joyce8/EMBER2024-capa huggingface dataset:
Function at 0x598380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
mov edx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x20]
mov edi, dword [edi]
test edi, edi
mov dword [ebp + 0x10], ecx
je 0x5983b5
test esi, esi
je 0x5983b5
mov al, byte [edi + edx]
xor al, byte [ecx]
mov byte [ebx], al
inc ebx
inc ecx
dec esi
inc edi
and edi, 0xf
jmp 0x59839c
cmp esi, 0x10
jb 0x598433
xor edi, edi
mov eax, ebx
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0x1c]
sub eax, edi
mov dword [ebp - 4], eax
mov eax, ecx
sub eax, edi
mov dword [ebp - 0xc], eax
mov eax, esi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.005985c7
mov edx, dword [ebp - 4]
add esp, 0x10
mov ecx, edi
push 4
pop edi
mov eax, dword [ebx + ecx]
xor eax, dword [ecx]
mov dword [edx + ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x598405
mov edi, dword [ebp + 0x1c]
add edx, 0x10
sub esi, 0x10
mov dword [ebp - 4], edx
add ebx, 0x10
sub dword [ebp - 8], 1
jne 0x5983e8
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x1c]
test esi, esi
je 0x598469
push dword [ebp + 0x14]
push edx
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.005985c7
mov eax, dword [ebp + 0x1c]
add esp, 0x10
mov ecx, dword [ebp + 0x10]
sub ebx, eax
sub ecx, eax
lea edx, [edi + eax]
add edi, esi
mov al, byte [edx + ecx]
xor al, byte [edx]
mov byte [edx + ebx], al
inc edx
sub esi, 1
jne 0x59845b
mov eax, dword [ebp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x598473
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ecx]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp + 0x10], edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
test ecx, ecx
je 0x5984b6
mov ebx, dword [ebp + 0x1c]
test esi, esi
je 0x5984b6
mov al, byte [ecx + ebx]
xor al, byte [edx]
mov byte [edi], al
inc edi
inc edx
mov dword [ebp - 4], edi
dec esi
mov dword [ebp + 0x10], edx
inc ecx
and ecx, 0xf
mov dword [ebp - 8], ecx
jne 0x598499
mov eax, dword [ebp + 0x18]
movzx ebx, byte [eax + 0xc]
movzx eax, byte [eax + 0xd]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x18]
shl ebx, 8
movzx eax, byte [eax + 0xe]
or ebx, eax
mov eax, dword [ebp + 0x18]
shl ebx, 8
movzx eax, byte [eax + 0xf]
or ebx, eax
cmp esi, 0x10
jb 0x598553
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
shr ecx, 4
lea eax, [ecx + ebx]
neg ebx
cmp eax, ecx
cmovae ebx, ecx
mov dword [ebp - 4], ebx
xor ebx, ebx
push dword [ebp - 4]
cmp eax, ecx
push edi
push edx
cmovae ebx, eax
call dword [ebp + 0x24]
mov ecx, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
add esp, 0x14
mov byte [ecx + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [ecx + 0xe], al
mov byte [ecx + 0xf], bl
test ebx, ebx
jne 0x598536
push ecx
call fcn.005985e8
pop ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
shl eax, 4
sub esi, eax
add edx, eax
add edi, eax
mov dword [ebp + 0x10], edx
cmp esi, 0x10
jae 0x5984e3
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], edi
test esi, esi
je 0x5985bd
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
push edi
push dword [ebp + 0x14]
push 1
push ecx
push ecx
call dword [ebp + 0x24]
add esp, 0x14
inc ebx
mov eax, ebx
mov byte [edi + 0xf], bl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [edi + 0xe], al
test ebx, ebx
jne 0x59859a
push edi
call fcn.005985e8
pop ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
sub edi, eax
sub edx, eax
lea ebx, [ecx + eax]
add ecx, esi
mov al, byte [edi + ebx]
xor al, byte [ebx]
mov byte [edx + ebx], al
inc ebx
sub esi, 1
jne 0x5985af
mov eax, dword [ebp + 0x20]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
leave
ret
Function at 0x598609
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov edx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [esi]
test esi, esi
mov dword [ebp + 0x10], ecx
je 0x59863e
test edi, edi
je 0x59863e
mov al, byte [esi + edx]
xor al, byte [ecx]
mov byte [ebx], al
inc ebx
inc ecx
dec edi
inc esi
and esi, 0xf
jmp 0x598625
cmp edi, 0x10
jb 0x5986b7
mov eax, ebx
sub eax, edx
mov dword [ebp - 4], eax
mov eax, ecx
sub eax, edx
mov dword [ebp - 8], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 0xc], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
push dword [ebp + 0x14]
push ebx
push ebx
call dword [ebp + 0x20]
add esp, 0xc
cmp esi, 0x10
jae 0x59869e
push 0xf
pop ecx
sub ecx, esi
lea edx, [esi + ebx]
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
shr ecx, 2
inc ecx
mov eax, dword [ebx + edx]
xor eax, dword [edx]
mov dword [esi + edx], eax
lea edx, [edx + 4]
sub ecx, 1
jne 0x59868b
mov ebx, dword [ebp + 0x18]
add dword [ebp - 4], 0x10
sub edi, 0x10
add dword [ebp - 8], 0x10
xor esi, esi
sub dword [ebp - 0xc], 1
jne 0x598669
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x18]
test edi, edi
je 0x5986e3
push dword [ebp + 0x14]
push edx
push edx
call dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
sub ebx, eax
sub ecx, eax
lea edx, [esi + eax]
add esi, edi
mov al, byte [edx + ecx]
xor al, byte [edx]
mov byte [edx + ebx], al
inc edx
sub edi, 1
jne 0x5986d5
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
leave
ret
Function at 0x5989b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp - 0x30], ecx
push ebx
mov ebx, dword [ebp + 0xc]
cmp eax, 0x7f
ja 0x598ace
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x28]
push edx
push ecx
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x2c]
mov eax, dword [ebp + 0x10]
xor esi, esi
add eax, 7
add esp, 0xc
cdq
and edx, 7
lea edi, [edx + eax]
sar edi, 3
cmp dword [ebp + 0x1c], esi
je 0x598a3a
test edi, edi
jle 0x598a77
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x30]
sub eax, ecx
sub edx, ecx
mov esi, eax
sub ebx, ecx
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov byte [esi + ecx], al
mov byte [ebx + ecx], al
inc ecx
sub edi, 1
jne 0x598a27
jmp 0x598a75
test edi, edi
jle 0x598a77
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
sub eax, ecx
lea edx, [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov ecx, edx
sub ebx, ecx
lea edx, [ebp - 0x18]
add edx, esi
mov cl, byte [eax + edx]
mov eax, dword [ebp - 0x38]
mov byte [edx], cl
mov al, byte [eax + edx]
xor al, cl
inc esi
mov byte [ebx + edx], al
mov eax, dword [ebp - 0x34]
cmp esi, edi
jl 0x598a58
xor esi, esi
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, reloc.WS2_32.dll_getsockopt
jns 0x598a89
dec ebx
or ebx, 0xfffffff8
inc ebx
cdq
lea edi, [ebp - 0x28]
and edx, 7
add eax, edx
sar eax, 3
add edi, eax
test ebx, ebx
jne 0x598aa6
mov esi, edi
mov edi, dword [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x598acc
push 8
pop eax
sub eax, ebx
mov dword [ebp - 0x34], eax
mov dl, byte [edi + esi]
mov ecx, ebx
mov al, byte [edi + esi + 1]
shl dl, cl
mov cl, byte [ebp - 0x34]
shr al, cl
or dl, al
mov eax, dword [ebp - 0x30]
mov byte [eax + esi], dl
inc esi
cmp esi, 0x10
jl 0x598aae
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
Function at 0x598adb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x598af6
push 0xfffffffffffffffe
pop eax
jmp 0x598bb5
push edi
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, edi
add eax, dword [esi + 0x30]
adc ecx, dword [esi + 0x34]
cmp ecx, 0x20000000
ja 0x598bb1
jb 0x598b1a
test eax, eax
jne 0x598bb1
mov dword [esi + 0x34], ecx
lea ebx, [esi + 0x40]
mov ecx, dword [esi + 0x16c]
mov dword [esi + 0x30], eax
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x598b62
mov edx, dword [ebp + 0xc]
test edi, edi
je 0x598b47
mov al, byte [edx]
lea ebx, [esi + 0x40]
xor byte [ebx + ecx], al
inc edx
dec edi
inc ecx
and ecx, 0xf
jne 0x598b33
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x598ba7
lea eax, [esi + 0x60]
push eax
push ebx
call fcn.00599f71
mov eax, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x598b68
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, edi
lea edx, [esi + 0x60]
and ecx, 0xfffffff0
mov dword [ebp - 0xc], ecx
je 0x598b89
push ecx
push eax
push edx
push ebx
call fcn.00599d54
mov eax, dword [ebp - 0xc]
add esp, 0x10
add dword [ebp - 4], eax
sub edi, eax
test edi, edi
je 0x598ba4
mov esi, dword [ebp - 4]
mov ecx, edi
xor edx, edx
mov al, byte [edx + esi]
xor byte [ebx + edx], al
inc edx
cmp edx, edi
jb 0x598b94
mov esi, dword [ebp + 8]
jmp 0x598ba7
mov ecx, dword [ebp - 8]
mov dword [esi + 0x16c], ecx
xor eax, eax
jmp 0x598bb4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x599ba3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x16c], ecx
mov dword [ebx + 0x168], ecx
cmp esi, 0xc
jne 0x599bed
mov esi, dword [ebp + 0xc]
mov edi, ebx
xor eax, eax
inc eax
mov dword [ebp + 8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [ebx + 0xc], cx
mov byte [ebx + 0xe], cl
mov byte [ebx + 0xf], al
jmp 0x599ce2
mov dword [ebp + 0x10], esi
lea edi, [ebx + 0x40]
mov dword [edi], ecx
lea edx, [ebx + 0x60]
mov dword [edi + 4], ecx
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], ecx
mov dword [ebp - 8], edx
cmp esi, 0x10
jb 0x599c46
mov ebx, dword [ebp + 0xc]
mov eax, esi
shr eax, 4
mov dword [ebp - 4], eax
mov al, byte [ecx + ebx]
xor byte [edi + ecx], al
inc ecx
cmp ecx, 0x10
jb 0x599c14
push edx
push edi
call fcn.00599f71
mov edx, dword [ebp - 8]
add ebx, 0x10
pop ecx
pop ecx
sub esi, 0x10
sub dword [ebp - 4], 1
push 0
pop ecx
jne 0x599c14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 8]
jmp 0x599c49
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x599c66
mov al, byte [ecx + edx]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x599c4d
lea esi, [ebx + 0x60]
push esi
push edi
call fcn.00599f71
pop ecx
pop ecx
jmp 0x599c69
lea esi, [ebx + 0x60]
mov eax, dword [ebp + 0x10]
xor edx, edx
shld edx, eax, 3
push esi
xor byte [ebx + 0x4b], dl
shl eax, 3
mov dword [ebp + 0x10], eax
mov ecx, eax
mov eax, edx
shrd ecx, eax, 0x18
push edi
xor byte [ebx + 0x4c], cl
mov ecx, dword [ebp + 0x10]
shrd ecx, eax, 0x10
xor byte [ebx + 0x4d], cl
mov ecx, dword [ebp + 0x10]
mov eax, ecx
xor byte [ebx + 0x4f], cl
shrd eax, edx, 8
xor byte [ebx + 0x4e], al
call fcn.00599f71
movzx eax, byte [ebx + 0x4d]
pop ecx
pop ecx
movzx ecx, byte [ebx + 0x4c]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 0x4f]
shl ecx, 8
or ecx, eax
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x48]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebp + 8], ecx
xor ecx, ecx
mov dword [ebx + 0xc], eax
push dword [ebx + 0x174]
lea eax, [ebx + 0x20]
mov dword [ebx + 0x40], ecx
push eax
push ebx
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], ecx
call dword [ebx + 0x170]
mov ecx, dword [ebp + 8]
add esp, 0xc
inc ecx
mov eax, ecx
mov byte [ebx + 0xf], cl
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, ecx
pop edi
shr eax, 8
pop esi
mov byte [ebx + 0xe], al
pop ebx
leave
ret
Function at 0x59a769
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
lea edx, [esi + 0x10]
mov bl, byte [esi]
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
push edi
test bl, 0x40
jne 0x59a7bb
push ecx
push edx
push esi
call eax
mov ecx, dword [ebp - 0x20]
lea edx, [esi + 0x10]
add esp, 0xc
movzx eax, bl
xor edi, edi
push 0xf
and eax, 7
pop ebx
sub ebx, eax
mov byte [esi], al
mov dword [ebp - 0x34], ebx
jmp 0x59a7dd
movzx eax, byte [esi + ebx]
or edi, eax
mov byte [esi + ebx], 0
shl edi, 8
inc ebx
cmp ebx, 0xf
jb 0x59a7cf
movzx eax, byte [esi + 0xf]
mov ebx, dword [ebp + 0x14]
or edi, eax
mov byte [esi + 0xf], 1
cmp edi, ebx
je 0x59a7fb
or eax, 0xffffffff
jmp 0x59a8cb
mov edi, ebx
shr edi, 4
test edi, edi
je 0x59a82d
push edx
push esi
push ecx
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [ebp - 0x2c]
shl edi, 4
add esp, 0x18
add dword [ebp - 0x24], edi
add dword [ebp - 0x1c], edi
sub ebx, edi
je 0x59a880
shr edi, 4
push edi
push esi
call fcn.0059ad4b
pop ecx
pop ecx
mov edi, dword [ebp - 0x20]
test ebx, ebx
je 0x59a883
push edi
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
add esp, 0xc
xor edx, edx
test ebx, ebx
je 0x59a870
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
sub edi, eax
sub dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
add eax, edx
mov cl, byte [edi + eax]
xor cl, byte [eax]
mov byte [esi + eax], cl
mov esi, dword [ebp - 0x30]
xor byte [esi + edx + 0x10], cl
inc edx
cmp edx, ebx
jb 0x59a851
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x28]
lea eax, [esi + 0x10]
push edi
push eax
push eax
call ebx
add esp, 0xc
jmp 0x59a886
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
push 0x10
pop eax
cmp ecx, eax
jae 0x59a8a1
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.00739c90
add esp, 0xc
push edi
lea eax, [ebp - 0x14]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x15]
mov byte [esi], al
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
Function at 0x59aad1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov bl, byte [esi]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
push edi
test bl, 0x40
jne 0x59ab28
push eax
lea eax, [esi + 0x10]
push eax
push esi
call ecx
mov edx, dword [ebp - 0x20]
add esp, 0xc
add dword [esi + 0x20], 1
adc dword [esi + 0x24], 0
movzx eax, bl
xor ecx, ecx
push 0xf
and eax, 7
pop ebx
sub ebx, eax
mov byte [esi], al
mov dword [ebp - 0x34], ebx
mov edi, ebx
jmp 0x59ab4c
movzx eax, byte [esi + edi]
or ecx, eax
mov byte [esi + edi], 0
shl ecx, 8
inc edi
cmp edi, 0xf
jb 0x59ab3e
movzx eax, byte [esi + 0xf]
mov ebx, dword [ebp + 0x14]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x59ab6a
or eax, 0xffffffff
jmp 0x59ac68
lea eax, [ebx + 0xf]
or eax, 8
shr eax, 3
add dword [esi + 0x20], eax
adc dword [esi + 0x24], 0
cmp dword [esi + 0x24], 0x20000000
jb 0x59ab93
ja 0x59ab8b
cmp dword [esi + 0x20], 0
jbe 0x59ab93
push 0xfffffffffffffffe
pop eax
jmp 0x59ac68
mov edi, ebx
shr edi, 4
test edi, edi
je 0x59abc8
lea eax, [esi + 0x10]
push eax
push esi
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x1c]
push edx
call dword [ebp - 0x2c]
shl edi, 4
add esp, 0x18
add dword [ebp - 0x20], edi
add dword [ebp - 0x1c], edi
sub ebx, edi
je 0x59ac20
shr edi, 4
push edi
push esi
call fcn.0059ad4b
pop ecx
pop ecx
test ebx, ebx
je 0x59ac20
mov edi, dword [ebp - 0x20]
xor ecx, ecx
test ebx, ebx
je 0x59abe1
mov al, byte [edi + ecx]
xor byte [esi + ecx + 0x10], al
inc ecx
cmp ecx, ebx
jb 0x59abd5
push dword [ebp - 0x24]
lea eax, [esi + 0x10]
push eax
push eax
call dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
add esp, 0x18
xor edx, edx
test ebx, ebx
je 0x59ac20
lea eax, [ebp - 0x14]
sub edi, eax
sub dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
add ecx, edx
mov al, byte [edi + ecx]
xor al, byte [ecx]
inc edx
mov byte [esi + ecx], al
cmp edx, ebx
jb 0x59ac0b
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push 0x10
pop eax
cmp ecx, eax
jae 0x59ac3b
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.00739c90
add esp, 0xc
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x15]
mov byte [esi], al
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
Function at 0x59bee7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x59bf10
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x59bf00
pop edi
pop esi
pop ebp
ret
Function at 0x59d6f4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x88], eax
push edi
mov eax, dword [ecx]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], 0x61707865
mov dword [ebp - 0x40], 0x3320646e
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x3c], 0x79622d32
mov dword [ebp - 0x38], 0x6b206574
mov dword [ebp - 8], eax
test edi, edi
je 0x59d7f9
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0x40
pop esi
lea eax, [ebp - 0x44]
cmp edi, esi
push eax
lea eax, [ebp - 0x84]
cmovb esi, edi
push eax
call fcn.0059d806
pop ecx
xor edx, edx
pop ecx
test esi, esi
je 0x59d7e0
mov edi, ebx
lea eax, [ebp - 0x84]
sub edi, eax
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 0x88]
sub eax, ecx
mov dword [ebp - 0x8c], eax
mov ebx, eax
lea ecx, [ebp - 0x84]
add ecx, edx
mov al, byte [edi + ecx]
xor al, byte [ecx]
inc edx
mov byte [ebx + ecx], al
cmp edx, esi
jb 0x59d7c5
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add dword [ebp - 0x88], esi
add ebx, esi
sub edi, esi
mov dword [ebp + 0xc], ebx
inc dword [ebp - 0x14]
mov dword [ebp + 0x10], edi
test edi, edi
jne 0x59d785
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.007207bc
leave
ret
Function at 0x5aa156
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x5aa1cf
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x5aa16f
cmp al, 0x6b
jne 0x5aa1cf
inc ecx
cmp al, 0x6b
jne 0x5aa1a7
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x5aa18f
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x5aa18f
cmp dl, 0xbb
jne 0x5aa199
inc eax
cmp eax, esi
jl 0x5aa17d
sub esi, eax
test eax, eax
jne 0x5aa1aa
push 0x50
jmp 0x5aa19b
push 0x48
push str.d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x5aa1db
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x5aa1be
push 0x59
push str.d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x5aa1db
push esi
push ecx
push dword [ebp + 8]
call fcn.007390e0
add esp, 0xc
mov eax, esi
jmp 0x5aa1ed
push 0x3d
push str.d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00553208
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret