joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd9a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fdb01
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4fda27
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
jne 0x4fda2b
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4fd9f1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4fda2b
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4fda33
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004fd780
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.005033c0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
add esp, 0x48
ret
call fcn.00461ac0
jmp fcn.004fd9a0
Function at 0x51a610
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51a6b8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x51a66b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x51a6a2
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00461ac0
jmp fcn.0051a610
Function at 0x5884a0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5886b6
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x588539
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x588697
cmp ecx, 0xe
jne 0x5885b2
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x588697
cmp ecx, 0xf
jne 0x588628
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x588697
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.00461ac0
jmp fcn.005884a0
Function at 0x596040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5961f8
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.00596bc0
movzx eax, byte [esp + 0xc]
test al, al
je 0x5960d1
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
test ecx, ecx
je 0x5960d1
cmp ecx, 1
je 0x5960c4
movzx ebx, byte [edx]
test bl, bl
jne 0x5960b6
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5960d1
cmp bl, 0xff
jne 0x5960c4
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x5960d1
cmp ecx, 8
jg 0x5960da
mov ebx, dword [esp + 0x3c]
xor eax, eax
jmp 0x5960f1
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x5960d1
mov byte [esp + 0x40], 1
add esp, 0x34
ret
movzx esi, byte [edx + eax]
or esi, ebp
mov dword [ebx], esi
mov dword [ebx + 4], edi
inc eax
cmp eax, ecx
jge 0x596115
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
cmp eax, ecx
jb 0x5960e5
jmp 0x5961f2
mov dword [esp + 0x14], ecx
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
mov byte [esp + 0x13], dl
cmp dl, 0x20
sbb ebp, ebp
mov dword [esp + 0x24], ebp
add ecx, 0xffffffe0
mov esi, ecx
neg ecx
mov byte [esp + 0x12], cl
cmp cl, 0x20
sbb edi, edi
mov dword [esp + 0x20], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
mov dword [esp + 0x1c], eax
mov edi, dword [ebx]
mov dword [esp + 0x18], edi
mov ebx, dword [ebx + 4]
shl edi, cl
mov ecx, edx
shl ebx, cl
and ebx, ebp
mov ecx, esi
mov ebp, dword [esp + 0x18]
shr ebp, cl
and ebp, eax
or ebp, ebx
mov ebx, dword [esp + 0x20]
and ebx, edi
or ebp, ebx
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 4], ebp
movzx edi, byte [esp + 0x12]
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov dword [esp + 0x20], edx
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp + 0x18]
shl edx, cl
mov eax, dword [esp + 0x24]
and edx, eax
not ebx
or ebx, edi
mov edi, ecx
mov ecx, esi
mov esi, ebp
shl ebp, cl
mov ecx, edi
shr edx, cl
and edx, eax
mov eax, dword [esp + 0x1c]
and ebp, eax
or edx, ebp
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x20]
xor ebx, 0xffffffff
and ebx, esi
or ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [edx], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ecx, ecx
not ecx
or ecx, edi
sar eax, cl
mov dword [edx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x5960da
call fcn.00462f50
nop
call fcn.00461ac0
jmp fcn.00596040
Function at 0x598f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x599144
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.004635fc
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00598500
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.00463146
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x599012
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x5990e5
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x599116
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x59900b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x59900b
test byte [eax], al
cmp ebp, 0x20
jb 0x599108
mov eax, ebp
mov ecx, 0x20
call fcn.00462f50
nop
call fcn.00461ac0
jmp fcn.00598f60
Function at 0x5a29b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a2b71
sub esp, 0x34
lea eax, [0x688960]
mov dword [esp], eax
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5a29ef
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x5a2b18
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x5a2b43
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5a29e7
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5a29e7
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5a29e7
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x5a29e7
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x5a2ac2
cmp eax, ebp
jle 0x5a2ac2
jbe 0x5a2b67
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x5a2b1c
mov eax, esi
mov ecx, edx
call fcn.00462f50
mov ecx, eax
mov eax, ebp
call fcn.00462f50
nop
call fcn.00461ac0
jmp fcn.005a29b0
Function at 0x5a5760
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a58d3
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5a5793
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5a5793
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5a5799
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5a57a7
cmp ecx, 4
jne 0x5a57d8
cmp al, 0x2c
ja 0x5a57c0
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5a57d2
cmp al, 0x24
je 0x5a57d2
cmp al, 0x26
jae 0x5a57d2
jmp 0x5a57d8
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5a57d2
cmp al, 0x5b
je 0x5a57d2
cmp al, 0x5d
jne 0x5a57d8
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5a580f
cmp al, 0x26
ja 0x5a57f1
cmp al, 0x24
je 0x5a582e
cmp al, 0x26
je 0x5a582e
jmp 0x5a58b5
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5a582e
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5a58af
cmp al, 0x2f
je 0x5a582e
jmp 0x5a58b5
cmp al, 0x3d
ja 0x5a5826
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5a582e
cmp al, 0x3d
je 0x5a582e
jmp 0x5a58b5
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5a58a5
cmp ecx, 2
jg 0x5a5869
cmp ecx, 1
je 0x5a585e
cmp ecx, 2
jne 0x5a58b5
cmp al, 0x2f
je 0x5a584c
cmp al, 0x3b
je 0x5a584c
cmp al, 0x2c
jne 0x5a5853
mov eax, 1
jmp 0x5a5859
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5a588f
cmp al, 0x40
je 0x5a587d
cmp al, 0x2f
je 0x5a587d
cmp al, 0x3f
jne 0x5a5884
mov eax, 1
jmp 0x5a588a
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5a589f
cmp ecx, 7
jne 0x5a58b5
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5a58af
cmp al, 0x7e
jne 0x5a58b5
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5a58cd
cmp al, 0x21
je 0x5a58c7
add eax, 0xffffffd8
cmp al, 2
ja 0x5a58cd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00461ac0
jmp fcn.005a5760
Function at 0x5ad170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ad2c4
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00596bc0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5ad1da
lea eax, [0x6987c0]
mov dword [esp], eax
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x6d855f]
mov dword [eax], ecx
lea ecx, [0x73d8a4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5ad2b0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005973f0
movzx eax, byte [esp + 0x10]
test al, al
je 0x5ad27d
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
movzx esi, byte [esp + 0x1b]
xor esi, 0xffffff80
xchg esi, eax
movzx eax, al
xchg esi, eax
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x5ad1da
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x6987c0]
mov dword [esp], eax
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x6d80f5]
mov dword [eax], ecx
lea ecx, [0x73d8a4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00461ac0
jmp fcn.005ad170
Function at 0x5b8760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b898f
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00463145
lea ecx, [0x5b89a0]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005aa880
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5b8885
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5b885c
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005aa880
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5b88e2
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5b88b7
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5b8907
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x5b898b
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x5b898b
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x6ae320]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00408f50
mov eax, dword [esp + 8]
lea ecx, [0x73dc8c]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.00461ac0
jmp fcn.005b8760
Function at 0x61d6f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61d919
sub esp, 0x6c
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0046314b
mov ecx, dword [esp + 0x70]
mov dword [esp], ecx
mov dword [esp + 4], 0xf
call fcn.00626e00
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
lea edi, [esp + 0x58]
lea esi, [esp + 8]
call fcn.0046362e
lea edi, [esp + 0x44]
lea esi, [esp + 0x58]
call fcn.0046362e
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x61d905
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x70]
movzx edx, byte [ecx + 8]
test dl, dl
je 0x61d775
xor eax, eax
jmp 0x61d85c
movzx edx, byte [ecx + 9]
test dl, dl
je 0x61d7f2
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x3c], eax
lea eax, [0x6a6b60]
mov dword [esp], eax
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword [eax], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [0x91eb10]
mov edx, dword [esp + 0x40]
test ecx, ecx
jne 0x61d7e2
mov dword [eax + 8], edx
jmp 0x61d85c
lea edi, [eax + 8]
mov ecx, eax
mov eax, edx
call fcn.00462ed0
mov eax, ecx
jmp 0x61d85c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x34], eax
lea eax, [0x6a6b60]
mov dword [esp], eax
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [0x91eb10]
mov edx, dword [esp + 0x34]
test ecx, ecx
jne 0x61d84e
mov dword [eax + 8], edx
jmp 0x61d85c
lea edi, [eax + 8]
mov ecx, eax
mov eax, edx
call fcn.00462ed0
mov eax, ecx
mov dword [esp + 0x28], eax
lea ecx, [0x6a6be0]
mov dword [esp], ecx
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [eax + 0x10], edx
mov edx, dword [0x91eb10]
test edx, edx
jne 0x61d893
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
jmp 0x61d8ad
lea edi, [eax + 0xc]
mov edx, eax
mov eax, ecx
call fcn.00462ed0
lea edi, [edx + 8]
mov eax, dword [esp + 0x28]
call fcn.00462ed0
mov eax, edx
test eax, eax
jne 0x61d8c3
lea eax, [0x6a6be0]
mov dword [esp], eax
call fcn.0040b7c0
mov eax, dword [esp + 4]
mov dword [eax + 4], 4
mov ecx, dword [0x91eb10]
test ecx, ecx
jne 0x61d8de
lea ecx, [0x6c75f5]
mov dword [eax], ecx
jmp 0x61d8ed
mov edi, eax
lea eax, [0x6c75f5]
call fcn.00462ed0
mov eax, edi
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x6c
ret
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], ebx
add esp, 0x6c
ret
call fcn.00461ac0
jmp fcn.0061d6f0