joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5aa9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5aabcc
sub esp, 0x7c
lea edi, [esp + 0x1c]
mov esi, dword [esp + 0x80]
call fcn.00471f0c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.005a9fb0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
lea edi, [esp + 0x54]
xor eax, eax
call fcn.00471a56
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
xor ecx, ecx
jmp 0x5aaaa0
mov edx, dword [esp + 0x48]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x5aab6a
mov dword [esp + 0x48], ecx
lea edx, [esp + ecx*8 + 0x54]
mov ebx, dword [edx]
mov dword [esp + 0x44], ebx
mov edx, dword [edx + 4]
imul ebp, ecx, 0x33
mov esi, ebp
sar ebp, 0x1f
shr ebp, 0x1d
add ebp, esi
mov dword [esp + 0x50], ebp
and ebp, 0xfffffff8
sub esi, ebp
mov ecx, esi
shl ebx, cl
shl edx, cl
mov dword [esp + 0x4c], edx
lea ebp, [ecx - 0x20]
mov ecx, ebp
mov edi, dword [esp + 0x44]
shl edi, cl
neg ecx
mov edx, dword [esp + 0x44]
shr edx, cl
cmp ebp, 0x20
sbb ebp, ebp
and edi, ebp
cmp esi, 0x20
sbb ebp, ebp
and ebx, ebp
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
mov esi, dword [esp + 0x4c]
and esi, ebp
mov ebp, ebx
shr ebx, 8
shr ebp, 0x10
mov dword [esp + 0x4c], ebp
mov ebp, dword [esp + 0x18]
shr ebp, 0x18
cmp ecx, 0x20
sbb ecx, ecx
and edx, ecx
or esi, edx
or edi, esi
mov edx, edi
shl edi, 0x18
or edi, ebx
xchg edi, eax
mov byte [esp + 9], al
xchg edi, eax
mov ebx, edx
shl edx, 0x10
mov esi, dword [esp + 0x4c]
or esi, edx
xchg esi, eax
mov byte [esp + 0xa], al
xchg esi, eax
mov edx, ebx
shl ebx, 8
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x50]
xor ecx, ecx
jmp 0x5aaba4
test byte [eax], al
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 0x20
mov dword [esp + 0x90], 0x20
add esp, 0x7c
ret
test byte [eax], al
movzx ebp, byte [esp + ecx + 0x10]
movzx esi, byte [eax + edx]
or esi, ebp
xchg esi, ebx
mov byte [eax + edx], bl
xchg esi, ebx
inc ecx
mov edx, ebx
cmp ecx, 8
jge 0x5aaa99
mov ebx, edx
sar edx, 3
add edx, ecx
cmp edx, 0x20
jge 0x5aaa99
jb 0x5aab8d
mov eax, edx
mov ecx, 0x20
call fcn.00471840
nop
call fcn.004703c0
jmp fcn.005aa9f0
Function at 0x5aaca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5aae24
sub esp, 0x6c
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00471a56
mov ecx, dword [0x93265c]
lea edx, [esp + 0x40]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 8], ecx
call fcn.005aa1a0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x68], ecx
lea edi, [esp + 0x14]
xor eax, eax
call fcn.00471a58
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
lea edx, [esp + 0x14]
mov dword [esp + 4], edx
call fcn.005aa9f0
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x5aae1a
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [esp + 0x74]
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 8]
movzx edi, byte [edi]
and edi, 1
mov dword [esp + 0x38], edi
sar edi, 0x1f
nop
xor ebx, ebx
mov eax, dword [esp + 0x38]
sub ebx, eax
mov dword [esp + 0x34], ebx
mov eax, 0
sbb eax, edi
mov dword [esp + 0x3c], eax
and ecx, ebx
and edx, eax
mov edi, ebx
not ebx
not eax
and ebp, ebx
or ecx, ebp
mov ebp, dword [esp + 0x70]
mov dword [ebp], ecx
and esi, eax
or edx, esi
mov dword [ebp + 4], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 8]
and edx, edi
mov esi, dword [ecx + 0xc]
mov edi, dword [esp + 0x3c]
and esi, edi
mov edi, dword [esp + 0x74]
mov ecx, dword [edi + 8]
and ecx, ebx
or ecx, edx
mov edx, dword [edi + 0xc]
mov dword [ebp + 8], ecx
and edx, eax
or edx, esi
mov dword [ebp + 0xc], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 0x10]
mov esi, dword [esp + 0x34]
and edx, esi
mov esi, dword [ecx + 0x14]
mov ecx, dword [esp + 0x3c]
and esi, ecx
mov ecx, dword [edi + 0x10]
and ecx, ebx
or ecx, edx
mov edx, dword [edi + 0x14]
mov dword [ebp + 0x10], ecx
and edx, eax
or edx, esi
mov dword [ebp + 0x14], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x34]
and edx, esi
mov esi, dword [ecx + 0x1c]
mov ecx, dword [esp + 0x3c]
and esi, ecx
mov ecx, dword [edi + 0x18]
and ecx, ebx
or ecx, edx
mov edx, dword [edi + 0x1c]
mov dword [ebp + 0x18], ecx
and edx, eax
or edx, esi
mov dword [ebp + 0x1c], edx
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx + 0x20]
mov esi, dword [esp + 0x34]
and esi, edx
mov ecx, dword [ecx + 0x24]
mov edx, dword [esp + 0x3c]
and edx, ecx
mov ecx, dword [edi + 0x20]
and ebx, ecx
or ebx, esi
mov ecx, dword [edi + 0x24]
mov dword [ebp + 0x20], ebx
and eax, ecx
or eax, edx
mov dword [ebp + 0x24], eax
mov dword [esp + 0x78], ebp
add esp, 0x6c
ret
xor eax, eax
mov ecx, eax
call fcn.00471840
nop
call fcn.004703c0
jmp fcn.005aaca0
Function at 0x5b5310
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b5524
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5b53a7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x5b5505
cmp ecx, 0xe
jne 0x5b5420
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5b5505
cmp ecx, 0xf
jne 0x5b5496
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5b5505
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.004703c0
jmp fcn.005b5310
Function at 0x5b7870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b7a17
sub esp, 0x30
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.005b8370
movzx eax, byte [esp + 0xc]
test al, al
je 0x5b78ff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5b78ff
mov edx, dword [esp + 0x24]
cmp eax, 1
je 0x5b78f2
movzx ebx, byte [edx]
test bl, bl
jne 0x5b78e4
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5b78ff
cmp bl, 0xff
jne 0x5b78f2
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x5b78ff
cmp eax, 8
jg 0x5b7908
mov ebx, dword [esp + 0x38]
xor ecx, ecx
jmp 0x5b7933
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
jg 0x5b78ff
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x5b7913
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x20], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x40]
neg ecx
mov byte [esp + 0x13], cl
shl ebp, cl
mov dword [esp + 0x1c], ebp
mov edi, edx
shl edx, cl
add eax, 0xffffffe0
mov byte [esp + 0x12], al
mov ecx, eax
shr edi, cl
mov dword [esp + 0x18], edi
neg eax
mov ecx, eax
mov esi, dword [esp + 0x20]
shl esi, cl
movzx edi, byte [esp + 0x13]
xchg edi, eax
shr al, 5
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov dword [esp + 0x20], edi
cmp al, 0x20
sbb edi, edi
sbb ebp, ebp
and edi, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x11], al
xchg ebp, eax
movzx ecx, byte [esp + 0x13]
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and edx, esi
mov dword [ebx], edx
mov ebp, dword [esp + 0x1c]
and ebp, esi
not eax
or eax, ecx
mov byte [esp + 0x13], al
shr edx, cl
and edx, esi
mov esi, dword [esp + 0x20]
cmp esi, 1
sbb esi, esi
xor esi, 0xffffffff
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x12]
cmp cl, 0x20
sbb eax, eax
mov esi, dword [esp + 0x18]
and esi, eax
or ebp, esi
or ebp, edi
mov dword [ebx + 4], ebp
mov esi, ebp
shl ebp, cl
and ebp, eax
or edx, ebp
movzx ecx, byte [esp + 0x11]
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0x20]
and ebp, esi
or ebp, edx
mov dword [ebx], ebp
movzx ecx, byte [esp + 0x13]
sar eax, cl
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x5b7908
call fcn.004703c0
jmp fcn.005b7870
Function at 0x5c4e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c4feb
sub esp, 0x30
lea eax, [0x6a1880]
mov dword [esp], eax
call fcn.0040c000
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5c4e8f
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x5c4fbd
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x5c4fd7
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5c4e85
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5c4e85
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5c4e85
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x5c4e85
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [esi + edx]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x5c4f5f
cmp ebx, ebp
jle 0x5c4f5f
ja 0x5c4fc1
mov eax, ebp
mov ecx, ebx
call fcn.00471840
nop
call fcn.004703c0
jmp fcn.005c4e50
Function at 0x5c76d0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c7841
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5c7701
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5c7701
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5c7707
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5c7715
cmp ecx, 4
jne 0x5c7746
cmp al, 0x2c
ja 0x5c772e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5c7740
cmp al, 0x24
je 0x5c7740
cmp al, 0x26
jae 0x5c7740
jmp 0x5c7746
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5c7740
cmp al, 0x5b
je 0x5c7740
cmp al, 0x5d
jne 0x5c7746
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5c777d
cmp al, 0x26
ja 0x5c775f
cmp al, 0x24
je 0x5c779c
cmp al, 0x26
je 0x5c779c
jmp 0x5c7823
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5c779c
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5c781d
cmp al, 0x2f
je 0x5c779c
jmp 0x5c7823
cmp al, 0x3d
ja 0x5c7794
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5c779c
cmp al, 0x3d
je 0x5c779c
jmp 0x5c7823
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5c7813
cmp ecx, 2
jg 0x5c77d7
cmp ecx, 1
je 0x5c77cc
cmp ecx, 2
jne 0x5c7823
cmp al, 0x2f
je 0x5c77ba
cmp al, 0x3b
je 0x5c77ba
cmp al, 0x2c
jne 0x5c77c1
mov eax, 1
jmp 0x5c77c7
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5c77fd
cmp al, 0x40
je 0x5c77eb
cmp al, 0x2f
je 0x5c77eb
cmp al, 0x3f
jne 0x5c77f2
mov eax, 1
jmp 0x5c77f8
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5c780d
cmp ecx, 7
jne 0x5c7823
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5c781d
cmp al, 0x7e
jne 0x5c7823
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5c783b
cmp al, 0x21
je 0x5c7835
add eax, 0xffffffd8
cmp al, 2
ja 0x5c783b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.004703c0
jmp fcn.005c76d0
Function at 0x5d07b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d08fc
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.005b8370
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5d0818
lea eax, [0x6b6b60]
mov dword [esp], eax
call fcn.0040c000
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x708a83]
mov dword [eax], ecx
lea ecx, [0x762e24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5d08e8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005b89b0
movzx eax, byte [esp + 0x10]
test al, al
je 0x5d08b5
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5d0818
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x6b6b60]
mov dword [esp], eax
call fcn.0040c000
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x70858c]
mov dword [eax], ecx
lea ecx, [0x762e24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.004703c0
jmp fcn.005d07b0
Function at 0x5dba20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5dbc54
sub esp, 0x68
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.00471a55
lea ecx, [0x5dbc60]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
lea ebx, [esp + 0x84]
mov dword [esp + 0x54], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005cc830
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5dbb49
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov esi, dword [esp + 0x2c]
mov dword [esp], 2
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
lea edx, [esp + 0x2c]
call esi
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5dbb17
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call fcn.005cc830
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5dbbaf
mov dword [esp + 0x14], edx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov dword [esp], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
lea edx, [esp + 0x2c]
call ebp
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5dbb7b
mov eax, dword [esp + 0x88]
test eax, eax
je 0x5dbbd4
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x5dbc50
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x5dbc50
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], eax
lea eax, [0x6cef80]
mov dword [esp], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call fcn.0040a1e0
mov eax, dword [esp + 8]
lea ecx, [0x7630b0]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x68
ret
call fcn.004703c0
jmp fcn.005dba20
Function at 0x6560c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x95eda0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65629c
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
mov ecx, dword [0x95f020]
test ecx, ecx
jne 0x6560ed
mov ecx, dword [esp + 0x38]
jmp 0x656104
mov ecx, dword [eax + 0x10]
call fcn.004717e0
mov dword [edi], ecx
mov ecx, dword [esp + 0x38]
mov dword [edi + 4], ecx
mov edx, dword [eax + 0x2c]
mov dword [edi + 8], edx
mov dword [eax + 0x10], 0
mov dword [eax + 0x2c], ecx
lea edx, [0x6a14c0]
mov dword [esp], edx
call fcn.0040c000
mov eax, dword [esp + 4]
mov dword [eax + 4], 1
lea ecx, [0x760a14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [ecx + 0x74], 1
mov dword [ecx + 0x78], 1
mov edx, dword [0x95f020]
test edx, edx
jne 0x656155
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x3c]
jmp 0x65617c
call fcn.00471810
mov dword [edi], eax
mov edx, dword [ecx + 0x70]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0x20]
mov dword [edi + 0xc], ebx
mov ebx, dword [esp + 0x3c]
mov dword [edi + 0x10], ebx
mov ebp, dword [ecx + 0x7c]
mov dword [edi + 0x14], ebp
mov dword [ecx + 0x70], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 0x24], eax
mov ebp, dword [esp + 0x34]
mov dword [ecx + 0x28], ebp
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x7c], ebx
xor ebx, ebx
jmp 0x656198
inc ebx
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jle 0x6561f3
mov ebp, dword [edx + ebx*4]
test ebp, ebp
je 0x656197
lea eax, [0x6abdc0]
mov dword [esp], eax
mov dword [esp + 4], ebp
lea ecx, [0x6f763d]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 5
call fcn.0040e320
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x6561e7
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
jmp 0x656197
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x20]
mov dword [esp + 0x20], edx
mov ebp, dword [ecx + 0x24]
mov dword [esp + 0x18], ebp
xor esi, esi
jmp 0x656206
inc esi
cmp esi, ebp
jge 0x656275
mov edi, dword [edx + esi*4]
test edi, edi
je 0x656205
mov dword [esp + 0x14], esi
lea eax, [0x6abdc0]
mov dword [esp], eax
mov dword [esp + 4], edi
lea ecx, [0x6f8579]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 8
call fcn.0040e320
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x65625d
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x656205
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x656277
cmp eax, ebx
setle al
cmp esi, ebp
setge dl
mov ecx, dword [ecx + 0x14]
test ecx, 1
setne cl
mov ebx, dword [esp + 0x38]
mov byte [ebx + 0x4d], cl
mov byte [ebx + 0x4e], al
mov byte [ebx + 0x4f], dl
add esp, 0x24
ret
call fcn.004703c0
jmp fcn.006560c0