0x563cc2
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov al, byte [ecx + eax]
xor al, byte [ecx]
mov byte [ecx + esi], al
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
add eax, ecx
cmp eax, esi
jae 0x563cbd
mov eax, dword [esp + 0x18]
mov al, byte [eax + edi]
xor al, byte [ecx + 1]
mov byte [edi], al
mov eax, dword [esp + 0x28]
add eax, ecx
cmp eax, esi
jae 0x563cb8
mov al, byte [ecx + 2]
add ecx, 4
xor al, byte [edx + ebp + 3]
add edx, 4
mov byte [edi + 1], al
add edi, 4
cmp edx, 0x10
jb 0x563c53
jmp 0x563ce8
add edx, 3
jmp 0x563cc3
add edx, 2
jmp 0x563cc3
inc edx
cmp edx, 0x10
jae 0x563ce8
mov esi, dword [esp + 0x18]
lea ecx, [edx + ebx]
mov edi, 0x10
sub edi, edx
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edi, 1
jne 0x563cd6
mov esi, dword [esp + 0x38]
push dword [esp + 0x3c]
push ebx
push ebx
call dword [esp + 0x50]
add esp, 0xc
mov ebp, ebx
cmp esi, 0x10
jbe 0x563d19
mov eax, dword [esp + 0x10]
sub esi, 0x10
add eax, 0x10
mov dword [esp + 0x38], esi
add ebx, 0x10
mov dword [esp + 0x10], eax
test esi, esi
jne 0x563c11
mov eax, dword [esp + 0x40]
pop edi
pop ebx
cmp eax, ebp
je 0x563d2a
movups xmm0, xmmword [ebp]
movups xmmword [eax], xmm0
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x57a480
Capabilities:
Encode data using xor

Disassembly:
call fcn.004507f0
test eax, eax
je 0x57a4bc
call fcn.005614a0
test eax, eax
je 0x57a49b
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x57a49b
jmp eax
push 0x115
push str.cryptocmaccmac.c
push 0xba
push 0xd3
push 6
call fcn.00560730
add esp, 0x14
xor eax, eax
ret
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x57a4ce
xor eax, eax
pop edi
ret
push ebp
push esi
push dword [edi]
call fcn.0055a830
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x57a579
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x57a51a
test esi, esi
jle 0x57a557
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x57a504
jmp 0x57a557
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x57a538
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.0060ecf0
add esp, 0xc
test esi, esi
jle 0x57a557
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x57a543
push esi
push ebp
push ebp
push dword [edi]
call fcn.0055af10
add esp, 0x10
pop ebx
test eax, eax
jne 0x57a579
push esi
push ebp
call fcn.00560db0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret

Function at 0x58b2f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005fab70
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x58b370
mov cl, byte [edi]
test cl, cl
je 0x58b370
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x58b320
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x58b410
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005fab70
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x58b493
mov al, byte [ebx]
test al, al
je 0x58b493
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.0058b4d0
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or esi, eax
mov al, byte [ebx]
xor esi, edi
mov dword [esp + 0x10], esi
test al, al
jne 0x58b437
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret