joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5478b0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x7c7e44], eax
cmp dword [0x7c9b6c], eax
je 0x5479fc
push 8
lea ecx, [ebp - 0x18]
mov dword [0x7c9b6c], eax
push ecx
push 0x1004
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0054a740
add esp, 0xc
mov dword [0x7c9b3c], eax
cmp dword [0x70d264], eax
je 0x5479fc
push 0x7c7e48
mov dword [0x70d264], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
movzx ecx, word [0x7c7e44]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
je 0x547968
sub eax, 0xd
je 0x547955
sub eax, 1
jne case.default.0x54797a
mov byte [0x7c7e52], al
mov dword [0x7c931c], 0x70d246
jmp 0x5479e1
mov byte [0x7c7e52], 1
mov dword [0x7c931c], 0x70d24c
jmp 0x5479e1
mov eax, ecx
mov byte [0x7c7e52], 1
shr eax, 0xa
dec eax
cmp eax, 4
ja case.default.0x54797a
jmp dword [eax*4 + 0x547a0c]
mov byte [0x7c7e52], 0
mov dword [0x7c931c], 0x70d23a
jmp 0x5479e1
mov dword [0x7c931c], 0x70d240
jmp 0x5479e1
push 0xa
lea eax, [ebp - 0x10]
mov dword [0x7c931c], 0x70d234
push eax
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [0x7c931c]
movsx cx, byte [ebp - 0x10]
mov word [eax], cx
movsx ax, byte [ebp - 0xf]
movzx eax, ax
push eax
call fcn.0061bd2f
mov ecx, dword [0x7c931c]
add esp, 4
mov word [ecx + 2], ax
cmp dword [0x7c9b38], 0x4e8
je 0x5479fc
mov eax, dword [0x7c9b3c]
mov dword [0x7c9b38], eax
call fcn.00547af0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
Function at 0x5481f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 2
jae 0x54843d
mov ecx, dword [0x7c7e44]
cmp dword [0x7c9b68], ecx
je 0x54848b
cmp byte [0x7c7e3a], 0
mov eax, 0x404
mov dword [0x7c9b68], ecx
je 0x54825b
cmp cx, ax
jne 0x54825b
mov dword [0x7c7ef4], 0x7000404
mov eax, 0x7000404
mov dword [0x7c7ef8], 0
jmp 0x54843f
cmp ecx, 0xe0080404
je 0x548287
cmp ecx, 0xe0090404
je 0x548287
cmp ecx, 0xe00a0404
je 0x548287
cmp ecx, 0xe00b0404
je 0x548287
cmp ecx, 0xe00e0804
jne 0x548429
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push ecx
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x548429
cmp dword [0x7c7e30], 0
jne 0x54834e
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push str.TINTLGNT.IME
push 0xffffffffffffffff
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x54834e
push 0xffffffffffffffff
push str.CINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x54834e
push 0xffffffffffffffff
push str.MSTCIPHA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x54834e
push 0xffffffffffffffff
push str.PINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x54834e
push 0xffffffffffffffff
push str.MSSCIPYA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push 1
push 0x409
call esi
cmp eax, 2
jne 0x548429
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
movzx esi, word [0x7c7e44]
mov ebx, eax
test ebx, ebx
je 0x548429
call fcn.005c8aa0
mov eax, esp
push eax
push ebx
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x404]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x548429
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
push 0x68d1ec
push dword [ebp - 0x40c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x548429
mov edx, dword [ebp - 0x410]
mov eax, dword [edx + 8]
movzx ecx, al
and eax, 0xffff0000
shl ecx, 8
or ecx, eax
shl ecx, 8
cmp dword [0x7c7e30], 0
jne 0x54847a
mov eax, 0x404
cmp si, ax
jne 0x548458
cmp ecx, 0x4020000
je 0x54847a
cmp ecx, 0x4030000
je 0x54847a
cmp ecx, 0x4040000
je 0x54847a
cmp ecx, 0x5000000
je 0x54847a
cmp ecx, 0x5010000
je 0x54847a
cmp ecx, 0x5020000
je 0x54847a
cmp ecx, 0x6000000
je 0x54847a
mov dword [0x7c7ef8], 0
mov dword [0x7c7ef4], 0
xor eax, eax
lea esp, [ebp - 0x420]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4
mov eax, 0x804
cmp si, ax
jne 0x548429
cmp ecx, 0x4010000
je 0x54847a
cmp ecx, 0x4020000
je 0x54847a
cmp ecx, 0x5030000
jne 0x548429
mov eax, esi
or eax, ecx
mov dword [0x7c7ef4], eax
mov eax, dword [edx + 0xc]
mov dword [0x7c7ef8], eax
mov eax, dword [edi*4 + 0x7c7ef4]
jmp 0x54843f
Function at 0x5485a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x7c7e44]
push ebx
cmp eax, 0xe00e0804
je 0x54876e
cmp eax, 0xe0090404
je 0x54876e
mov ebx, dword [0x7c7ef4]
test ebx, ebx
je 0x54876e
xor cl, cl
mov edx, 0x404
mov byte [ebp - 0x109], cl
cmp ax, dx
jne 0x54875d
movups xmm0, xmmword [str.softwaremicrosoftwindowscurrentversion_]
mov ax, word [0x68d218]
and ebx, 0xffff0000
mov word [ebp - 0xe0], ax
cmp ebx, 0x5010000
mov al, byte [0x68d21a]
mov edx, str.MSTCIPH
movups xmmword [ebp - 0x108], xmm0
mov byte [ebp - 0xde], al
mov eax, str.TINTLGNT
movups xmm0, xmmword [0x68d200]
push esi
cmovb edx, eax
movups xmmword [ebp - 0xf8], xmm0
mov esi, edx
movq xmm0, qword [0x68d210]
push edi
movq qword [ebp - 0xe8], xmm0
mov al, byte [edx]
inc edx
test al, al
jne 0x548654
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x548664
mov ecx, edx
lea eax, [ebp - 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
mov ecx, edx
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
jne 0x548748
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 4
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push str.Keyboard_Mapping
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x548725
mov eax, dword [ebp - 0x118]
cmp ebx, 0x5000000
ja 0x5486f0
cmp al, 0x22
je 0x548706
cmp al, 0x23
je 0x548706
cmp ebx, 0x5010000
je 0x548700
cmp ebx, 0x5020000
jne 0x548725
sub al, 0x22
cmp al, 2
ja 0x548725
push dword [ebp - 0x110]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x110]
mov bl, byte [ebp - 0x109]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x109]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
Function at 0x548990
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x7c7e38], 0
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
jne 0x548b58
cmp byte [0x7c9b50], 0
mov dword [0x7c7e40], eax
jne 0x5489f2
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x5489f2
push 0x7c9b4c
push 0x68d11c
push 1
push 0
push 0x6b3f00
mov byte [0x7c9b50], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x7c7e58
mov dword [0x7c7e58], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x105
lea eax, [ebp - 0x10c]
mov byte [0x7c7e39], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x548ada
lea ecx, [ebp - 0x10c]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x548a30
mov eax, dword [0x68d12c]
mov dword [ecx], eax
mov eax, dword [0x68d130]
mov dword [ecx + 4], eax
mov ax, word [0x68d134]
mov word [ecx + 8], ax
mov al, byte [0x68d136]
mov byte [ecx + 0xa], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x7c7e54], eax
test eax, eax
je 0x548ad3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call esi
push str.ImmUnlockIMC
push dword [0x7c7e54]
mov dword [0x7c7e20], eax
call esi
push str.ImmLockIMCC
push dword [0x7c7e54]
mov dword [0x7c7e24], eax
call esi
push str.ImmUnlockIMCC
push dword [0x7c7e54]
mov dword [0x7c7e28], eax
call esi
push str.ImmDisableTextFrameService
push dword [0x7c7e54]
mov dword [0x7c7e2c], eax
call esi
pop esi
test eax, eax
je 0x548ada
push 0xffffffffffffffff
call eax
jmp 0x548ada
mov byte [0x7c7e39], 1
push dword [0x7c7e40]
mov byte [0x7c7e38], 1
call sub.IMM32.dll_ImmGetContext
push eax
mov dword [edi + 4], eax
push dword [0x7c7e40]
call sub.IMM32.dll_ImmReleaseContext
call fcn.005478b0
call fcn.00547880
push 2
call fcn.00549b00
add esp, 4
call fcn.00549ec0
test eax, eax
setne byte [0x7c7e3a]
call fcn.00547a20
cmp byte [0x7c7e3a], 0
je 0x548b58
mov eax, dword [0x7c7e44]
and eax, 0x3ff
cmp eax, 4
jne 0x548b47
call fcn.00547c60
test eax, eax
je 0x548b47
mov al, 1
jmp 0x548b49
xor al, al
push 0
mov byte [0x7c7e3d], al
call fcn.0054a080
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4
Function at 0x549200
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667f60
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x834], eax
cmp byte [eax + 0x20], 0
je 0x549420
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x549420
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
mov dword [ebp - 0x830], ebx
test ebx, ebx
je 0x54927e
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov dword [ebp - 0x82c], edi
test edi, edi
jne 0x549289
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x549420
mov esi, edi
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0xf
mov byte [ebp - 0x828], 0
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x5492b3
sub esi, ecx
cmp esi, 0xf
ja 0x5492e2
push esi
lea eax, [ebp - 0x828]
mov dword [ebp - 0x818], esi
push edi
push eax
call fcn.006029d0
mov byte [ebp + esi - 0x828], 0
jmp 0x54936f
cmp esi, 0x7fffffff
ja 0x54943c
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x549312
mov eax, connect
mov edi, closesocket
push eax
call fcn.00449c20
add esp, 4
mov ebx, eax
jmp 0x549346
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x549333
push eax
call fcn.00449c20
add esp, 4
mov ebx, eax
jmp 0x549346
test eax, eax
je 0x549344
push eax
call fcn.005c7d27
add esp, 4
mov ebx, eax
jmp 0x549346
xor ebx, ebx
push esi
push dword [ebp - 0x82c]
mov dword [ebp - 0x818], esi
push ebx
mov dword [ebp - 0x814], edi
call fcn.006029d0
mov byte [ebx + esi], 0
mov dword [ebp - 0x828], ebx
mov ebx, dword [ebp - 0x830]
add esp, 0xc
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x5493ea
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
push 0x400
cmovae ecx, dword [ebp - 0x828]
lea edx, [ebp - 0x810]
push edx
add eax, ecx
sub eax, ecx
push eax
push ecx
push 0
push dword [0x7c9b3c]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x5493ea
mov ecx, dword [ebp - 0x834]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00548b70
mov ecx, dword [0x7c9320]
test ecx, ecx
je 0x5493ea
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x814]
cmp edx, 0x10
jb 0x549420
mov ecx, dword [ebp - 0x828]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x549416
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x549441
push edx
push ecx
call fcn.005c7d65
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
call fcn.0044d230
call fcn.0060d0a2
int3
Function at 0x54b6e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x54b6f9
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 4], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x5509a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6683d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x71ccd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x5509da
mov edx, dword [edi]
mov ecx, dword [edi + 0x10]
xor ebx, ebx
add ecx, edx
mov dword [ebp + 0xc], ebx
cmp edx, ecx
jae 0x550a03
nop dword [eax + eax]
movzx eax, byte [edx]
inc edx
imul ebx, ebx, 0x1000193
xor ebx, eax
cmp edx, ecx
jb 0x5509f0
mov dword [ebp + 0xc], ebx
movzx eax, byte [esi]
lea ecx, [esi + 1]
and eax, 1
add ecx, eax
lea eax, [ecx + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push edi
push ebx
mov ecx, esi
call fcn.00550be0
mov ecx, eax
test ecx, ecx
je 0x550a44
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ebx, [esi + 3]
mov dword [ebp - 0x18], 0
lea eax, [ebx + 1]
neg ebx
sbb ebx, ebx
and ebx, eax
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00552330
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp + 0x10]
push esi
lea ecx, [edi + 8]
call fcn.0044b1e0
mov eax, dword [esi + 0x18]
lea ecx, [ebp - 0x1c]
mov dword [edi + 0x20], eax
mov dword [ebp - 0x18], 0
call fcn.00550e00
mov esi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp dword [ebx + 0x14], 0
mov eax, dword [ebx + 8]
lea edi, [eax + 1]
jne 0x550ac5
push edi
mov ecx, ebx
call fcn.00552540
mov ecx, dword [ebx + 4]
cmp ecx, eax
cmovb ecx, eax
push ecx
mov ecx, ebx
call fcn.005521c0
jmp 0x550af2
cmp edi, dword [ebx + 0x10]
jbe 0x550af2
mov ecx, eax
mov edx, 1
shr ecx, 1
add eax, ecx
cmp edi, eax
cmovb edx, ecx
mov ecx, ebx
add edx, dword [ebx + 8]
push edx
call fcn.00552540
cmp eax, dword [ebx + 4]
je 0x550af2
push eax
mov ecx, ebx
call fcn.005526a0
mov eax, dword [ebp + 0xc]
xor edx, edx
div dword [ebx + 4]
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], 0
lea edi, [eax + edx*4]
and edx, 0x7fffffff
mov dword [esi + 4], edx
mov eax, dword [edi]
test eax, eax
jne 0x550b3a
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x14]
lea ecx, [edx + eax*4]
mov eax, dword [ecx]
test eax, eax
je 0x550b30
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [edx + eax*4], esi
mov dword [edi], ecx
mov eax, dword [ecx]
mov dword [esi], eax
mov dword [ecx], esi
jmp 0x550b42
mov eax, dword [eax]
mov dword [esi], eax
mov eax, dword [edi]
mov dword [eax], esi
inc dword [ebx + 8]
lea ecx, [ebp - 0x1c]
call fcn.00550e20
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5523b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ecx]
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 1
push esi
push edi
lea edi, [ecx + 1]
mov dword [ebp - 4], ecx
add edi, eax
mov ecx, ebx
lea eax, [edi + 1]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0x10
jb 0x5523db
mov ecx, dword [ebx]
mov esi, dword [ebx + 0x10]
xor edx, edx
add esi, ecx
cmp ecx, esi
jae 0x5523f6
movzx eax, byte [ecx]
inc ecx
imul edx, edx, 0x1000193
xor edx, eax
cmp ecx, esi
jb 0x5523e6
mov ecx, dword [ebp - 4]
push edi
push ebx
push edx
call fcn.00550be0
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x5526a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
call fcn.005521c0
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x14]
lea edi, [eax + edx*4]
mov dword [ebp + 8], edi
mov edi, dword [edi]
test edi, edi
je 0x55276f
push ebx
nop word [eax + eax]
cmp dword [edi + 0x1c], 0x10
lea eax, [edi + 8]
mov esi, edi
jb 0x5526de
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x18]
xor edx, edx
add ebx, eax
cmp eax, ebx
jae 0x552700
nop dword [eax]
movzx ecx, byte [eax]
inc eax
imul edx, edx, 0x1000193
xor edx, ecx
cmp eax, ebx
jb 0x5526f0
mov ebx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ebx + 4]
mov eax, edx
and eax, 0x7fffffff
mov dword [edi + 4], eax
mov eax, dword [edi]
test eax, eax
je 0x552740
nop word [eax + eax]
mov ecx, dword [eax + 4]
shr ecx, 0x1f
not ecx
test cl, 1
jne 0x552740
mov ecx, edx
mov esi, eax
or ecx, 0x80000000
mov dword [eax + 4], ecx
mov eax, dword [eax]
test eax, eax
jne 0x552720
mov eax, dword [ebx + 0x14]
lea ecx, [eax + edx*4]
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
jne 0x552758
mov dword [ecx], edx
mov edi, dword [esi]
mov dword [ebp + 8], esi
jmp 0x552766
mov eax, dword [eax]
mov edi, dword [esi]
mov dword [esi], eax
mov ecx, dword [ecx]
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], edi
test edi, edi
jne 0x5526d0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x555c70
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
push 0x68bb48
lea esi, [edi + 0x255]
push esi
call fcn.00614ae2
add esp, 8
test eax, eax
je 0x555c9a
push eax
call fcn.006149a7
add esp, 4
mov al, 1
pop edi
pop esi
ret
cmp byte [edi + 0x364], 0
jne 0x555cf4
push 0x68e180
push esi
call fcn.00614ae2
mov esi, eax
add esp, 8
test esi, esi
je 0x555cf4
push esi
push 1
push 4
push 0x68d878
call fcn.00616f1d
push esi
push 1
push 4
push 0x68d87c
call fcn.00616f1d
push esi
push 1
lea eax, [edi + 0x150]
push 4
push eax
call fcn.00616f1d
push esi
call fcn.006149a7
add esp, 0x34
mov al, 1
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x555d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x13e4], 0x20
je 0x555d56
xor al, al
pop esi
pop ebp
ret 4
cmp byte [esi + 0x365], 0
jne 0x555d95
cmp dword [esi + 0x13e8], 0x10
push edi
lea edi, [esi + 0x13d4]
jb 0x555d71
mov edi, dword [edi]
mov edx, dword [ebp + 8]
xor ecx, ecx
xor dword [edi + ecx*4], edx
inc ecx
mov eax, dword [esi + 0x13e4]
add edx, 0x1000193
shr eax, 2
cmp ecx, eax
jne 0x555d76
mov byte [esi + 0x365], 1
pop edi
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x5571b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x557272
cmp byte [esi + 0x3e], 0
je 0x557272
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x557260
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x557228
sub eax, 1
je 0x55722c
sub eax, 2
jne 0x557260
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x557249
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00616f1d
add esp, 0x10
cmp edi, eax
jne 0x557260
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
Function at 0x558a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x558aa5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x558ae3
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x558ae3
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x558bc0
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x558b0d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x558b46
push dword [esi + 0x4c]
push edi
call fcn.0061c60d
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x558bc5
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x558b93
sub eax, 1
je 0x558b93
sub eax, 2
jne 0x558bc0
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00552910
add esp, 8
test al, al
movzx eax, di
jne 0x558bc5
jmp 0x558bc0
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x558bb0
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.00616f1d
add esp, 0x10
cmp ebx, eax
jne 0x558bc0
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x558acd
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4