joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5de094
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5de0ad
test al, 0x10
jne 0x5de0b1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5de0b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x5de0d6
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5de0ce
test al, 0x10
je 0x5de0d2
xor eax, eax
jmp 0x5de0d8
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x5de450
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5de4cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.0040aec8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5de4b7
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040b05c
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call fcn.0040aec8
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5de4d4
lea eax, [ebp - 4]
call fcn.00409f90
ret

Function at 0x5de8f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5de9a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040aec8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5de990
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040b05c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040aec8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5de990
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5de9b8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5de990
cmp dword [ebp - 0xc], 0x34
jne 0x5de990
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5de9ad
lea eax, [ebp - 4]
call fcn.00409f90
ret
Function at 0x5dea20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x5dea35
add esp, 0xfffffff0
call fcn.00408808
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.005de0b8
test al, al
jne 0x5dea6b
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x79ba38]
mov dl, 1
mov eax, dword [0x5dd290]
call fcn.0042cf94
call fcn.00409610
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040aec8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x5dea9e
mov ecx, dword [0x79bd1c]
mov dl, 1
mov eax, dword [0x5dd290]
call fcn.0042cec4
call fcn.00409610
lea eax, [ebx + 4]
xor ecx, ecx
mov edx, esi
call fcn.0040ab00
mov eax, dword [ebx + 4]
call fcn.0040aa3c
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.0040aec8
push eax
call sub.version.dll_GetFileVersionInfoW
call fcn.0042ec58
mov eax, ebx
call fcn.005df33c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5deae8
call fcn.00408860
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e0020
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x5e0084
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040af84
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.004267e4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e008b
lea eax, [ebp - 0x14]
call fcn.00409f90
ret

Function at 0x5e0bcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e0c62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x79c8a8]
cmp dword [eax], 2
jne 0x5e0c0c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
jmp 0x5e0c44
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040abf8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040a7dc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040aa3c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0c69
lea eax, [ebp - 8]
call fcn.00409fd8
lea eax, [ebp - 4]
call fcn.00409fb4
ret
Function at 0x5e1cc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00409f90
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040aec8
push eax
push edi
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x5e1d6d
xor eax, eax
push ebp
push 0x5e1d66
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040b05c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040aec8
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5e1d48
mov edx, dword [ebp - 8]
shr edx, 1
dec edx
mov eax, ebx
call fcn.0040b05c
jmp 0x5e1d4f
mov eax, ebx
call fcn.00409f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e1d6d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5e1d78
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x5e1df0
push 0
mov eax, ebx
call fcn.0040aec8
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x5e1de7
mov ebx, esi
test ebx, ebx
je 0x5e1dbf
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.0040aec8
push eax
push 1
push 0
mov eax, edi
call fcn.0040aec8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x5e4e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00406900
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x5e4f9c
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x5e4e92
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00406900
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x5e4fd4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff74
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, 0x38
mov esi, str.80_
lea eax, [esp + 0x1c]
movzx edi, byte [esi]
mov edx, edi
and edx, 0x80000007
jns 0x5e5009
dec edx
or edx, 0xfffffff8
inc edx
test edi, edi
jns 0x5e5010
add edi, 7
sar edi, 3
mov ebx, dword [esp]
movzx ebx, byte [ebx + edi]
and bl, byte [edx + 0x78a9f4]
setne dl
mov byte [eax], dl
inc eax
inc esi
dec ecx
jne 0x5e4ff7
xor eax, eax
mov dword [esp + 0x14], eax
mov esi, 0x78a9e4
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
xor ecx, ecx
lea eax, [esp + 0x54]
movzx edi, byte [esi]
add edi, ecx
cmp edi, 0x1c
jge 0x5e505e
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x38]
mov byte [eax + 0x1c], dl
jmp 0x5e506c
movzx edx, byte [esp + edi]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax + 0x1c], dl
inc ecx
inc eax
cmp ecx, 0x1c
jne 0x5e5043
lea eax, [esp + 9]
xor ecx, ecx
mov edx, 8
call fcn.00407764
xor ecx, ecx
mov ebp, 0x78a9b4
movzx eax, byte [ebp]
cmp byte [esp + eax + 0x54], 0
je 0x5e50b9
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
mov edi, eax
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
movzx eax, byte [edx + 0x78a9f4]
shr eax, 2
or byte [esp + edi + 9], al
inc ecx
inc ebp
cmp ecx, 0x30
jne 0x5e508a
cmp byte [esp + 8], 0
je 0x5e511c
movzx eax, byte [esp + 9]
shl eax, 0x18
movzx edx, byte [esp + 0xb]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xd]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0xf]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
movzx eax, byte [esp + 0xa]
shl eax, 0x18
movzx edx, byte [esp + 0xc]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xe]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x10]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx + 4], eax
jmp 0x5e5187
movzx edx, byte [esp + 9]
shl edx, 0x18
movzx ecx, byte [esp + 0xb]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xd]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0xf]
or edx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
mov ecx, eax
inc ecx
mov ebx, 0x1f
sub ebx, ecx
mov ecx, dword [esp + 4]
mov dword [ecx + ebx*4], edx
movzx edx, byte [esp + 0xa]
shl edx, 0x18
movzx ecx, byte [esp + 0xc]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xe]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0x10]
or edx, ecx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
add dword [esp + 0x18], 8
inc esi
cmp dword [esp + 0x14], 0x10
jne 0x5e503d
mov eax, dword [esp + 4]
movzx edx, byte [esp + 8]
mov byte [eax + 0x80], dl
add esp, 0x8c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e51b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx edx, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.005e4d20
mov edx, eax
mov eax, 4
call fcn.005e4d28
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], str.UUUU
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x5e5239
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x5e5207
cmp byte [ebp + 8], 0
jne 0x5e5368
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x5e533d
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x5e5317
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x5e5368
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x5e5355
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e54c0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
mov ebx, 0x78a9fc
lea esi, [esp + 4]
lea ecx, [esp + 8]
mov edx, esi
mov eax, dword [esp]
call fcn.005e5374
lea edx, [esp + 8]
mov eax, esi
call fcn.005e53c4
mov edx, edi
mov ecx, 8
mov eax, dword [esp + 8]
shr eax, 4
mov edi, dword [esp + 8]
shl edi, 0x1c
or eax, edi
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x600]
xor dword [esi], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x400]
xor dword [esi], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x200]
xor dword [esi], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esi], eax
mov eax, dword [esp + 8]
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x700]
xor dword [esi], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x500]
xor dword [esi], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x300]
xor dword [esi], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esi], eax
mov eax, dword [esi]
shr eax, 4
mov edi, dword [esi]
shl edi, 0x1c
or eax, edi
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x600]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x400]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x200]
xor dword [esp + 8], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esp + 8], eax
mov eax, dword [esi]
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x700]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x500]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x300]
xor dword [esp + 8], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esp + 8], eax
dec ecx
jne 0x5e54f4
lea edx, [esp + 8]
mov eax, esi
call fcn.005e5440
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov eax, dword [esi]
call fcn.005e53a0
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5e5730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.00406900
xor eax, eax
mov dword [esp], eax
mov esi, 0x788634
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.00406900
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x5e57ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.00406900
dec edi
test edi, edi
jl 0x5e58cc
inc edi
mov dword [esp + 4], edi
mov esi, ebx
movzx eax, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x5e57fd
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x5e58c1
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x5e5841
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x5e57de
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.00406900
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5e59d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
push ecx
shr ecx, 2
je 0x5e59ea
cld
mov eax, dword [edi]
xor dword [esi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x5e59dd
pop ecx
and ecx, 3
je 0x5e59f9
mov al, byte [edi]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x5e59f0
pop edi
pop esi
ret

Function at 0x5e5a04
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
movzx eax, byte [esp]
movzx eax, byte [eax + 0x788744]
mov byte [esp + 4], al
movzx eax, byte [esp + 1]
movzx eax, byte [eax + 0x788744]
mov byte [esp + 5], al
movzx eax, byte [esp + 2]
movzx eax, byte [eax + 0x788744]
mov byte [esp + 6], al
movzx eax, byte [esp + 3]
movzx eax, byte [eax + 0x788744]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x5e5aa0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x15], cl
mov ebx, edx
mov dword [ebp - 0x14], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x15], 0
jne 0x5e5b2e
lea ecx, [eax]
and ecx, 0x80000003
jns 0x5e5acb
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x78897c]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x5e5ae6
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x788d7c]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x5e5b02
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x78917c]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x5e5b1e
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x78957c]
mov dword [edx], ecx
jmp 0x5e5ba7
lea ecx, [eax]
and ecx, 0x80000003
jns 0x5e5b3d
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
movzx ecx, byte [ecx + 0x788744]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x5e5b5a
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
movzx ecx, byte [ecx + 0x788744]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x5e5b79
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
movzx ecx, byte [ecx + 0x788744]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x5e5b98
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
movzx ecx, byte [ecx + 0x788744]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x5e5ab6
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call fcn.005e59d0
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret