joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57cfe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd8
mov ecx, 1
xor eax, eax
push ebx
push esi
mov esi, 7
mov edx, 8
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xcc], ecx
cmp dword [0xd9e5b0], eax
push edi
mov ebx, 2
mov edi, 0xb
mov dword [esp + 0x6c], esi
mov dword [esp + 0x78], edx
mov dword [esp + 0x84], esi
mov dword [esp + 0x90], edx
mov esi, 9
mov edx, 0xa
mov dword [esp + 0x14], 0x57cdd0
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x57cdb0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], 0x57ce10
mov dword [esp + 0x30], 3
mov dword [esp + 0x38], 0x57cdf0
mov dword [esp + 0x3c], 5
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0x57ce30
mov dword [esp + 0x48], 6
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0x57ce50
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x57ce70
mov dword [esp + 0x60], 0xc
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], 0x57cea0
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x57cec0
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 0x57cee0
mov dword [esp + 0x8c], 0x57cf00
mov dword [esp + 0x98], 0x57cf20
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], 0x57cf40
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], 0x57cf60
mov dword [esp + 0xb4], esi
mov dword [esp + 0xbc], 0x57cf80
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc8], 0x57cfa0
mov dword [esp + 0xcc], 0xd
mov dword [esp + 0xd4], 0x57cfc0
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], 0x57ce90
jne 0x57d1e3
push ebp
xor ebp, ebp
mov edi, 0xd9e370
lea ecx, [ecx]
lea esi, [esp + 0x14]
mov ebx, 0x12
lea esp, [esp]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi - 4]
push eax
push ecx
push edx
push ebp
call fcn.0046a350
mov dword [edi], eax
add esp, 0x10
add edi, 4
add esi, 0xc
dec ebx
jne 0x57d1b0
inc ebp
cmp edi, 0xd9e5b0
jl 0x57d1a0
mov dword [0xd9e5b0], 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xd8
ret

Function at 0x5823a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, 0x34001a
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [0xeebb18]
mov dword [esp], 0x340026
mov dword [esp + 4], 0x340027
mov dword [esp + 8], 0x340028
mov dword [esp + 0xc], 0x340029
mov dword [esp + 0x10], 0x34002a
mov ecx, dword [esp + eax*4]
push ecx
call fcn.005848d0
mov edx, dword [0xeebb18]
mov eax, dword [esp + edx*4 + 0x18]
push eax
call fcn.005848d0
add esp, 0x30
jmp fcn.00579480
Function at 0x582410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, 0x34001a
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [0xeebb18]
mov dword [esp], 0x340026
mov dword [esp + 4], 0x340027
mov dword [esp + 8], 0x340028
mov dword [esp + 0xc], 0x340029
mov dword [esp + 0x10], 0x34002a
mov ecx, dword [esp + eax*4]
push ecx
call fcn.005848e0
mov edx, dword [0xeebb18]
mov eax, dword [esp + edx*4 + 0x18]
push eax
call fcn.005848e0
add esp, 0x30
jmp fcn.005794c0
Function at 0x58d0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
call fcn.0058c590
push 0x34001a
call fcn.005848f0
push 4
push 0xa
mov dword [0xd9edec], eax
call fcn.00412da0
push 4
push 0xf
mov dword [0xd9ede4], eax
call fcn.00412da0
add esp, 0x14
mov dword [0x910e90], eax
xor esi, esi
mov eax, dword [0xd9edec]
push 1
push 0
push 2
push 0
push esi
push eax
call fcn.00584900
mov ecx, dword [0xd9ede4]
add esp, 0x18
mov dword [ecx + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x58d106
mov ecx, dword [ecx + 4]
push 0
push ecx
call fcn.00584b30
mov edx, dword [0xd9ede4]
mov eax, dword [edx + 8]
push 0
push eax
call fcn.00584b30
mov ecx, dword [0xd9ede4]
mov edx, dword [ecx + 4]
push 0
push edx
call fcn.00584af0
mov eax, dword [0xd9ede4]
mov ecx, dword [eax + 8]
push 0
push ecx
call fcn.00584af0
mov edx, dword [0xd9ede4]
mov eax, dword [edx + 8]
push 1
push eax
call fcn.00584990
add esp, 0x28
xor esi, esi
nop
mov ecx, dword [0xd9ede4]
mov edx, dword [ecx]
push esi
push edx
call fcn.005851b0
mov ecx, dword [0x910e90]
add esp, 8
mov dword [ecx + esi*4], eax
inc esi
cmp esi, 0xf
jl 0x58d180
xor esi, esi
jmp 0x58d1b0
mov edx, dword [0x910fa8]
mov eax, dword [0x910e90]
mov ecx, dword [eax + esi*4]
push edx
push ecx
call fcn.00585200
movsx edx, byte [0xd9ede0]
add esp, 8
cmp edx, esi
jne 0x58d1eb
mov eax, dword [0x910fac]
mov ecx, dword [0x910e90]
mov edx, dword [ecx + esi*4]
push eax
push edx
call fcn.00585200
add esp, 8
inc esi
cmp esi, 7
jle 0x58d1b0
mov esi, 8
jmp 0x58d200
mov eax, dword [0x910fa8]
mov ecx, dword [0x910e90]
mov edx, dword [ecx + esi*4]
push eax
push edx
call fcn.00585200
movsx eax, byte [0xd9ede0]
add esp, 8
dec eax
lea ecx, [esi - 8]
cmp eax, ecx
jne 0x58d23f
mov edx, dword [0x910fac]
mov eax, dword [0x910e90]
mov ecx, dword [eax + esi*4]
push edx
push ecx
call fcn.00585200
add esp, 8
inc esi
cmp esi, 0xe
jle 0x58d200
push 0
push 0
call fcn.00581660
push 1
push 1
call fcn.00581660
call fcn.0058c9d0
push 1
call fcn.005819a0
movsx dx, byte [0xd9ede0]
mov eax, dword [0xd9ede4]
mov ecx, dword [eax + 4]
push edx
push ecx
call fcn.00584af0
movsx dx, byte [0xd9ede0]
mov eax, dword [0xd9ede4]
mov ecx, dword [eax + 8]
push edx
push ecx
call fcn.00584af0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x60001
push 1
call fcn.00861e00
add esp, 0x34
pop esi
jmp fcn.0058ce00
Function at 0x5bfdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86e7bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x10], esi
call fcn.005cd200
mov ebp, dword [esp + 0x30]
push ebp
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.005cd240
mov ebx, dword [esp + 0x24]
add ebp, ebp
push ebp
mov dword [esi + 8], ebx
call fcn.0084673d
mov edi, eax
mov ecx, ebp
mov edx, ecx
shr ecx, 2
or eax, 0xffffffff
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movzx eax, word [ebx]
shl eax, 2
push eax
call fcn.0084673d
mov edi, eax
mov dword [esi], edi
movzx ecx, word [ebx]
shl ecx, 2
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
add esp, 8
cmp word [ebx], ax
jbe 0x5bfe85
lea ecx, [ebx + 4]
jmp 0x5bfe70
movzx edx, word [ecx]
mov edi, dword [esi + 4]
mov word [edi + edx*2], ax
movzx edx, word [ebx]
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x5bfe70
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x5d0980
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [eax], 1
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
push esi
mov eax, 0xdaa650
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d09a8
mov edi, dword [ebp + 8]
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
jmp 0x5d09c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d09c0
sub eax, esi
lea eax, [eax + edx + 2]
push eax
call fcn.0043ca12
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x5d09e0
xor esi, esi
jmp 0x5d09ff
push edi
push 0xdaa650
push 0x885644
push esi
call fcn.0043bcd5
push esi
push str.MC:_s_n
call fcn.00425c40
add esp, 0x18
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.kernel32.dll_FindFirstFileA]
push esi
mov ebx, eax
call fcn.0043c8f1
add esp, 4
cmp ebx, 0xffffffff
jne 0x5d0a30
mov edx, dword [ebp + 0x10]
mov dword [edx], 0xffffff89
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov edi, edi
cmp byte [esp + 0x4c], 0x2e
jne 0x5d0a5b
mov al, byte [esp + 0x4d]
test al, al
je 0x5d0a97
cmp al, 0x2e
jne 0x5d0a5b
mov al, byte [esp + 0x4e]
test al, al
je 0x5d0a97
lea eax, [esp + 0x4c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d0a62
sub eax, edx
cmp eax, 0x20
jae 0x5d0a97
mov ecx, 0x50
lea esi, [esp + 0x20]
lea edi, [esp + 0x160]
lea eax, [esp + 0x160]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x14]
call fcn.005d08f0
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x5d0a40
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
test edi, edi
je 0x5d0acf
mov ecx, dword [esp + 0x18]
sub ecx, edi
mov eax, 0x66666667
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov esi, edx
test esi, esi
jne 0x5d0ae5
test edi, edi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0xffffff89
je 0x5d0b92
jmp 0x5d0b89
mov edx, esi
shl edx, 6
push edx
call fcn.0043ca12
add esp, 4
test eax, eax
jne 0x5d0b05
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffff86
jmp 0x5d0b89
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx + 8], eax
cmp edi, dword [esp + 0x18]
je 0x5d0b89
lea ebx, [edi + 0x14]
lea edi, [eax + 0x10]
lea ebx, [ebx]
lea ecx, [ebx - 0x10]
lea esi, [edi - 0x10]
call fcn.005cfc70
lea esi, [edi - 8]
mov ecx, ebx
call fcn.005cfc70
mov ecx, dword [ebx + 0xc]
mov dword [edi], ecx
test byte [ebx - 0x14], 0x10
mov eax, 0x83
je 0x5d0b4a
mov eax, 0xa3
mov word [edi + 4], ax
lea eax, [ebx + 0x18]
mov edx, edi
xor esi, esi
sub edx, eax
mov dword [edi + 0xc], esi
add edx, 0x10
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5d0b60
mov ecx, dword [esp + 0x18]
add ebx, 0x140
mov word [edi + 6], si
mov dword [edi + 8], esi
lea eax, [ebx - 0x14]
add edi, 0x40
cmp eax, ecx
jne 0x5d0b20
mov edi, dword [esp + 0x14]
push edi
call fcn.0043b58d
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f3dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x91cfa4]
mov al, byte [eax + 0x1a]
cmp al, 0xff
je 0x5f3def
movzx eax, al
cdq
mov ecx, 0x17
idiv ecx
jmp 0x5f3df4
mov edx, 1
mov eax, dword [0xe7d200]
imul edx, edx, 0x4c0
push ebx
push esi
movzx esi, byte [0xe7d180]
add edx, 0xd92230
test eax, eax
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov bl, 1
jne case.0x5f3e3a.0
mov al, byte [edi + 0x33c]
test al, al
jne case.0x5f3e3a.0
push edi
call fcn.005ef040
add esp, 4
cmp eax, 4
ja case.0x5f3e3a.2
jmp dword [eax*4 + 0x5f3f8c]
xor ecx, ecx
test esi, esi
mov dword [ebp - 8], ecx
jle case.0x5f3e3a.0
mov esi, dword [ebp + 8]
lea ecx, [ecx]
test byte [0xe7d25c], bl
je 0x5f3e5c
shl bl, 1
jmp 0x5f3ebe
shl bl, 1
mov byte [ebp - 1], bl
movsx ebx, byte [ecx + esi + 0x332]
test bl, 0x30
je 0x5f3ebb
test bl, 6
je 0x5f3ebb
mov ax, word [ecx*2 + 0xe7d114]
cmp ax, 0x2710
jae 0x5f3eb6
test ax, ax
jbe 0x5f3eb6
test bl, 4
jne 0x5f3eb6
test bl, 0x20
je 0x5f3ea2
movzx eax, ax
add eax, 0x1388
cdq
mov ecx, 0x2710
idiv ecx
mov eax, edx
movzx edx, ax
push edx
push edi
call fcn.00649e70
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
je 0x5f3ebb
test bl, 0x40
jne 0x5f3ed2
mov bl, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
inc ecx
cmp ecx, eax
mov dword [ebp - 8], ecx
jl 0x5f3e50
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ecx + esi + 0x332]
test al, al
jns 0x5f3f0f
mov bl, byte [0xe7d182]
dec bl
mov al, 1
shl al, cl
mov byte [0xe7d182], bl
mov word [esi + 0xdc], 0x6f
mov cl, byte [0xe7d25c]
pop edi
or cl, al
pop esi
mov byte [0xe7d25c], cl
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.005f3d20
add esp, 4
test eax, eax
je 0x5f3f4f
mov bl, byte [0xe7d182]
mov ecx, dword [ebp - 8]
dec bl
mov dl, 1
shl dl, cl
mov byte [0xe7d182], bl
mov word [esi + 0xdc], 0x6f
mov al, byte [0xe7d25c]
pop edi
or al, dl
pop esi
mov byte [0xe7d25c], al
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test bl, 0x20
je 0x5f3f5b
xor byte [edi + 0x2c1], 1
mov al, byte [edi + 0x2c1]
mov cl, byte [ebp - 8]
mov dl, 1
mov byte [0xe7d1cc], al
mov al, byte [0xe7d25c]
shl dl, cl
pop edi
pop esi
mov byte [0xe7d181], cl
or al, dl
mov byte [0xe7d25c], al
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5fd440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov cx, word [esi + 0xea]
push ebx
xor eax, eax
cmp cx, word [esi + 0xec]
push edi
jne 0x5fd4e9
mov dword [ebp - 4], eax
nop
movzx edx, byte [esi + 0xd9]
mov ecx, dword [ebp - 4]
xor edx, 1
add edx, 0x38
imul edx, edx, 0xb
add edx, ecx
mov cl, byte [edx + esi]
cmp cl, 0xff
je 0x5fd48a
movzx eax, cl
cdq
mov edi, 0x17
idiv edi
jmp 0x5fd48f
mov edx, 1
imul edx, edx, 0x4c0
movzx eax, cl
mov ecx, dword [esi + eax*4 + 0x20c]
add edx, 0xd92230
cmp ecx, 0x240000
mov ebx, edx
jae 0x5fd4e7
xor edi, edi
mov di, word [esi + eax*2 + 0x1dc]
xor eax, eax
mov ax, word [ebx + 0xec]
add di, 0x8000
push eax
push edi
call fcn.006442d0
add esp, 8
cmp ax, 0x2000
jbe 0x5fd4ef
mov eax, dword [ebp - 4]
inc eax
cmp eax, 0xb
mov dword [ebp - 4], eax
jl 0x5fd460
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ebx, word [ebx + 0xec]
xor ecx, ecx
mov cx, 0x8000
sub edi, ebx
cmp cx, di
mov edx, 0x4000
push 0x100
sbb ecx, ecx
and ecx, 0xfffe
sub edx, eax
inc ecx
imul ecx, edx
xor eax, eax
mov ax, word [esi + 0xea]
add ecx, ebx
push eax
push ecx
call fcn.00643cb0
push 0x100
mov word [esi + 0xf0], ax
push eax
call fcn.0063c810
xor ecx, ecx
mov cx, word [esi + 0xf0]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
push 0x100
fadd dword [esi + 0x2c4]
push ecx
fstp dword [esi + 0x168]
call fcn.0063c7f0
mov dword [ebp - 4], eax
fild dword [ebp - 4]
add esp, 0x1c
pop edi
mov eax, 1
fadd dword [esi + 0x2cc]
pop ebx
fstp dword [esi + 0x16c]
mov esp, ebp
pop ebp
ret
Function at 0x638ec0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push 1
call fcn.0042a960
add esp, 4
cmp eax, 0xa
je 0x639162
mov al, byte [0xdabb03]
test al, al
je 0x639162
test byte [0xe7e574], 2
je 0x639162
push ebx
push esi
push edi
push 1
call fcn.0042a960
mov ebx, dword [esp + 0x18]
add esp, 4
cmp eax, 7
je 0x638f13
push 1
call fcn.0042a960
add esp, 4
cmp eax, 0xc
jne 0x638f65
push 2
call fcn.0042a960
add esp, 4
cmp eax, 0xb
jne 0x638f65
xor edi, edi
xor esi, esi
jmp 0x638f30
push 0xff
push 0xff
push 0xff
push 0xff
push esi
push edi
call fcn.006df040
push 0
push esi
push edi
call fcn.006df010
add esp, 0x24
inc esi
cmp esi, 0x28
jl 0x638f30
inc edi
cmp edi, 2
jl 0x638f24
jmp 0x638f8d
xor esi, esi
jmp 0x638f70
mov eax, dword [0x91cfa8]
movzx ecx, byte [eax + 0x70]
push 0
xor ecx, ebx
push esi
push ecx
call fcn.006df010
add esp, 0xc
inc esi
cmp esi, 0x28
jl 0x638f70
mov eax, dword [0x91cfa8]
cmp byte [eax + 0x64], 5
jne 0x638fa1
cmp ebx, 1
je 0x63915f
movzx edx, byte [eax + 0x70]
movzx esi, byte [esp + 0x18]
push 1
xor edx, ebx
push esi
push edx
call fcn.006df010
push 1
call fcn.0042a960
add esp, 0x10
cmp eax, 7
je 0x638fd7
push 1
call fcn.0042a960
add esp, 4
cmp eax, 0xc
jne 0x6390c3
push 2
call fcn.0042a960
add esp, 4
cmp eax, 0xb
jne 0x6390c3
mov eax, dword [0x91cfa8]
movzx ecx, byte [eax + 0x70]
xor ecx, ebx
push esi
push ecx
call fcn.006def40
movsx edx, word [0xeebb04]
mov dword [esp + 0x14], edx
add esp, 8
fild dword [esp + 0xc]
fmul dword [0x870774]
fsubr dword [0x8d3180]
faddp st(1)
call fcn.0043bd30
mov edi, eax
mov al, byte [0xeb2c38]
test al, al
jne 0x63906d
push 1
call fcn.0042a960
add esp, 4
cmp eax, 7
jne 0x63906d
movsx eax, word [0xeebb06]
mov ecx, dword [0xeebb14]
mov dword [esp + 0xc], eax
neg ecx
sbb ecx, ecx
fild dword [esp + 0xc]
and ecx, 0x20
mov dword [esp + 0xc], ecx
fmul dword [0x870774]
fsubr dword [0x8d317c]
fiadd dword [esp + 0xc]
jmp 0x63909c
movsx edx, word [0xeebb06]
mov eax, dword [0xeebb14]
mov dword [esp + 0xc], edx
neg eax
sbb eax, eax
fild dword [esp + 0xc]
and eax, 0x20
mov dword [esp + 0xc], eax
fmul dword [0x870774]
fsubr dword [0x8d317c]
fiadd dword [esp + 0xc]
call fcn.0043bd30
movzx ecx, ax
mov eax, dword [0x91cfa8]
push ecx
movzx ecx, byte [eax + 0x70]
movsx edx, di
push edx
xor ecx, ebx
push esi
push ecx
call fcn.006defc0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ecx
ret
test ebx, ebx
mov edx, dword [0x91cfa8]
movzx eax, byte [edx + 0x70]
push esi
jne 0x6390f5
push eax
call fcn.006def40
movsx ecx, word [0xeebb04]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [0x870774]
fsubr dword [0x885df0]
jmp 0x639118
xor eax, ebx
push eax
call fcn.006def40
movsx ecx, word [0xeebb04]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul dword [0x870774]
fsubr dword [0x8d3178]
faddp st(1)
add esp, 8
call fcn.0043bd30
mov edx, dword [0xeebb14]
neg edx
sbb edx, edx
and edx, 0x20
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
mov edi, eax
fadd dword [0x8d3174]
call fcn.0043bd30
mov ecx, dword [0x91cfa8]
movzx edx, byte [ecx + 0x70]
push eax
movsx eax, di
push eax
xor edx, ebx
push esi
push edx
call fcn.006defc0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x6aa9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
call fcn.006aa980
add esp, 8
test al, al
jne 0x6aa9ed
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esp + 0x18]
push ebx
push ebp
lea eax, [edi + edi*4]
lea ebp, [esi + eax*8]
imul ebp, ebp, 0x110
mov bl, byte [ebp + 0xeb65db]
push ecx
push esi
add bl, 0x40
push edi
shl bl, 1
call fcn.006161c0
add esp, 0xc
cmp al, 3
jae 0x6aaa1b
mov al, 3
mov cl, byte [esp + 0x20]
mov dl, 3
imul dl
sub al, 0x1b
add bl, al
movzx eax, cl
cmp eax, 0x21
ja case.0x6aaa36.1
movzx eax, byte [eax + 0x6aac14]
jmp dword [eax*4 + 0x6aac04]
test byte [ebp + 0xeb662c], 3
je case.0x6aaa36.1
add bl, 0xa
jmp case.0x6aaa36.1
mov edx, dword [ebp + 0xeb662c]
and dl, 3
cmp dl, 1
je case.0x6aaa36.1
add bl, 0xa
jmp case.0x6aaa36.1
push 0
push esi
push edi
call fcn.00615b50
mov cl, byte [esp + 0x2c]
add esp, 0xc
test al, al
je case.0x6aaa36.1
or bl, 0xff
cmp cl, 0x14
jb 0x6aaad6
mov byte [esp + 0x13], 0
mov esi, 6
mov eax, dword [esp + 0x1c]
push esi
push eax
push edi
call fcn.00615b50
mov dl, byte [esp + 0x1f]
add dl, al
add esp, 0xc
inc esi
cmp esi, 0xb
mov byte [esp + 0x13], dl
jl 0x6aaa84
mov al, byte [esp + 0x20]
cmp al, 0x14
je 0x6aaaaf
cmp al, 0x15
jne 0x6aaac7
mov ecx, dword [esp + 0x1c]
push 4
push ecx
push edi
call fcn.00615b50
add esp, 0xc
test al, al
je 0x6aaac7
inc byte [esp + 0x13]
mov al, byte [esp + 0x13]
test al, al
mov cl, byte [esp + 0x20]
jne 0x6aaad6
add bl, 0xf8
mov edx, edi
xor edx, 1
mov eax, edi
imul edx, edx, 0x2970
mov esi, dword [edx + 0xed5a7c]
imul eax, eax, 0x2970
mov eax, dword [eax + 0xed5a7c]
sub eax, esi
cmp eax, 0xfffffffd
jg 0x6aab0e
push 0xa
call fcn.0063c860
mov cl, byte [esp + 0x24]
add esp, 4
add bl, al
jmp 0x6aab82
cmp cl, 0xe
ja 0x6aab21
mov edx, dword [ebp + 0xeb6630]
shr edx, 4
and edx, 0x7f
jmp 0x6aab5c
cmp cl, 0x1b
jb 0x6aab53
cmp cl, 0x1f
ja 0x6aab53
mov edx, dword [ebp + 0xeb6630]
mov eax, dword [ebp + 0xeb6644]
shr edx, 0x12
shr eax, 0xa
and edx, 0x7f
and eax, 0x7f
add edx, eax
mov eax, dword [ebp + 0xeb662c]
shr eax, 0x19
lea edx, [edx + eax*2]
jmp 0x6aab76
mov edx, dword [ebp + 0xeb662c]
shr edx, 0x19
mov eax, dword [ebp + 0xeb663c]
shr eax, 0x15
and eax, 0x7f
lea edx, [eax + edx*2]
mov eax, dword [ebp + 0xeb6628]
shr eax, 0x19
add edx, eax
mov eax, 0x88888889
mul edx
shr edx, 4
add bl, dl
xor edx, edx
imul edi, edi, 0x274
lea esi, [edi + 0xe7ecdc]
movzx eax, word [esi]
cmp eax, dword [esp + 0x1c]
jne case.0x6aabad.1
movzx eax, byte [edi + edx + 0xe7ece2]
cmp eax, 0xc
ja case.0x6aabad.1
movzx eax, byte [eax + 0x6aac4c]
jmp dword [eax*4 + 0x6aac38]
test cl, cl
jne case.0x6aabad.1
add bl, 0x14
jmp case.0x6aabad.1
cmp cl, 0xe
jbe case.0x6aabad.1
jmp 0x6aabd0
cmp cl, 0xe
ja case.0x6aabad.1
jmp 0x6aabd0
cmp cl, 0x1b
jae case.0x6aabad.1
add bl, 0xec
inc edx
add esi, 2
cmp edx, 3
jl 0x6aab90
test cl, cl
mov al, byte [ebp + 0xeb6630]
je 0x6aabf4
test al, 0xf
jne 0x6aabfa
shr bl, 1
pop ebp
mov al, bl
pop ebx
pop edi
pop esi
pop ecx
ret
test al, 0xf
je 0x6aabfa
shr bl, 1
pop ebp
mov al, bl
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x6ad2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov cl, byte [edi + 0xd9]
xor eax, eax
test cl, cl
sete al
lea eax, [eax + eax - 1]
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 1
jne 0x6ad329
xor ecx, ecx
mov cl, byte [edi]
push ecx
call fcn.0063dd40
add esp, 4
mov bl, al
inc bl
cmp bl, 0xff
je 0x6ad34c
movzx eax, bl
cdq
mov ecx, 0x17
idiv ecx
jmp 0x6ad351
xor edx, edx
mov dl, byte [edi]
push edx
call fcn.0063dd30
add esp, 4
mov bl, al
inc bl
cmp bl, 0xff
je 0x6ad34c
movzx eax, bl
cdq
mov ecx, 0x17
idiv ecx
jmp 0x6ad351
mov edx, 1
mov esi, dword [0x91cfa4]
imul edx, edx, 0x4c0
add edx, 0xd92230
mov dword [ebp + 0xc], 0x7fffffff
mov dword [ebp + 8], 0xa
cmp edi, edx
je 0x6ad3f4
mov al, byte [edx + 1]
test al, al
je 0x6ad3f4
mov al, byte [ebp + 0x10]
test al, al
je 0x6ad3de
movzx ecx, byte [edi + 0xd9]
mov al, byte [edx]
cmp al, byte [esi + ecx*2 + 0x1c]
je 0x6ad3f4
cmp al, byte [esi + ecx*2 + 0x1d]
je 0x6ad3f4
xor ecx, 1
cmp al, byte [esi + ecx*2 + 0x1c]
je 0x6ad3f4
cmp al, byte [esi + ecx*2 + 0x1d]
je 0x6ad3f4
cmp byte [ebp + 0x10], 2
jne 0x6ad3de
movsx eax, word [ebp - 4]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld st(0)
fmul dword [edi + 0x2c4]
fld dword [edx + 0x2d0]
fadd dword [edx + 0x2c4]
fmul st(2)
fadd dword [0x871358]
fcompp
fnstsw ax
fstp st(0)
test ah, 5
jnp 0x6ad3f4
mov al, byte [edx]
movzx ecx, al
mov ecx, dword [edi + ecx*4 + 0x20c]
cmp ecx, dword [ebp + 0xc]
jae 0x6ad3f4
mov bl, al
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
add edx, 0x4c0
dec eax
mov dword [ebp + 8], eax
jne 0x6ad371
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x760340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0
mov bl, 2
call fcn.0075b6d0
mov esi, eax
mov cl, byte [esi + 0xd9]
xor eax, eax
add esp, 4
test cl, cl
sete al
mov dword [esp + 0xc], 0xa
lea eax, [eax + eax - 1]
mov edi, eax
mov dword [esp + 0x10], edi
mov al, byte [esi + 1]
test al, al
je 0x7604b7
mov cl, byte [esi + 0x28d]
test cl, cl
je 0x7603d1
cmp cl, 0xff
je 0x76039e
movzx eax, cl
cdq
mov edi, 0x17
idiv edi
mov edi, dword [esp + 0x10]
jmp 0x7603a3
mov edx, 1
imul edx, edx, 0x4c0
add edx, 0xd92230
cmp byte [edx + 0x291], 0x27
jne 0x7603d1
movzx eax, byte [edx + 0x292]
sub eax, 5
je 0x7604b7
sub eax, 2
je 0x7604b7
cmp byte [esi + 0xda], 0xb
je 0x7604b7
cmp byte [esi + 0x288], 3
jne 0x7604b7
test cl, cl
je 0x760468
push esi
call fcn.0075b700
add esp, 4
test al, al
jne 0x760468
mov al, byte [esi + 0x28d]
cmp al, 0xff
je 0x760413
movzx eax, al
cdq
mov ecx, 0x17
idiv ecx
jmp 0x760418
mov edx, 1
movsx eax, di
imul edx, edx, 0x4c0
mov dword [esp + 0x14], eax
add edx, 0xd92230
fild dword [esp + 0x14]
fld st(0)
fmul dword [esi + 0x2c4]
fxch st(1)
fmul dword [edx + 0x2c4]
fcompp
fnstsw ax
test ah, 5
jp 0x760458
movzx ecx, byte [edx]
cmp dword [esi + ecx*4 + 0x20c], 0x240000
jmp 0x760466
movzx edx, byte [edx]
cmp dword [esi + edx*4 + 0x20c], 0x640000
jbe 0x76046f
cmp bl, 2
jne 0x76046f
mov bl, 1
fld dword [esi + 0x2cc]
push 0x600
call fcn.0043bd30
push eax
movsx eax, di
lea eax, [eax + eax*2]
shl eax, 8
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fadd dword [esi + 0x2c4]
call fcn.0043bd30
xor ecx, ecx
mov cl, byte [esi + 0xd9]
xor cl, 1
push eax
push ecx
call fcn.006ad090
add esp, 0x10
test al, al
jne 0x7604b7
xor bl, bl
mov eax, dword [esp + 0xc]
add esi, 0x4c0
dec eax
mov dword [esp + 0xc], eax
jne 0x760373
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0xc
ret