joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4414fb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x441514
or eax, 0xffffffff
jmp 0x441575
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x441571
push 0x3d
push esi
call fcn.0044173c
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x441571
cmp esi, eax
je 0x441571
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x45bc14]
sete cl
cmp eax, dword [0x45bc18]
mov dword [ebp - 8], ecx
jne 0x441557
mov edi, eax
call fcn.0044149a
mov dword [0x45bc14], eax
cmp eax, ebx
jne 0x4415b0
cmp dword [ebp + 0xc], ebx
je 0x441579
cmp dword [0x45bc1c], ebx
je 0x441579
call fcn.004409b4
test eax, eax
je 0x4415b0
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x441582
xor eax, eax
jmp 0x441574
push 4
call fcn.004337bf
cmp eax, ebx
pop ecx
mov dword [0x45bc14], eax
je 0x441571
mov dword [eax], ebx
cmp dword [0x45bc1c], ebx
jne 0x4415b0
push 4
call fcn.004337bf
cmp eax, ebx
pop ecx
mov dword [0x45bc1c], eax
je 0x441571
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x45bc14]
call fcn.0044144d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x441611
cmp dword [esi], ebx
je 0x441611
lea esi, [esi + edi*4]
push dword [esi]
call fcn.004337d1
cmp dword [ebp - 8], ebx
pop ecx
jne 0x4415f4
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x441652
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x4415eb
mov eax, edi
shl eax, 2
push eax
push dword [0x45bc14]
call fcn.0043488b
cmp eax, ebx
pop ecx
pop ecx
je 0x441652
jmp 0x44164d
cmp dword [ebp - 8], ebx
jne 0x4416bd
cmp edi, ebx
jge 0x441620
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x45bc14]
call fcn.0043488b
cmp eax, ebx
pop ecx
pop ecx
je 0x441571
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x45bc14], eax
cmp dword [ebp + 0xc], ebx
je 0x4416a7
push dword [ebp - 4]
call fcn.00432170
inc eax
inc eax
push eax
call fcn.004337bf
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4416a7
push dword [ebp - 4]
push esi
call fcn.00432210
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4416a0
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.004337d1
pop ecx
cmp dword [ebp - 8], ebx
je 0x4416b5
push dword [ebp - 4]
call fcn.004337d1
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x441574
push dword [ebp - 4]
call fcn.004337d1
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x44157e
Function at 0xa48058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa481a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa4807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4806a
add dl, dl
jne 0xa48089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa480dc
xor eax, eax
add dl, dl
jne 0xa48096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa4817d
add dl, dl
jne 0xa480a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa480b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa480bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa480c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa480d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa48075
mov eax, 1
add dl, dl
jne 0xa480ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa480f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa480e1
sub eax, ebx
mov ebx, 1
jne 0xa48128
mov ecx, 1
add dl, dl
jne 0xa4810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa48119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa48105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa48075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa4813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa4814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa48136
cmp eax, 0x7d00
jae 0xa4816d
cmp eax, 0x500
jb 0xa48168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa48075
cmp eax, 0x7f
ja 0xa48170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa48075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa4819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa48075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x1bfe6f2a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x8622bb
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x402734
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4027ac
xor eax, eax
push ebp
push 0x4027a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4027ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x402e9c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402efd
cmp word [0x40a208], 0xd7b2
jne 0x402ec5
cmp dword [0x40a210], 0
jbe 0x402ec5
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40905c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402f24
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x402f19
push 0
push 0x409054
push 0x40905c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4039dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403a42
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040313c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402628
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403a2c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a49
lea eax, [ebp - 0x10]
call fcn.00403018
ret
Function at 0x405be8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cdq
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97

Function at 0x405c0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.004050bb
pop ecx
push eax

Function at 0x405c28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405070
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0

Function at 0x405c58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.004050bb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405070

Function at 0x405cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.004050ab
cmovge ebp, dword [edx + 0x1b]
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
invalid
movsd dword es:[edi], dword [esi]
out dx, eax
cli
invalid
Function at 0x5b0ef9d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.05b0ec5d

Function at 0x5b17550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0x640]
lea edx, [ebp - 1]
push esi
dec eax
push edi
push 1
cmp dword [ecx + 0x644], eax
jne 0x5b17578
mov byte [ebp - 1], 0x86
call fcn.05b175e0
add esp, 4
jmp 0x5b1759f
mov byte [ebp - 1], 6
mov byte [ebp - 2], 0x80
call fcn.05b175e0
mov eax, dword [ecx + 0x640]
lea edx, [ebp - 2]
dec eax
push 1
mov dword [ecx + 0x644], eax
call fcn.05b175e0
add esp, 8
xor edi, edi
cmp dword [ecx + 0x640], edi
jbe 0x5b175d0
nop dword [eax]
mov eax, dword [ecx + 0x648]
lea esi, [edi + ecx]
mov edx, dword [ecx + 0x640]
xor eax, edi
inc edi
mov al, byte [eax + ecx]
mov byte [esi + edx], al
cmp edi, dword [ecx + 0x640]
jb 0x5b175b0
mov eax, dword [ecx + 0x640]
pop edi
add eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b1ea40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
cmp esi, 0x80
jge 0x5b1ea68
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x5b1eb12
lea eax, [esi + 0x20]
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x10000
jge 0x5b1eb04
push ebx
push edi
mov edi, 0xa2
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
lea eax, [ebx + edi]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
movzx ecx, word [eax*4 + 0x5c44640]
sub edx, ecx
js 0x5b1eaa4
mov edx, eax
lea ebx, [eax + 1]
mov dword [ebp - 4], edx
jmp 0x5b1eaaa
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, ebx
jge 0x5b1ea84
movzx ecx, word [edx*4 + 0x5c44640]
movzx eax, byte [edx*4 + 0x5c44643]
add eax, ecx
pop edi
pop ebx
cmp esi, eax
jge 0x5b1eae9
movzx eax, byte [edx*4 + 0x5c44642]
xor ecx, esi
and ecx, eax
test ecx, 1
jne 0x5b1eae9
shr eax, 1
movzx eax, word [eax*2 + 0x5c45bc8]
add eax, esi
movzx esi, ax
mov eax, dword [ebp - 8]
test eax, eax
je 0x5b1eb12
xor edx, edx
mov ecx, esi
cmp eax, 2
sete dl
call fcn.05b1eb60
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10400]
cmp eax, 0x27
lea eax, [esi + 0x28]
jbe 0x5b1eb14
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b21420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 0x10], ebx
xor ecx, ecx
mov dword [ebp - 0xc], edi
test esi, esi
jle 0x5b21536
cmp esi, 0x20
jb 0x5b21516
lea eax, [esi - 1]
lea edx, [esi - 1]
add eax, edi
add edx, ebx
cmp ebx, eax
ja 0x5b2145f
cmp edx, edi
jae 0x5b21516
mov eax, esi
and eax, 0x8000001f
jns 0x5b2146d
dec eax
or eax, 0xffffffe0
inc eax
movaps xmm3, xmmword [0x5c4d700]
mov edx, esi
movaps xmm4, xmmword [0x5c4d750]
mov esi, edi
movaps xmm5, xmmword [0x5c4d720]
sub edx, eax
movaps xmm6, xmmword [0x5c4d6e0]
sub esi, ebx
mov dword [ebp - 4], esi
mov eax, ebx
lea esi, [edi + 0x10]
mov edi, dword [ebp - 4]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 8]
movups xmm2, xmmword [edi + eax]
movaps xmm0, xmm3
pcmpgtb xmm0, xmm2
movaps xmm1, xmm2
pxor xmm0, xmm4
pcmpgtb xmm1, xmm5
pandn xmm1, xmm0
movaps xmm0, xmm2
paddb xmm0, xmm6
pand xmm0, xmm1
pandn xmm1, xmm2
por xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm2, xmmword [ebx + ecx]
add ecx, 0x20
movaps xmm0, xmm3
pcmpgtb xmm0, xmm2
movaps xmm1, xmm2
pxor xmm0, xmm4
pcmpgtb xmm1, xmm5
pandn xmm1, xmm0
movaps xmm0, xmm2
paddb xmm0, xmm6
pand xmm0, xmm1
pandn xmm1, xmm2
por xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
add eax, 0x20
cmp ecx, edx
jl 0x5b214a5
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
cmp ecx, esi
jge 0x5b21536
sub edi, ebx
lea edx, [ecx + ebx]
sub esi, ecx
mov al, byte [edx + edi]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x5b2152e
add al, 0x20
mov byte [edx], al
inc edx
sub esi, 1
jne 0x5b21521
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b32660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0xd
push esi
push edi
mov dword [esp + 0x10], ecx
lea esi, [ebx - 1]
test esi, esi
js 0x5b3269a
mov edi, dword [ebp + 8]
movzx edx, byte [esi + edi]
lea ecx, [eax*8]
xor edx, ecx
xor eax, edx
sub esi, 1
jns 0x5b32682
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
mov edi, dword [eax + edx*4]
test edi, edi
je 0x5b3270e
nop dword [eax]
mov eax, dword [edi + 0x14]
inc eax
cmp ebx, eax
jne 0x5b32708
mov eax, dword [ebp + 8]
lea edx, [edi + 0x28]
mov esi, ebx
sub esi, 4
jb 0x5b326d6
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x5b326db
add edx, 4
add eax, 4
sub esi, 4
jae 0x5b326c5
cmp esi, 0xfffffffc
je 0x5b32729
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x5b32708
cmp esi, 0xfffffffd
je 0x5b32729
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x5b32708
cmp esi, 0xfffffffe
je 0x5b32729
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x5b32708
cmp esi, 0xffffffff
je 0x5b32729
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x5b32729
mov edi, dword [edi]
test edi, edi
jne 0x5b326b0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x10]
lea ecx, [ebx + 0x29]
sub eax, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
add eax, 0x16
cdq
mov esi, eax
mov ebx, edx
call fcn.05b7ef20
test eax, eax
je 0x5b32768
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
or eax, ebx
je 0x5b3277c
push ebx
push esi
call fcn.05c20d50
add esp, 8
mov esi, eax
jmp 0x5b3277e
xor esi, esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
test esi, esi
je 0x5b32753
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
add eax, edi
push ebx
push eax
lea eax, [esi + 0xc]
push eax
call fcn.05b15590
sub esi, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [esp + 0x10]
add esi, 0xc
mov edx, edi
push esi
call fcn.05b32ee0
mov ecx, dword [ebp + 0x14]
add esp, 4
add eax, ebx
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b32fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
mov dword [esp + 0x10], eax
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
add ebx, ebx
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
lea esi, [ebx*4]
call fcn.05b7ef20
test eax, eax
jne 0x5b33151
mov eax, esi
or eax, 0
je 0x5b33151
push 0
push esi
call fcn.05c20d50
mov edi, eax
add esp, 8
mov dword [esp + 0x24], edi
test edi, edi
je 0x5b33151
push esi
push 0
push edi
call fcn.05b02790
mov esi, dword [esp + 0x20]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x18], eax
cmp dword [esi + 0xc], eax
jle 0x5b330cf
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
cmp dword [ecx], 0
je 0x5b330ba
mov ebx, dword [ecx]
mov eax, dword [ebx]
mov dword [ecx], eax
lea eax, [ebx + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5b33062
sub eax, edx
mov esi, 0xd
add eax, 0xffffffff
js 0x5b33095
nop word [eax + eax]
movzx edx, byte [ebx + eax + 0x28]
lea ecx, [esi*8]
xor edx, ecx
xor esi, edx
sub eax, 1
jns 0x5b33080
xor edx, edx
mov edi, dword [esp + 0x24]
mov eax, esi
mov ecx, dword [esp + 0x1c]
div dword [esp + 0x20]
mov eax, dword [edi + edx*4]
mov dword [ebx], eax
mov dword [edi + edx*4], ebx
cmp dword [ecx], 0
jne 0x5b33056
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
inc eax
add ecx, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp eax, dword [esi + 0xc]
jl 0x5b33051
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5b33142
cmp dword [0x5c525e8], 0
je 0x5b33138
mov eax, dword [0x5c545d8]
test eax, eax
je 0x5b330f3
push eax
call dword [0x5c52638]
add esp, 4
push dword [esp + 0x10]
call dword [0x5c52614]
push dword [esp + 0x14]
sub dword [0x5c54628], eax
dec dword [0x5c5464c]
call dword [0x5c5260c]
mov eax, dword [0x5c545d8]
add esp, 8
test eax, eax
je 0x5b33142
push eax
call dword [0x5c52640]
add esp, 4
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [0x5c5260c]
add esp, 4
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b39620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edx
mov dword [eax], 0
test edi, edi
je 0x5b39717
mov ebx, dword [ebp + 0xc]
mov esi, 0xd
lea edx, [ebx - 1]
test edx, edx
js 0x5b39677
mov ebx, dword [ebp + 8]
nop word [eax + eax]
movsx ecx, byte [edx + ebx]
lea eax, [esi*8]
xor ecx, eax
xor esi, ecx
sub edx, 1
jns 0x5b39660
mov ebx, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
lea eax, [esi*8]
xor eax, esi
xor eax, ecx
and eax, 0x1ff
lea eax, [edi + eax*4]
mov edi, dword [eax]
mov dword [esp + 0x14], eax
test edi, edi
je 0x5b396fe
cmp dword [edi + 8], ecx
jne 0x5b396f7
cmp dword [edi + 4], ebx
jne 0x5b396f7
mov edx, dword [edi]
mov ecx, ebx
mov esi, dword [ebp + 8]
sub ecx, 4
jb 0x5b396c1
nop
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x5b396c6
add edx, 4
add esi, 4
sub ecx, 4
jae 0x5b396b0
cmp ecx, 0xfffffffc
je 0x5b3970e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x5b396f3
cmp ecx, 0xfffffffd
je 0x5b3970e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x5b396f3
cmp ecx, 0xfffffffe
je 0x5b3970e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x5b396f3
cmp ecx, 0xffffffff
je 0x5b3970e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x5b3970e
mov ecx, dword [esp + 0xc]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x5b39698
lea edi, [ebx + 0x10]
xor esi, esi
call fcn.05b7ef20
test eax, eax
je 0x5b39720
jmp 0x5b39787
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
or eax, esi
je 0x5b39781
test esi, esi
ja 0x5b39781
jb 0x5b39734
cmp edi, 0x7ffffeff
ja 0x5b39781
cmp dword [0x5c525e8], esi
je 0x5b39773
mov eax, dword [0x5c545d8]
test eax, eax
je 0x5b3974f
push eax
call dword [0x5c52638]
add esp, 4
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.05c20dc0
mov eax, dword [0x5c545d8]
test eax, eax
je 0x5b3976d
push eax
call dword [0x5c52640]
add esp, 4
mov esi, dword [esp + 0x10]
jmp 0x5b39783
push edi
call dword [0x5c52608]
add esp, 4
mov esi, eax
jmp 0x5b39783
xor esi, esi
test esi, esi
jne 0x5b39798
xor eax, eax
jl 0x5b397a4
jg 0x5b39791
test edi, edi
je 0x5b397a4
mov edi, 7
jmp 0x5b397a6
push edi
push 0
push esi
call fcn.05b02790
add esp, 0xc
xor edi, edi
test esi, esi
je 0x5b397d1
mov edx, dword [esp + 0xc]
lea eax, [esi + 0x10]
push ebx
push dword [ebp + 8]
mov dword [esi], eax
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
call fcn.05b15590
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov dword [ecx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret