joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ad5ab
sub esp, 0x30
lea eax, [0x6db260]
mov dword [esp], eax
call fcn.0040bc10
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5ad44f
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x5ad57d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x5ad597
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ad445
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ad445
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ad445
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x5ad445
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [esi + edx]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x5ad51f
cmp ebx, ebp
jle 0x5ad51f
ja 0x5ad581
mov eax, ebp
mov ecx, ebx
call fcn.00471b30
nop
call fcn.004706b0
jmp fcn.005ad410
Function at 0x5ade30
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5aded6
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5ade89
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x5adec0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.004706b0
jmp fcn.005ade30
Function at 0x5b4a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b4bea
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00471d4b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x5b4a6f
inc ebx
cmp edx, ebx
jle 0x5b4b8e
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x5b4b32
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x5b4ae3
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x5b4a6e
lea edi, [esp + 0x28]
call fcn.00471d4b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.005b5490
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0047222e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0047222e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.00471d4b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.005b5370
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0047222e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0047222e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.00471d4a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x7330f2]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.00471d4b
lea ecx, [0x704780]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.00409df0
mov ecx, dword [esp + 8]
lea edx, [0x7a49a0]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.00471d4a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x731c24]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.00471d4b
lea ecx, [0x704780]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.00409df0
mov ecx, dword [esp + 8]
lea edx, [0x7a49a0]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.004706b0
jmp fcn.005b4a40
Function at 0x5bba30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bbbec
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00471d47
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x5bba68
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x5bba91
lea eax, [0x6e06e0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0046ca20
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.00471d47
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x5bbad4
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x5bbae3
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x5bbaf2
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x5bbb01
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x5bbb10
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x5bbb1c
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x5bbb28
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x5bbb98
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x6e06e0]
mov dword [esp + 0x10], eax
call fcn.0046cad0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call fcn.00472440
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.00472206
add esp, 0x5c
ret
call fcn.004706b0
jmp fcn.005bba30
Function at 0x5d26e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d2851
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x5d2777
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x5d2716
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5d2783
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x5d2741
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5d2783
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x20]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x5d2783
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.005df020
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.005d9c30
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.004706b0
jmp fcn.005d26e0
Function at 0x5e1bc0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e1d31
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5e1bf1
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5e1bf1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5e1bf7
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5e1c05
cmp ecx, 4
jne 0x5e1c36
cmp al, 0x2c
ja 0x5e1c1e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5e1c30
cmp al, 0x24
je 0x5e1c30
cmp al, 0x26
jae 0x5e1c30
jmp 0x5e1c36
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5e1c30
cmp al, 0x5b
je 0x5e1c30
cmp al, 0x5d
jne 0x5e1c36
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5e1c6d
cmp al, 0x26
ja 0x5e1c4f
cmp al, 0x24
je 0x5e1c8c
cmp al, 0x26
je 0x5e1c8c
jmp 0x5e1d13
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5e1c8c
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5e1d0d
cmp al, 0x2f
je 0x5e1c8c
jmp 0x5e1d13
cmp al, 0x3d
ja 0x5e1c84
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5e1c8c
cmp al, 0x3d
je 0x5e1c8c
jmp 0x5e1d13
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5e1d03
cmp ecx, 2
jg 0x5e1cc7
cmp ecx, 1
je 0x5e1cbc
cmp ecx, 2
jne 0x5e1d13
cmp al, 0x2f
je 0x5e1caa
cmp al, 0x3b
je 0x5e1caa
cmp al, 0x2c
jne 0x5e1cb1
mov eax, 1
jmp 0x5e1cb7
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5e1ced
cmp al, 0x40
je 0x5e1cdb
cmp al, 0x2f
je 0x5e1cdb
cmp al, 0x3f
jne 0x5e1ce2
mov eax, 1
jmp 0x5e1ce8
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5e1cfd
cmp ecx, 7
jne 0x5e1d13
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5e1d0d
cmp al, 0x7e
jne 0x5e1d13
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5e1d2b
cmp al, 0x21
je 0x5e1d25
add eax, 0xffffffd8
cmp al, 2
ja 0x5e1d2b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.004706b0
jmp fcn.005e1bc0
Function at 0x5edb50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5edc9c
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.0059f300
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5edbb8
lea eax, [0x6ec1a0]
mov dword [esp], eax
call fcn.0040bc10
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x73d65e]
mov dword [eax], ecx
lea ecx, [0x7a4344]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5edc88
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.0059f940
movzx eax, byte [esp + 0x10]
test al, al
je 0x5edc55
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5edbb8
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x6ec1a0]
mov dword [esp], eax
call fcn.0040bc10
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x73cf91]
mov dword [eax], ecx
lea ecx, [0x7a4344]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.004706b0
jmp fcn.005edb50
Function at 0x5f8c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f8e94
sub esp, 0x68
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.00471d45
lea ecx, [0x5f8ea0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
lea ebx, [esp + 0x84]
mov dword [esp + 0x54], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005e9990
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5f8d89
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov esi, dword [esp + 0x2c]
mov dword [esp], 2
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
lea edx, [esp + 0x2c]
call esi
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5f8d57
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call fcn.005e9990
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5f8def
mov dword [esp + 0x14], edx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov dword [esp], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
lea edx, [esp + 0x2c]
call ebp
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5f8dbb
mov eax, dword [esp + 0x88]
test eax, eax
je 0x5f8e14
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x5f8e90
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x5f8e90
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], eax
lea eax, [0x705080]
mov dword [esp], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call fcn.00409df0
mov eax, dword [esp + 8]
lea ecx, [0x7a4b90]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x68
ret
call fcn.004706b0
jmp fcn.005f8c60
Function at 0x60f4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60f592
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x60f501
mov edx, dword [esp + 0x18]
movzx ebx, byte [ecx + edx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x60f4eb
mov eax, ecx
jmp 0x60f4f2
mov eax, ecx
mov ecx, 0x100
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
sar ebp, 0x1f
xor edi, edi
jmp 0x60f544
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
movzx eax, byte [eax + edx - 1]
mov ecx, esi
and esi, ebx
and eax, ecx
xor esi, eax
xchg esi, ebx
not ebx
xchg esi, ebx
inc edi
movzx eax, byte [esp + 0xb]
and eax, esi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jle 0x60f55f
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub eax, edi
lea ecx, [eax - 1]
sub esi, edi
mov ebp, dword [esp + 0x1c]
cmp ebp, ecx
ja 0x60f512
jmp 0x60f588
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ecx
mov ecx, ebp
call fcn.00471b30
nop
call fcn.004706b0
jmp fcn.0060f4b0
Function at 0x617ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x617eb9
sub esp, 0x6c
lea edi, [esp + 0x74]
xor eax, eax
call fcn.00471d37
lea edi, [esp + 8]
call fcn.00471d37
mov ecx, dword [esp + 0x70]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.00476380
mov ecx, dword [esp + 4]
test ecx, ecx
setne cl
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x70]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xcc]
mov ebx, dword [ecx + 0xd0]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
movzx edx, byte [ecx + 0x36]
mov byte [esp + 0x68], dl
movzx edx, word [ecx + 0x3a]
mov word [esp + 0x6a], dx
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x78]
mov ebx, dword [ecx + 0x7c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x38]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x54]
mov ebx, dword [ecx + 0x58]
mov ebp, dword [ecx + 0x5c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x6c]
mov ebx, dword [ecx + 0x70]
mov ebp, dword [ecx + 0x74]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x48]
mov ebx, dword [ecx + 0x4c]
mov ebp, dword [ecx + 0x50]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x3c]
mov ebx, dword [ecx + 0x40]
mov ebp, dword [ecx + 0x44]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x617de3
movzx eax, byte [ecx + 0x34]
test al, al
je 0x617e2c
cmp word [ecx + 0x28], 0x304
je 0x617e2c
movzx eax, byte [ecx + 0xa4]
test al, al
je 0x617e12
lea eax, [ecx + 0xb1]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x617e2c
lea eax, [ecx + 0xbd]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x617e45
lea eax, [0x74d61c]
mov dword [esp + 0x64], eax
jmp 0x617e9d
cmp word [ecx + 0x28], 0x304
je 0x617e93
movzx eax, byte [ecx + 0x34]
test al, al
jne 0x617e93
lea eax, [0x6eb700]
mov dword [esp], eax
call fcn.0040bc10
mov eax, dword [esp + 4]
lea ecx, [0x617ed0]
mov dword [eax], ecx
mov ecx, dword [0x98d0b8]
test ecx, ecx
jne 0x617e7f
mov ecx, dword [esp + 0x70]
jmp 0x617e8a
call fcn.00471ab0
mov ecx, dword [esp + 0x70]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x64], eax
jmp 0x617e9d
mov eax, dword [ecx + 0x84]
mov dword [esp + 0x64], eax
movzx eax, byte [ecx + 0x94]
mov byte [esp + 0x60], al
lea edi, [esp + 0x74]
lea esi, [esp + 8]
call fcn.00472166
add esp, 0x6c
ret
call fcn.004706b0
jmp fcn.00617ce0
Function at 0x63d430
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x98cddc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x63d535
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00471d38
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
jmp 0x63d4e5
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005e7e40
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
dec eax
test eax, eax
jg 0x63d4ab
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005e8020
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call fcn.004706b0
jmp fcn.0063d430