joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acbb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51b581
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4acc12
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov eax, esi
jmp 0x4acc14
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x4accb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51b5b1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4acd12
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov eax, esi
jmp 0x4acd14
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x4ad0c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51b611
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4ad122
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov eax, esi
jmp 0x4ad124
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x4c57d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51e021
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x1c], eax
cmp esi, eax
je 0x4c582e
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], ecx
push edx
lea ecx, [esi + 0xc]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x4c58d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51e051
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4c5938
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x10], edx
mov eax, esi
jmp 0x4c593a
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10
Function at 0x4c5a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51e0b1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4c5aa2
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov eax, esi
jmp 0x4c5aa4
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x4c5ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51e111
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4c5c08
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x10], edx
mov eax, esi
jmp 0x4c5c0a
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x4c7430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51e3c9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov ecx, dword [sym.imp.QtCore4.dll_struct_QListData::Data_QListData::shared_null]
mov esi, dword [esp + 0x1c]
mov dword [esi], ecx
mov edx, ecx
mov ecx, 1
lock xadd dword [edx], ecx
mov edx, dword [sym.imp.QtGui4.dll_struct_QMetaObject_const_QWidget::staticMetaObject]
mov ecx, dword [esp + 0x20]
push esi
push edx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.QtCore4.dll_void___cdecl_qt_qFindChildren_helper_class_QObject_const___class_QString_const___class_QRegExp_const___struct_QMetaObject_const___class_QList_void____]
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4f8230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5251d5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x5ac54c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
mov dword [esp + 0x20], 0
mov byte [esp + 0x18], 0x20
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x12]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
mov ecx, dword [esp + 0x3c]
call dword [sym.imp.QtCore4.dll_public:_char_const____thiscall_QVariant::typeName_void_const]
push 0xffffffffffffffff
push eax
call dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromLatin1_helper_char_const___int_]
add esp, 8
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 0x20
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
push 0
push str.The_property__1_could_not_be_written._The_type__2_is_not_supported_yet.
lea edx, [esp + 0x24]
push str.QFormBuilder
push edx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QCoreApplication::translate_char_const___char_const___char_const___enum_QCoreApplication::Encoding_]
add esp, 0x14
mov edx, dword [esp + 0x38]
mov esi, dword [sym.imp.QtCore4.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_const__]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
mov byte [esp + 0x3c], 2
call esi
lea edx, [esp + 0xe]
push edx
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
mov ecx, eax
mov byte [esp + 0x3c], 3
call esi
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], 1
mov byte [esp + 0x2c], 2
or eax, 0xffffffff
lock xadd dword [edx], eax
mov esi, dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
jne 0x4f8327
mov ecx, dword [esp + 0x14]
push ecx
call esi
add esp, 4
mov edx, dword [esp + 0x18]
mov byte [esp + 0x2c], 1
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4f8343
mov ecx, dword [esp + 0x18]
push ecx
call esi
add esp, 4
mov edx, dword [esp + 0x10]
mov byte [esp + 0x2c], 0
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4f835f
mov ecx, dword [esp + 0x10]
push ecx
call esi
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x4fd25c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ac54c]
jne 0x4fd266
repz ret
jmp fcn.004fdb97

Function at 0x4fe4e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
add esp, 0xc
mov ecx, eax
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QString::toLocal8Bit_void_]
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4fe522
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
push 8
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.004fe400
lea ecx, [esp + 4]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::detach_void_]
mov ecx, dword [esp + 0x20]
lea edx, [esp]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
mov eax, dword [edx + 0xc]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push edx
call sub.QtCore4.dll_void___cdecl_qWinMain_struct_HINSTANCE_____struct_HINSTANCE_____char___int__int___class_QVector_char____
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
add esp, 0x18
cmp ecx, 1
je 0x4fe586
mov eax, dword [esp]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push edx
push eax
lea ecx, [esp + 8]
call fcn.004fe230
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
push esi
add eax, 0x10
push eax
push ecx
call fcn.00401090
mov esi, eax
mov eax, dword [esp + 0xc]
add esp, 8
test eax, eax
je 0x4fe5be
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x4fe5be
mov eax, dword [esp + 4]
push 4
push eax
call dword [sym.imp.QtCore4.dll_public:_static_void___cdecl_QVectorData::free_struct_QVectorData___int_]
add esp, 8
mov ecx, dword [esp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4fe5d9
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
add esp, 4
mov eax, esi
pop esi
add esp, 0x10
ret 0x10
Function at 0x15d26b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
test ecx, ecx
je 0x15d27b2
test edx, edx
je 0x15d27b2
cmp dword [esp + 0x2c], 0
mov dword [esp], ecx
je 0x15d26fc
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x15d2703
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp dword [esp + 0x2c], edi
jne 0x15d26e0
jmp 0x15d2705
mov esi, 0x1505
jmp 0x15d2705
mov esi, ecx
mov ecx, dword [esp]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov ebx, edi
sub ebx, 1
jb 0x15d27b2
mov dword [esp + 0x14], ebx
mov dword [esp + 8], edx
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
xor ebx, ebx
mov edx, edi
mov dword [esp + 4], edi
mov dword [esp + 0xc], ebp
jmp 0x15d2753
mov eax, ebx
and eax, 1
xor ebx, 1
lea ebx, [ebx + eax*2]
cmp ebx, edx
mov ebp, dword [esp + 0xc]
jae 0x15d27b0
lea eax, [ebx + ebp]
and eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x15d27b0
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x15d2740
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.015d8ce0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x15d2740
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x10]
call fcn.015d8d00
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x15d2740
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x15d27b2
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x15d34e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x15d3676
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x15d366f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x15d3571
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0x15d366f
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0x15d35e5
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
nop
nop
nop
nop
mov ebx, eax
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
mov eax, ebx
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x15d3590
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0x15d3538
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0x15d3624
neg edx
xor eax, eax
mov ebx, ebp
nop
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x15d3610
mov edx, dword [esp]
sub edx, eax
jmp 0x15d3629
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0x15d3530
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x15d3640
jmp 0x15d3530
shl ecx, 0x10
or ecx, edi
jmp 0x15d367b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x15d3690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x15d36f7
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
not esi
test ecx, ecx
je 0x15d36ee
xor edx, edx
nop
nop
nop
nop
movzx edi, byte [eax + edx]
mov ebx, esi
not ebx
or ebx, 0xf
add ebx, esi
inc ebx
shr esi, 4
mov ebp, edi
and ebp, 0xf
xor ebp, ebx
xor esi, dword [ebp*4 + 0x43ea18]
mov ebx, esi
and ebx, 0xf
shr edi, 4
add ebx, edi
and edi, esi
shr esi, 4
add edi, edi
sub ebx, edi
xor esi, dword [ebx*4 + 0x43ea18]
inc edx
cmp ecx, edx
jne 0x15d36b0
lea eax, [esi + esi]
not eax
add eax, esi
jmp 0x15d36f9
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x15d92f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x15d941e
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x15d932d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x15d9351
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x15d9320
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x15d9320
lea ebp, [ebx + 1]
push ebp
call fcn.015d8bd0
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x15d942c
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x15d9398
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x15d942e
movzx edx, word [edi]
test dx, dx
je 0x15d942e
cmp dx, 0x7f
jbe 0x15d9380
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ecx, 2
jb 0x15d93e0
cmp ebp, 0x7ff
ja 0x15d93e0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x15d9387
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x15d9387
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x15d9387
push 1
call fcn.015d8bd0
add esp, 4
mov esi, eax
jmp 0x15d942e
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x15d9457
mov bl, 0x2f
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx ebx, byte [esi + ecx]
cmp ebx, 0x5c
je 0x15d9450
test ebx, ebx
jne 0x15d9452
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.015d57f0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x15f2010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x60], 0x2bb62db3
mov dword [esp + 0x64], 0x17b72985
mov dword [esp + 0x68], 0x13c01581
mov dword [esp + 0x6c], 0x1f8611bd
mov dword [esp + 0x70], 0x1b1a1db1
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov word [esp + 0x7c], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0x1d
ja 0x15f20da
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
movzx ecx, byte [esp + ecx + 0x60]
lea edx, [eax + ecx]
add edx, 0xb0bef15a
add eax, 0xb0bef15a
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
add al, 0x8a
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x60], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x1e
jb 0x15f2090
lea edi, [esp + 0x60]
lea ecx, [esp + 0x44]
push edi
call fcn.016081a0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4447fc]
Function at 0x15fdd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [0x440870]
sub esp, 4
cmp eax, 0
je 0x15fdf10
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [0x44086c]
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [0x440860]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x15fdf04
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [0x440838]
sub esp, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.015d8ce0
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0
je 0x15fdef2
mov esi, dword [ebp + 8]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov al, byte [esp + 0x14]
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], 0x5b
mov byte [esp + 0x21], 0x8d
mov byte [esp + 0x22], 0xb3
mov byte [esp + 0x23], 0x8b
mov byte [esp + 0x24], 0xa6
mov byte [esp + 0x25], 0x92
mov byte [esp + 0x26], 0xa7
mov byte [esp + 0x27], 0x95
mov byte [esp + 0x28], 0xac
mov byte [esp + 0x29], 0x57
mov byte [esp + 0x2a], 0x9e
mov byte [esp + 0x2b], 0x9b
mov byte [esp + 0x2c], 0x90
mov byte [esp + 0x2d], 0xd
lea eax, [esp + 0x20]
add eax, 0xe
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 3
call fcn.015d8c50
call fcn.015d9290
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x11
jae 0x15fdecf
mov dword [esp + 0x40], edi
jmp 0x15fde71
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
movzx edi, byte [esp + eax + 0x20]
mov ecx, edx
add ecx, 0xdd9074ac
lea eax, [edx + edi - 0x226f8b54]
and ecx, edi
add edx, 0xac
and edx, edi
add ecx, edx
mov edx, ecx
xor edx, eax
not ecx
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
add al, 0x4c
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x11
jb 0x15fde71
mov edi, dword [esp + 0x40]
jmp 0x15fdecf
jmp 0x15fded1
lea eax, [esp + 0x20]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.015d94a0
sub esp, 0xc
jmp 0x15fdeec
and al, 1
mov byte [esp + 0xf], al
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [0x44083c]
sub esp, 4
jmp 0x15fdf04
call dword [0x44085c]
jmp 0x15fdf0c
jmp 0x15fdf0e
jmp 0x15fdf10
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret