joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x80], edi
cmp dword [edi + 0x24610], 0
je 0x4c8dfa
push str.AHD_interpolation..._n
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
add esp, 8
push 0
push 0
mov ecx, edi
call fcn.004cc560
push 5
mov ecx, edi
call fcn.004ca860
push 0x680000
call fcn.00593e38
add esp, 4
mov ebx, eax
mov ecx, edi
mov dword [ebp - 0x64], ebx
push str.ahd_interpolate__
push ebx
call fcn.004dc800
lea eax, [ebx + 0x300000]
mov ecx, 2
mov dword [ebp - 0x88], eax
lea eax, [ebx + 0x600000]
mov dword [ebp - 0x84], eax
movzx eax, word [edi + 0x44a8]
sub eax, 5
mov dword [ebp - 0x6c], ecx
cmp eax, ecx
jle 0x4c986d
nop
movzx eax, word [edi + 0x44aa]
mov edx, 2
sub eax, 5
mov dword [ebp - 0x5c], edx
cmp eax, edx
jle 0x4c984f
mov ebx, ecx
lea eax, [ecx + 0x200]
neg ebx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], ebx
mov esi, ecx
mov dword [ebp - 0x68], esi
cmp ecx, eax
jge 0x4c9064
mov ecx, edx
mov eax, edx
and ecx, 1
neg eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x54], eax
lea esp, [esp]
movzx eax, word [edi + 0x44a8]
sub eax, 2
cmp esi, eax
jge 0x4c905e
mov ebx, dword [edi + 0x388]
mov eax, esi
and eax, 7
mov edx, ebx
add eax, eax
add ecx, eax
add ecx, ecx
shr edx, cl
and edx, 1
add edx, dword [ebp - 0x5c]
mov ecx, edx
mov dword [ebp - 0x60], edx
and ecx, 1
add ecx, eax
mov eax, dword [ebp - 0x5c]
add ecx, ecx
add eax, 0x200
shr ebx, cl
and ebx, 3
mov dword [ebp - 0x48], ebx
cmp edx, eax
jge 0x4c9044
movzx ecx, word [edi + 0x44aa]
lea eax, [ecx - 2]
cmp edx, eax
jge 0x4c9044
mov eax, dword [edi + 0x44c0]
imul ecx, esi
mov edi, dword [ebp - 0x48]
add ecx, edx
movzx edx, word [eax + ecx*8 + 0xa]
lea ecx, [eax + ecx*8]
mov eax, edx
lea esi, [ecx + ebx*2]
mov dword [ebp - 0x58], ecx
movzx ecx, word [ecx - 6]
mov dword [ebp - 0x70], esi
mov ebx, ecx
movzx esi, word [esi]
add esi, ebx
mov dword [ebp - 0x50], eax
add esi, eax
mov eax, dword [ebp - 0x58]
add esi, esi
movzx eax, word [eax + edi*2 - 0x10]
sub esi, eax
mov eax, dword [ebp - 0x58]
movzx eax, word [eax + edi*2 + 0x10]
sub esi, eax
sar esi, 2
cmp cx, dx
mov ecx, edx
jae 0x4c8f75
cmp esi, ecx
mov eax, ecx
cmovl eax, esi
cmp ebx, eax
jg 0x4c8f89
mov ebx, ecx
cmp esi, ecx
jmp 0x4c8f86
cmp esi, ebx
invalid
Function at 0x4c98c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edx, str.embed
mov eax, esi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4c98f3
test cl, cl
je 0x4c98ef
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4c98f3
add eax, 2
add edx, 2
test cl, cl
jne 0x4c98d3
xor eax, eax
jmp 0x4c98f8
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c9911
push 0x5d4a20
push esi
call fcn.005232e0
mov edi, eax
add esp, 8
mov dword [ebp - 4], edi
jmp 0x4c9978
mov eax, dword [ebx + 0x3b0]
test eax, eax
je 0x4c9b02
push eax
call fcn.00593e38
add esp, 4
mov esi, eax
mov ecx, ebx
push str.apply_profile__
push esi
call fcn.004dc800
push 0
push dword [ebx + 0x3a4]
push dword [ebx + 0x4fa58]
call fcn.00595cb4
push dword [ebx + 0x4fa58]
push dword [ebx + 0x3b0]
push 1
push esi
call fcn.00595b79
push dword [ebx + 0x3b0]
push esi
call fcn.00523370
mov edi, eax
push esi
mov dword [ebp - 4], edi
call fcn.00592c4b
add esp, 0x28
test edi, edi
je 0x4c9b1b
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4c9a23
call fcn.00526510
mov esi, eax
mov dword [ebp + 0xc], esi
test esi, esi
je 0x4c9af0
cmp dword [ebx + 0x24610], 0
je 0x4c99bc
push str.Applying_color_profile..._n
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
add esp, 8
push 0
push 0
push 0x4009a
push esi
push 0x4009a
push edi
call fcn.005274a0
movzx edx, word [ebx + 0x44aa]
mov edi, eax
movzx ecx, word [ebx + 0x44a8]
mov esi, dword [ebx + 0x44c0]
imul edx, ecx
push edx
push esi
push esi
push edi
call fcn.005275a0
push edi
mov dword [ebx + 0x43fc], 1
call fcn.00527510
push dword [ebp + 0xc]
call fcn.00522c40
mov edi, dword [ebp - 4]
add esp, 0x30
push edi
call fcn.00522c40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x628c60
push esi
call fcn.005931b4
add esp, 8
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4c9ad9
push eax
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.00595b79
mov esi, dword [ebp + 0xc]
push 0
push 0
push esi
call fcn.00595cb4
push dword [ebp + 8]
call fcn.0045c670
push eax
mov dword [ebp + 8], eax
call fcn.00593e38
add esp, 0x24
mov dword [ebx + 0x3b8], eax
mov ecx, ebx
push str.apply_profile__
push eax
call fcn.004dc800
push esi
push dword [ebp + 8]
push 1
push dword [ebx + 0x3b8]
call fcn.00595b79
push esi
call fcn.00593079
push dword [ebp + 8]
push dword [ebx + 0x3b8]
call fcn.00523370
mov esi, eax
mov dword [ebp + 0xc], eax
add esp, 0x1c
test esi, esi
jne 0x4c999d
push dword [ebx + 0x3b8]
call fcn.00592c4b
add esp, 4
mov dword [ebx + 0x3b8], esi
push edi
call fcn.00522c40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push str.Cannot_open_file__s__n
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
add esp, 0xc
push edi
call fcn.00522c40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebx + 4]
push str._s_has_no_embedded_profile._n
call fcn.00592f31
add eax, 0x40
push eax
call fcn.0059320e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cb8e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.005970f0
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov edi, 1
push 0
push 0
push dword [esi + 0x4fa58]
call fcn.00595cb4
push dword [esi + 0x4fa58]
lea eax, [ebp - 0x4004]
push 0x4000
push edi
push eax
call fcn.00595b79
add esp, 0x1c
mov eax, 0x21c
nop
cmp byte [ebp + eax - 0x4004], 0xff
jne 0x4cb946
cmp byte [ebp + eax - 0x4003], 0
jne 0x4cb960
xor edi, edi
inc eax
cmp eax, 0x3fff
jb 0x4cb930
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4ce0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2078
call fcn.005970f0
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor edx, edx
mov dword [ebp - 0x2050], ecx
mov eax, 0x40
mov dword [ebp - 0x2068], edx
sub eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 0xc]
movlpd qword [ebp - 0x204c], xmm0
mov ebx, dword [ebp - 0x204c]
mov dword [ebp - 0x2058], eax
lea eax, [ebp - 0x2044]
push edi
mov edi, dword [ebp - 0x2048]
movupd xmmword [ebp - 0x2078], xmm0
mov dword [ebp - 0x2054], eax
mov eax, dword [ebp + 0x10]
test edx, edx
push 0
cmovne eax, dword [ebp + 0x14]
push eax
push dword [ecx + 0x4fa58]
call fcn.00595cb4
mov ecx, dword [ebp - 0x2050]
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x2060], edx
xor eax, eax
cmp dx, word [ecx + 0x44aa]
jae 0x4ce266
mov edx, dword [ebp - 0x2054]
mov dword [ebp - 0x2064], edx
jmp 0x4ce190
sub eax, dword [ebp + 8]
mov dword [ebp - 0x205c], eax
jns 0x4ce211
jmp 0x4ce1a0
movq xmm1, qword [ebp - 0x204c]
movd xmm0, esi
xor esi, esi
psllq xmm1, xmm0
movq qword [ebp - 0x204c], xmm1
mov edi, dword [ebp - 0x2048]
mov ebx, dword [ebp - 0x204c]
cmp dword [ebp + 0xc], esi
jle 0x4ce204
jmp 0x4ce1d0
push dword [ecx + 0x4fa58]
call fcn.00597fff
mov ecx, esi
add esp, 4
shl eax, cl
add esi, 8
mov ecx, dword [ebp - 0x2050]
or ebx, eax
cmp esi, dword [ebp + 0xc]
jl 0x4ce1d0
mov eax, dword [ebp - 0x205c]
mov dword [ebp - 0x2048], edi
mov dword [ebp - 0x204c], ebx
mov esi, dword [ebp + 0xc]
add eax, esi
mov dword [ebp - 0x205c], eax
js 0x4ce1a0
mov ecx, 0x40
mov edx, edi
sub ecx, eax
mov eax, ebx
sub ecx, dword [ebp + 8]
call fcn.00599ab0
mov ecx, dword [ebp - 0x2058]
call fcn.00599ad0
mov edx, dword [ebp - 0x2064]
mov ecx, dword [ebp - 0x2050]
inc dword [ebp - 0x2060]
mov word [edx], ax
add edx, 2
movzx eax, word [ecx + 0x44aa]
cmp dword [ebp - 0x2060], eax
mov eax, dword [ebp - 0x205c]
mov dword [ebp - 0x2064], edx
jl 0x4ce190
mov edx, dword [ebp - 0x2068]
add dword [ebp - 0x2054], 0x1020
inc edx
mov dword [ebp - 0x2068], edx
cmp edx, 2
jl 0x4ce144
movzx ebx, word [ecx + 0x44aa]
xor edi, edi
dec ebx
test ebx, ebx
jle 0x4ce329
jmp 0x4ce2a0
movzx eax, word [ebp + edi*2 - 0x1022]
mov edx, edi
movzx esi, word [ebp + edi*2 - 0x2044]
and edx, 1
sub esi, eax
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
movzx esi, word [ebp + edi*2 - 0x1024]
sub eax, ecx
movd xmm0, eax
movzx eax, word [ebp + edi*2 - 0x2042]
sub esi, eax
cvtdq2pd xmm0, xmm0
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
addsd xmm0, qword [ebp + edx*8 - 0x2078]
movsd qword [ebp + edx*8 - 0x2078], xmm0
mov edx, edi
movd xmm0, eax
not edx
cvtdq2pd xmm0, xmm0
and edx, 1
inc edi
addsd xmm0, qword [ebp + edx*8 - 0x2078]
movsd qword [ebp + edx*8 - 0x2078], xmm0
cmp edi, ebx
jl 0x4ce2a0
movupd xmm0, xmmword [ebp - 0x2078]
jmp 0x4ce32c
xorps xmm0, xmm0
movaps xmm1, xmm0
unpckhpd xmm1, xmm0
divsd xmm0, xmm1
call fcn.00594730
mulsd xmm0, qword [0x5c3680]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
cvtsd2ss xmm0, xmm0
pop ebx
movss dword [ebp - 0x2058], xmm0
fld dword [ebp - 0x2058]
call fcn.005920c1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d29d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov word [ebp - 4], 0xffff
lea eax, [ebp - 4]
push dword [esi + 0x4fa58]
push 2
push 1
push eax
call fcn.00595b79
add esp, 0x10
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004eb010
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d2a10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push dword [esi + 0x4fa58]
push 4
push 1
push eax
call fcn.00595b79
add esp, 0x10
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004eb040
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d2df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
mov byte [ebp - 5], 0
je 0x4d2e2d
push esi
mov esi, 0x13
push dword [edi + 0x4fa58]
dec esi
call fcn.00597fff
add esp, 4
mov byte [ebp + esi - 0x18], al
test esi, esi
jne 0x4d2e13
pop esi
jmp 0x4d2e43
push dword [edi + 0x4fa58]
lea eax, [ebp - 0x18]
push 1
push 0x13
push eax
call fcn.00595b79
add esp, 0x10
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x38]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push str._d:_d:_d__d:_d:_d
push eax
movdqu xmmword [ebp - 0x3c], xmm0
movdqu xmmword [ebp - 0x2c], xmm0
call fcn.00593320
add esp, 0x20
cmp eax, 6
jne 0x4d2ede
sub dword [ebp - 0x28], 0x76c
lea eax, [ebp - 0x3c]
dec dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], 0xffffffff
call fcn.00597095
add esp, 4
test edx, edx
jl 0x4d2ec4
jg 0x4d2eac
test eax, eax
je 0x4d2ec4
lea eax, [ebp - 0x3c]
push eax
call fcn.00597095
add esp, 4
mov dword [edi + 0x378], eax
mov dword [edi + 0x37c], edx
lea ecx, [ebp - 0x18]
add edi, 0x49738
mov eax, ecx
sub edi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x4d2ed1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005920c1
mov esp, ebp
pop ebp
ret 4
Function at 0x4d3280
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
lea eax, [ebp - 0xc]
mov ebx, 2
mov dword [ebp - 0x24], edi
xorps xmm0, xmm0
mov dword [ebp - 0x10], ebx
movupd xmmword [ebp - 0x20], xmm0
push dword [edi + 0x4fa58]
push ebx
push ebx
push eax
call fcn.00595b79
mov eax, dword [ebp + 8]
add esp, 0x10
movsd xmm0, qword [ebp - 0x18]
sub eax, ebx
je 0x4d3389
movsd qword [ebp - 0x2c], xmm0
movsd xmm0, qword [ebp - 0x20]
movsd qword [ebp - 0x18], xmm0
push esi
jmp 0x4d32e0
push dword [edi + 0x4fa58]
lea esi, [ebp - 0xc]
dec eax
push 1
lea esi, [esi + ebx*2]
mov dword [ebp + 8], eax
push 2
push esi
call fcn.00595b79
mov eax, dword [ebp - 0x10]
xor ebx, 2
movzx esi, byte [esi]
add esp, 0x10
movzx edx, byte [ebp + eax*2 - 0xb]
mov eax, esi
movzx edi, byte [ebp + ebx*2 - 0xc]
movzx ecx, byte [ebp + ebx*2 - 0xb]
shl eax, 8
or edx, eax
mov eax, edi
shl eax, 8
or ecx, eax
mov eax, dword [ebp - 0x10]
sub ecx, edx
movd xmm0, ecx
movzx ecx, byte [ebp + eax*2 - 0xb]
movzx eax, byte [ebp + ebx*2 - 0xb]
cvtdq2pd xmm0, xmm0
mov ebx, dword [ebp - 0x10]
shl eax, 8
inc ebx
shl ecx, 8
or eax, edi
mov edi, dword [ebp - 0x24]
or ecx, esi
sub eax, ecx
and ebx, 3
mov dword [ebp - 0x10], ebx
mulsd xmm0, xmm0
addsd xmm0, qword [ebp - 0x18]
movapd xmm1, xmm0
movd xmm0, eax
mov eax, dword [ebp + 8]
movsd qword [ebp - 0x18], xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm0, qword [ebp - 0x2c]
movsd qword [ebp - 0x2c], xmm0
test eax, eax
jne 0x4d32e0
pop esi
jmp 0x4d338e
movsd xmm1, qword [ebp - 0x20]
comisd xmm0, xmm1
mov ecx, 0x4d4d
mov eax, 0x4949
pop edi
pop ebx
cmova eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret 4
Function at 0x4dca10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 2
push 0xfffffe58
push dword [esi + 0x4fa58]
call fcn.00595cb4
push dword [esi + 0x4fa58]
lea eax, [ebp - 0x1ac]
push 0x1a8
push 1
push eax
call fcn.00595b79
add esp, 0x1c
xor eax, eax
xor ecx, ecx
pop esi
lea esp, [esp]
cmp byte [ebp + eax - 0x1ac], 0
je 0x4dca6b
inc ecx
cmp byte [ebp + eax - 0x1ab], 0
je 0x4dca76
inc ecx
cmp byte [ebp + eax - 0x1aa], 0
je 0x4dca81
inc ecx
cmp byte [ebp + eax - 0x1a9], 0
je 0x4dca8c
inc ecx
add eax, 4
cmp eax, 0x1a8
jb 0x4dca60
xor eax, eax
cmp ecx, 0x14
mov ecx, dword [ebp - 4]
setg al
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret

Function at 0x4dcb70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0
push 0xc00
push dword [ebx + 0x4fa58]
call fcn.00595cb4
push dword [ebx + 0x4fa58]
lea eax, [ebp - 0x1c]
push 0x18
push 1
push eax
call fcn.00595b79
movzx ecx, byte [ebp - 0x14]
add esp, 0x1c
movzx eax, byte [ebp - 8]
and ecx, 3
shl ecx, 4
and eax, 3
or ecx, eax
mov edx, 0x5deed4
mov dword [ebp - 0x20], ecx
mov edi, 4
lea ecx, [ecx]
cmp ecx, dword [edx - 4]
jne 0x4dcc13
mov esi, ebx
mov ecx, edx
sub esi, edx
jmp 0x4dcbe0
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx + 0x210], al
test al, al
jne 0x4dcbe0
lea eax, [edx + 0xc]
mov esi, ebx
sub esi, eax
jmp 0x4dcc00
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax + 0x250], cl
test cl, cl
jne 0x4dcc00
mov ecx, dword [ebp - 0x20]
add edx, 0x20
dec edi
jne 0x4dcbd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret

Function at 0x4dcc30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0
push 0
push dword [edi + 0x4fa58]
call fcn.00595cb4
add esp, 0xc
xor esi, esi
jmp 0x4dcc60
push dword [edi + 0x4fa58]
lea eax, [ebp - 0x10]
push 0xc
push 1
push eax
call fcn.00595b79
movzx eax, byte [ebp - 0xc]
add esp, 0x10
mov cl, byte [ebp - 0xe]
shr cl, 4
shr al, 4
and cl, al
movzx eax, byte [ebp - 9]
shr al, 4
and cl, al
movzx eax, byte [ebp - 7]
shr al, 4
and cl, al
and cl, byte [ebp - 0xf]
and cl, byte [ebp - 0xa]
and cl, byte [ebp - 8]
and cl, byte [ebp - 5]
and cl, 3
cmp cl, 3
jne 0x4dccc9
inc esi
cmp esi, 0x400
jl 0x4dcc60
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4ddd20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x4ddd3c
mov dword [edi + 0x44728], ebx
xor eax, eax
pop edi
pop ebx
pop ebp
ret 4
cmp dword [edi + 0x44728], 0
jne 0x4ddd86
push dword [edi + 0x4fa58]
mov ecx, dword [edi + 0x44a0]
mov eax, 0x4000
sub eax, ecx
push eax
lea eax, [edi + 0x45730]
add eax, ecx
push 1
push eax
call fcn.00595b79
push dword [edi + 0x4fa58]
lea eax, [edi + 0x45730]
push dword [edi + 0x44a0]
push 1
push eax
call fcn.00595b79
add esp, 0x20
mov ecx, dword [edi + 0x44728]
or edx, 0xffffffff
sub ecx, ebx
and ecx, 0x1ffff
mov eax, ecx
mov dword [edi + 0x44728], ecx
xor eax, 0x1ff80
and ecx, 7
sar eax, 3
push esi
movzx esi, byte [eax + edi + 0x45731]
movzx eax, byte [eax + edi + 0x45730]
shl esi, 8
or eax, esi
sar eax, cl
mov ecx, ebx
shl edx, cl
pop esi
not edx
pop edi
and eax, edx
pop ebx
pop ebp
ret 4
Function at 0x4dfde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0
push dword [ebp + 8]
push dword [esi + 0x4fa58]
call fcn.00595cb4
add esp, 0xc
mov ecx, esi
call fcn.004d2a10
cmp eax, 0xff
ja 0x4dffe6
test eax, eax
je 0x4dffce
push ebx
push edi
mov ebx, 0x10bf
lea ecx, [ecx]
dec eax
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.004d29d0
mov ecx, esi
movzx edi, ax
call fcn.004d29d0
push dword [esi + 0x4fa58]
movzx eax, ax
mov dword [ebp + 8], eax
call fcn.005960c7
add esp, 4
mov dword [ebp - 4], eax
cmp edi, 0x100
jne 0x4dfe75
mov ecx, esi
call fcn.004d29d0
mov ecx, esi
mov word [esi + 0x44a4], ax
call fcn.004d29d0
mov word [esi + 0x44a6], ax
jmp 0x4dffaa
cmp edi, 0x121
jne 0x4dfeb3
mov ecx, esi
call fcn.004d29d0
mov ecx, esi
mov word [esi + 0x44a8], ax
call fcn.004d29d0
mov ecx, 0x10bc
mov word [esi + 0x44aa], ax
cmp ax, cx
jne 0x4dffaa
mov word [esi + 0x44aa], bx
jmp 0x4dffaa
cmp edi, 0x130
jne 0x4dfef1
push dword [esi + 0x4fa58]
call fcn.00597fff
push dword [esi + 0x4fa58]
sar eax, 7
mov dword [esi + 0x3bc], eax
call fcn.00597fff
shr eax, 3
add esp, 8
not eax
and eax, 1
mov word [esi + 0x44b6], ax
jmp 0x4dffaa
cmp edi, 0x131
jne 0x4dff30
mov dword [esi + 0x388], 9
lea edi, [esi + 0x358]
mov ebx, 0x24
mov edi, edi
push dword [esi + 0x4fa58]
call fcn.00597fff
and al, 3
lea edi, [edi - 1]
add esp, 4
mov byte [edi + 1], al
dec ebx
jne 0x4dff10
mov ebx, 0x10bf
jmp 0x4dffaa
cmp edi, 0x2ff0
jne 0x4dff67
xor edi, edi
lea ebx, [ebx]
mov ecx, esi
call fcn.004d29d0
movzx eax, ax
movd xmm0, eax
mov eax, edi
cvtdq2ps xmm0, xmm0
xor eax, 1
inc edi
movss dword [esi + eax*4 + 0x24644], xmm0
cmp edi, 4
jb 0x4dff40
jmp 0x4dffaa
cmp edi, 0xc000
jne 0x4dffaa
movsx edi, word [esi]
mov eax, 0x4949
mov word [esi], ax
lea ebx, [ebx]
mov ecx, esi
call fcn.004d2a10
movzx ecx, word [esi + 0x44a6]
cmp eax, ecx
ja 0x4dff80
mov ecx, esi
mov word [esi + 0x44aa], ax
call fcn.004d2a10
mov word [esi + 0x44a8], ax
mov word [esi], di
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push 0
push eax
push dword [esi + 0x4fa58]
call fcn.00595cb4
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
jne 0x4dfe20
pop edi
pop ebx
movzx eax, word [esi + 0x3bc]
mov cx, ax
shl word [esi + 0x44a8], cl
shr word [esi + 0x44aa], cl
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4dfff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x49734]
test dword [eax + 0x8c], 0x40000
je 0x4e013e
push ebx
call fcn.004d29d0
movzx ebx, ax
test ebx, ebx
je 0x4e013d
push edi
mov edi, 0x4949
lea eax, [ebp - 0x10]
dec ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.004ec550
cmp dword [ebp - 0xc], 0x100
ja 0x4e0121
cmp dword [ebp - 8], 0xd
ja 0x4e0121
xor eax, eax
cmp word [esi], di
setne al
push eax
push dword [esi + 0x49734]
call fcn.004525a0
push dword [esi + 0x49734]
call fcn.004525d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4e010a
mov eax, dword [ebp - 8]
mov cx, word [ebp - 0x14]
mov word [edi], cx
mov ecx, dword [ebp - 0xc]
mov ebx, dword [eax*4 + 0x5de888]
imul ebx, ecx
mov dword [edi + 4], 0x10
mov word [edi + 2], ax
mov dword [edi + 8], ecx
cmp ebx, 4
jle 0x4e00d1
push ebx
call fcn.00593e38
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ebx
push dword [esi + 0x4fa58]
push 1
push ebx
push eax
call fcn.00595b79
add esp, 0x14
jmp 0x4e0107
cmp ebx, 2
jne 0x4e00fd
cmp eax, ebx
jne 0x4e00f1
push dword [esi + 0x4fa58]
lea eax, [edi + 0xc]
push ebx
push 1
push eax
call fcn.00595b79
add esp, 0x10
jmp 0x4e0107
mov ecx, esi
call fcn.004d29d0
movzx eax, ax
jmp 0x4e0104
mov ecx, esi
call fcn.004d2a10
mov dword [edi + 0xc], eax
mov ebx, dword [ebp - 4]
push 0
push dword [ebp - 0x10]
push dword [esi + 0x4fa58]
call fcn.00595cb4
mov edi, 0x4949
jmp 0x4e0131
push 0
push dword [ebp - 0x10]
push dword [esi + 0x4fa58]
call fcn.00595cb4
add esp, 0xc
test ebx, ebx
jne 0x4e0026
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4e2140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], 0
push 0
push esi
mov dword [ebp - 0xc], 0
movzx eax, word [edi]
push dword [edi + 0x4fa58]
mov dword [ebp - 0x14], eax
call fcn.00595cb4
push dword [edi + 0x4fa58]
call fcn.00597fff
add esp, 0x10
test eax, eax
jne 0x4e234c
push dword [edi + 0x4fa58]
call fcn.00597fff
add esp, 4
sub eax, 0x4d
jne 0x4e234c
push dword [edi + 0x4fa58]
call fcn.00597fff
add esp, 4
sub eax, 0x52
jne 0x4e234c
push ebx
push dword [edi + 0x4fa58]
call fcn.00597fff
imul eax, eax, 0x101
add esp, 4
mov ecx, edi
mov word [edi], ax
call fcn.004d2a10
push dword [edi + 0x4fa58]
lea ebx, [esi + 8]
add ebx, eax
mov dword [ebp - 4], ebx
call fcn.005960c7
add esp, 4
mov dword [ebp + 8], eax
cmp eax, ebx
jge 0x4e2331
xor esi, esi
lea ebx, [esi + 4]
jmp 0x4e2200
push dword [edi + 0x4fa58]
call fcn.00597fff
shl esi, 8
add esp, 4
or esi, eax
dec ebx
jne 0x4e2200
mov ecx, edi
call fcn.004d2a10
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp esi, 0x505244
je 0x4e22d5
cmp esi, 0x545457
je 0x4e22b4
cmp esi, 0x574247
jne 0x4e2301
mov ecx, edi
call fcn.004d2a10
mov ecx, str.DiMAGE_A200
lea eax, [edi + 0x251]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e2274
test dl, dl
je 0x4e2270
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e2274
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e2254
xor eax, eax
jmp 0x4e2279
sbb eax, eax
or eax, 1
xor ecx, ecx
mov ebx, 3
test eax, eax
cmovne ebx, ecx
xor esi, esi
mov ecx, edi
call fcn.004d29d0
movzx eax, ax
movd xmm0, eax
mov eax, esi
sar eax, 1
xor eax, esi
inc esi
cvtdq2ps xmm0, xmm0
xor eax, ebx
movss dword [edi + eax*4 + 0x24644], xmm0
cmp esi, 4
jl 0x4e2287
mov ebx, dword [ebp - 0x10]
jmp 0x4e2301
push dword [edi + 0x4fa58]
call fcn.005960c7
add esp, 4
mov ecx, edi
push eax
call fcn.004e39d0
mov eax, dword [ebp - 4]
mov dword [edi + 0x398], eax
jmp 0x4e2301
push 1
push 8
push dword [edi + 0x4fa58]
call fcn.00595cb4
add esp, 0xc
mov ecx, edi
call fcn.004d29d0
movzx eax, ax
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.004d29d0
movzx eax, ax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
add eax, 8
push 0
add eax, ebx
push eax
push dword [edi + 0x4fa58]
call fcn.00595cb4
push dword [edi + 0x4fa58]
call fcn.005960c7
add esp, 0x10
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 4]
jl 0x4e21f3
mov eax, dword [ebp - 8]
mov word [edi + 0x44a4], ax
mov eax, dword [ebp - 0xc]
mov word [edi + 0x44a6], ax
mov eax, dword [ebp - 0x14]
mov word [edi], ax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4