joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ebb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ed9d
sub esp, 0x68
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x102
call fcn.0045cfa0
mov eax, dword [esp + 0x74]
test byte [eax], al
mov ecx, eax
mov eax, 0xaaaaaaab
mov edx, dword [esp + 0x70]
mov ebx, edx
mul edx
shr edx, 1
lea eax, [edx + edx*2]
sub ebx, eax
lea eax, [ecx + ebx*4 + 0xe0]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x64], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x14]
mov dword [esp + 0x40], esi
mov dword [esp], eax
call fcn.00402cb0
mov eax, dword [esp + 4]
test eax, eax
je 0x45ec3e
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x45ecc6
mov eax, dword [esp + 0x74]
lea ecx, [eax + 0xe0]
mov dword [esp], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
call fcn.0045fb50
movzx eax, byte [esp + 8]
test al, al
jne 0x45ec6f
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x40]
jmp 0x45ecc6
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
movzx ebx, byte [eax + 0x6e]
mov ebp, dword [esp + 0x64]
mov dword [esp], ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], bl
call fcn.0045f860
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x60], ebx
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x70]
mov ecx, eax
and eax, 1
mov edx, dword [esp + 0x74]
lea eax, [edx + eax*8 + 0xec]
mov edi, dword [eax]
mov esi, dword [eax + 4]
add edi, 1
mov dword [esp + 0x3c], edi
mov dword [eax], edi
adc esi, 0
mov dword [eax + 4], esi
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x78]
mov dword [esp], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
call fcn.0045f5f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
lea edi, [esp + 0x48]
mov edx, eax
xor eax, eax
call fcn.0046f20a
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 0x50]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x15
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.0045d1c0
add esp, 0x68
ret
call fcn.0046db70
jmp fcn.0045ebb0
Function at 0x462ad0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x462b6b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x14a5898]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0046f207
lea ecx, [0x462b80]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0046da80
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0046db70
jmp fcn.00462ad0
Function at 0x46ee20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x14a6320]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46d5ab
je 0x46d5fe
cmp ebx, 0x20
jbe 0x46d604
cmp ebx, 0x40
jbe 0x46d64a
jmp 0x46d6eb
test ebx, ebx
je 0x46d5f4
add eax, 0x10
test ax, 0xff0
je 0x46d5e0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xef76e0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xef77e0]
jmp 0x46d5c8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46d5c8
pxor xmm1, xmmword [0x14a6330]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x14a6330]
pxor xmm2, xmmword [0x14a6340]
pxor xmm3, xmmword [0x14a6350]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x14a6330]
pxor xmm2, xmmword [0x14a6340]
pxor xmm3, xmmword [0x14a6350]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46d74a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x14a56ca], 0
je 0x46ee3a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46d570
jmp fcn.004097c0
Function at 0x483790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48389c
sub esp, 0x54
mov eax, dword [esp + 0x60]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov eax, dword [0x144daf0]
mov dword [esp + 0x38], eax
nop
mov dword [esp], eax
call fcn.0047e7f0
mov eax, dword [esp + 4]
test eax, eax
jne 0x483886
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov edi, dword [edi + 0x14]
mov edi, dword [edi + 0xc]
mov dword [esp], edi
mov dword [esp + 4], 8
mov edi, dword [esp + 0x58]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call fcn.0046cf70
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x483866
xor eax, eax
xor ecx, ecx
jmp 0x48387a
mov dword [esp], eax
call fcn.0040ab40
mov eax, dword [esp + 4]
mov ecx, eax
lea eax, [0xeeb428]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x54
ret
je 0x48388b
mov eax, dword [eax + 4]
mov ecx, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0043b1a0
nop
call fcn.0046db70
jmp fcn.00483790
Function at 0x48eb50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48ecdb
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.0046f20b
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x48eb7f
xor edx, edx
jmp 0x48ebaa
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0xd94424]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.00403260
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x48ebb5
mov edx, 1
jmp 0x48ebe9
cmp ecx, 0x23
je 0x48ebbe
xor edx, edx
jmp 0x48ebe9
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0xda1d0b]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.00403260
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x48ec43
lea edi, [esp + 0x3c]
call fcn.0046f20b
mov ecx, dword [0x144dc34]
lea edx, [0xeeb510]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.0049bb30
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.0046f6ee
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x48ecba
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.0046f20b
mov ecx, dword [0x144dc30]
mov edx, dword [0x144dc34]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.0048ecf0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.0046f6ee
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0046f6ee
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0046f6ee
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.0046db70
jmp fcn.0048eb50
Function at 0x49a290
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49a47a
sub esp, 0x48
mov eax, dword [0x144dc30]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.00496400
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046f6ee
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046f6ee
call fcn.00493bd0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00466420
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x49a367
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x49a381
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x49a3f8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49a3ce
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49a3ca
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x49a3c3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x49a3d0
mov ebx, 0x1d
jmp 0x49a3ee
mov ebp, eax
jmp 0x49a3d0
mov ebp, eax
cmp ebp, 0xd
jae 0x49a46d
lea eax, [ebp - 1]
lea edx, [0x13cfce0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x49a463
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x49a3f8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x49a42a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x49a432
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.0046eff0
mov eax, ebp
mov ecx, 0xd
call fcn.0046eff0
nop
call fcn.0046db70
jmp fcn.0049a290
Function at 0x52a550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52a6fa
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0046f20b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x52a57f
inc ebx
cmp edx, ebx
jle 0x52a69e
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x52a642
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x52a5f3
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x52a57e
lea edi, [esp + 0x28]
call fcn.0046f20b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0052aee0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0046f6ee
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0046f6ee
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.0046f20b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0052aad0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0046f6ee
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0046f6ee
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0046f20a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0xd8d8c2]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.0046f20b
lea ecx, [0xcf11c0]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040aa10
mov ecx, dword [esp + 8]
lea edx, [0xeeb400]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0046f20a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0xd8b113]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.0046f20b
lea ecx, [0xcf11c0]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040aa10
mov ecx, dword [esp + 8]
lea edx, [0xeeb400]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.0046db70
jmp fcn.0052a550
Function at 0x598a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x598c1c
sub esp, 0x68
lea edi, [esp + 0x78]
xor eax, eax
call fcn.0046f20b
mov dword [esp], 0
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 8], ecx
call fcn.00456240
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x30], edx
lea edi, [esp + 0x50]
xor eax, eax
call fcn.0046f20b
lea ecx, [0xd9af4d]
mov dword [esp], ecx
mov dword [esp + 4], 0x1d
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
call fcn.0048eb50
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x28]
lea edi, [esp + 0x50]
lea esi, [esp + 0x10]
call fcn.0046f6ee
lea edi, [esp + 0x78]
lea esi, [esp + 0x50]
call fcn.0046f6ee
mov ecx, dword [esp + 0x34]
test ecx, ecx
jne 0x598c0a
mov dword [esp + 0x64], edx
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.0046f6ee
lea eax, [0xd9af4d]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x1d
call fcn.0048c160
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
cmp eax, edx
jne 0x598b5a
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.00403260
movzx eax, byte [esp + 0xc]
test al, al
je 0x598b56
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x64]
jmp 0x598bf8
mov edx, dword [esp + 0x30]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0040ac40
mov eax, dword [esp + 8]
lea ecx, [0xc68880]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0040ac40
mov eax, dword [esp + 8]
lea ecx, [0xc68880]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
lea eax, [0xdbfb32]
mov dword [esp], eax
mov dword [esp + 4], 0x6a
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004dfc30
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x68
ret
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x68
ret
call fcn.0046db70
jmp fcn.00598a40
Function at 0x60b660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60b807
sub esp, 0x30
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.0060c160
movzx eax, byte [esp + 0xc]
test al, al
je 0x60b6ef
mov eax, dword [esp + 0x28]
test eax, eax
je 0x60b6ef
mov edx, dword [esp + 0x24]
cmp eax, 1
je 0x60b6e2
movzx ebx, byte [edx]
test bl, bl
jne 0x60b6d4
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x60b6ef
cmp bl, 0xff
jne 0x60b6e2
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x60b6ef
cmp eax, 8
jg 0x60b6f8
mov ebx, dword [esp + 0x38]
xor ecx, ecx
jmp 0x60b723
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
jg 0x60b6ef
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x60b703
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x20], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x40]
neg ecx
mov byte [esp + 0x13], cl
shl ebp, cl
mov dword [esp + 0x1c], ebp
mov edi, edx
shl edx, cl
add eax, 0xffffffe0
mov byte [esp + 0x12], al
mov ecx, eax
shr edi, cl
mov dword [esp + 0x18], edi
neg eax
mov ecx, eax
mov esi, dword [esp + 0x20]
shl esi, cl
movzx edi, byte [esp + 0x13]
xchg edi, eax
shr al, 5
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov dword [esp + 0x20], edi
cmp al, 0x20
sbb edi, edi
sbb ebp, ebp
and edi, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x11], al
xchg ebp, eax
movzx ecx, byte [esp + 0x13]
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and edx, esi
mov dword [ebx], edx
mov ebp, dword [esp + 0x1c]
and ebp, esi
not eax
or eax, ecx
mov byte [esp + 0x13], al
shr edx, cl
and edx, esi
mov esi, dword [esp + 0x20]
cmp esi, 1
sbb esi, esi
xor esi, 0xffffffff
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x12]
cmp cl, 0x20
sbb eax, eax
mov esi, dword [esp + 0x18]
and esi, eax
or ebp, esi
or ebp, edi
mov dword [ebx + 4], ebp
mov esi, ebp
shl ebp, cl
and ebp, eax
or edx, ebp
movzx ecx, byte [esp + 0x11]
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0x20]
and ebp, esi
or ebp, edx
mov dword [ebx], ebp
movzx ecx, byte [esp + 0x13]
sar eax, cl
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x60b6f8
call fcn.0046db70
jmp fcn.0060b660
Function at 0x62a520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x14a5898]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x62a66c
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.0060c160
movzx eax, byte [esp + 0xc]
test al, al
jne 0x62a588
lea eax, [0xc99640]
mov dword [esp], eax
call fcn.0040d3b0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0xda7539]
mov dword [eax], ecx
lea ecx, [0xeeb34c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x62a658
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.0060c7a0
movzx eax, byte [esp + 0x10]
test al, al
je 0x62a625
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x62a588
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0xc99640]
mov dword [esp], eax
call fcn.0040d3b0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0xda61c3]
mov dword [eax], ecx
lea ecx, [0xeeb34c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0046db70
jmp fcn.0062a520