joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7e30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5c7ee6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040acb4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5c7ed0
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040ae48
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040acb4
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5c7ed0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5c7ef8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5c7ed0
cmp dword [ebp - 0xc], 0x34
jne 0x5c7ed0
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7eed
lea eax, [ebp - 4]
call fcn.00409e3c
ret

Function at 0x5c7f60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x5c7f75
add esp, 0xfffffff0
call fcn.004086b4
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.005c7688
test al, al
jne 0x5c7fab
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x7728a8]
mov dl, 1
mov eax, dword [0x5c6890]
call fcn.0042c85c
call fcn.004094bc
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040acb4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x5c7fde
mov ecx, dword [0x772b60]
mov dl, 1
mov eax, dword [0x5c6890]
call fcn.0042c78c
call fcn.004094bc
lea eax, [ebx + 4]
xor ecx, ecx
mov edx, esi
call fcn.0040a9b0
mov eax, dword [ebx + 4]
call fcn.0040a8ec
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.0040acb4
push eax
call sub.version.dll_GetFileVersionInfoW
call fcn.0042e518
mov eax, ebx
call fcn.005c887c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c8028
call fcn.0040870c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c9560
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x5c95c4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040ad70
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00425fdc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c95cb
lea eax, [ebp - 0x14]
call fcn.00409e3c
ret
Function at 0x5ca6b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00409e3c
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040acb4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x5ca761
xor eax, eax
push ebp
push 0x5ca75a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040ae48
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040acb4
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040acb4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5ca73c
mov edx, dword [ebp - 8]
shr edx, 1
dec edx
mov eax, ebx
call fcn.0040ae48
jmp 0x5ca743
mov eax, ebx
call fcn.00409e3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca761
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5cd4c0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff74
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, 0x38
mov esi, str.80_
lea eax, [esp + 0x1c]
movzx edi, byte [esi]
mov edx, edi
and edx, 0x80000007
jns 0x5cd4f5
dec edx
or edx, 0xfffffff8
inc edx
test edi, edi
jns 0x5cd4fc
add edi, 7
sar edi, 3
mov ebx, dword [esp]
movzx ebx, byte [ebx + edi]
and bl, byte [edx + 0x76639c]
setne dl
mov byte [eax], dl
inc eax
inc esi
dec ecx
jne 0x5cd4e3
xor eax, eax
mov dword [esp + 0x14], eax
mov esi, 0x76638c
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
xor ecx, ecx
lea eax, [esp + 0x54]
movzx edi, byte [esi]
add edi, ecx
cmp edi, 0x1c
jge 0x5cd54a
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x38]
mov byte [eax + 0x1c], dl
jmp 0x5cd558
movzx edx, byte [esp + edi]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax + 0x1c], dl
inc ecx
inc eax
cmp ecx, 0x1c
jne 0x5cd52f
lea eax, [esp + 9]
xor ecx, ecx
mov edx, 8
call fcn.004074c0
xor ecx, ecx
mov ebp, 0x76635c
movzx eax, byte [ebp]
cmp byte [esp + eax + 0x54], 0
je 0x5cd5a5
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
mov edi, eax
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
movzx eax, byte [edx + 0x76639c]
shr eax, 2
or byte [esp + edi + 9], al
inc ecx
inc ebp
cmp ecx, 0x30
jne 0x5cd576
cmp byte [esp + 8], 0
je 0x5cd608
movzx eax, byte [esp + 9]
shl eax, 0x18
movzx edx, byte [esp + 0xb]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xd]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0xf]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
movzx eax, byte [esp + 0xa]
shl eax, 0x18
movzx edx, byte [esp + 0xc]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xe]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x10]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx + 4], eax
jmp 0x5cd673
movzx edx, byte [esp + 9]
shl edx, 0x18
movzx ecx, byte [esp + 0xb]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xd]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0xf]
or edx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
mov ecx, eax
inc ecx
mov ebx, 0x1f
sub ebx, ecx
mov ecx, dword [esp + 4]
mov dword [ecx + ebx*4], edx
movzx edx, byte [esp + 0xa]
shl edx, 0x18
movzx ecx, byte [esp + 0xc]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xe]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0x10]
or edx, ecx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
add dword [esp + 0x18], 8
inc esi
cmp dword [esp + 0x14], 0x10
jne 0x5cd529
mov eax, dword [esp + 4]
movzx edx, byte [esp + 8]
mov byte [eax + 0x80], dl
add esp, 0x8c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5cd6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx edx, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.005cd20c
mov edx, eax
mov eax, 4
call fcn.005cd214
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], str.UUUU
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x5cd725
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x5cd6f3
cmp byte [ebp + 8], 0
jne 0x5cd854
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x5cd829
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x5cd803
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x5cd854
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x5cd841
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5cd9ac
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
mov ebx, 0x7663a4
lea esi, [esp + 4]
lea ecx, [esp + 8]
mov edx, esi
mov eax, dword [esp]
call fcn.005cd860
lea edx, [esp + 8]
mov eax, esi
call fcn.005cd8b0
mov edx, edi
mov ecx, 8
mov eax, dword [esp + 8]
shr eax, 4
mov edi, dword [esp + 8]
shl edi, 0x1c
or eax, edi
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x600]
xor dword [esi], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x400]
xor dword [esi], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x200]
xor dword [esi], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esi], eax
mov eax, dword [esp + 8]
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x700]
xor dword [esi], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x500]
xor dword [esi], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x300]
xor dword [esi], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esi], eax
mov eax, dword [esi]
shr eax, 4
mov edi, dword [esi]
shl edi, 0x1c
or eax, edi
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x600]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x400]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x200]
xor dword [esp + 8], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esp + 8], eax
mov eax, dword [esi]
xor eax, dword [edx]
add edx, 4
mov edi, 0x3f
and edi, eax
mov edi, dword [ebx + edi*4 + 0x700]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x500]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x300]
xor dword [esp + 8], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esp + 8], eax
dec ecx
jne 0x5cd9e0
lea edx, [esp + 8]
mov eax, esi
call fcn.005cd92c
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov eax, dword [esi]
call fcn.005cd88c
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5cdc1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.004066d8
xor eax, eax
mov dword [esp], eax
mov esi, 0x763fdc
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.004066d8
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x5cdc98
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.004066d8
dec edi
test edi, edi
jl 0x5cddb8
inc edi
mov dword [esp + 4], edi
mov esi, ebx
movzx eax, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x5cdce9
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x5cddad
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x5cdd2d
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x5cdcca
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.004066d8
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5cdebc
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
push ecx
shr ecx, 2
je 0x5cded6
cld
mov eax, dword [edi]
xor dword [esi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x5cdec9
pop ecx
and ecx, 3
je 0x5cdee5
mov al, byte [edi]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x5cdedc
pop edi
pop esi
ret

Function at 0x5cdef0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
movzx eax, byte [esp]
movzx eax, byte [eax + 0x7640ec]
mov byte [esp + 4], al
movzx eax, byte [esp + 1]
movzx eax, byte [eax + 0x7640ec]
mov byte [esp + 5], al
movzx eax, byte [esp + 2]
movzx eax, byte [eax + 0x7640ec]
mov byte [esp + 6], al
movzx eax, byte [esp + 3]
movzx eax, byte [eax + 0x7640ec]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x5cdf8c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x15], cl
mov ebx, edx
mov dword [ebp - 0x14], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x15], 0
jne 0x5ce01a
lea ecx, [eax]
and ecx, 0x80000003
jns 0x5cdfb7
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x764324]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x5cdfd2
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x764724]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x5cdfee
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x764b24]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x5ce00a
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x764f24]
mov dword [edx], ecx
jmp 0x5ce093
lea ecx, [eax]
and ecx, 0x80000003
jns 0x5ce029
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
movzx ecx, byte [ecx + 0x7640ec]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x5ce046
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
movzx ecx, byte [ecx + 0x7640ec]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x5ce065
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
movzx ecx, byte [ecx + 0x7640ec]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x5ce084
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
movzx ecx, byte [ecx + 0x7640ec]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x5cdfa2
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call fcn.005cdebc
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ce0c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.005cdebc
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x5ce19b
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x765324]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x765724]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x765b24]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x765f24]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x7641ec]
lea edi, [esi]
and edi, 0x80000003
jns 0x5ce135
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + 0x7641ec]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x5ce154
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + 0x7641ec]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x5ce173
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x7641ec]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x5ce192
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x5ce220
lea ecx, [esi]
and ecx, 0x80000003
jns 0x5ce1aa
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
movzx ecx, byte [ecx + 0x7641ec]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x5ce1ca
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
movzx ecx, byte [ecx + 0x7641ec]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x5ce1ec
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
movzx ecx, byte [ecx + 0x7641ec]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x5ce20e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
movzx ecx, byte [ecx + 0x7641ec]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x5ce0e5
mov eax, dword [ebp - 0x14]
mov edi, eax
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5cf494
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.004074c0
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x5cf615
mov edi, 1
xor esi, esi
jmp 0x5cf556
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x5cf4da
cmp edi, dword [esp + 8]
jg 0x5cf5fb
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x5cf5b1
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x5cf5f3
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
mov ecx, esi
lea edx, [esp + 0x39]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x5cf4b1
add esp, 0x78
pop edi
pop esi
pop ebx
ret