joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a183b
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x62456080
mov dword [esp + 0x18], 0x20062
mov dword [esp + 0x14], ebx
mov ebx, 0x5a1808
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], ebx
xor ebx, ebx
mov ebp, dword [esp + 0x1c]
mov ebp, dword [ebp]
xor ebx, ebp
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x5a187a
cmp ebx, 0x2b5
je 0x5a1898
int3
mov ebp, dword [esp + 0x10]
add edx, ebx
mov ebx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edx
mov dword [esp + 4], 0x6e0004c2
jmp 0x5a18ac
ret 4

Function at 0x5a1ab1
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x14
mov dword [esp + 0x10], 0x4f71bdb1
mov dword [esp + 0xc], 0x2006b
mov dword [esp + 8], ebx
mov ebx, 0x5a1a80
mov dword [esp + 4], ebp
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp]
xor ebx, ebp
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5a1af0
cmp ebx, 0x33ce
je 0x5a1b0e
int3
mov ebp, dword [esp + 4]
add eax, ebx
mov ebx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], eax
mov dword [esp + 4], 0x720004c2
jmp 0x5a1b22
ret 4

Function at 0x5a2ca8
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
sub esp, 0x24
mov dword [esp + 0x20], 0xe2ba70fa
mov dword [esp + 0x1c], 0x20034
mov dword [esp + 0x18], edx
mov edx, 0x5a2c78
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
xor edx, ecx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5a2ce7
cmp edx, 0x2901
je 0x5a2d04
int3
mov ecx, dword [esp + 0x14]
add esi, edx
mov edx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], esi
mov dword [esp + 4], 0x8c0004c2
jmp 0x5a2d18
ret 4

Function at 0x5a2e1b
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x1c
mov dword [esp + 0x18], 0xede0a975
mov dword [esp + 0x14], 0x2004a
mov dword [esp + 0x10], ebx
mov ebx, 0x5a2de8
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ebx
xor ebx, ebx
mov esi, dword [esp + 0x18]
mov esi, dword [esi]
xor ebx, esi
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x5a2e5a
cmp ebx, 0x3d0c
je 0x5a2e77
int3
mov esi, dword [esp + 0xc]
add edi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], edi
mov dword [esp + 4], 0x630004c2
jmp 0x5a2e8b
ret 4
Function at 0x5a452d
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x7eb178d1
mov dword [esp + 0x18], 0x20038
mov dword [esp + 0x14], ecx
mov ecx, 0x5a44fc
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
xor ecx, ebx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x5a456c
cmp ecx, 0x1b16
je 0x5a4589
int3
mov ebx, dword [esp + 0x10]
add edx, ecx
mov ecx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edx
mov dword [esp + 4], 0x440004c2
jmp 0x5a459d
ret 4

Function at 0x5aace1
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x24
mov dword [esp + 0x20], 0x81229ed3
mov dword [esp + 0x1c], 0x20043
mov dword [esp + 0x18], edx
mov edx, 0x5aacb0
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edx
xor edx, edx
mov edi, dword [esp + 0x20]
mov edi, dword [edi]
xor edx, edi
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5aad20
cmp edx, 0x124b
je 0x5aad3d
int3
mov edi, dword [esp + 0x14]
add ecx, edx
mov edx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ecx
mov dword [esp + 4], 0xe90004c2
jmp 0x5aad51
ret 4

Function at 0x5ab3be
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x24
mov dword [esp + 0x20], 0xcc526d0f
mov dword [esp + 0x1c], 0x20057
mov dword [esp + 0x18], ebp
mov ebp, 0x5ab38c
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], ebp
xor ebp, ebp
mov edi, dword [esp + 0x20]
mov edi, dword [edi]
xor ebp, edi
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5ab3fd
cmp ebp, 0xc3d
je 0x5ab41a
int3
mov edi, dword [esp + 0x14]
add ebx, ebp
mov ebp, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ebx
mov dword [esp + 4], 0xc0004c2
jmp 0x5ab42e
ret 4

Function at 0x5aba95
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x20
mov dword [esp + 0x1c], 0xe820f53
mov dword [esp + 0x18], 0x2007f
mov dword [esp + 0x14], eax
mov eax, 0x5aba64
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], eax
xor eax, eax
mov ebp, dword [esp + 0x1c]
mov ebp, dword [ebp]
xor eax, ebp
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x5abad4
cmp eax, 0x23dc
je 0x5abaf1
int3
mov ebp, dword [esp + 0x10]
add ebx, eax
mov eax, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0x6d0004c2
jmp 0x5abb05
ret 4
Function at 0x5abc4a
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x14
mov dword [esp + 0x10], 0x2ec8532a
mov dword [esp + 0xc], 0x20068
mov dword [esp + 8], ebx
mov ebx, 0x5abc18
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov esi, dword [esp + 0x10]
mov esi, dword [esi]
xor ebx, esi
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5abc89
cmp ebx, 0xbfe
je 0x5abca6
int3
mov esi, dword [esp + 4]
add ecx, ebx
mov ebx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ecx
mov dword [esp + 4], 0xc80004c2
jmp 0x5abcba
ret 4

Function at 0x5ad7d5
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
sub esp, 0x24
mov dword [esp + 0x20], 0x37451148
mov dword [esp + 0x1c], 0x2006f
mov dword [esp + 0x18], edx
mov edx, 0x5ad7a4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], edx
xor edx, edx
mov ebx, dword [esp + 0x20]
mov ebx, dword [ebx]
xor edx, ebx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5ad814
cmp edx, 0x37e5
je 0x5ad831
int3
mov ebx, dword [esp + 0x14]
add esi, edx
mov edx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], esi
mov dword [esp + 4], 0xb80004c2
jmp 0x5ad845
ret 4

Function at 0x5ada24
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x14
mov dword [esp + 0x10], 0x9d07a8b3
mov dword [esp + 0xc], 0x20068
mov dword [esp + 8], edx
mov edx, 0x5ad9f4
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
xor edx, edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
xor edx, ecx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5ada63
cmp edx, 0x30da
je 0x5ada80
int3
mov ecx, dword [esp + 4]
add eax, edx
mov edx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], eax
mov dword [esp + 4], 0x8d0004c2
jmp 0x5ada94
ret 4

Function at 0x5ae693
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x14
mov dword [esp + 0x10], 0xc18f82d1
mov dword [esp + 0xc], 0x20044
mov dword [esp + 8], ebx
mov ebx, 0x5ae660
mov dword [esp + 4], edx
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
xor ebx, edx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5ae6d2
cmp ebx, 0x124
je 0x5ae6ef
int3
mov edx, dword [esp + 4]
add edi, ebx
mov ebx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], edi
mov dword [esp + 4], 0x620004c2
jmp 0x5ae703
ret 4
Function at 0x5ae855
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x24
mov dword [esp + 0x20], 0x7f176ca6
mov dword [esp + 0x1c], 0x20075
mov dword [esp + 0x18], ebp
mov ebp, 0x5ae824
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebp
xor ebp, ebp
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
xor ebp, eax
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5ae894
cmp ebp, 0x1db1
je 0x5ae8b1
int3
mov eax, dword [esp + 0x14]
add ebx, ebp
mov ebp, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ebx
mov dword [esp + 4], 0x280004c2
jmp 0x5ae8c5
ret 4

Function at 0x5af2c5
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp + 0x14], 0xbab1819c
mov dword [esp + 0x10], 0x20067
mov dword [esp + 0xc], ebp
mov ebp, 0x5af294
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
xor ebp, ebp
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
xor ebp, ecx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x5af304
cmp ebp, 0xd9e
je 0x5af321
int3
mov ecx, dword [esp + 8]
add eax, ebp
mov ebp, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], eax
mov dword [esp + 4], 0xa30004c2
jmp 0x5af335
ret 4

Function at 0x5af4a2
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x14
mov dword [esp + 0x10], 0xa18e8975
mov dword [esp + 0xc], 0x20063
mov dword [esp + 8], esi
mov esi, 0x5af470
mov dword [esp + 4], ebp
mov dword [esp + 0x10], esi
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp]
xor esi, ebp
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5af4e1
cmp esi, 0x3ca8
je 0x5af4ff
int3
mov ebp, dword [esp + 4]
add ecx, esi
mov esi, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ecx
mov dword [esp + 4], 0x710004c2
jmp 0x5af513
ret 4

Function at 0x5b4768
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], 0xc5b95b5c
mov dword [esp + 0x14], 0x2004f
mov dword [esp + 0x10], edi
mov edi, 0x5b4738
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], edi
xor edi, edi
mov edx, dword [esp + 0x18]
mov edx, dword [edx]
xor edi, edx
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x5b47a7
cmp edi, 0x2225
je 0x5b47c4
int3
mov edx, dword [esp + 0xc]
add ebx, edi
mov edi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ebx
mov dword [esp + 4], 0xc50004c2
jmp 0x5b47d8
ret 4
Function at 0x5b4927
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7c
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x14
mov dword [esp + 0x10], 0xdf4e3c06
mov dword [esp + 0xc], 0x2003d
mov dword [esp + 8], edi
mov edi, 0x5b48f4
mov dword [esp + 4], edx
mov dword [esp + 0x10], edi
xor edi, edi
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
xor edi, edx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5b4966
cmp edi, 0x1543
je 0x5b4983
int3
mov edx, dword [esp + 4]
add ebx, edi
mov edi, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebx
mov dword [esp + 4], 0x410004c2
jmp 0x5b4997
ret 4

Function at 0x5b5f80
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x18
mov dword [esp + 0x14], 0xf083d994
mov dword [esp + 0x10], 0x20036
mov dword [esp + 0xc], esi
mov esi, 0x5b5f50
mov dword [esp + 8], edi
mov dword [esp + 0x14], esi
xor esi, esi
mov edi, dword [esp + 0x14]
mov edi, dword [edi]
xor esi, edi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x5b5fbf
cmp esi, 0x1ef5
je 0x5b5fdc
int3
mov edi, dword [esp + 8]
add edx, esi
mov esi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], edx
mov dword [esp + 4], 0x140004c2
jmp 0x5b5ff0
ret 4

Function at 0x5c195b
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x82
push dword [esp]
sub dword [esp], 0x7f
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
sub esp, 0x14
mov dword [esp + 0x10], 0x830f67f7
mov dword [esp + 0xc], 0x20045
mov dword [esp + 8], edx
mov edx, 0x5c1928
mov dword [esp + 4], eax
mov dword [esp + 0x10], edx
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
xor edx, eax
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5c199a
cmp edx, 0x1b3b
je 0x5c19b7
int3
mov eax, dword [esp + 4]
add ecx, edx
mov edx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ecx
mov dword [esp + 4], 0x40004c2
jmp 0x5c19cb
ret 4

Function at 0x5c1beb
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp + 0x14], 0x30ae56a9
mov dword [esp + 0x10], 0x20059
mov dword [esp + 0xc], esi
mov esi, 0x5c1bb8
mov dword [esp + 8], edx
mov dword [esp + 0x14], esi
xor esi, esi
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
xor esi, edx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x5c1c2a
cmp esi, 0x397f
je 0x5c1c47
int3
mov edx, dword [esp + 8]
add eax, esi
mov esi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], eax
mov dword [esp + 4], 0xbd0004c2
jmp 0x5c1c5b
ret 4
Function at 0x5c9aa2
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x18
mov dword [esp + 0x14], 0x651bb089
mov dword [esp + 0x10], 0x2005f
mov dword [esp + 0xc], edi
mov edi, 0x5c9a70
mov dword [esp + 8], ebx
mov dword [esp + 0x14], edi
xor edi, edi
mov ebx, dword [esp + 0x14]
mov ebx, dword [ebx]
xor edi, ebx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x5c9ae1
cmp edi, 0x2629
je 0x5c9afe
int3
mov ebx, dword [esp + 8]
add edx, edi
mov edi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], edx
mov dword [esp + 4], 0xcb0004c2
jmp 0x5c9b12
ret 4

Function at 0x5ce768
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x96c188d9
mov dword [esp + 0x18], 0x20031
mov dword [esp + 0x14], ebp
mov ebp, 0x5ce738
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], ebp
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
xor ebp, ecx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x5ce7a7
cmp ebp, 0x7d3
je 0x5ce7c4
int3
mov ecx, dword [esp + 0x10]
add ebx, ebp
mov ebp, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0x840004c2
jmp 0x5ce7d8
ret 4

Function at 0x5ce94e
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x18
mov dword [esp + 0x14], 0xa172a459
mov dword [esp + 0x10], 0x20057
mov dword [esp + 0xc], esi
mov esi, 0x5ce91c
mov dword [esp + 8], ebx
mov dword [esp + 0x14], esi
xor esi, esi
mov ebx, dword [esp + 0x14]
mov ebx, dword [ebx]
xor esi, ebx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x5ce98d
cmp esi, 0x1653
je 0x5ce9aa
int3
mov ebx, dword [esp + 8]
add edx, esi
mov esi, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], edx
mov dword [esp + 4], 0xa50004c2
jmp 0x5ce9be
ret 4

Function at 0x5cef23
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x1d78ceda
mov dword [esp + 0x18], 0x2005a
mov dword [esp + 0x14], edx
mov edx, 0x5ceef0
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
xor edx, edx
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor edx, edi
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x5cef62
cmp edx, 0x2d8e
je 0x5cef7f
int3
mov edi, dword [esp + 0x10]
add ebx, edx
mov edx, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0x630004c2
jmp 0x5cef93
ret 4
Function at 0x5cf075
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x1c
mov dword [esp + 0x18], 0x9c4d8c9d
mov dword [esp + 0x14], 0x20072
mov dword [esp + 0x10], eax
mov eax, 0x5cf044
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], eax
xor eax, eax
mov esi, dword [esp + 0x18]
mov esi, dword [esi]
xor eax, esi
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x5cf0b4
cmp eax, 0xc5
je 0x5cf0d0
int3
mov esi, dword [esp + 0xc]
add edi, eax
mov eax, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], edi
mov dword [esp + 4], 0x210004c2
jmp 0x5cf0e4
ret 4

Function at 0x5d103b
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x14
mov dword [esp + 0x10], 0x140df844
mov dword [esp + 0xc], 0x20041
mov dword [esp + 8], ecx
mov ecx, 0x5d1008
mov dword [esp + 4], edx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
xor ecx, edx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5d107a
cmp ecx, 0x2fc5
je 0x5d1097
int3
mov edx, dword [esp + 4]
add eax, ecx
mov ecx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], eax
mov dword [esp + 4], 0x4f0004c2
jmp 0x5d10ab
ret 4

Function at 0x5d137a
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x14
mov dword [esp + 0x10], 0xca3cd95d
mov dword [esp + 0xc], 0x2006d
mov dword [esp + 8], edi
mov edi, 0x5d1348
mov dword [esp + 4], esi
mov dword [esp + 0x10], edi
xor edi, edi
mov esi, dword [esp + 0x10]
mov esi, dword [esi]
xor edi, esi
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x5d13ba
cmp edi, 0x676
je 0x5d13d7
int3
mov esi, dword [esp + 4]
add ebp, edi
mov edi, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebp
mov dword [esp + 4], 0x970004c2
jmp 0x5d13eb
ret 4

Function at 0x5d6221
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x24
mov dword [esp + 0x20], 0x2ba2c6b1
mov dword [esp + 0x1c], 0x20038
mov dword [esp + 0x18], ebp
mov ebp, 0x5d61f0
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], ebp
xor ebp, ebp
mov esi, dword [esp + 0x20]
mov esi, dword [esi]
xor ebp, esi
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x5d6260
cmp ebp, 0x3c82
je 0x5d627d
int3
mov esi, dword [esp + 0x14]
add edx, ebp
mov ebp, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edx
mov dword [esp + 4], 0xdd0004c2
jmp 0x5d6291
ret 4
Function at 0x5e51d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.00637690
mov dword [ebp - 0x914], 0
lea ecx, [ebp - 0x910]
call fcn.005e5440
push 0x13dd
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00637390
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
cmp dword [ebp + 0xc], 0
je 0x5e52f3
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.005f7e40
add esp, 8
test eax, eax
je 0x5e52ee
push 0x69efb0
lea ecx, [ebp - 0xd14]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.00637400
add esp, 8
mov edx, dword [ebp + 0x10]
add edx, 0x381
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.00637400
add esp, 8
mov ecx, dword [ebp + 0x10]
add ecx, 0x7dd
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.005f65f0
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x910]
call fcn.005e5be0
mov ecx, dword [ebp - 0x914]
or ecx, eax
mov dword [ebp - 0x914], ecx
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x68d], 0
je 0x5e52ee
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x685], 0
je 0x5e52ee
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x695], 0
jne 0x5e52ee
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x699], 0
jne 0x5e52ee
mov eax, dword [ebp - 0x914]
or ah, 1
mov dword [ebp - 0x914], eax
jmp 0x5e537e
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov dl, byte [ebp + 8]
push edx
call fcn.005f77a0
add esp, 0xc
test eax, eax
je 0x5e537e
push 0x69efc0
lea ecx, [ebp - 0x1114]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00637400
add esp, 8
mov ecx, dword [ebp + 0x10]
add ecx, 0x381
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.00637400
add esp, 8
mov eax, dword [ebp + 0x10]
add eax, 0x7dd
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.005f65f0
add esp, 8
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x910]
call fcn.005e5be0
mov ecx, dword [ebp - 0x914]
or ecx, eax
mov dword [ebp - 0x914], ecx
cmp dword [ebp + 0x14], 0
je 0x5e53b3
cmp dword [ebp + 0x18], 0
jle 0x5e53b3
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
call fcn.00637390
add esp, 0xc
lea ecx, [ebp - 0x900]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.005e4980
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.005e4a90
add esp, 0x10
mov edx, dword [ebp - 0x914]
or edx, eax
mov dword [ebp - 0x914], edx
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x1118], eax
lea ecx, [ebp - 0x910]
call fcn.005e60f0
mov eax, dword [ebp - 0x1118]
mov esp, ebp
pop ebp
ret
Function at 0x5ec360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00637540
add esp, 4
add eax, 0x14
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006382fb
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x5ec42b
cmp dword [ebp + 8], 0x30
je 0x5ec3c9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10010]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x10010]
add ecx, 1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10010], ecx
jmp 0x5ec3d2
mov eax, dword [ebp - 8]
mov dword [eax], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
call fcn.006373f0
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0xc]
call fcn.005ec800
mov byte [ebp - 4], al
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.006382f0
add esp, 4
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc