joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5be6ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 0x50]
xor ebx, ebx
cmp ecx, ebx
mov dword [edi], 0x5fad9c
je 0x5be705
push edi
call fcn.005bda5c
cmp dword [edi + 0x6c], ebx
push esi
je 0x5be778
nop
mov esi, dword [edi + 0x6c]
cmp esi, ebx
mov eax, dword [esi + 0x44]
mov dword [edi + 0x6c], eax
je 0x5be773
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov ecx, dword [esi + 0x28]
push ecx
call fcn.007152ac
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov edx, dword [esi + 0x1c]
push edx
call fcn.007152ac
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [esi + 0x10]
push eax
call fcn.007152ac
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov ecx, dword [esi + 4]
push ecx
call fcn.007152ac
push esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.007152ac
add esp, 0x14
cmp dword [edi + 0x6c], ebx
jne 0x5be70c
mov eax, dword [edi + 0x58]
cmp eax, ebx
lea esi, [edi + 0x58]
jne 0x5be786
mov dword [esi], ebx
jmp 0x5be790
push ebx
push esi
call fcn.007148fc
add esp, 8
cmp dword [edi + 0x78], ebx
je 0x5be7b4
lea esp, [esp]
mov ecx, dword [edi + 0x78]
cmp ecx, ebx
mov edx, dword [ecx + 0x5c]
mov dword [edi + 0x78], edx
je 0x5be7af
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [edi + 0x78], ebx
jne 0x5be79c
mov eax, dword [edi + 0x64]
cmp eax, ebx
je 0x5be7d3
mov ecx, dword [eax + 0x10]
add eax, 0x10
cmp ecx, ebx
jne 0x5be7c9
mov dword [eax], ebx
jmp 0x5be7d3
push ebx
push eax
call fcn.007148fc
add esp, 8
mov eax, dword [edi + 0x64]
cmp eax, ebx
je 0x5be817
mov ecx, dword [eax + 4]
test ecx, 0x40000000
jne 0x5be814
cmp ecx, ebx
je 0x5be814
mov edx, ecx
and edx, 0xff
dec edx
je 0x5be814
dec ecx
mov dword [eax + 4], ecx
and ecx, 0xff
dec ecx
jne 0x5be814
push eax
and eax, 0xfffff000
mov ecx, dword [eax]
add ecx, 0x340
call fcn.00713dcc
mov dword [edi + 0x64], ebx
mov dword [edi + 0x60], ebx
mov ecx, dword [edi + 0x5c]
cmp ecx, ebx
je 0x5be85d
mov eax, dword [ecx + 4]
test eax, 0x40000000
jne 0x5be85a
cmp eax, ebx
je 0x5be85a
mov edx, eax
and edx, 0xff
dec edx
je 0x5be85a
dec eax
mov dword [ecx + 4], eax
and eax, 0xff
dec eax
jne 0x5be85a
push ecx
and ecx, 0xfffff000
mov ecx, dword [ecx]
add ecx, 0x340
call fcn.00713dcc
mov dword [edi + 0x5c], ebx
mov dword [esi], ebx
mov eax, dword [edi + 0x54]
cmp eax, ebx
pop esi
je 0x5be8a4
mov ecx, dword [eax + 4]
test ecx, 0x40000000
jne 0x5be8a1
cmp ecx, ebx
je 0x5be8a1
mov edx, ecx
and edx, 0xff
dec edx
je 0x5be8a1
dec ecx
mov dword [eax + 4], ecx
and ecx, 0xff
dec ecx
jne 0x5be8a1
push eax
and eax, 0xfffff000
mov ecx, dword [eax]
add ecx, 0x340
call fcn.00713dcc
mov dword [edi + 0x54], ebx
lea ecx, [edi + 8]
call fcn.0056d73c
mov dword [edi], 0x5f7a90
pop edi
pop ebx
ret
Function at 0x5beddc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
mov eax, dword [esi + 0x1c]
xor ebx, ebx
add eax, 0xfffffffe
cmp eax, 3
push edi
mov dword [esp + 0x10], ebx
ja 0x5bf063
jmp dword [eax*4 + 0x487c08]
mov eax, dword [esi + 0x1c]
sub eax, ebx
je 0x5bf184
dec eax
jne 0x5bf2ac
mov byte [esp + 0x7c], 1
mov edx, dword [esi]
mov ebp, dword [edx + 0x864]
cmp ebp, ebx
mov dword [esp + 0x18], ebp
je 0x5bf29f
mov eax, dword [ebp + 0xa0]
cmp eax, ebx
mov ecx, dword [ebp + 0xa4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
je 0x5bf29f
cmp dword [esi + 8], ebx
mov dword [esp + 0x14], ebx
jle 0x5bf29f
jmp 0x5bf0bc
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [edx + eax*4]
push ecx
mov ecx, dword [esi]
call fcn.005fd59c
mov edi, eax
cmp edi, ebx
je 0x5bf28b
cmp byte [edi], 0x2a
jne 0x5bf1b7
cmp byte [edi + 1], bl
jne 0x5bf1b7
mov edx, dword [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.005bddcc
jmp 0x5bf27a
mov edx, dword [esi]
mov eax, dword [edx + 0x864]
cmp eax, ebx
je 0x5bf075
mov ecx, dword [eax + 0xa0]
cmp dword [ecx + 0x48], ebx
jne 0x5bf1ae
cmp dword [eax + 0x4c], 7
setge al
cmp al, bl
je 0x5bf075
mov byte [esp + 0x7c], bl
jmp 0x5bf07a
push 0x3a
push edi
call fcn.005733ec
add esp, 8
test eax, eax
jne 0x5bf1e9
push edi
push 0x5f77d0
call fcn.005732dc
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x5bf1e5
push edi
call fcn.007152ac
add esp, 4
mov edi, ebp
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.0060e3cc
push ebx
push ebx
push edi
lea ecx, [esp + 0x48]
call fcn.0060f5dc
cmp dword [ebp + 0x4c], 8
jl 0x5bf247
mov eax, dword [esp + 0x7c]
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebp
call fcn.005bdd7c
jmp 0x5bf271
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.005bdfdc
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x5bf271
mov edx, dword [esp + 0x7c]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.005bdfdc
lea ecx, [esp + 0x3c]
call fcn.0056d73c
push edi
call fcn.007152ac
add esp, 4
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x5bf0bc
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x14]
call fcn.005adefc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x5cad4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x5cad6d
mov eax, dword [esp + 0x30]
push eax
call fcn.00574ebc
add esp, 4
pop esi
add esp, 0x24
ret 8
mov eax, dword [eax + 0x78]
cmp eax, 7
push edi
jne 0x5cadd4
mov ecx, dword [esi + 4]
movzx edi, word [ecx + 0x5a]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
lea ecx, [eax + 0x10]
push edi
push ecx
add eax, 0x3c
push eax
call fcn.0058692c
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
push edi
push eax
add eax, 0x4c
push eax
call fcn.0058692c
mov eax, dword [esi + 0x18]
movzx ecx, byte [eax + 0x20]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
add esp, 0x20
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.005c7ffc
pop edi
pop esi
add esp, 0x24
ret 8
test eax, eax
mov ecx, esi
jne 0x5cae0d
push eax
call fcn.005c97dc
push 1
mov ecx, esi
mov edi, eax
call fcn.005c97dc
mov ecx, dword [esi + 0x18]
movzx edx, byte [ecx]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push eax
push edi
mov ecx, esi
call fcn.005c7ffc
pop edi
pop esi
add esp, 0x24
ret 8
push ebx
push ebp
push 0
call fcn.005c97dc
push 1
mov ecx, esi
mov ebp, eax
call fcn.005c97dc
mov edi, eax
push 0
push edi
push ebp
call fcn.005751dc
add esp, 0xc
test eax, eax
jne 0x5cae80
mov eax, dword [esp + 0x38]
push eax
call fcn.0057676c
add esp, 4
test eax, eax
jne 0x5cae80
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x5cae65
mov ecx, dword [ecx + 0x48]
test cl, 2
je 0x5cae5b
mov eax, 1
test cl, 1
je 0x5cae6a
or eax, 2
jmp 0x5cae6a
mov eax, 0xff
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ebx
push edx
push edi
push ebp
mov ecx, esi
call fcn.005c7ffc
jmp 0x5cae93
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push edi
push eax
call fcn.00575aec
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x5caeb2
mov ecx, esi
call fcn.005c619c
mov edx, dword [eax]
neg edx
push ebx
push edx
call fcn.00576eac
add esp, 8
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0x78], 4
jne 0x5caf14
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x5caf14
mov edx, dword [eax + 0xc]
test edx, edx
jbe 0x5caf14
mov ecx, dword [ecx + 0x68]
mov eax, dword [ecx + 0x210]
test eax, eax
jne 0x5caede
call fcn.005d85cc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], eax
call fcn.00574ebc
mov eax, dword [esp + 0x3c]
add esp, 4
lea edx, [esp + 0x20]
push edx
push 0x48cea0
push eax
mov ecx, esi
call fcn.005c78fc
push ebx
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00576fcc
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x5cf48c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x18]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x5cf51a
cmp dword [eax + 0x78], 9
jne 0x5cf51a
mov eax, dword [ebp + 0x2c]
cmp eax, ebx
je 0x5cf4ba
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x5cf4ba
mov eax, dword [eax + 0x3e0]
jmp 0x5cf4bc
xor eax, eax
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.005771bc
add esp, 0xc
test al, al
je 0x5cf564
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.005755dc
mov edx, dword [ebp + 4]
mov ecx, dword [edx + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call fcn.0056a71c
push eax
call fcn.0057517c
add esp, 8
test eax, eax
je 0x5cf564
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
cmp dword [esp + 0x44], ebx
je 0x5cf570
mov ecx, ebp
call fcn.005c58bc
test eax, eax
je 0x5cf564
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push ecx
push edx
sub esp, 0xdc
mov ecx, esp
push eax
call fcn.005cacec
mov ecx, ebp
call fcn.005cfd3c
test eax, eax
je 0x5cf564
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
lea ecx, [ebp + 0x7c]
push edi
push ecx
mov dword [esp + 0x4c], ebx
call fcn.0057517c
add esp, 8
test eax, eax
je 0x5cf666
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push edx
push eax
mov ecx, ebp
call fcn.005ce04c
mov esi, dword [ebp + 0x4c]
test esi, esi
je 0x5cf666
movsx eax, word [esi + 0x12]
mov edx, dword [edi + 4]
cmp eax, edx
jg 0x5cf636
movsx ecx, word [esi + 0x1a]
cmp edx, ecx
jge 0x5cf636
movsx edx, word [esi + 0x10]
mov dword [esp + 0x1c], eax
movsx eax, word [esi + 0x14]
mov dword [esp + 0x18], edx
movsx edx, word [esi + 0x16]
mov dword [esp + 0x20], eax
movsx eax, word [esi + 0x18]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [esi + 0x1c]
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x1c]
push edi
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ecx
call fcn.00557a0c
add esp, 0xc
test ax, ax
je 0x5cf636
movzx eax, byte [esi + 0x1d]
sub eax, 0
mov ebx, 1
je 0x5cf628
dec eax
je 0x5cf623
dec eax
jne 0x5cf636
mov eax, dword [esi + 8]
mov cl, byte [esi + 0x1e]
add byte [eax + 0x25], cl
jmp 0x5cf636
mov eax, dword [esi + 8]
jmp 0x5cf632
mov eax, dword [esi + 8]
xor byte [eax + 0x25], 1
mov eax, dword [esi + 0xc]
xor byte [eax + 0x25], 1
mov esi, dword [esi]
test esi, esi
jne 0x5cf5ac
test ebx, ebx
je 0x5cf666
mov eax, dword [ebp + 0x50]
test eax, eax
je 0x5cf666
nop
mov cl, byte [eax + 0x25]
test cl, cl
je 0x5cf65b
mov dword [esp + 0x44], 1
mov byte [eax + 0x25], 0
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x5cf64c
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
Function at 0x5ec16c
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
push ebx
mov bl, byte [eax]
test bl, bl
push esi
mov byte [esp + 0xb], 0
mov esi, eax
je 0x5ec1c8
cmp bl, 0x3d
mov byte [esp + 0xc], bl
je 0x5ec1c8
cmp bl, 0x3b
je 0x5ec1c8
cmp bl, 0x2f
je 0x5ec1c8
cmp bl, 0x23
je 0x5ec1c8
cmp bl, 0x3f
je 0x5ec1c8
cmp bl, 0x20
je 0x5ec1c8
cmp bl, 0x3a
je 0x5ec1d0
mov eax, dword [esp + 0xc]
push eax
call fcn.005ebf9c
add esp, 4
test al, al
jne 0x5ec1c0
cmp bl, 0x2d
je 0x5ec1c0
mov byte [esp + 0xb], 1
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x5ec17e
pop esi
xor al, al
pop ebx
add esp, 8
ret
mov al, byte [esp + 0xb]
test al, al
pop esi
setne al
pop ebx
add esp, 8
ret

Function at 0x5ed04c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x5ed07a
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x5ed05d
pop esi
ret 4

Function at 0x5ed08c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx + 0xdc8]
mov ecx, dword [ebx + 0xdcc]
push edi
lea edi, [esi*4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.0071528c
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xdc8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
add esp, 4
cmp ecx, eax
mov dword [ebx + 0xdcc], esi
mov dword [ebx + 0xdd4], eax
lea ebp, [esi - 1]
mov dword [esp + 0x1c], eax
jle 0x5ed195
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + eax*4]
and edi, 0xfffffff8
cmp edi, 1
jbe 0x5ed184
mov ecx, edi
xor esi, esi
call fcn.00573eec
mov cx, word [eax]
test cx, cx
je 0x5ed13a
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x5ed11c
mov edx, dword [ebx + 0xdc8]
and esi, ebp
and esi, 0x7fffffff
cmp dword [edx + esi*4], 0
mov eax, 7
je 0x5ed168
mov ecx, edx
lea esp, [esp]
add esi, eax
and esi, ebp
mov edx, dword [ecx + esi*4]
inc eax
test edx, edx
jne 0x5ed15c
mov ecx, edi
call fcn.00573eec
movzx eax, byte [eax]
mov ecx, dword [ebx + 0xdc8]
and eax, 7
or eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x5ed0fc
mov edx, dword [esp + 0x14]
push edx
call fcn.007152ac
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x5f593c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.00573eec
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.00573eec
mov cx, word [eax]
test cx, cx
je 0x5f597e
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x5f5960
push esi
push ebp
mov ecx, edi
call fcn.005f1c4c
mov edx, dword [edi + 0xdc8]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x5f59ad
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.005f1bac
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x636d5c
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x30
push edi
lea eax, [esp + 0x44]
mov edi, ecx
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.005958fc
add esp, 8
test al, al
je 0x636f06
mov edx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x48]
push esi
push 1
push ebp
push edx
call fcn.0059597c
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
jne 0x636db2
mov eax, dword [esp + 0x48]
push ebp
push eax
mov ecx, edi
call fcn.00636cbc
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 0x10
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
push edx
call dword [fcn.005f60ec]
xor ecx, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
mov ch, al
movzx edx, ah
movzx eax, byte [esp + 0x52]
or ecx, edx
shl ecx, 8
or ecx, eax
push ecx
call dword [fcn.005f60c0]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
mov ebp, eax
push ebp
push edx
call dword [fcn.005f603c]
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 0x24]
push 1
push ecx
call dword [fcn.005f60f0]
mov dword [esp + 0x10], 0x28
mov edx, dword [esi + 0x10]
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov eax, 1
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], ax
mov eax, dword [esi + 8]
mov ecx, 2
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov cl, byte [eax + 6]
mov byte [esp + 0x3a], cl
mov dl, byte [eax + 5]
mov byte [esp + 0x39], dl
mov cl, byte [eax + 4]
mov byte [esp + 0x38], cl
mov byte [esp + 0x3b], bl
mov dl, byte [eax + 0xa]
mov byte [esp + 0x3e], dl
mov cl, byte [eax + 9]
mov byte [esp + 0x3d], cl
mov dl, byte [eax + 8]
mov ecx, esi
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3f], bl
call fcn.005ad51c
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
push 0xb8074a
push ebx
lea ebx, [esp + 0x18]
push ebx
mov ebx, dword [esi + 4]
push ebx
mov ebx, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x10]
push ebx
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push 0
push 0
sub ebx, ecx
push ebx
sub eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x48]
push edx
mov edx, dword [ecx + 0x24]
push edx
call dword [fcn.005f60e0]
mov ecx, esi
call fcn.005ad53c
mov ecx, esi
call fcn.005ad68c
push esi
call fcn.007152ac
mov eax, dword [esp + 0x50]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
add esp, 4
push eax
push edx
call dword [fcn.005f603c]
push ebp
call dword [fcn.005f6124]
mov eax, dword [esp + 0x44]
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x24]
push eax
push edx
call dword [fcn.005f60e8]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x30
ret 0x10
Function at 0x63fc4c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.00573b1c
mov edx, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0xc24]
push 0x60409c
call fcn.0064b6ac
mov dword [esp + 0x18], ebx
push 0xa
push ebx
call fcn.005ea0ec
mov esi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x820]
add esp, 8
push esi
call fcn.0065f0dc
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x820]
push esi
call fcn.0065f2bc
push esi
mov edi, eax
call fcn.007152ac
add esp, 4
test edi, edi
je 0x63fdd3
mov ecx, dword [ebp]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, dword [edi + 0xa0]
mov dword [esp + 0x18], 2
call fcn.0065fc2c
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x63fd1a
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.005ae1cc
mov ecx, eax
call fcn.0057423c
test al, al
je 0x63fda0
mov dword [esp + 0x1c], ebx
jmp 0x63fdd3
lea ecx, [esp + 0x10]
call fcn.005ae2cc
mov edi, eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x63fd2c
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x63fd53
mov cl, byte [eax + edi]
movzx edx, cl
mov dl, byte [edx + 0x5f93c8]
xor dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jl 0x63fd3d
mov eax, dword [0x604090]
xor ebx, ebx
test eax, eax
je 0x63fd8f
mov eax, 0x604090
mov esi, eax
lea esp, [esp]
mov eax, dword [eax]
push eax
push edi
call fcn.0057345c
add esp, 8
test eax, eax
jne 0x63fd8a
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
mov eax, esi
jne 0x63fd6c
jmp 0x63fd8f
mov ebx, 1
push edi
call fcn.007152ac
add esp, 4
test ebx, ebx
je 0x63fdb3
mov ebx, dword [esp + 0x18]
inc ebx
cmp ebx, 0x270f
mov dword [esp + 0x18], ebx
jl 0x63fc84
jmp 0x63fdd3
mov ecx, dword [ebp]
mov ecx, dword [ecx + 0xc24]
lea eax, [esp + 0x10]
push eax
push 0x60409c
call fcn.0064a78c
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
push 0xa
push eax
call fcn.005ea0ec
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x64d47c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov al, byte [edi]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cmp al, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
je 0x64d4d4
nop
movzx esi, al
movzx eax, byte [esi + 0x5f93c8]
xor eax, esi
mov esi, ecx
shr esi, 0x1b
shl ecx, 5
or esi, ecx
add esi, eax
mov ecx, esi
mov esi, edx
shr esi, 0x1a
shl edx, 6
or esi, edx
add esi, eax
mov al, byte [edi + 1]
inc edi
cmp al, bl
mov edx, esi
jne 0x64d49c
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp]
push eax
call fcn.007152ac
add esp, 4
push 0x604824
mov ecx, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
call fcn.00572efc
lea ecx, [ecx]
mov esi, dword [esp + ebx*4 + 0x10]
mov edi, 8
lea esp, [esp]
mov ecx, esi
shr ecx, 0x1c
push ecx
call fcn.005729cc
add esp, 4
push eax
mov ecx, ebp
call fcn.00572b3c
shl esi, 4
dec edi
jne 0x64d50c
inc ebx
cmp ebx, 2
jl 0x64d4fc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x6611dc
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], edi
jne 0x6611fc
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0xc]
push ecx
push 0x20000013
push eax
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], edi
call dword [fcn.005f64f4]
test eax, eax
je 0x661357
mov ecx, dword [esi + 0x28]
push ebx
push edi
push edi
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], edi
xor ebx, ebx
call dword [fcn.00682b28]
test eax, eax
je 0x6612e4
push ebp
nop
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x6612e3
lea edx, [ebx + eax + 1]
push edx
mov dword [esp + 0x1c], edi
call fcn.0071528c
mov ebp, eax
add esp, 4
cmp ebp, edi
je 0x6612e3
cmp ebx, edi
jbe 0x66128c
mov esi, dword [esi + 0x10]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x28]
lea ecx, [esp + 0x18]
push ecx
push edx
lea edi, [ebx + ebp]
push edi
push eax
call dword [fcn.00682b2c]
test eax, eax
je 0x6612bd
mov ecx, dword [esp + 0x10]
mov byte [edi + ecx], 0
push ebp
lea ecx, [esi + 0x10]
call fcn.00572a2c
add ebx, dword [esp + 0x18]
push ebp
call fcn.007152ac
mov eax, dword [esi + 0x28]
add esp, 4
push 0
push 0
lea edx, [esp + 0x18]
push edx
push eax
call dword [fcn.00682b28]
xor edi, edi
test eax, eax
jne 0x66124c
pop ebp
mov eax, dword [esi + 0xc]
cmp eax, 0x197
pop ebx
je 0x66132f
cmp eax, 0x191
je 0x66132f
cmp eax, 0x12c
jb 0x661316
cmp eax, 0x190
jae 0x66131b
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
cmp eax, 0x190
jbe 0x661357
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret
mov ecx, dword [esi + 0x28]
push edi
push 7
push 0x2eee
push ecx
call dword [fcn.005f644c]
push eax
call dword [0x682b34]
xor edx, edx
cmp eax, 0x2f00
sete dl
inc edx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x18
ret