joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58e240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58e3fc
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00469927
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x58e278
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x58e2a1
lea eax, [0x8d9fa0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044e6e0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00469927
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x58e2e4
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x58e2f3
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x58e302
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x58e311
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x58e320
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x58e32c
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x58e338
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x46], ax
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x38]
cmp eax, edx
jae 0x58e3a8
mov dword [esp + 0x24], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x8d9fa0]
mov dword [esp + 0x10], eax
call fcn.0044e860
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call fcn.0046a020
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00469de6
add esp, 0x5c
ret
call fcn.00468280
jmp fcn.0058e240
Function at 0x5a4390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a4501
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x5a4427
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x5a43c6
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5a4433
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x5a43f1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5a4433
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x5a4433
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.005a4180
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.005abd90
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.00468280
jmp fcn.005a4390
Function at 0x5b6010
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b6181
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5b6041
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5b6041
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5b6047
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5b6055
cmp ecx, 4
jne 0x5b6086
cmp al, 0x2c
ja 0x5b606e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5b6080
cmp al, 0x24
je 0x5b6080
cmp al, 0x26
jae 0x5b6080
jmp 0x5b6086
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5b6080
cmp al, 0x5b
je 0x5b6080
cmp al, 0x5d
jne 0x5b6086
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5b60bd
cmp al, 0x26
ja 0x5b609f
cmp al, 0x24
je 0x5b60dc
cmp al, 0x26
je 0x5b60dc
jmp 0x5b6163
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5b60dc
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5b615d
cmp al, 0x2f
je 0x5b60dc
jmp 0x5b6163
cmp al, 0x3d
ja 0x5b60d4
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5b60dc
cmp al, 0x3d
je 0x5b60dc
jmp 0x5b6163
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5b6153
cmp ecx, 2
jg 0x5b6117
cmp ecx, 1
je 0x5b610c
cmp ecx, 2
jne 0x5b6163
cmp al, 0x2f
je 0x5b60fa
cmp al, 0x3b
je 0x5b60fa
cmp al, 0x2c
jne 0x5b6101
mov eax, 1
jmp 0x5b6107
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5b613d
cmp al, 0x40
je 0x5b612b
cmp al, 0x2f
je 0x5b612b
cmp al, 0x3f
jne 0x5b6132
mov eax, 1
jmp 0x5b6138
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5b614d
cmp ecx, 7
jne 0x5b6163
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5b615d
cmp al, 0x7e
jne 0x5b6163
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5b617b
cmp al, 0x21
je 0x5b6175
add eax, 0xffffffd8
cmp al, 2
ja 0x5b617b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00468280
jmp fcn.005b6010
Function at 0x5c20e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c2230
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.0056fd50
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5c2148
lea eax, [0x8f2320]
mov dword [esp], eax
call fcn.0040c320
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x97f9f8]
mov dword [eax], ecx
lea ecx, [0xa2d758]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5c221c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005703a0
movzx eax, byte [esp + 0x10]
test al, al
je 0x5c21e9
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5c2148
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x8f2320]
mov dword [esp], eax
call fcn.0040c320
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x97f0cb]
mov dword [eax], ecx
lea ecx, [0xa2d758]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00468280
jmp fcn.005c20e0
Function at 0x5ccf50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cd17d
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00469925
lea ecx, [0x5cd190]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005bf580
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 8]
mov dword [esp + 0x24], edx
xor eax, eax
jmp 0x5cd073
mov dword [esp + 0x14], eax
mov ecx, dword [edx + eax*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
cmp eax, ecx
jl 0x5cd04a
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005bf580
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5cd0d0
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5cd0a5
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5cd0f5
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x5cd179
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x5cd179
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x91c320]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00409930
mov eax, dword [esp + 8]
lea ecx, [0xa2e1bc]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.00468280
jmp fcn.005ccf50
Function at 0x5d9680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d9762
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5d96d1
mov edx, dword [esp + 0x18]
movzx ebx, byte [edx + ecx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x5d96bb
mov eax, ecx
jmp 0x5d96c2
mov eax, ecx
mov ecx, 0x100
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
sar ebp, 0x1f
xor edi, edi
jmp 0x5d9714
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
movzx eax, byte [eax + edx - 1]
mov ecx, esi
and esi, ebx
and eax, ecx
xor esi, eax
xchg esi, ebx
not ebx
xchg esi, ebx
inc edi
movzx eax, byte [esp + 0xb]
and eax, esi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jle 0x5d972f
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub eax, edi
lea ecx, [eax - 1]
sub esi, edi
mov ebp, dword [esp + 0x1c]
cmp ebp, ecx
ja 0x5d96e2
jmp 0x5d9758
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ecx
mov ecx, ebp
call fcn.004696f0
nop
call fcn.00468280
jmp fcn.005d9680
Function at 0x5e2650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e27bf
sub esp, 0x64
lea edi, [esp + 0x6c]
xor eax, eax
call fcn.00469919
lea edi, [esp + 8]
call fcn.00469919
mov ecx, dword [esp + 0x68]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.0046e050
mov ecx, dword [esp + 4]
test ecx, ecx
setne cl
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x68]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xc4]
mov ebx, dword [ecx + 0xc8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x74]
mov ebx, dword [ecx + 0x78]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x36]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x50]
mov ebx, dword [ecx + 0x54]
mov ebp, dword [ecx + 0x58]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x68]
mov ebx, dword [ecx + 0x6c]
mov ebp, dword [ecx + 0x70]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x48]
mov ebp, dword [ecx + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x38]
mov ebx, dword [ecx + 0x3c]
mov ebp, dword [ecx + 0x40]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x5e2742
movzx eax, byte [ecx + 0x34]
test al, al
je 0x5e278b
cmp word [ecx + 0x28], 0x304
je 0x5e278b
movzx eax, byte [ecx + 0x9c]
test al, al
je 0x5e2771
lea eax, [ecx + 0xa9]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x5e278b
lea eax, [ecx + 0xb5]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x5e27a4
lea eax, [0x9adb80]
mov dword [esp + 0x60], eax
jmp 0x5e27ae
mov eax, dword [ecx + 0x80]
mov dword [esp + 0x60], eax
lea edi, [esp + 0x6c]
lea esi, [esp + 8]
call fcn.00469d5a
add esp, 0x64
ret
call fcn.00468280
jmp fcn.005e2650
Function at 0x606bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xe11d80]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x606d58
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x606bdc
movzx ecx, byte [esp + 0x80]
jmp 0x606be9
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x606c21
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x606d3f
cmp cl, 0xe4
je 0x606c00
cmp ax, 0x303
jmp 0x606c25
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x606cb3
cmp cl, 0xe3
jne 0x606c7d
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.00469dbe
call fcn.00606890
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.0048c1a0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x8d9c60]
mov dword [esp], eax
lea eax, [0xa2c828]
mov dword [esp + 4], eax
call fcn.00438c00
nop
call fcn.00468280
jmp fcn.00606bb0
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
mov ecx, 0xb022364
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x28386d7e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x49f100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b9a1b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.adobe::nglcontroller::AMTLegacyProfile.0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
mov byte [ebp - 4], 2
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
push 0x28
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00650ded
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov word [edi + 0x50], ax
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], 0xf
mov byte [edi + 0x54], al
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], 0xf
mov byte [edi + 0x6c], al
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], 0xf
mov byte [edi + 0x84], al
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], 0xf
mov byte [edi + 0x9c], al
mov byte [ebp - 4], 7
mov dword [edi + 0xb4], eax
mov dword [edi + 0xb8], eax
mov dword [edi + 0xbc], eax
mov word [edi + 0xc0], ax
mov dword [edi + 0xc4], 2
mov word [edi + 0xc8], ax
mov byte [edi + 0xca], al
cmp dword [ebx + 0x10], eax
je 0x49f248
push ebx
mov ecx, edi
call fcn.0049f480
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a5950
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ba5b9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x7c
mov eax, dword [0x7e500c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4a59b6
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x88]
call fcn.004382a0
lea eax, [ebp - 0x70]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4a59ee
mov eax, dword [ecx]
lea edx, [ebp - 0x70]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x4c], eax
push 0x40
mov byte [ebp - 4], 5
call fcn.00650ded
mov esi, eax
add esp, 4
lea eax, [ebp - 0x70]
mov dword [esi + 0x10], 0
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ebp - 0x88]
push eax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x78]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.004ccff0
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
push 0
push esi
push 0x4ca070
push 0
push 0
call fcn.0067da1c
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4a5af6
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 8
call fcn.004a5ba0
lea ecx, [ebp - 0x1c]
call fcn.004a35b0
cmp dword [ebp - 0x18], 0
jne 0x4a5b04
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4a5aa7
mov edx, dword [ecx]
lea eax, [ebp - 0x48]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x24], 0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x4a5ad7
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a5acd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a5b09
push edx
push ecx
call fcn.0065106e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00650ddc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x1c
push 6
mov dword [ebp - 0x18], 0
call fcn.00654cd3
call fcn.006708f3
call fcn.0066bea5
int3