joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ccf80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cd0ea
sub esp, 0x40
mov eax, dword [esp + 0x70]
cmp eax, 4
jne 0x4cd0e1
mov ecx, dword [esp + 0x6c]
cmp dword [ecx], 0x6c616964
je 0x4cd086
mov edx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], edx
mov ebp, dword [esp + 0x4c]
mov dword [esp], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004ccdc0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
call fcn.004d1900
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
add esp, 0x40
ret
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4cd0ac
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4ccfb6
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
call eax
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4ccfbe
mov ecx, dword [esp + 0x6c]
jmp 0x4ccfb6
call fcn.0045b380
jmp fcn.004ccf80
Function at 0x4ed860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x4eda71
sub esp, 0x84
mov byte [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea eax, [esp + 0x74]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 0
call fcn.004dd910
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov byte [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
xor ebp, ebp
lea esi, [esp + 0x44]
lea edi, [esp + 0x54]
lea ebp, [esp + 0x64]
mov dword [esp + 0x3c], ebp
xor ebp, ebp
jmp 0x4eda1c
mov ebp, dword [esp + 0x2c]
inc ebp
shl ebx, 1
mov dword [esp + 0x2c], ebp
mov esi, edx
mov edi, ecx
mov dword [esp + 0x3c], eax
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
cmp ebx, 8
jge 0x4eda05
mov byte [esp + 0x2b], al
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.004ed020
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx ebx, byte [esp + 0x2b]
test bl, 0x80
je 0x4ed949
mov ebx, dword [esp + 0x88]
mov dword [esp], ebx
mov ebp, dword [esp + 0x8c]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x90]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.004eba60
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x2b]
jmp 0x4ed949
inc ebp
mov eax, dword [esp + 0x94]
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x94]
cmp ebp, ecx
jge 0x4eda3c
mov dword [esp + 0x30], ebp
movzx eax, byte [ebx + ebp]
mov byte [esp + 0x34], al
xor eax, eax
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 0x34]
jmp 0x4ed977
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.004eb7d0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
add esp, 0x84
ret
call fcn.0045b380
jmp fcn.004ed860
Function at 0x4f6d20
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f6f3d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4f6dd7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4f6e50
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4f6db8
cmp ecx, 0xf
jne 0x4f6ec9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4f6db8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4f6db8
call fcn.0045b380
jmp fcn.004f6d20
Function at 0x4fe3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fe5db
sub esp, 0x6c
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x4fe5ca
nop
movzx edx, byte [0x7cd2e8]
test dl, dl
je 0x4fe5be
mov dword [0x7cd2ec], ecx
mov edx, dword [0x7e34e0]
test edx, edx
jne 0x4fe5a7
mov eax, dword [esp + 0x80]
mov dword [0x7cd2f0], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4fe59c
nop
movzx edx, byte [ecx + 0xf]
mov ebx, edx
and edx, 0x1f
test bl, 0x20
jne 0x4fe46f
or edx, 0x80
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00488aa0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x40], edx
mov ebx, dword [esp + 0x84]
mov dword [esp], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 4], ebx
call fcn.004fe5f0
lea esi, [esp + 8]
lea edi, [esp + 0x54]
call fcn.0045d094
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
lea edi, [esp + 0x1c]
lea esi, [esp + 0x54]
call fcn.0045d094
call fcn.004fb590
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
test ecx, ecx
jne 0x4fe569
mov ecx, dword [esp + 0x74]
cmp eax, ecx
ja 0x4fe5d5
mov edx, dword [esp + 0x78]
sub edx, eax
mov ebx, edx
neg edx
sar edx, 0x1f
and edx, eax
mov ebp, dword [esp + 0x70]
add edx, ebp
mov dword [esp + 0x8c], edx
sub ecx, eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
add esp, 0x6c
ret
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x6c
ret
xor edx, edx
xor ecx, ecx
xor eax, eax
jmp 0x4fe46f
lea edi, [0x7cd2f0]
mov eax, dword [esp + 0x80]
call fcn.0045c920
jmp 0x4fe446
mov eax, dword [esp + 0x80]
jmp 0x4fe446
xor edx, edx
xor ecx, ecx
xor eax, eax
jmp 0x4fe46f
call fcn.0045ca00
nop
call fcn.0045b380
jmp fcn.004fe3f0
Function at 0x51fe60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x520024
sub esp, 0x34
lea eax, [0x63f540]
mov dword [esp], eax
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x51feff
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edi, dword [esp + 0x2c]
mov ebx, edi
cmp esi, edx
jge 0x51fedc
cmp eax, ebp
jle 0x51fedc
jbe 0x52001a
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x51fe97
jmp 0x520011
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
je 0x51ffd2
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ecx, ebp
jge 0x52000d
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x51fec0
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x51fef7
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x51fef7
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x51fef7
add esp, 0x34
ret
mov eax, esi
mov ecx, edx
call fcn.0045c9a0
mov ecx, eax
mov eax, ebp
call fcn.0045c9a0
nop
call fcn.0045b380
jmp fcn.0051fe60
Function at 0x526840
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5268e8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5268af
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x526899
call fcn.0045b380
jmp fcn.00526840
Function at 0x52dd20
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52ded5
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x52dd49
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x52dd43
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x52dd43
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x52dec7
cmp al, 0x2c
ja 0x52dea4
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x52dd7d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x52dd77
cmp al, 0x26
jae 0x52dd77
cmp al, 0x2f
ja 0x52de6a
cmp al, 0x26
ja 0x52de42
cmp al, 0x24
jne 0x52de37
cmp ecx, 2
jg 0x52ddfb
cmp ecx, 1
je 0x52ddf0
cmp ecx, 2
jne 0x52ddd2
cmp al, 0x2f
jne 0x52ddc0
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x52ddb6
cmp al, 0x2c
je 0x52ddb6
cmp al, 0x3f
sete al
jmp 0x52ddbb
cmp ecx, 7
jne 0x52ddea
cmp al, 0x21
jne 0x52dde2
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x52dddc
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x52de21
cmp al, 0x40
jne 0x52de0f
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x52de05
cmp al, 0x3f
je 0x52de05
cmp al, 0x3a
sete al
jmp 0x52de0a
cmp ecx, 6
je 0x52de31
cmp ecx, 7
jne 0x52ddd2
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x52dda2
jmp 0x52ddd2
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x52dda2
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x52de5c
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x52dda2
jmp 0x52ddd2
cmp al, 0x3d
ja 0x52de89
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x52dda2
cmp al, 0x3d
je 0x52dda2
jmp 0x52ddd2
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x52dda2
cmp al, 0x5f
je 0x52de56
cmp al, 0x7e
je 0x52de56
jmp 0x52ddd2
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x52dd77
cmp al, 0x5b
je 0x52dd77
cmp al, 0x5d
je 0x52dd77
jmp 0x52dd87
cmp ecx, 4
je 0x52dd66
jmp 0x52dd87
call fcn.0045b380
jmp fcn.0052dd20
Function at 0x541be0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x541dc4
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov ebx, edx
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, edx
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
mov esi, edx
shl edx, 0x18
or edx, ecx
and edx, 0xfffffff
movzx ecx, byte [eax + 4]
movzx edi, byte [eax + 5]
mov dword [esp + 4], edi
movzx edi, byte [eax + 6]
movzx eax, byte [eax + 7]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [eax + 0x18], edx
shr ebx, 0x18
shr ebp, 0x10
or ebx, ebp
shr esi, 8
or ebx, esi
or ecx, ebx
mov edx, dword [esp + 4]
shl edx, 8
or ecx, edx
shl edi, 0x10
or edi, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edi, ecx
and edi, 0xffffffc
mov dword [eax + 0x1c], edi
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 8]
movzx ebx, byte [ecx + 9]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0xa]
mov esi, ebx
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [ecx + 0xb]
mov edi, ebx
shl ebx, 0x18
or edx, ebx
and edx, 0xffffffc
movzx ebx, byte [ecx + 0xc]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0xd]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0xe]
movzx ecx, byte [ecx + 0xf]
mov dword [eax + 0x20], edx
shr ebp, 0x18
shr esi, 0x10
or ebp, esi
shr edi, 8
or ebp, edi
mov edx, dword [esp + 4]
or edx, ebp
mov ebp, dword [esp]
shl ebp, 8
or edx, ebp
shl ebx, 0x10
or ebx, edx
shl ecx, 0x18
or ebx, ecx
and ebx, 0xffffffc
mov dword [eax + 0x24], ebx
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 0x10]
movzx ebx, byte [ecx + 0x11]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0x12]
mov esi, ebx
shl ebx, 0x10
or ebx, edx
movzx edx, byte [ecx + 0x13]
mov edi, edx
shl edx, 0x18
or edx, ebx
movzx ebx, byte [ecx + 0x14]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0x15]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0x16]
movzx ecx, byte [ecx + 0x17]
mov dword [eax + 0x28], edx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or esi, edi
mov edx, dword [esp + 4]
or edx, esi
mov ebp, dword [esp]
shl ebp, 8
or edx, ebp
shl ebx, 0x10
or ebx, edx
shl ecx, 0x18
or ebx, ecx
mov dword [eax + 0x2c], ebx
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 0x18]
movzx ebx, byte [ecx + 0x19]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0x1a]
mov esi, ebx
shl ebx, 0x10
or ebx, edx
movzx edx, byte [ecx + 0x1b]
mov edi, edx
shl edx, 0x18
or edx, ebx
movzx ebx, byte [ecx + 0x1c]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0x1d]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0x1e]
movzx ecx, byte [ecx + 0x1f]
mov dword [eax + 0x30], edx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or esi, edi
mov edx, dword [esp + 4]
or edx, esi
mov ebp, dword [esp]
shl ebp, 8
or edx, ebp
shl ebx, 0x10
or ebx, edx
shl ecx, 0x18
or ebx, ecx
mov dword [eax + 0x34], ebx
add esp, 8
ret
call fcn.0045b380
jmp fcn.00541be0
Function at 0x54e580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54e688
sub esp, 0x20
mov ecx, dword [esp + 0x28]
cmp ecx, 1
jl 0x54e66d
mov edx, dword [esp + 0x24]
movzx ebx, byte [ecx + edx - 1]
lea eax, [ecx - 1]
movzx ebp, bl
mov esi, eax
sub eax, ebp
cmp ecx, 0x100
jge 0x54e661
mov edi, ecx
mov dword [esp + 0x14], esi
mov byte [esp + 0xb], bl
mov dword [esp + 0x10], ebp
not eax
sar eax, 0x1f
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
jmp 0x54e621
inc ebx
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
movzx esi, byte [edx + esi]
movzx edx, byte [esp + 0xb]
and edx, ebp
and esi, ebp
xor edx, esi
not edx
and eax, edx
movzx edx, byte [esp + 0xb]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov edx, ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
movzx ebx, byte [esp + 0xb]
mov ebx, dword [esp + 0xc]
cmp ebx, ecx
jge 0x54e633
sub ebp, ebx
sub esi, ebx
cmp esi, edi
jb 0x54e5e8
jmp 0x54e67e
mov ecx, eax
shl eax, 4
and ecx, eax
mov eax, ecx
shl ecx, 2
and ecx, eax
mov eax, ecx
shl ecx, 1
and ecx, eax
sar cl, 7
movzx eax, byte [esp + 0xb]
and eax, ecx
movzx eax, al
inc eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], cl
add esp, 0x20
ret
mov edi, ecx
mov ecx, 0x100
jmp 0x54e5c7
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov eax, esi
mov ecx, edi
call fcn.0045c9a0
nop
call fcn.0045b380
jmp fcn.0054e580
Function at 0x55ed60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55ef2e
sub esp, 0x4c
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov edx, dword [eax + 0x38]
mov ebx, dword [ecx + 0x164]
mov ebp, dword [ecx + 0x168]
mov esi, dword [ecx + 0x16c]
mov edi, dword [eax + 0x3c]
mov ecx, dword [eax + 0x40]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
call fcn.00568ed0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0045cbba
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00565610
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + 0x40]
mov ecx, dword [ecx + 0x20]
mov dword [esp], edx
call ecx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00565610
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x30]
mov dword [esp], ebx
mov byte [esp + 4], 0x16
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.005536b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x55ef22
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x118]
mov edx, dword [esp + 0x50]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x50]
mov esi, dword [edx + 0x54]
mov edi, dword [edx + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.0054e2d0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x28]
movzx edx, byte [ecx + 0x61]
test dl, dl
je 0x55ee9f
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
add esp, 0x4c
ret
mov ecx, dword [ecx + 0x84]
test ecx, ecx
je 0x55ee8b
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x44]
mov ebx, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov esi, dword [eax + 0x3c]
mov eax, dword [eax + 0x40]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
lea ecx, [0x67b232]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.00568aa0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x7c], edx
mov ecx, dword [0x7e34e0]
test ecx, ecx
jne 0x55ef15
mov dword [ebx + 0x74], eax
jmp 0x55ee8b
lea edi, [ebx + 0x74]
call fcn.0045c920
jmp 0x55ee8b
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x4c
ret
call fcn.0045b380
jmp fcn.0055ed60