joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b100
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b29b
sub esp, 0x3c
mov eax, dword [esp + 0x40]
cmp eax, 0x7000000
jle 0x40b12b
mov eax, 0x7000000
jmp 0x40b133
test eax, eax
je 0x40b28f
mov dword [esp + 0x18], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.0045f620
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
add eax, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
lea esi, [0x9edc40]
movsd xmm0, qword [esi + ebp*8]
movsd qword [esp + 0x1c], xmm0
movsd xmm1, qword [esi + ecx*8]
movsd qword [esp + 0x24], xmm1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004589f0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x34], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
shl eax, 5
mov ecx, dword [esp + 0x10]
shr ecx, 0x1b
or ecx, eax
and ecx, 0xfffff
mov dword [esp], ecx
call fcn.00458ac0
movsd xmm0, qword [esp + 0x34]
movsd xmm1, qword [esp + 0x1c]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x24]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x894868]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x894938]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b26a
xorps xmm0, xmm0
mov eax, dword [esp + 0x18]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x894998]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x44], eax
add esp, 0x3c
ret
mov dword [esp + 0x44], 0
add esp, 0x3c
ret
call fcn.0045e260
jmp fcn.0040b100
Function at 0x413f60
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41414c
sub esp, 0x18
mov eax, dword [0xa43a40]
test eax, eax
jne 0x414135
nop
lea eax, [0xa43a2c]
mov dword [esp], eax
call fcn.00408f90
mov eax, dword [0xa43a30]
test eax, eax
je 0x413fa9
cmp dword [eax + 8], 0xcc
jne 0x41401f
mov eax, dword [0xa43a24]
test eax, eax
jne 0x414001
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xa48db0]
mov dword [esp + 8], eax
call fcn.0040b2b0
mov eax, dword [esp + 0xc]
mov dword [0xa43a24], eax
mov ecx, dword [0xa439e8]
mov dword [eax], ecx
mov eax, dword [0xa43a24]
mov dword [0xa439e8], eax
movzx eax, byte [0xa441c0]
test al, al
jne 0x414001
xor eax, eax
jmp 0x414129
mov eax, dword [0xa43a24]
mov ecx, dword [eax + 4]
mov dword [0xa43a24], ecx
mov ecx, dword [0xa43a30]
mov dword [eax + 4], ecx
mov dword [0xa43a30], eax
mov eax, dword [0xa43a30]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00402080
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xa43e50]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414072
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41407f
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045f670
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xa43e50]
test edx, edx
jne 0x4140ab
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4140cc
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045f670
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045f670
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045f670
nop
lea eax, [0xa43a2c]
mov dword [esp], eax
call fcn.00409190
nop
lea eax, [0xa43a28]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402200
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
lea ecx, [0x9e741c]
movzx ebx, byte [ecx + ebx]
lea ebp, [0xa441c0]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jl 0x4140f6
jmp 0x414001
lea eax, [0x6bf6e8]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00433dc0
nop
call fcn.0045e260
jmp fcn.00413f60
Function at 0x426e20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426f90
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00424cf0
mov eax, dword [esp + 4]
test eax, eax
je 0x426f79
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00422b60
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00408f90
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x426eb7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x426f1d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x426ecc
cmp byte [ebp + 6], dl
je 0x426ed7
cmp esi, ebx
ja 0x426f1d
jne 0x426eb5
cmp byte [ebp + 6], dl
jbe 0x426eb5
jmp 0x426f1d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409190
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426f14
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426f14
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00426d40
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409190
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426f70
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426f70
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x6c1e6c]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433dc0
nop
call fcn.0045e260
jmp fcn.00426e20
Function at 0x427410
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42752c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4274a5
cmp cl, 2
je 0x42744d
cmp cl, 3
jne 0x427515
mov byte [eax + 8], 1
jmp 0x427511
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c050
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0xa27fa4]
sub eax, dword [0xa27f88]
mov dword [0xa27fa4], eax
mov eax, dword [0xa27f94]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xa27f94], ecx
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00409190
jmp 0x427511
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413f60
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0xa27f7c]
sub eax, dword [0xa27f60]
mov dword [0xa27f7c], eax
mov eax, dword [0xa27f6c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xa27f6c], ecx
nop
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00409190
add esp, 0x14
ret
lea eax, [0x6bb18e]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433dc0
nop
call fcn.0045e260
jmp fcn.00427410
Function at 0x42c9d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42caa2
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42ca0d
lea eax, [0x6b9105]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.004383d0
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42ca21
test cl, cl
jmp 0x42ca8f
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f767
lea ecx, [0x42cab0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.0045e150
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42ca96
call fcn.00438500
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.0045e260
jmp fcn.0042c9d0
Function at 0x45f520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xa43fa0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45dceb
je 0x45dd3e
cmp ebx, 0x20
jbe 0x45dd44
cmp ebx, 0x40
jbe 0x45dd8a
jmp 0x45de2b
test ebx, ebx
je 0x45dd34
add eax, 0x10
test ax, 0xff0
je 0x45dd20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x8970c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x8972c0]
jmp 0x45dd08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45dd08
pxor xmm1, xmmword [0xa43fb0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45de8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xa43999], 0
je 0x45f53a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45dcb0
jmp fcn.004079e0
Function at 0x47b7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b95d
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x47b801
xor edx, edx
jmp 0x47b82c
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x6bf8fb]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x47b837
mov edx, 1
jmp 0x47b86b
cmp ecx, 0x23
je 0x47b840
xor edx, edx
jmp 0x47b86b
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x6c4a0e]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x47b8c5
lea edi, [esp + 0x3c]
call fcn.0045f76b
mov ecx, dword [0xa16f10]
lea edx, [0x895b10]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.00486540
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.0045fc4e
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x47b93c
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.0045f76b
mov ecx, dword [0xa16f14]
mov edx, dword [0xa16f10]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.0047b970
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.0045fc4e
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.0045e260
jmp fcn.0047b7d0
Function at 0x500af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x20]
cmp eax, dword [ecx + 8]
jbe 0x500ce6
sub esp, 0xa0
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0xa8]
cmp ecx, edx
jne 0x500ccd
cmp edx, 0x48
jg 0x500cb5
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f75e
lea edi, [esp + 0x10]
call fcn.0045f75e
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xb0]
mov ebp, dword [esp + 0xa4]
xor eax, eax
jmp 0x500b88
sub edx, eax
movzx edi, byte [ebp + edx - 1]
mov edx, ecx
sub ecx, eax
movzx esi, byte [ebx + ecx - 1]
xchg edi, ebx
mov byte [esp + eax + 0x58], bl
xchg edi, ebx
xchg esi, ebx
mov byte [esp + eax + 0x10], bl
xchg esi, ebx
inc eax
mov esi, dword [esp + 0xa8]
mov ecx, edx
mov edx, esi
cmp edx, eax
jg 0x500b5c
xor eax, eax
xor ecx, ecx
jmp 0x500c95
lea edx, [eax - 0x48]
neg edx
neg edx
sar edx, 0x1f
and edx, eax
movzx ebx, byte [esp + edx + 0x58]
movzx ebp, byte [esp + edx + 0x59]
mov esi, ebp
shl ebp, 8
or ebp, ebx
shr esi, 0x18
movzx ebx, byte [esp + edx + 0x5a]
mov edi, ebx
shl ebx, 0x10
or ebx, ebp
shr edi, 0x10
or edi, esi
movzx ebp, byte [esp + edx + 0x5b]
mov esi, ebp
shl ebp, 0x18
or ebp, ebx
shr esi, 8
or esi, edi
movzx ebx, byte [esp + edx + 0x5c]
or ebx, esi
movzx esi, byte [esp + edx + 0x5d]
shl esi, 8
or esi, ebx
movzx ebx, byte [esp + edx + 0x5e]
shl ebx, 0x10
or ebx, esi
movzx esi, byte [esp + edx + 0x5f]
shl esi, 0x18
or esi, ebx
mov dword [esp + 0xc], esi
movzx ebx, byte [esp + edx + 0x10]
movzx edi, byte [esp + edx + 0x11]
mov dword [esp + 8], edi
shl edi, 8
or edi, ebx
mov ebx, dword [esp + 8]
shr ebx, 0x18
movzx esi, byte [esp + edx + 0x12]
mov dword [esp + 8], esi
shr esi, 0x10
or esi, ebx
mov ebx, dword [esp + 8]
shl ebx, 0x10
or ebx, edi
movzx edi, byte [esp + edx + 0x13]
mov dword [esp + 8], edi
shr edi, 8
or edi, esi
mov esi, dword [esp + 8]
shl esi, 0x18
or esi, ebx
movzx ebx, byte [esp + edx + 0x14]
or ebx, edi
movzx edi, byte [esp + edx + 0x15]
shl edi, 8
or edi, ebx
movzx ebx, byte [esp + edx + 0x16]
shl ebx, 0x10
or ebx, edi
movzx edx, byte [esp + edx + 0x17]
shl edx, 0x18
or edx, ebx
sub ebp, esi
mov ebx, dword [esp + 0xc]
mov esi, ebx
sbb ebx, edx
sub ebp, ecx
sbb ebx, 0
add eax, 8
nop
mov ecx, esi
not ecx
and ecx, edx
xor esi, edx
xchg esi, ebx
not ebx
xchg esi, ebx
and ebx, esi
or ecx, ebx
shr ecx, 0x1f
cmp eax, 0x48
jl 0x500b95
cmp ecx, 1
sete al
and eax, 1
mov byte [esp + 0xbc], al
add esp, 0xa0
ret
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x894a78]
mov dword [esp + 4], eax
call fcn.00433690
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x894a98]
mov dword [esp + 4], eax
call fcn.00433690
nop
call fcn.0045e260
jmp fcn.00500af0
Function at 0x539280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x539462
sub esp, 0x68
lea edi, [esp + 0x78]
xor eax, eax
call fcn.0045f76b
mov dword [esp], 0
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 8], ecx
call fcn.0044b280
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x30], edx
lea edi, [esp + 0x54]
xor eax, eax
call fcn.0045f76b
lea ecx, [0x6bc3a8]
mov dword [esp], ecx
mov dword [esp + 4], 0x13
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
call fcn.0047b7d0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
lea edi, [esp + 0x54]
lea esi, [esp + 0x10]
call fcn.0045fc4e
lea edi, [esp + 0x78]
lea esi, [esp + 0x54]
call fcn.0045fc4e
mov ecx, dword [esp + 0x34]
test ecx, ecx
jne 0x539450
mov dword [esp + 0x40], ebx
lea edi, [esp]
lea esi, [esp + 0x54]
call fcn.0045fc4e
lea eax, [0x6bc3a8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x13
call fcn.004791c0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x5393a0
mov dword [esp], eax
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00402870
movzx eax, byte [esp + 0xc]
test al, al
je 0x53939c
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x40]
jmp 0x53943e
mov edx, dword [esp + 0x30]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00408970
mov eax, dword [esp + 8]
lea ecx, [0x67e720]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.00408970
mov eax, dword [esp + 8]
lea ecx, [0x67e720]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
lea eax, [0x6cd683]
mov dword [esp], eax
mov dword [esp + 4], 0x6a
lea eax, [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00511cc0
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ebx
add esp, 0x68
ret
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], ebx
add esp, 0x68
ret
call fcn.0045e260
jmp fcn.00539280
Function at 0x58bc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58bd72
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00544870
movzx eax, byte [esp + 0xc]
test al, al
jne 0x58bc8a
lea eax, [0x687ca0]
mov dword [esp], eax
call fcn.0040af90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x6c69b5]
mov dword [eax], ecx
lea ecx, [0x895274]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x58bd5e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00544f50
movzx eax, byte [esp + 0x10]
test al, al
je 0x58bd2b
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x58bc8a
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x687ca0]
mov dword [esp], eax
call fcn.0040af90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x6c6461]
mov dword [eax], ecx
lea ecx, [0x895274]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045e260
jmp fcn.0058bc20