joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e37b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10
sub esi, edx
pop edi
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, dword [ebp + 0x10]
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub edi, 1
jne 0x5e37c7
pop edi
pop esi
pop ebp
ret
Function at 0x5e4c64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x134], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], ecx
test edi, edi
je 0x5e4cb8
cmp edi, dword [ebx]
je 0x5e4cb4
test eax, eax
je 0x5e4e9e
test esi, esi
js 0x5e4e9e
mov dword [ebx], edi
jmp 0x5e4cc3
cmp dword [ebx], 0
je 0x5e4e9e
mov edi, dword [ebx]
push edi
call fcn.00533435
pop ecx
test al, 2
jne 0x5e4e9e
xor eax, eax
inc eax
cmp dword [ebp - 0x128], 0
je 0x5e4e58
push edi
mov dword [ebp - 0x134], eax
call fcn.005310c8
pop ecx
mov ecx, 0x90
cmp eax, ecx
jg 0x5e4e9e
cmp eax, esi
jge 0x5e4d5d
push dword [ebp - 0x12c]
push edi
push dword [ebx + 4]
call fcn.0055c3f6
add esp, 0xc
test eax, eax
je 0x5e4e9e
push esi
push dword [ebp - 0x128]
push dword [ebx + 4]
call fcn.0055c577
add esp, 0xc
test eax, eax
je 0x5e4e9e
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x94]
push eax
push dword [ebx + 4]
call fcn.0055c36b
add esp, 0xc
test eax, eax
je 0x5e4e9e
mov esi, dword [ebp - 0x130]
jmp 0x5e4d81
cmp esi, ecx
ja 0x5e4e9e
push esi
push dword [ebp - 0x128]
lea eax, [ebp - 0x94]
push eax
call fcn.00717660
add esp, 0xc
mov dword [ebp - 0x130], esi
mov ecx, 0x90
cmp esi, ecx
je 0x5e4da5
sub ecx, esi
lea eax, [ebp - 0x94]
push ecx
add eax, esi
push 0
push eax
call fcn.00718210
add esp, 0xc
mov ecx, 0x90
xor esi, esi
mov eax, esi
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmmword [str.6666666666666666d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_sign.c]
movups xmmword [ebp + eax - 0x124], xmm0
add eax, 0x10
cmp eax, ecx
jl 0x5e4da9
push dword [ebp - 0x12c]
push edi
push dword [ebx + 8]
call fcn.0055c3f6
add esp, 0xc
test eax, eax
je 0x5e4e78
push edi
call fcn.005310c8
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 8]
call fcn.0055c577
add esp, 0x10
test eax, eax
je 0x5e4e78
mov eax, esi
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmmword [0x82c450]
movups xmmword [ebp + eax - 0x124], xmm0
add eax, 0x10
cmp eax, 0x90
jl 0x5e4e01
push dword [ebp - 0x12c]
push edi
push dword [ebx + 0xc]
call fcn.0055c3f6
add esp, 0xc
test eax, eax
je 0x5e4e78
push edi
call fcn.005310c8
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0xc]
call fcn.0055c577
add esp, 0x10
test eax, eax
je 0x5e4e78
jmp 0x5e4e5a
xor esi, esi
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0055c5a9
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
cmp dword [ebp - 0x134], 0
je 0x5e4e9a
mov ebx, 0x90
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.0054ec79
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.0054ec79
add esp, 0x10
mov eax, esi
jmp 0x5e4ea0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5fa695
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 4]
cmovge edx, edi
cmovge edi, ecx
mov dword [ebp + 0xc], edx
push dword [edi + 4]
push ebx
call fcn.00539fa7
pop ecx
pop ecx
test eax, eax
je 0x5fa708
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [eax + 4], esi
jle 0x5fa6f3
mov eax, dword [eax]
mov ecx, dword [edi]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax + 4]
jl 0x5fa6ce
jmp 0x5fa6f3
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [edi + 4]
cmp esi, eax
jl 0x5fa6e8
push ebx
mov dword [ebx + 4], eax
call fcn.00539d8b
pop ecx
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5fb422
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0x14]
xor edi, edi
call fcn.00551347
push dword [ebp + 0x14]
call fcn.0055128a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5fb601
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.00539fa7
pop ecx
pop ecx
test eax, eax
je 0x5fb600
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x5fb5de
mov edi, ecx
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x5fb470
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.00539d8b
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.005fa77a
add esp, 0x10
test eax, eax
push 1
pop eax
cmovne edi, eax
pop ebx
push dword [ebp + 0x14]
call fcn.005511ea
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x60bcc4
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shr eax, 0x10
xor eax, dword [ebp + 8]
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x618aed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
push esi
mov esi, ebx
jb 0x618b27
push edi
mov edi, ebx
xor edx, edx
lea edi, [edi + 8]
lea eax, [ebx + edi]
xor ecx, ecx
bts edx, eax
inc esi
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
cmp ebx, ecx
ja 0x618aff
jb 0x618b26
cmp dword [ebp + 8], edx
jae 0x618aff
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x626e8f
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x100
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
jne 0x626f05
mov edx, dword [ebp + 8]
movaps xmm0, xmmword [str.expand_32_byte_kexpand_16_byte_k]
movups xmmword [esi], xmm0
movd xmm0, dword [eax]
movd xmm3, dword [edx + 0x10]
movd xmm1, dword [edx]
movd xmm2, dword [edx + 0x14]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x10], xmm2
movd xmm3, dword [eax + 4]
movd xmm0, dword [edx + 4]
movd xmm1, dword [edx + 0x18]
movd xmm2, dword [ebp + 0x14]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x20], xmm2
movd xmm3, dword [edx + 8]
movd xmm0, dword [edx + 0x1c]
movd xmm2, dword [edx + 0xc]
jmp 0x626f66
mov ecx, dword [ebp + 8]
movaps xmm0, xmmword [0x83ddc0]
movups xmmword [esi], xmm0
movd xmm0, dword [eax]
movd xmm3, dword [ecx]
movd xmm1, dword [ecx]
movd xmm2, dword [ecx + 4]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x10], xmm2
movd xmm3, dword [eax + 4]
movd xmm0, dword [ecx + 4]
movd xmm1, dword [ecx + 8]
movd xmm2, dword [ebp + 0x14]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x20], xmm2
movd xmm3, dword [ecx + 8]
movd xmm0, dword [ecx + 0xc]
movd xmm2, dword [ecx + 0xc]
movd xmm1, dword [ebp + 0x18]
mov eax, esi
punpckldq xmm1, xmm3
punpckldq xmm2, xmm0
punpckldq xmm2, xmm1
movups xmmword [esi + 0x30], xmm2
pop esi
pop ebp
ret 0x14
Function at 0x627d1b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x627e36
lea eax, [ebp - 0x42c]
push eax
push 0
push 0
push 0x86f9a0
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x627da3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x430], esi
push eax
call fcn.00607ca7
lea eax, [ebp - 0x11c]
push eax
push esi
push str.Failed_to_read___AppData___path._Error___u_:__s
push 0x29
push str.d:package_cache_tact3.7.19_src_armadillo_armadillo.windows.cpp
push 4
push str.tact
call fcn.00785e68
add esp, 0x24
mov al, 1
jmp 0x627e38
xor ecx, ecx
lea eax, [ebp - 0x428]
push ecx
push ecx
push 0x30c
push eax
push 0xffffffffffffffff
push dword [ebp - 0x42c]
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x42c]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
je 0x627d9c
mov eax, 0x30c
cmp edi, eax
jl 0x627e00
push eax
push str.Path_to___AppData___is_too_long._It_exceeds__d_characters.
push 0x3a
push str.d:package_cache_tact3.7.19_src_armadillo_armadillo.windows.cpp
push 4
push str.tact
call fcn.00785e68
add esp, 0x18
jmp 0x627d9c
movaps xmm0, xmmword [str.Battle.net_Armad.index]
lea eax, [edi + 0x16]
mov dword [ebp - 0xc], 0x6f6c6c69
mov byte [ebp - 8], 0
movups xmmword [ebp - 0x1c], xmm0
cmp eax, esi
ja 0x627e36
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push ebx
call fcn.00692b8b
add esp, 0x10
xor al, al
jmp 0x627e38
mov al, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006fedff
leave
ret
Function at 0x63d14c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x6c], eax
call fcn.0068dc83
push edx
push eax
call fcn.0068dbfd
mov edi, eax
mov eax, edx
add edi, 0x9502f900
mov dword [ebp - 0x68], edi
adc eax, 0
xor bl, bl
mov dword [ebp - 0x64], eax
call fcn.0068dc83
push edx
push eax
call fcn.0068dbfd
push dword [ebp - 0x64]
push edi
push edx
push eax
call fcn.00607c5b
add esp, 0x20
test al, al
je 0x63d1d6
lea edi, [esi + 0xc]
push edi
call fcn.0068b74d
mov bl, al
pop ecx
test bl, bl
jne 0x63d1f4
call fcn.0068dc83
push edx
push eax
call fcn.0068dbfd
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push edx
push eax
call fcn.00607c5b
add esp, 0x18
test al, al
jne 0x63d1a9
push str.Failed_to_aquire_downloader_lock_while_dumping_state.
push 0x2c8
push str.d:package_cache_tact3.7.19_srcdownloaddownload_curl.cpp
push 4
push str.tact
call fcn.00785e68
add esp, 0x14
movaps xmm0, xmmword [0x8419f0]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x10], 0x6e776f44
movaps xmm0, xmmword [0x8419e0]
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0xc], 0x6325203a
movaps xmm0, xmmword [0x8419d0]
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 8], 0xa
movaps xmm0, xmmword [0x841a00]
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmmword [0x8419c0]
movups xmmword [ebp - 0x20], xmm0
mov al, byte [esi + 0x2f8]
push 0x46
pop ecx
push 0x54
pop edx
test al, al
lea eax, [ebp - 0x60]
cmovne ecx, edx
push ecx
push dword [esi + 0x178]
push dword [esi + 0x138]
push dword [esi + 0xf8]
push eax
push dword [ebp - 0x6c]
call fcn.00607dea
add esp, 0x18
test bl, bl
je 0x63d280
lea eax, [esi + 0xc]
push eax
call fcn.0068b73f
pop ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006fedff
leave
ret 4

Function at 0x63ec30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov al, byte [ecx]
inc ecx
test al, al
je 0x63ec4d
movzx eax, al
xor eax, edx
imul edx, eax, 0x1000193
jmp 0x63ec39
mov eax, edx
pop ebp
ret

Function at 0x655db5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
shr eax, cl
add ecx, 8
xor byte [edx], al
inc edx
cmp ecx, 0x20
jb 0x655dbd
pop ebp
ret
Function at 0x65c1e6
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x110], ecx
cmp dword [edi], 0xffffffff
jne 0x65c2c2
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push esi
push eax
push 0x8004667e
push ebx
mov dword [edi], ebx
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x65c27c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], esi
push eax
call fcn.00607ca7
lea eax, [ebp - 0x104]
push eax
push esi
push str.Failed_to_set_socket_non_blocking_mode._Error__d_:__s
push 0xce
push str.d:package_cache_tact3.7.19_srcdownloaddownload_curl.windows.cpp
push 4
push str.tact
call fcn.00785e68
add esp, 0x24
mov eax, dword [ebp - 0x110]
push edi
push ebx
push dword [eax + 8]
call fcn.0069ef07
mov esi, eax
add esp, 0xc
test esi, esi
je 0x65c2c0
cmp esi, 0xffffffff
je 0x65c2c0
push esi
call fcn.006a1b05
push eax
push esi
push str.curl_multi_socket_action_failed_to_update_socket._Error__d_:__s
push 0xd4
push str.d:package_cache_tact3.7.19_srcdownloaddownload_curl.windows.cpp
push 4
push str.tact
call fcn.00785e68
add esp, 0x20
pop esi
pop ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 4], eax
xor ecx, ebp
mov eax, dword [ebp + 0x14]
mov dword [edi + 8], eax
pop edi
call fcn.006fedff
leave
ret 0x10
Function at 0x65cdfc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 1
lea eax, [ebp - 0x105]
mov byte [ebp - 0x105], 1
push eax
push dword [ecx + 0x300]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x65ce7b
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], esi
push eax
call fcn.00607ca7
lea eax, [ebp - 0x104]
push eax
push esi
push str.Failed_to_preemptively_wake_worker_thread.._Error__d_:__s
push 0x149
push str.d:package_cache_tact3.7.19_srcdownloaddownload_curl.windows.cpp
push 4
push str.tact
call fcn.00785e68
add esp, 0x24
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006fedff
leave
ret

Function at 0x664d89
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x164]
test eax, eax
je 0x664db2
push eax
call fcn.0062b41e
pop ecx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov eax, dword [esi + 0x1d0]
test eax, eax
je 0x664dc9
push eax
call fcn.00657153
pop ecx
mov dword [esi + 0x1d0], ebx
lea ecx, [esi + 0x70]
call fcn.0065a143
mov byte [esi + 0x68], bl
lea ecx, [esi + 0x170]
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov word [esi + 0x134], bx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
pop esi
pop ebx
jmp fcn.0068bd1c
Function at 0x66cb1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
cmp dword [eax], edx
je 0x66cb31
push 0x11
pop eax
leave
ret
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp dword [esi + 0xc], edx
je 0x66cc4e
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x66cc4e
movzx eax, byte [esi + 4]
xor ecx, ecx
mov dword [ebp - 8], eax
xor edi, edi
add eax, edx
bts ecx, eax
cmp eax, 0x20
cmovae edi, ecx
xor ecx, edi
cmp eax, 0x40
mov eax, edi
mov edi, dword [esi + 0xc]
cmovae eax, ecx
cmp edx, eax
jb 0x66cb9e
ja 0x66cb78
cmp edi, ecx
jbe 0x66cb9e
push eax
push ecx
push edi
push str.Key_layout_count___u__exceeds_maximum___llu_
push 0x10d
push str.d:package_cachecasc1.4.49_src_static.cpp
push 4
push str.casc
call fcn.00785e68
add esp, 0x20
jmp 0x66cc6c
test edi, edi
je 0x66cbc9
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add ecx, dword [ebp - 8]
movzx esi, byte [ebx]
add ecx, eax
mov eax, esi
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
add eax, ecx
cmp eax, 0x38
jne 0x66cbe1
inc edx
add ebx, 8
cmp edx, edi
jb 0x66cba2
cmp dword [esi + 0x20], 0
jbe 0x66cc2c
cmp dword [esi + 0x20], 1
jne 0x66cbf1
push str.Aligned_cached_buffer_count_of_1_isnt_valid__it_must_be_2_or_greater
push 0x121
jmp 0x66cc58
push 0x38
push eax
push edx
push str.Key_layout__u__total_bit_count___u__isnt_expected_bit_count___u_
push 0x118
jmp 0x66cb85
mov ecx, dword [esi + 0x24]
test ecx, ecx
jne 0x66cc04
push str.Aligned_cached_buffer_size_of_0_isnt_valid
push 0x127
jmp 0x66cc58
lea eax, [ecx - 1]
test ecx, eax
je 0x66cc2c
push ecx
push str.Aligned_cached_buffer_size_must_be_a_power_of_2___u_isnt_
push 0x12e
push str.d:package_cachecasc1.4.49_src_static.cpp
push 4
push str.casc
call fcn.00785e68
add esp, 0x18
jmp 0x66cc6c
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x66cc38
call fcn.0068ba3e
push esi
lea ecx, [ebp + 0xc]
push ecx
push eax
mov ecx, eax
call fcn.0066c1bf
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x66cc6f
push str.Must_provide_at_least_1_key_bit_layout.
push 0x106
push str.d:package_cachecasc1.4.49_src_static.cpp
push 4
push str.casc
call fcn.00785e68
add esp, 0x14
push 0xa
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x66e81a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
mov edi, dword [esi + 0x3c]
mov eax, dword [esi + 0x4c]
lea eax, [edi + eax*8]
mov dword [ebp + 8], eax
cmp edi, eax
je 0x66e88a
add ecx, 0x24
mov dword [ebp + 0x10], ecx
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00665f70
test eax, eax
je 0x66e87f
mov eax, dword [eax + 8]
cmp dword [eax + 0x38], esi
jne 0x66e867
add eax, 0x20
jmp 0x66e86f
cmp dword [eax + 0x78], esi
jne 0x66e87f
add eax, 0x60
push ebx
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
call fcn.0066ebe5
mov ecx, dword [ebp + 0x10]
add edi, 8
cmp edi, dword [ebp + 8]
jne 0x66e842
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x38]
mov dword [esi + 0x28], eax
call fcn.004fac18
xor ecx, ecx
mov byte [esi + 0x2e], cl
mov eax, dword [0x848428]
mov dword [esi + 0x30], eax
mov eax, dword [0x84842c]
mov dword [esi + 0x34], eax
cmp byte [esi + 0x2d], cl
jne 0x66e8b6
test bl, bl
je 0x66e8c9
mov word [esi + 0x2c], cx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x28], ecx
lea eax, [esi + 0x54]
push eax
call fcn.00693854
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x66f35b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 8
push 0x80
mov eax, 0x7aa4eb
call fcn.007000c1
mov esi, ecx
mov dword [ebp - 0x6c], esi
mov eax, dword [ebx + 8]
and dword [ebp - 0x60], 0
mov dword [ebp - 0x70], eax
mov eax, dword [esi]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], reloc.WS2_32.dll_htonl
mov edi, dword [esi + 0x18]
and dword [ebp - 4], 0
add edi, 0xc
push edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x8c], edi
call fcn.0068b721
add esi, 0x1c
mov byte [ebp - 4], 1
push esi
mov dword [ebp - 0x7c], esi
call fcn.00691ea4
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x84], ecx
lea eax, [ecx + eax*8]
mov dword [ebp - 0x74], eax
cmp ecx, eax
je 0x66f44b
mov ecx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x84]
add ecx, 0x24
mov esi, dword [ebp - 0x70]
mov dword [ebp - 0x78], ecx
mov eax, dword [edi]
mov dword [ebp - 0x88], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x88]
push eax
call fcn.00665f70
test eax, eax
je 0x66f409
mov eax, dword [eax + 8]
jmp 0x66f40b
xor eax, eax
test eax, eax
je 0x66f43a
cmp dword [eax + 0x18], 0
je 0x66f43a
cmp dword [eax + 0x38], 0
je 0x66f420
cmp dword [eax + 0x38], esi
jne 0x66f43a
cmp dword [eax + 0x78], 0
je 0x66f42b
cmp dword [eax + 0x78], esi
jne 0x66f43a
cmp byte [eax + 0x48], 0
je 0x66f43a
push eax
lea ecx, [ebp - 0x68]
call fcn.0064bb3b
mov ecx, dword [ebp - 0x78]
add edi, 8
cmp edi, dword [ebp - 0x74]
jne 0x66f3e3
mov esi, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x80]
push dword [ebx + 0x10]
mov ecx, dword [ebp - 0x6c]
push dword [ebx + 0xc]
push dword [ebp - 0x70]
call fcn.0066e81a
push esi
call fcn.00691eb2
push edi
mov byte [ebp - 4], 2
call fcn.0068b73f
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0
mov eax, dword [eax + 0x18]
add eax, 0x10
push eax
call fcn.00693f3e
mov edi, dword [ebp - 0x64]
add esp, 0xc
mov eax, dword [ebp - 0x60]
lea eax, [edi + eax*8]
mov dword [ebp - 0x74], eax
cmp edi, eax
je 0x66f508
mov eax, dword [ebp - 0x6c]
add eax, 0x24
mov dword [ebp - 0x80], eax
push esi
call fcn.00691ea4
pop ecx
mov ecx, dword [ebp - 0x80]
push edi
call fcn.00665f70
test eax, eax
je 0x66f4b4
mov eax, dword [eax + 8]
jmp 0x66f4b6
xor eax, eax
test eax, eax
jne 0x66f4cb
push esi
mov byte [ebp - 4], 3
call fcn.00691eb2
pop ecx
mov byte [ebp - 4], 0
jmp 0x66f500
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], eax
push esi
mov byte [ebp - 4], 4
call fcn.00691eb2
pop ecx
mov ecx, dword [ebp - 0x7c]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x66f500
push dword [edi + 4]
mov eax, dword [ebp - 0x6c]
push dword [edi]
push dword [eax + 4]
push dword [ebp - 0x78]
call ecx
add esp, 0x10
add edi, 8
cmp edi, dword [ebp - 0x74]
jne 0x66f49b
lea ecx, [ebp - 0x68]
call fcn.0060a124
mov ecx, dword [ebp - 0x14]
call fcn.0070009c
ret 0xc
Function at 0x675d8f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
movzx eax, byte [edx + esi]
xor ecx, eax
inc edx
cmp edx, 9
jb 0x675d9a
mov eax, ecx
shr eax, 4
xor eax, ecx
movzx ecx, byte [ebp + 0xc]
add eax, ecx
and eax, 0xf
pop esi
pop ebp
ret