joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449950
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x449990
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x77c8c0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x449b92
je 0x449b7a
cmp ebx, 0x20
jbe 0x449b3c
cmp ebx, 0x40
jbe 0x449aab
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x77c8d0]
pxor xmm2, xmmword [0x77c8e0]
pxor xmm3, xmmword [0x77c8f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x449a31
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x77c8d0]
pxor xmm2, xmmword [0x77c8e0]
pxor xmm3, xmmword [0x77c8f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
pxor xmm1, xmmword [0x77c8d0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqu xmm1, xmmword [eax]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
test ebx, ebx
je 0x449bc5
add eax, 0x10
test ax, 0xff0
je 0x449bb1
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x66e560]
jmp 0x449b7e
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x66e660]
jmp 0x449b7e
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
Function at 0x44ab60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x24c
mov dword [esp], esp
mov dword [esp + 4], 0x24c
call fcn.0044a5f0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xe4
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xe4
call fcn.0044a5f0
lea ebx, [esp + 0xe4]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44ac00
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00449820
call fcn.00429920
ret
Function at 0x4610a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4611e0
sub esp, 0x50
mov eax, dword [esp + 0x68]
test eax, eax
jle 0x4611d9
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x44], ecx
mov edx, dword [0x76a974]
mov dword [esp], edx
call fcn.0045d090
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x48], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x54]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0043d130
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x4611d3
test ecx, ecx
je 0x4611a7
cmp ecx, 0x3e5
jne 0x46117f
mov ecx, dword [0x766844]
mov edx, dword [0x766840]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], ecx
add esp, 0x50
ret
mov dword [esp + 0x40], ecx
lea ecx, [0x742720]
mov dword [esp], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 4], ecx
call fcn.0040a8e0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x46116f
mov dword [esp + 0x3c], 0x20000027
lea ecx, [0x742720]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040a8e0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x46116f
xor edx, edx
mov ecx, edx
jmp 0x46116f
xor ecx, ecx
jmp 0x4610c9
call fcn.00448420
jmp fcn.004610a0
Function at 0x464620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46470f
sub esp, 0x54
mov eax, dword [0x76aa54]
mov dword [esp], eax
call fcn.0045d090
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043d130
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4646eb
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x742720]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040a8e0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x4646df
call fcn.00448420
jmp fcn.00464620
Function at 0x464b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x464ca5
sub esp, 0x50
mov eax, dword [0x76a948]
mov dword [esp], eax
call fcn.0045d090
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x54]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043d130
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x464c9f
test ecx, ecx
je 0x464c77
cmp ecx, 0x3e5
jne 0x464c53
mov eax, dword [0x766840]
mov ecx, dword [0x766844]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x50
ret
mov dword [esp + 0x3c], ecx
lea eax, [0x742720]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.0040a8e0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x464c47
mov dword [esp + 0x38], 0x20000027
lea eax, [0x742720]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040a8e0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x464c47
xor ecx, ecx
mov eax, ecx
jmp 0x464c47
call fcn.00448420
jmp fcn.00464b80
Function at 0x488760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48879e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor ebx, ebx
cmp ebx, eax
jge 0x488799
lea ebp, [edx + 1]
inc ebx
movzx esi, byte [edx]
imul ecx, ecx, 0x1000193
xor ecx, esi
mov edx, ebp
cmp ebx, eax
jl 0x488784
mov dword [esp + 0x14], ecx
ret
call fcn.00448420
jmp fcn.00488760
Function at 0x4ad790
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ad838
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4ad7ff
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x4ad7e9
call fcn.00448420
jmp fcn.004ad790
Function at 0x4e34f0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e370d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4e35a7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4e3620
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4e3588
cmp ecx, 0xf
jne 0x4e3699
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4e3588
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4e3588
call fcn.00448420
jmp fcn.004e34f0
Function at 0x5398f0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x539aae
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x539919
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x539913
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x539913
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x539aa0
cmp al, 0x2c
ja 0x539a7d
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x53994d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x539947
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x539947
cmp al, 0x2f
ja 0x539a42
cmp al, 0x26
ja 0x539a1a
cmp al, 0x24
jne 0x539a10
cmp ecx, 2
jg 0x5399c4
cmp ecx, 1
je 0x5399b9
cmp ecx, 2
jne 0x5399b3
cmp al, 0x2f
jne 0x539993
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x53999f
mov eax, 1
jmp 0x53998e
cmp al, 0x2c
jne 0x5399ab
mov eax, 1
jmp 0x53998e
cmp al, 0x3f
sete al
jmp 0x53998e
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5399f8
cmp al, 0x40
jne 0x5399d8
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x5399e4
mov eax, 1
jmp 0x5399d3
cmp al, 0x3f
jne 0x5399f0
mov eax, 1
jmp 0x5399d3
cmp al, 0x3a
sete al
jmp 0x5399d3
cmp ecx, 6
je 0x539a0a
cmp ecx, 7
je 0x539a04
jmp 0x5399b3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
jne 0x5399b3
jmp 0x539975
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x539975
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x539a34
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
jne 0x5399b3
jmp 0x539975
cmp al, 0x3d
ja 0x539a61
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x539975
cmp al, 0x3d
jne 0x5399b3
jmp 0x539975
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x539975
cmp al, 0x5f
je 0x539a2e
cmp al, 0x7e
jne 0x5399b3
jmp 0x539a2e
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x539947
cmp al, 0x5b
je 0x539947
cmp al, 0x5d
jne 0x53995a
jmp 0x539947
cmp ecx, 4
jne 0x53995a
jmp 0x539936
call fcn.00448420
jmp fcn.005398f0
Function at 0x548e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x548f6a
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0x18c]
test edx, edx
jne 0x548f66
mov ecx, dword [eax + 0x10]
movzx edx, word [esp + 0x1c]
movzx edx, dx
mov ebx, edx
shl edx, cl
cmp ecx, 0x20
sbb ebp, ebp
and ebp, edx
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
or ebp, edx
mov dword [eax + 8], ebp
add ecx, 0xffffffe0
mov edx, ebx
shl ebx, cl
cmp ecx, 0x20
sbb ebp, ebp
and ebp, ebx
neg ecx
shr edx, cl
cmp ecx, 0x20
sbb ebx, ebx
and ebx, edx
or ebp, ebx
or esi, ebp
mov dword [eax + 0xc], esi
mov edx, dword [eax + 0x10]
movzx ebx, word [esp + 0x1e]
movzx ebx, bx
add edx, ebx
mov dword [eax + 0x10], edx
cmp edx, 0x30
jb 0x548f3b
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 8]
mov ebx, ecx
shr ecx, 0x10
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0
mov ecx, dword [eax + 0x10]
add ecx, 0xffffffd0
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0x14]
test byte [ecx], al
mov ebp, dword [eax + 0x158]
lea esi, [ebp + 6]
cmp ebp, esi
ja 0x548f5f
cmp esi, 0xf8
ja 0x548f5f
lea edi, [ebp - 0xf8]
xchg edi, ebx
neg ebx
xchg edi, ebx
dec edi
sar edi, 0x1f
xor edi, 0xffffffff
and ebp, edi
mov byte [eax + ebp + 0x14], dl
mov edi, edx
shr edx, 8
shl ebx, 0x18
or edx, ebx
mov byte [eax + ebp + 0x15], dl
mov edx, edi
shr edi, 0x10
mov ebx, dword [esp + 0x10]
shl ebx, 0x10
or edi, ebx
xchg edi, ebx
mov byte [eax + ebp + 0x16], bl
xchg edi, ebx
shr edx, 0x18
mov ebx, dword [esp + 0x10]
mov edi, ebx
shl ebx, 8
or edx, ebx
mov byte [eax + ebp + 0x17], dl
mov word [eax + ebp + 0x18], di
cmp esi, 0xf0
jge 0x548f3f
mov dword [eax + 0x158], esi
add esp, 0x14
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0xf8
call fcn.005484c0
mov eax, dword [esp + 0x18]
xor esi, esi
jmp 0x548f35
call fcn.004246c0
ud2
add esp, 0x14
ret
call fcn.00448420
jmp fcn.00548e10
Function at 0x54ae10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54af91
sub esp, 0x24
xor eax, eax
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov ebp, dword [esp + 0x30]
cmp eax, ebp
jge 0x54af8d
mov esi, dword [ecx]
shl edx, 1
mov word [esp + 0x12], dx
test eax, eax
jne 0x54ae5c
add ecx, 4
inc eax
jmp 0x54ae35
test esi, esi
jne 0x54ae62
jmp 0x54ae56
mov edi, ebx
sub ebx, esi
mov dword [esp + 0x3c], ebx
cmp ebx, edi
ja 0x54af86
mov esi, dword [esp + 0x28]
test byte [esi], al
lea ebp, [esi + 0x5c]
mov dword [esp], ebp
mov ebp, dword [esp + 0x40]
sub ebp, ebx
shl ebx, 3
lea ecx, [ebp - 1]
sar ecx, 0x1f
xor ecx, 0xffffffff
and ebx, ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x38]
lea esi, [ebx + ecx]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x3c]
sub edi, esi
mov dword [esp + 0x18], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
call fcn.0054b1f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
lea eax, [ecx + eax]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
movzx esi, word [esp + 0x12]
xor edi, edi
mov word [esp + 0x10], si
cmp edi, ebx
jge 0x54af57
lea ebx, [edx - 0x10]
neg ebx
mov ecx, ebx
shl esi, cl
cmp cl, 0x20
sbb ebx, ebx
and ebx, esi
mov esi, ebx
and ebx, 0xff
mov ecx, edi
lea edi, [0x747ea0]
movzx ebx, byte [edi + ebx]
shr si, 8
movzx esi, si
movzx esi, byte [edi + esi]
mov edi, dword [ebp]
shl ebx, 8
or ebx, esi
movzx esi, word [eax]
mov ebp, dword [ebp + 4]
cmp esi, ebp
jae 0x54af7f
shl esi, 2
mov word [edi + esi], bx
mov word [edi + esi + 2], dx
add eax, 8
lea edi, [ecx + 1]
movzx ecx, word [esp + 0x10]
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
mov word [esp + 0x10], si
cmp edi, ebx
jl 0x54aedf
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
cmp eax, ebx
ja 0x54af78
mov eax, edx
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov edx, esi
mov ebx, dword [esp + 0x3c]
jmp 0x54ae56
call fcn.004246c0
ud2
call fcn.00424660
ud2
call fcn.004246c0
ud2
add esp, 0x24
ret
call fcn.00448420
jmp fcn.0054ae10
Function at 0x558f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x558fef
sub esp, 0x20
mov eax, dword [esp + 0x24]
lea ecx, [eax + 0x100]
test byte [ecx], al
movzx ecx, byte [eax + 0x180]
mov byte [esp + 0x17], cl
movzx edx, cl
cmp edx, 0x80
ja 0x558fe8
lea ebx, [edx - 0x80]
neg ebx
lea ebp, [ebx - 1]
sar ebp, 0x1f
xor ebp, 0xffffffff
and edx, ebp
lea edx, [eax + edx + 0x100]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call fcn.0044d4d0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 0x180]
add edx, 4
mov byte [ecx + 0x180], dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
movzx edx, byte [esp + 0x17]
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], al
mov eax, dword [ecx + 0x184]
cmp eax, 0x20
jae 0x558fe1
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
shl eax, 3
mov dword [ecx + eax], edx
mov dword [ecx + eax + 4], ebx
mov eax, dword [ecx + 0x184]
inc eax
mov dword [ecx + 0x184], eax
add esp, 0x20
ret
call fcn.00424660
ud2
call fcn.004246c0
ud2
call fcn.00448420
jmp fcn.00558f10
Function at 0x565b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x565c0e
movzx eax, byte [esp + 0xc]
test al, al
je 0x565c01
mov eax, dword [esp + 8]
cmp eax, 1
jle 0x565bfb
mov ecx, dword [esp + 4]
movzx edx, byte [ecx]
cmp dl, 0x22
jne 0x565b87
lea edx, [eax - 1]
cmp edx, eax
jae 0x565bf4
movzx ebx, byte [ecx + eax - 1]
cmp bl, 0x22
jne 0x565b87
cmp edx, 1
jb 0x565bed
lea edx, [eax - 3]
sar edx, 0x1f
xor edx, 0xffffffff
and edx, 1
add ecx, edx
add eax, 0xfffffffe
xor edx, edx
cmp edx, eax
jge 0x565bb6
jae 0x565be6
movzx ebx, byte [ecx + edx]
lea ebp, [ebx - 0x20]
xchg ebp, eax
cmp al, 0x5f
xchg ebp, eax
jae 0x565be2
cmp bl, 0x22
je 0x565bde
cmp bl, 0x3b
je 0x565bda
cmp bl, 0x5c
setne bl
test bl, bl
je 0x565bc4
inc edx
cmp edx, eax
jl 0x565b8d
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 1
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
ret
xor ebx, ebx
jmp 0x565bad
xor ebx, ebx
jmp 0x565bad
xor ebx, ebx
jmp 0x565bad
call fcn.00424660
ud2
call fcn.004246c0
ud2
call fcn.00424660
ud2
mov ecx, dword [esp + 4]
jmp 0x565b87
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
jmp 0x565b87
call fcn.00448420
jmp fcn.00565b20

Function at 0x569dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x569e97
sub esp, 4
mov eax, dword [esp + 8]
test byte [eax], al
mov dword [esp], eax
call fcn.005682a0
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
movzx ebx, word [esp + 0xc]
test edx, edx
jle 0x569e40
cmp eax, 2
jb 0x569e90
movzx ebp, byte [ecx + 1]
movzx esi, byte [ecx]
shl esi, 8
or esi, ebp
cmp bx, si
je 0x569e58
cmp edx, 6
jb 0x569e51
lea ebp, [eax - 7]
sar ebp, 0x1f
xor ebp, 0xffffffff
and ebp, 6
add ecx, ebp
add edx, 0xfffffffa
add eax, 0xfffffffa
test edx, edx
jg 0x569e0d
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
add esp, 4
ret
call fcn.004246c0
ud2
cmp eax, 6
jb 0x569e89
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
movzx ebx, byte [ecx + 5]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or ecx, ebx
shl eax, 0x10
or ecx, eax
shl edx, 0x18
or ecx, edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x14], 1
add esp, 4
ret
call fcn.004246c0
ud2
call fcn.004246c0
ud2
call fcn.00448420
jmp fcn.00569dd0