joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44470b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov cl, byte [esi]
movsx eax, cl
cmp eax, 0x30
jg 0x44480b
cmp eax, 0x2e
jge 0x44482c
cmp eax, 0x27
jg 0x444779
cmp eax, 0x26
jge 0x44482c
cmp eax, 0x21
jl 0x44474d
cmp eax, 0x22
jle 0x44482c
cmp eax, 0x24
je 0x44482c
cmp cl, 0x80
jae 0x444881
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
mov edi, dword [sym.imp.MSVCRT.dll__isctype]
cmp dword [eax], 1
jle 0x44482f
movzx eax, cl
push 4
push eax
call edi
pop ecx
pop ecx
jmp 0x444840
cmp eax, 0x2a
jl 0x44474d
cmp eax, 0x2c
jle 0x44482c
cmp eax, 0x2d
jne 0x44474d
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
mov edx, eax
xor edx, 0x80
sub edx, 0x80
cmp edx, 0xffffffff
je 0x444878
cmp cl, 0x80
jae 0x4447df
mov ecx, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [ecx], 1
jle 0x4447ca
push 0x107
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x4447db
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
mov ecx, dword [ecx]
mov ax, word [ecx + eax*2]
and eax, 0x107
test eax, eax
jne 0x4447f8
mov al, byte [esi]
cmp al, 0x5f
je 0x4447f8
mov ecx, dword [sym.ruby187g.exc_re_mbctab]
movzx eax, al
cmp byte [eax + ecx], 0
je 0x444878
movzx eax, byte [esi]
mov ecx, dword [sym.ruby187g.exc_re_mbctab]
movzx eax, byte [eax + ecx]
lea esi, [esi + eax + 1]
jmp 0x444878
cmp eax, 0x3a
jl 0x44474d
cmp eax, 0x40
jle 0x44482c
cmp eax, 0x5c
je 0x44482c
cmp eax, 0x60
je 0x44482c
cmp eax, 0x7e
jne 0x44474d
inc esi
jmp 0x444878
movzx eax, cl
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
mov ecx, dword [ecx]
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
je 0x444881
mov al, byte [esi + 1]
inc esi
cmp al, 0x80
jae 0x444878
mov ecx, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [ecx], 1
jle 0x444863
movzx eax, al
push 4
push eax
call edi
pop ecx
pop ecx
jmp 0x444874
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movzx eax, al
mov ecx, dword [ecx]
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
jne 0x444844
xor eax, eax
cmp byte [esi], al
sete al
jmp 0x444883
xor eax, eax
pop edi
pop esi
ret

Function at 0x4467b6
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [sym.ruby187g.exc_rb_curr_thread]
push esi
push edi
mov edi, dword [0x496e88]
test edi, edi
je 0x4467ff
mov eax, dword [ecx + 0x84]
mov edx, 0x4000
mov esi, eax
and esi, edx
je 0x4467e2
cmp dword [sym.ruby187g.exc_ruby_safe_level], 4
jl 0x4467ff
test esi, esi
je 0x4467ec
push edi
call sym.ruby187g.exc_rb_exc_jump
or eax, edx
mov dword [ecx + 0x84], eax
push dword [0x496e88]
call sym.ruby187g.exc_rb_exc_raise
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str._FATAL__failed_to_allocate_memory_n
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x44681d
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jge 0x446838
push str.negative_allocation_size__or_too_big_
push dword [sym.ruby187g.exc_rb_eNoMemError]
call sym.ruby187g.exc_rb_raise
jne 0x44683d
push 1
pop esi
cmp dword [sym.ruby187g.exc_ruby_gc_stress], 0
jne 0x446855
mov eax, dword [0x497eb0]
add eax, esi
cmp eax, dword [0x48730c]
jbe 0x44685a
call fcn.0044712d
call sym.ruby187g.exc_rb_w32_enter_critical
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push esi
call ebx
pop ecx
mov edi, eax
call sym.ruby187g.exc_rb_w32_leave_critical
test edi, edi
jne 0x446892
call fcn.0044712d
call sym.ruby187g.exc_rb_w32_enter_critical
push esi
call ebx
pop ecx
mov edi, eax
call sym.ruby187g.exc_rb_w32_leave_critical
test edi, edi
jne 0x446892
jmp sym.ruby187g.exc_rb_memerror
add dword [0x497eb0], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x44694d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [esp + 4], 0
je 0x446969
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [esp + 4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp sym.ruby187g.exc_rb_w32_leave_critical
ret
Function at 0x4472aa
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x497ecc]
push ebx
cmp dword [0x497ed0], eax
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_malloc]
jne 0x447311
add eax, 0xa
mov dword [0x497ecc], eax
lea esi, [eax + eax*2]
shl esi, 2
call sym.ruby187g.exc_rb_w32_enter_critical
cmp dword [0x497ed0], 0
push esi
jle 0x4472f9
push dword [0x496ea0]
call dword [sym.imp.MSVCRT.dll_realloc]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x447303
mov dword [0x496ea0], esi
jmp 0x447303
call edi
pop ecx
mov dword [0x496ea0], eax
mov esi, eax
call sym.ruby187g.exc_rb_w32_leave_critical
test esi, esi
jne 0x447311
jmp sym.ruby187g.exc_rb_memerror
mov ebx, 0x2710
call sym.ruby187g.exc_rb_w32_enter_critical
mov eax, dword [0x487310]
lea eax, [eax + eax*4 + 5]
shl eax, 2
push eax
call edi
pop ecx
mov esi, eax
call sym.ruby187g.exc_rb_w32_leave_critical
test esi, esi
jne 0x44734b
cmp dword [0x487310], ebx
je 0x447346
mov dword [0x487310], ebx
jmp 0x447316
jmp sym.ruby187g.exc_rb_memerror
mov eax, dword [0x497ed0]
mov ecx, dword [0x496ea0]
push 0x14
xor edx, edx
lea eax, [eax + eax*2]
mov dword [ecx + eax*4], esi
mov eax, esi
pop ecx
div ecx
test edx, edx
jne 0x447371
inc dword [0x487310]
jmp 0x447378
push 0x14
pop eax
sub eax, edx
add esi, eax
mov eax, dword [0x497ed0]
mov ecx, dword [0x496ea0]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 + 4], esi
mov eax, dword [0x497ed0]
mov edx, dword [0x496ea0]
mov ecx, dword [0x487310]
lea eax, [eax + eax*2]
mov dword [edx + eax*4 + 8], ecx
mov eax, dword [0x487310]
lea eax, [eax + eax*4]
lea edi, [esi + eax*4]
mov eax, dword [0x496e94]
test eax, eax
je 0x4473ba
cmp eax, esi
jbe 0x4473c0
mov dword [0x496e94], esi
cmp dword [0x497eac], edi
jae 0x4473ce
mov dword [0x497eac], edi
fild dword [0x487310]
inc dword [0x497ed0]
fmul qword [0x476da8]
call sub.MSVCRT.dll__ftol
test eax, eax
mov dword [0x487310], eax
jg 0x4473f4
mov dword [0x487310], ebx
cmp esi, edi
jae 0x44740e
and dword [esi], 0
mov eax, dword [0x497ec4]
mov dword [esi + 4], eax
mov dword [0x497ec4], esi
add esi, 0x14
jmp 0x4473f4
pop edi
pop esi
pop ebx
ret

Function at 0x447b74
Capabilities:
Terminate process

Disassembly:
cmp dword [sym.ruby187g.exc_rb_gc_stack_start], 0
jne 0x447b85
push 0
call sym.ruby187g.exc_Init_stack
pop ecx
jmp fcn.004472aa

Function at 0x453425
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x48860c]
jne 0x453432
call fcn.00453466
mov eax, dword [0x499b54]
mov ecx, dword [eax]
add dword [0x499b54], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and ax, 0xdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x453466
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x499b68], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x499194
jne 0x453484
push 0x1571
call fcn.00453537
pop ecx
mov dword [0x48860c], 0x270
mov dword [0x499b54], esi
mov dword [esp + 0x10], 0xe3
mov edi, 0x7ffffffe
mov ecx, 0x9908b0df
mov edx, dword [esi]
mov ebp, dword [esi + 4]
lea eax, [esi + 4]
mov ebx, edx
xor ebx, ebp
and ebx, edi
xor ebx, edx
mov edx, ebp
and dl, 1
shr ebx, 1
neg dl
sbb edx, edx
and edx, ecx
xor ebx, edx
xor ebx, dword [eax + 0x630]
dec dword [esp + 0x10]
mov dword [esi], ebx
mov esi, eax
jne 0x4534a6
mov dword [esp + 0x10], 0x18c
mov edx, dword [esi]
mov ebp, dword [esi + 4]
lea eax, [esi + 4]
mov ebx, edx
xor ebx, ebp
and ebx, edi
xor ebx, edx
mov edx, ebp
and dl, 1
shr ebx, 1
neg dl
sbb edx, edx
and edx, ecx
xor ebx, edx
xor ebx, dword [esi - 0x38c]
dec dword [esp + 0x10]
mov dword [esi], ebx
mov esi, eax
jne 0x4534dd
mov eax, dword [esi]
mov edx, dword [0x499194]
mov ebx, eax
xor ebx, edx
and dl, 1
and ebx, edi
pop edi
xor ebx, eax
shr ebx, 1
neg dl
sbb edx, edx
and edx, ecx
xor ebx, edx
xor ebx, dword [esi - 0x38c]
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x453537
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 1
pop esi
mov dword [0x499194], eax
mov edx, esi
mov eax, 0x499194
mov ecx, dword [eax]
add eax, 4
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
inc edx
mov dword [eax], edi
cmp eax, 0x499b50
jl 0x45354c
mov dword [0x48860c], esi
mov dword [0x499b68], esi
pop edi
pop esi
ret

Function at 0x4554c8
Capabilities:
Terminate process

Disassembly:
push dword [sym.ruby187g.exc_ruby_copyright]
call dword [sym.imp.MSVCRT.dll_puts]
pop ecx
push 0
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x45f04b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
movzx eax, byte [ebx]
shl eax, 1
je 0x45f061
inc ebx
mov byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 8
jl 0x45f059
lea eax, [ebp - 0x10]
push eax
call sym.ruby187g.exc_des_setkey
test eax, eax
pop ecx
jne 0x45f16c
mov edi, dword [ebp + 0xc]
mov esi, 0x49b688
cmp byte [edi], 0x5f
je 0x45f099
push 2
mov dword [ebp + 8], 0x19
pop eax
jmp 0x45f121
cmp byte [ebx], 0
je 0x45f0e2
push 1
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebp - 0x10]
push eax
call sym.ruby187g.exc_des_cipher
add esp, 0x10
test eax, eax
jne 0x45f16c
xor ecx, ecx
movzx eax, byte [ebx]
shl eax, 1
je 0x45f0c4
inc ebx
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 8
jl 0x45f0bc
lea eax, [ebp - 0x10]
push eax
call sym.ruby187g.exc_des_setkey
test eax, eax
pop ecx
jne 0x45f16c
jmp 0x45f099
mov al, byte [edi]
push 3
inc edi
and dword [ebp + 8], 0
mov byte [0x49b688], al
pop ecx
movzx eax, byte [ecx + edi]
test eax, eax
jne 0x45f0fc
push 0x2e
pop eax
mov edx, dword [ebp + 8]
mov byte [ecx + 0x49b689], al
movzx eax, byte [eax + 0x49d360]
shl edx, 6
or eax, edx
dec ecx
mov dword [ebp + 8], eax
jns 0x45f0f1
push 4
mov esi, 0x49b68d
pop eax
add edi, eax
mov dword [ebp + 0xc], eax
xor ebx, ebx
dec eax
test eax, eax
jl 0x45f150
lea ecx, [esi + eax]
sub edi, esi
lea edx, [eax + 1]
movzx eax, byte [edi + ecx]
test eax, eax
jne 0x45f13e
push 0x2e
pop eax
mov byte [ecx], al
movzx eax, byte [eax + 0x49d360]
shl ebx, 6
or ebx, eax
dec ecx
dec edx
jne 0x45f133
push dword [ebp + 8]
add esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push ebx
push eax
push 0x49b680
call sym.ruby187g.exc_des_cipher
add esp, 0x10
test eax, eax
je 0x45f173
xor eax, eax
jmp 0x45f257
movzx ecx, byte [ebp - 7]
xor eax, eax
push 0x3f
mov ah, byte [ebp - 8]
or eax, ecx
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, ecx
pop ecx
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 3], dl
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 2], dl
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 1], dl
mov al, byte [eax + 0x489310]
mov byte [esi], al
add esi, 4
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 4]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 3]
shl eax, 8
or eax, edx
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 3], dl
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 2], dl
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 1], dl
mov al, byte [eax + 0x489310]
mov byte [esi], al
add esi, 4
movzx eax, byte [ebp - 2]
movzx edx, byte [ebp - 1]
shl eax, 8
or eax, edx
shl eax, 2
mov edx, eax
and edx, ecx
sar eax, 6
mov dl, byte [edx + 0x489310]
mov byte [esi + 2], dl
mov edx, eax
and edx, ecx
sar eax, 6
mov cl, byte [edx + 0x489310]
mov byte [esi + 1], cl
mov al, byte [eax + 0x489310]
and byte [esi + 3], 0
mov byte [esi], al
mov eax, 0x49b688
pop edi
pop esi
pop ebx
leave
ret
Function at 0x460967
Capabilities:
Terminate process

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
push dword [esp + 0x10]
call fcn.00460992
add esp, 0x10
test eax, eax
je 0x460991
cmp eax, 0xffffffff
jne 0x46098b
jmp sym.ruby187g.exc_rb_memerror
push eax
call sym.ruby187g.exc_rb_jump_tag
ret

Function at 0x46159d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
call sym.ruby187g.exc_rb_ary_new
mov ebx, eax
lea eax, [ebp + 8]
push eax
call sym.ruby187g.exc_rb_string_value
push dword [ebp + 8]
call sym.ruby187g.exc_rb_check_safe_obj
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], edi
jle 0x461615
mov eax, dword [ecx + 0xc]
push dword [ebp + 0xc]
add eax, edi
push eax
push ebx
call fcn.0046162c
add esp, 0xc
test eax, eax
jne 0x46161c
mov eax, dword [ebp + 8]
cmp edi, dword [eax + 8]
jge 0x461615
mov esi, dword [eax + 0xc]
add esi, edi
push esi
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [esi + eax + 1]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov esi, dword [ecx + 8]
lea edi, [edx + esi]
cmp eax, edi
jae 0x46160d
cmp byte [eax], 0
jne 0x46160d
inc eax
jmp 0x461601
sub eax, edx
mov edi, eax
cmp edi, esi
jl 0x4615c7
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
cmp eax, 0xffffffff
jne 0x461626
jmp sym.ruby187g.exc_rb_memerror
push eax
call sym.ruby187g.exc_rb_jump_tag

Function at 0x461675
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call sym.ruby187g.exc_rb_ary_new
xor ebx, ebx
mov edi, eax
cmp dword [ebp + 8], ebx
jle 0x4616c1
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
call sym.ruby187g.exc_rb_string_value
push dword [ebp + 0xc]
call sym.ruby187g.exc_rb_check_safe_obj
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push dword [eax + 0xc]
push edi
call fcn.0046162c
add esp, 0x14
test eax, eax
jne 0x4616c8
inc ebx
add esi, 4
cmp ebx, dword [ebp + 8]
jl 0x46168c
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0xffffffff
jne 0x4616d2
jmp sym.ruby187g.exc_rb_memerror
push eax
call sym.ruby187g.exc_rb_jump_tag
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp + 0xc]
push eax
push 0x4808d4
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ruby187g.exc_rb_scan_args
add esp, 0x14
cmp eax, 2
jne 0x461713
mov eax, dword [ebp - 4]
test al, 1
je 0x46170a
sar eax, 1
mov esi, eax
jmp 0x461715
push eax
call sym.ruby187g.exc_rb_num2long
pop ecx
jmp 0x461706
xor esi, esi
push dword [ebp + 0xc]
call sym.ruby187g.exc_rb_check_array_type
cmp eax, 4
pop ecx
jne 0x461730
push esi
push dword [ebp + 0xc]
call fcn.0046159d
pop ecx
pop ecx
jmp 0x461748
mov dword [ebp + 8], eax
push esi
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.00461675
add esp, 0xc
mov esi, eax
call sym.ruby187g.exc_rb_block_given_p
test eax, eax
je 0x46175f
push esi
call sym.ruby187g.exc_rb_ary_each
pop ecx
push 4
pop eax
jmp 0x461761
mov eax, esi
pop esi
leave
ret
Function at 0x549b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c65f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00544a10
test eax, eax
jne 0x549b7c
push ebp
push 0x53d11c
mov ecx, edi
call fcn.00548d90
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.00544440
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00532da0
push ebx
mov dword [esp + 0x4c], ebp
call fcn.00544bc0
add esp, 4
test eax, eax
je 0x549c1f
add esi, 0x18
push esi
call fcn.00582dc0
add esi, eax
push esi
call fcn.00582dc0
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x549f22
jmp dword [ecx*4 + 0x44e360]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.00548ed0
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.00582dc0
add esi, eax
push esi
call fcn.00582dc0
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x549c70
mov ecx, dword [esi + 0x1c]
push ecx
call dword [fcn.004cc610]
test eax, eax
je 0x549c70
mov eax, 1
jmp 0x549c72
xor eax, eax
cmp ebx, 8
jge 0x549ed7
cmp ebx, 7
ja 0x549f22
jmp dword [ebx*4 + 0x44e370]
test eax, eax
jne 0x549eea
mov ecx, dword [esp + 0x10]
push eax
push 0x53d108
call fcn.00548d90
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.0054a430
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x523260
call fcn.00532fa0
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x552c00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x555028]
xor edx, edx
cmp eax, edx
jne 0x552c26
xor eax, eax
mov byte [eax + 0x554f28], al
inc eax
cmp eax, 0x100
jl 0x552c0e
mov dword [0x555028], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x554f28
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x552cb7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x552c8a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x552c58
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x552d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x552d83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x552d6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x557020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x557241
cmp eax, 8
jg 0x557241
cmp dword [esp + 0x8c], 2
jl 0x557241
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x557241
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x557241
mov eax, dword [esp + 0x80]
test eax, eax
je 0x5570a7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x55722a
mov ebp, dword [fcn.004cc534]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x5570d9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x557211
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x5570f9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [fcn.004cc524]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x557138
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [fcn.004cc6bc]
lea ecx, [esp + 0x28]
push ecx
call dword [fcn.004cc5d0]
test eax, eax
jne 0x5571f8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.00556630
cmp eax, 1
jne 0x557222
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00556ee0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x5570ed
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x55722a
jmp 0x5570c4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.00556230
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c