joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ed18
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0050e91c
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret

Function at 0x520594
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x617888
call fcn.0050acb0
mov word [ebp - 0x14], 8
mov edx, 0x617a9c
mov ecx, dword [ebx]
mov dword [ecx], edx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 8], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x10], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x18], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x1c], edx
mov ecx, dword [ebx]
add ecx, 0x20
push ecx
call fcn.00545ab4
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x24], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x28], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x2c], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x30], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x34], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x38], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x3c], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebx]
add eax, 0x4c
push eax
call fcn.00461dcc
pop ecx
add dword [ebp - 8], 4
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x523f3c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x523f65
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x523f65
xor eax, eax
jmp 0x523f68
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x523f6c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov eax, 0x618360
push ebx
mov ebx, dword [ebp + 8]
call fcn.0050acb0
mov dword [ebx], 0xffffffff
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
cmp dword [0x61835c], 0
jne 0x523fad
lea ecx, [ebp - 0x48]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x44]
mov dword [0x61835c], eax
xor edx, edx
mov dword [ebx + 4], edx
cmp dword [0x61835c], 0
ja 0x523fc5
mov dword [0x61835c], 0x1000
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5241bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile
test byte [esi + 8], 4
jne 0x52428c
cmp dword [ebp - 4], 0
je 0x52428c
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
jmp 0x524261
mov al, byte [ebx]
movsx edx, al
cmp edx, 0xd
je 0x524213
mov byte [edi], al
inc edi
jmp 0x524260
cmp ebx, dword [ebp - 8]
jae 0x524227
movsx ecx, byte [ebx + 1]
cmp ecx, 0xa
je 0x524260
mov byte [edi], 0xd
inc edi
jmp 0x524260
mov byte [ebp - 9], 0x20
lea eax, [ebp - 0x10]
push 0
push eax
lea edx, [ebp - 9]
push 1
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0x10], 0
je 0x524253
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SetFilePointer
movsx edx, byte [ebp - 9]
cmp edx, 0xa
je 0x524260
mov byte [edi], 0xd
inc edi
inc ebx
cmp ebx, dword [ebp - 8]
ja 0x52426e
movsx ecx, byte [ebx]
cmp ecx, 0x1a
jne 0x524204
cmp ebx, dword [ebp - 8]
ja 0x524286
push 1
push 0
mov eax, dword [ebp - 8]
inc eax
sub eax, ebx
push eax
mov edx, dword [esi]
push edx
call sub.KERNEL32.DLL_SetFilePointer
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x524298
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
test byte [eax + 8], 1
je 0x5242c1
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00524410
add esp, 0xc
mov ecx, dword [ebp + 8]
test byte [ecx + 8], 4
je 0x5242eb
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
jmp 0x5243e0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], eax
lea ebx, [ebp - 0x102c]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x1000
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
jge 0x524317
lea eax, [ebp - 0x10]
jmp 0x52431a
lea eax, [ebp + 0x10]
mov edi, dword [eax]
jmp 0x52436c
mov edi, dword [ebp - 0x14]
sub edi, esi
push edi
push esi
push ebx
call fcn.0050a50c
add ebx, edi
xor ecx, ecx
inc edi
add esp, 0xc
mov byte [ebx], 0xd
inc ebx
add esi, edi
mov byte [ebx], 0xa
inc ebx
mov edx, dword [ebp - 8]
sub edx, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jge 0x524355
lea eax, [ebp - 0x18]
jmp 0x524358
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
sub edx, esi
mov dword [ebp - 0x20], edx
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jl 0x52436a
lea eax, [ebp - 0x20]
mov edi, dword [eax]
test edi, edi
jle 0x524383
push edi
push 0xa
push esi
call fcn.0050a825
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x52431e
test edi, edi
jle 0x524396
push edi
push esi
push ebx
call fcn.0050a50c
add esp, 0xc
add ebx, edi
add esi, edi
lea eax, [ebp - 0x102c]
mov dword [ebp - 0x24], eax
sub ebx, eax
test ebx, ebx
je 0x5243db
push 0
lea edx, [ebp - 0x28]
push edx
mov edi, ebx
push edi
mov eax, dword [ebp - 0x24]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_WriteFile
cmp edi, dword [ebp - 0x28]
je 0x5243db
cmp dword [ebp - 0x28], 0
jne 0x5243cc
xor eax, eax
jmp 0x524406
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x24], edx
sub edi, dword [ebp - 0x28]
mov ebx, edi
test ebx, ebx
jne 0x5243a5
mov eax, esi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x5243e9
mov al, 1
jmp 0x524406
test eax, eax
jle 0x5243fd
cmp eax, dword [ebp + 0x10]
jge 0x5243fd
sub dword [ebp + 0x10], eax
add dword [ebp + 0xc], eax
jmp 0x5242a8
xor eax, eax
jmp 0x524406
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5244a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x52450c
mov eax, dword [ebp + 0x10]
mov edx, edi
and edx, 0xffffffff
push eax
mov eax, edi
push edx
cdq
mov eax, edx
xor edx, edx
push eax
push 4
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
je 0x5244fa
push 1
add edi, dword [ebp + 0x10]
push edi
push ebx
call fcn.00524410
add esp, 0xc
test eax, eax
jge 0x52450e
mov edx, dword [ebp + 0x10]
push edx
push esi
push ebx
call fcn.00524518
add esp, 0xc
xor esi, esi
jmp 0x52450e
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x54721c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x208]
push edx
call sub.USER32.DLL_wvsprintfA
cmp eax, 0x208
jl 0x547260
push 0x10e
push str.c:_bcbemuvclutilcls.h
push str.bufSize___sizeof_szBuffer_
call fcn.005466e0
add esp, 0xc
cmp eax, 2
jne 0x547260
call sub.KERNEL32.DLL_DebugBreak
lea ecx, [ebp - 0x208]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret

Function at 0x5484a0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
test eax, eax
je 0x5484dd
push ebx
call sub.KERNEL32.DLL_GetFileType
test eax, eax
je 0x5484dd
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
push 0x612fec
call fcn.0050ed84
add esp, 0xc
jmp 0x548635
mov eax, dword [ebp + 8]
jmp 0x5485b7
lea edx, [ebp + 0xc]
push edx
push eax
push 0xff
lea eax, [ebp - 0x104]
push eax
call fcn.0050e91c
mov byte [ebp - 5], 0
add esp, 0x10
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x548620
call fcn.00548398
test eax, eax
jle 0x548620
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov ebx, eax
lea eax, [ebp - 0x104]
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push 0
push edx
push 0
push 1
push 0
push 0
push 0
push 1
push ebx
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
jmp 0x548635
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call sub.USER32.DLL_MessageBoxA
mov esp, ebp
mov edi, dword [ebp - 0x110]
mov esi, dword [ebp - 0x10c]
mov ebx, dword [ebp - 0x108]
pop ebp
ret

Function at 0x54a828
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x5c
push 0
push ebx
call fcn.0050a57c
add esp, 0xc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x54f814
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x60
push 0
push ebx
call fcn.0050a57c
add esp, 0xc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x54f854
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x70
push 0
push ebx
call fcn.0050a57c
add esp, 0xc
mov dword [ebx], 0xc1059ed8
mov dword [ebx + 4], 0x367cd507
mov dword [ebx + 8], 0x3070dd17
mov dword [ebx + 0xc], 0xf70e5939
mov dword [ebx + 0x10], 0xffc00b31
mov dword [ebx + 0x14], 0x68581511
mov dword [ebx + 0x18], 0x64f98fa7
mov dword [ebx + 0x1c], 0xbefa4fa4
mov dword [ebx + 0x6c], 0x1c
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x54f8b0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x70
push 0
push ebx
call fcn.0050a57c
add esp, 0xc
mov dword [ebx], 0x6a09e667
mov dword [ebx + 4], 0xbb67ae85
mov dword [ebx + 8], 0x3c6ef372
mov dword [ebx + 0xc], 0xa54ff53a
mov dword [ebx + 0x10], 0x510e527f
mov dword [ebx + 0x14], 0x9b05688c
mov dword [ebx + 0x18], 0x1f83d9ab
mov dword [ebx + 0x1c], 0x5be0cd19
mov dword [ebx + 0x6c], 0x20
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x55200c
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], edx
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret

Function at 0x5520b8
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], edx
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x552cc8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
xor eax, eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
je 0x552cf1
mov dword [ebp - 8], 1
mov dword [ebx], esi
jmp 0x552cf3
mov esi, dword [ebx]
cmp dword [ebp + 0xc], 0
je 0x552dd6
mov dword [ebp - 8], 1
push esi
call fcn.005899e8
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80
jle 0x552d2b
push str.j____int_sizeof_ctx__key_
push 0x68
push 0x61df60
call fcn.0054864c
add esp, 0xc
cmp edi, dword [ebp - 4]
jle 0x552d80
mov eax, dword [ebp + 0x18]
lea edx, [ebx + 4]
push eax
push esi
push edx
call fcn.00585f98
add esp, 0xc
test eax, eax
je 0x552ea9
push edi
mov ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebx + 4]
push eax
call fcn.00586150
add esp, 0xc
test eax, eax
je 0x552ea9
lea edx, [ebx + 0x4c]
push edx
lea ecx, [ebx + 0x50]
push ecx
lea eax, [ebx + 4]
push eax
call fcn.00586190
add esp, 0xc
test eax, eax
je 0x552ea9
jmp 0x552db4
test edi, edi
jl 0x552d8c
cmp edi, 0x80
jle 0x552da0
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.0054864c
add esp, 0xc
push edi
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebx + 0x50]
push ecx
call fcn.0050a50c
add esp, 0xc
mov dword [ebx + 0x4c], edi
mov eax, dword [ebx + 0x4c]
cmp eax, 0x80
je 0x552dd6
mov edx, 0x80
sub edx, eax
add eax, ebx
push edx
add eax, 0x50
push 0
push eax
call fcn.0050a57c
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x552e8e
xor eax, eax
lea edx, [ebp - 0x90]
mov dword [ebp - 0xc], edx
lea edx, [ebx + 0x50]
mov edi, dword [ebp - 0xc]
mov cl, byte [edx]
xor cl, 0x36
inc edx
mov byte [edi], cl
inc eax
inc dword [ebp - 0xc]
cmp eax, 0x80
jl 0x552dee
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 0x1c]
push eax
push esi
push edi
call fcn.00585f98
add esp, 0xc
test eax, eax
je 0x552ea9
push esi
call fcn.005899e8
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.00586150
add esp, 0xc
test eax, eax
je 0x552ea9
xor eax, eax
lea edx, [ebp - 0x90]
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x50]
mov edi, dword [ebp - 0x10]
mov cl, byte [edx]
xor cl, 0x5c
inc edx
mov byte [edi], cl
inc eax
inc dword [ebp - 0x10]
cmp eax, 0x80
jl 0x552e47
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 0x34]
push eax
push esi
push edi
call fcn.00585f98
add esp, 0xc
test eax, eax
je 0x552ea9
push esi
call fcn.005899e8
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.00586150
add esp, 0xc
test eax, eax
je 0x552ea9
lea edx, [ebx + 0x1c]
push edx
add ebx, 4
push ebx
call fcn.0058622c
add esp, 8
test eax, eax
je 0x552ea9
mov eax, 1
jmp 0x552eab
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5539ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10c], 0xffffffff
jne 0x5539c4
xor eax, eax
jmp 0x553a90
mov edx, dword [ebp + 8]
push edx
call fcn.00589928
mov ebx, eax
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [eax], ebx
cmp dword [ebp + 0xc], 0
jne 0x5539e5
mov eax, 1
jmp 0x553a90
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10c]
cmp ebx, eax
jne 0x553a15
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov esi, ecx
mov eax, dword [ebp + 8]
add eax, 0xec
cmp ebx, edx
jle 0x553a5f
mov cl, byte [eax]
inc edx
xor cl, byte [eax - 0x60]
inc eax
mov byte [esi], cl
inc esi
cmp ebx, edx
jg 0x553a05
jmp 0x553a5f
mov edx, dword [ebp + 8]
mov byte [edx + eax + 0xec], 0x80
mov edx, ebx
sub edx, eax
cmp edx, 1
jle 0x553a3e
dec edx
push edx
push 0
add eax, dword [ebp + 8]
add eax, 0xed
push eax
call fcn.0050a57c
add esp, 0xc
xor edx, edx
mov eax, dword [ebp + 0xc]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xec
cmp ebx, edx
jle 0x553a5f
mov cl, byte [eax]
inc edx
xor cl, byte [eax - 0x40]
inc eax
mov byte [esi], cl
inc esi
cmp ebx, edx
jg 0x553a51
mov esi, ebx
push esi
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00589938
add esp, 0x10
test eax, eax
jne 0x553a8b
push esi
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054a504
add esp, 8
xor eax, eax
jmp 0x553a90
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x555190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
jmp 0x55520a
cmp esi, 0x10
jb 0x555260
xor eax, eax
mov edx, ebx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 4]
mov edx, ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 8]
mov edx, ecx
mov edi, dword [ebp - 0x10]
mov ecx, dword [edx]
add edx, 4
add eax, 4
xor ecx, dword [edi]
mov edi, dword [ebp - 0x14]
mov dword [edi], ecx
add dword [ebp - 0x14], 4
add dword [ebp - 0x10], 4
cmp eax, 0x10
jb 0x555223
mov eax, dword [ebp + 0x14]
push eax
push ebx
push ebx
call dword [ebp + 0x1c]
mov dword [ebp - 4], ebx
add ebx, 0x10
add dword [ebp + 8], 0x10
add esp, 0xc
sub esi, 0x10
cmp esi, 0x10
jae 0x55520f
test esi, esi
je 0x5552db
xor eax, eax
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 4]
mov edx, ecx
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp + 8]
mov edx, ecx
jmp 0x55528e
mov cl, byte [edx]
mov edi, dword [ebp - 0x18]
xor cl, byte [edi]
mov edi, dword [ebp - 0x1c]
mov byte [edi], cl
inc eax
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
inc edx
cmp eax, 0x10
jae 0x555297
cmp esi, eax
ja 0x55527a
lea edx, [ebx + eax]
cmp eax, 0x10
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax]
jae 0x5552b9
mov cl, byte [edx]
mov edi, dword [ebp - 0x20]
mov byte [edi], cl
inc eax
inc dword [ebp - 0x20]
inc edx
cmp eax, 0x10
jb 0x5552a8
mov eax, dword [ebp + 0x14]
push eax
push ebx
push ebx
call dword [ebp + 0x1c]
add esp, 0xc
mov dword [ebp - 4], ebx
cmp esi, 0x10
jbe 0x5552db
add dword [ebp + 8], 0x10
sub esi, 0x10
add ebx, 0x10
test esi, esi
jne 0x555264
push 0x10
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0050a50c
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5552f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
cmp ebx, dword [ebp + 0xc]
je 0x555439
mov edi, dword [ebp + 0x18]
jmp 0x555365
cmp esi, 0x10
jb 0x5553ac
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0xc]
push edx
push ebx
call dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov ecx, edx
mov edx, edi
mov dword [ebp - 0x14], ecx
xor eax, eax
mov edi, dword [ebp - 0x14]
mov ecx, dword [edx]
add edx, 4
add eax, 4
xor dword [edi], ecx
add dword [ebp - 0x14], 4
cmp eax, 0x10
jb 0x555385
mov edi, ebx
sub esi, 0x10
add ebx, 0x10
add dword [ebp + 0xc], 0x10
cmp esi, 0x10
jae 0x55536a
push 0x10
push edi
mov eax, dword [ebp + 0x18]
push eax
call fcn.0050a50c
add esp, 0xc
jmp 0x5554a4
cmp esi, 0x10
jb 0x5554a4
mov eax, dword [ebp + 0x14]
push eax
lea edx, [ebp - 0x48]
push edx
push ebx
call dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x48]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, ebx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
add eax, 4
mov ecx, dword [ecx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ecx]
xor ecx, dword [edx]
mov dword [edi], ecx
mov ecx, dword [ebp - 8]
mov dword [edx], ecx
add edx, 4
add dword [ebp - 0x2c], 4
add dword [ebp - 0x28], 4
add dword [ebp - 0x24], 4
cmp eax, 0x10
jb 0x555465
sub esi, 0x10
add ebx, 0x10
add dword [ebp + 0xc], 0x10
cmp esi, 0x10
jae 0x55543e
test esi, esi
je 0x555527
mov eax, dword [ebp + 0x14]
push eax
lea edx, [ebp - 0x48]
push edx
push ebx
call dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x48]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x34], ecx
mov ecx, ebx
mov dword [ebp - 0x30], ecx
jmp 0x5554f5
mov ecx, dword [ebp - 0x30]
inc eax
mov cl, byte [ecx]
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
mov cl, byte [ecx]
xor cl, byte [edx]
mov byte [edi], cl
mov cl, byte [ebp - 9]
mov byte [edx], cl
inc edx
inc dword [ebp - 0x38]
inc dword [ebp - 0x34]
inc dword [ebp - 0x30]
cmp eax, 0x10
jae 0x5554fe
cmp esi, eax
ja 0x5554d1
cmp esi, 0x10
ja 0x555519
cmp eax, 0x10
jae 0x555527
mov dl, byte [ebx + eax]
mov ecx, dword [ebp + 0x18]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jb 0x555508
jmp 0x555527
sub esi, 0x10
add ebx, 0x10
add dword [ebp + 0xc], 0x10
test esi, esi
jne 0x5554a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret