joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f46e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5bd06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xc
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
jae 0x4f4706
xor eax, eax
jmp 0x4f474e
push edi
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
xor esi, esi
push ebx
movzx eax, word [ecx + 0x18]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
shr ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov byte [ebp - 0x14], bl
push dword [ebp - 0x14]
call fcn.004f47b7
mov ecx, dword [ebp - 0x18]
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xc
jl 0x4f4711
mov ecx, dword [ebp + 0x10]
xor eax, eax
shr ecx, 0x18
cmp byte [ebp - 5], cl
pop ebx
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00482224
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f47b7
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x10]
xor eax, edx
mov esi, dword [edi + 0xc]
mov ecx, dword [edi + 0x18]
movzx eax, al
shr edx, 8
mov eax, dword [esi + eax*4]
xor eax, edx
mov dword [edi + 0x10], eax
movzx eax, al
add eax, dword [edi + 0x14]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 0x14], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [esi + eax*4]
mov dword [edi + 0x18], ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4fe8f8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4fe90a
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4fe912
jae 0xe8383c5f
push ecx
push ebx
call 0x4fe8f8
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4fe92d
or eax, 0xc181027d
jge 0x4fe921
add ecx, 0x57be0177
ja 0x4fe924
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4fe931
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4fe91d
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114adcc
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4fe96e
mov byte [ebp - 1], 0
jmp 0x4fe972
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4fe982
push 1
call dword [0x575e34]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fe931
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4fe90a
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4fe912
jae 0xe8383c5f
push ecx
push ebx
call 0x4fe8f8
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4fe92d
or eax, 0xc181027d
jge 0x4fe921
add ecx, 0x57be0177
ja 0x4fe924
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4fe931
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4fe91d
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114adcc
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4fe96e
mov byte [ebp - 1], 0
jmp 0x4fe972
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4fe982
push 1
call dword [0x575e34]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fea6d
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4fea7f
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4fea87
jae 0xe8383dd4
push ecx
push ebx
call 0x4fea6d
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4feaa2
or eax, 0xc181027d
jge 0x4fea96
add ecx, 0x57be0177
ja 0x4fea99
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4feaa6
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4fea92
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114af41
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4feae3
mov byte [ebp - 1], 0
jmp 0x4feae7
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4feb01
lea ecx, [ebp - 2]
call fcn.004fec2f
push 0
lea ecx, [ebp - 3]
call fcn.004fedb3
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4feaa6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4fea7f
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4fea87
jae 0xe8383dd4
push ecx
push ebx
call 0x4fea6d
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4feaa2
or eax, 0xc181027d
jge 0x4fea96
add ecx, 0x57be0177
ja 0x4fea99
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4feaa6
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4fea92
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114af41
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4feae3
mov byte [ebp - 1], 0
jmp 0x4feae7
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4feb01
lea ecx, [ebp - 2]
call fcn.004fec2f
push 0
lea ecx, [ebp - 3]
call fcn.004fedb3
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ffbe7
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4ffbf9
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4ffc01
jae 0xe8384f4e
push ecx
push ebx
call 0x4ffbe7
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4ffc1c
or eax, 0xc181027d
jge 0x4ffc10
add ecx, 0x57be0177
ja 0x4ffc13
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4ffc20
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4ffc0c
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c0bb
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4ffc5d
mov byte [ebp - 1], 0
jmp 0x4ffc61
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ffc20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4ffbf9
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4ffc01
jae 0xe8384f4e
push ecx
push ebx
call 0x4ffbe7
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4ffc1c
or eax, 0xc181027d
jge 0x4ffc10
add ecx, 0x57be0177
ja 0x4ffc13
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4ffc20
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4ffc0c
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c0bb
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4ffc5d
mov byte [ebp - 1], 0
jmp 0x4ffc61
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ffd4c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4ffd5e
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4ffd66
jae 0xe83850b3
push ecx
push ebx
call 0x4ffd4c
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4ffd81
or eax, 0xc181027d
jge 0x4ffd75
add ecx, 0x57be0177
ja 0x4ffd78
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4ffd85
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4ffd71
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c220
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4ffdc2
mov byte [ebp - 1], 0
jmp 0x4ffdc6
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4ffdde
lea ecx, [ebp - 2]
call fcn.00500f4b
lea ecx, [ebp - 3]
call fcn.005010de
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ffd85
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4ffd5e
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4ffd66
jae 0xe83850b3
push ecx
push ebx
call 0x4ffd4c
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4ffd81
or eax, 0xc181027d
jge 0x4ffd75
add ecx, 0x57be0177
ja 0x4ffd78
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4ffd85
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4ffd71
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c220
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4ffdc2
mov byte [ebp - 1], 0
jmp 0x4ffdc6
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4ffdde
lea ecx, [ebp - 2]
call fcn.00500f4b
lea ecx, [ebp - 3]
call fcn.005010de
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ffec9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4ffedb
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4ffee3
jae 0xe8385230
push ecx
push ebx
call 0x4ffec9
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4ffefe
or eax, 0xc181027d
jge 0x4ffef2
add ecx, 0x57be0177
ja 0x4ffef5
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4fff02
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4ffeee
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c39d
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4fff3f
mov byte [ebp - 1], 0
jmp 0x4fff43
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4fff5f
push 0
lea ecx, [ebp - 2]
call fcn.004fedb3
push 2
lea ecx, [ebp - 3]
call fcn.00501262
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fff02
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x4ffedb
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x4ffee3
jae 0xe8385230
push ecx
push ebx
call 0x4ffec9
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x4ffefe
or eax, 0xc181027d
jge 0x4ffef2
add ecx, 0x57be0177
ja 0x4ffef5
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x4fff02
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x4ffeee
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c39d
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x4fff3f
mov byte [ebp - 1], 0
jmp 0x4fff43
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4fff5f
push 0
lea ecx, [ebp - 2]
call fcn.004fedb3
push 2
lea ecx, [ebp - 3]
call fcn.00501262
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50004a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x50005c
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x500064
jae 0xe83853b1
push ecx
push ebx
call 0x50004a
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x50007f
or eax, 0xc181027d
jge 0x500073
add ecx, 0x57be0177
ja 0x500076
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x500083
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x50006f
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c51e
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x5000c0
mov byte [ebp - 1], 0
jmp 0x5000c4
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x5000de
lea ecx, [ebp - 2]
call fcn.00500f4b
push 2
lea ecx, [ebp - 3]
call fcn.00501262
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x500083
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub esp, 8
jne 0x50005c
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x500064
jae 0xe83853b1
push ecx
push ebx
call 0x50004a
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x50007f
or eax, 0xc181027d
jge 0x500073
add ecx, 0x57be0177
ja 0x500076
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x500083
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x50006f
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x114c51e
add byte [eax], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x5000c0
mov byte [ebp - 1], 0
jmp 0x5000c4
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x5000de
lea ecx, [ebp - 2]
call fcn.00500f4b
push 2
lea ecx, [ebp - 3]
call fcn.00501262
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x538ac3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00538786

Function at 0x5440f1
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x573bed
call fcn.0048287a
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x54420e
cmp byte [ebx + 0x3e], 0
je 0x54420e
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.00482922
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x54413d
xor al, al
jmp 0x544210
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00412c80
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x54416d
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.00482922
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x5441a2
sub eax, 1
je 0x5441a6
dec eax
sub eax, 1
je 0x5441fc
xor bl, bl
jmp 0x5441fe
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x5441b6
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x5441de
cmp eax, 0x10
jae 0x5441c5
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0051d8bb
add esp, 0x10
cmp esi, eax
jne 0x54419e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x5441fc
test esi, esi
jne 0x544161
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00413800
jmp 0x54415b
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00405f90
mov al, bl
jmp 0x544210
mov al, 1
call fcn.00482824
ret

Function at 0x546f4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x546f5b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00546f67
Function at 0x5503ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
call fcn.0051c742
mov ecx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0xc]
xorps xmm1, xmm1
movsd qword [ebp - 0x20], xmm1
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov al, byte [eax]
mov dword [esi], ecx
mov byte [ebp - 1], al
movzx eax, byte [ecx]
test byte [eax + 0x59d629], 8
je 0x550405
inc ecx
movzx eax, byte [ecx]
test byte [eax + 0x59d629], 8
jne 0x5503f5
mov dword [ebp + 8], ecx
lea eax, [ebp + 8]
push eax
call fcn.0054fa4a
mov esi, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x18], eax
cmp byte [esi], 0x30
jne 0x550542
mov cl, byte [esi + 1]
cmp cl, 0x78
je 0x55042f
cmp cl, 0x58
jne 0x550542
mov al, byte [ebp - 1]
add esi, 2
mov cl, byte [esi]
cmp cl, al
jne 0x55044a
cmp dword [ebp - 0xc], 0
jne 0x5504a8
mov dword [ebp - 0xc], 1
jmp 0x5504a5
movzx eax, cl
test byte [eax + 0x59d629], 0x10
je 0x5504a8
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x550467
cmp cl, 0x30
jne 0x550467
inc dword [ebp - 0x14]
jmp 0x55049b
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x55049a
movsx eax, cl
push eax
call fcn.0054ffb5
movsd xmm1, qword [ebp - 0x20]
mulsd xmm1, qword [0x59b800]
pop ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
jmp 0x55049b
inc edi
cmp dword [ebp - 0xc], 0
mov al, byte [ebp - 1]
je 0x5504a5
dec edi
inc esi
jmp 0x550435
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], edi
push 0
pop edi
add eax, ecx
je 0x550542
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov cl, byte [esi]
shl eax, 2
cmp cl, 0x70
je 0x5504d3
cmp cl, 0x50
jne 0x550523
lea eax, [ebp + 8]
inc esi
push eax
mov dword [ebp + 8], esi
call fcn.0054fa4a
mov edx, dword [ebp + 8]
mov esi, eax
pop ecx
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x59d629], 2
je 0x550542
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x59d629], 2
mov al, byte [edx]
jne 0x5504f4
test esi, esi
je 0x550514
neg edi
mov ecx, dword [ebp - 8]
mov eax, ecx
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, edi
mov dword [esi], edx
cmp dword [ebp - 0x18], 0
je 0x550530
xorps xmm1, xmmword [0x5acdc0]
push eax
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.005204a7
add esp, 0xc
jmp 0x550544
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x556332
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00482f70
mov eax, dword [0x5bd06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1018], ebx
call fcn.0054894d
push ebx
lea esi, [eax - 1]
mov dword [ebp - 0x1020], esi
call fcn.005652e3
pop ecx
pop ecx
test esi, esi
jne 0x5563a8
push 1
push ebx
push edi
call fcn.005569bc
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov ebx, eax
inc esi
push dword [ebp - 0x1018]
call fcn.0051d06f
pop ecx
test eax, eax
je 0x556504
push 0
push 0
push edi
call fcn.00549fad
jmp 0x5564ff
push 0x59c0dc
lea eax, [esi + 0x14]
push eax
push edi
call fcn.00549e1f
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp - 0x1020]
add esp, 0xc
inc ebx
mov dword [ebp - 0x101c], esi
dec eax
mov dword [ebp - 0x1020], eax
test ebx, ebx
je 0x556385
push esi
push edi
call fcn.00549703
pop ecx
pop ecx
cmp eax, 3
jne 0x556475
push esi
push edi
call fcn.00549cac
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x556425
mov ebx, dword [ebp - 0x1018]
push ebx
call fcn.0051d4c0
mov esi, eax
push ebx
push esi
call fcn.0051dc19
push 0x5a5bf4
push edi
call fcn.00548e13
xor ebx, ebx
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x55646d
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.00549c00
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.0054a536
push dword [ebp - 0x1018]
push esi
push 1
push eax
call fcn.0051e021
mov esi, eax
lea eax, [ebp - 0x1014]
add dword [ebp - 0x100c], esi
push eax
call fcn.0054a5b5
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [ebp - 0x101c]
jmp 0x5564d9
push 0
push esi
push edi
call fcn.00549d0c
add esp, 0xc
cmp byte [eax], 0x2a
jne 0x556487
inc eax
movsx eax, byte [eax]
sub eax, 0x4c
je 0x5564c6
sub eax, 0x15
je 0x5564b3
sub eax, 0xb
je 0x5564af
dec eax
sub eax, 1
jne 0x5564f3
push dword [ebp - 0x1018]
push edi
call fcn.00556ad1
pop ecx
pop ecx
jmp 0x5564d7
push 1
jmp 0x5564c8
push dword [ebp - 0x1018]
push edi
call fcn.00556948
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x5564d9
push 0
push dword [ebp - 0x1018]
push edi
call fcn.005569bc
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1020]
inc esi
mov dword [ebp - 0x101c], esi
test eax, eax
jne 0x5563cc
jmp 0x556385
push 0x59c0f0
push esi
push edi
call fcn.00549b23
add esp, 0xc
jmp 0x55651e
test ebx, ebx
jne 0x556519
push 0xfffffffffffffffe
push edi
call fcn.005493ce
push edi
call fcn.00548de1
add esp, 0xc
sub esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00482224
mov esp, ebp
pop ebp
ret