joyce8/EMBER2024-capa huggingface dataset:
Function at 0x701de448
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 0x10]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
jmp 0x701de551
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp eax, ebx
mov esi, ebx
cmovle esi, eax
mov eax, ebx
sub eax, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ecx, eax
shr edi, cl
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
add eax, ecx
movzx eax, byte [eax]
mov edi, eax
mov eax, dword [esi*4 + 0x708458e0]
mov edx, dword [ebp - 0x1c]
and edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
sub eax, esi
mov edx, dword [ebp - 0x20]
mov ecx, eax
shl edx, cl
mov eax, edx
or eax, edi
mov edi, dword [ebp - 0x24]
mov byte [edi], al
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, eax
sub edx, esi
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x701de54f
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp edx, eax
jl 0x701de53f
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 1
mov dword [esp], str.buffer_putbits:_error._bit_stream_buffer_needs_to_be_bigger_n
call sub.msvcrt.dll_fwrite
jmp 0x701de559
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
add eax, edx
mov byte [eax], 0
sub ebx, esi
test ebx, ebx
jg 0x701de46a
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x701e1b6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jle 0x701e1b7e
cmp dword [ebp + 8], 2
jle 0x701e1bb0
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Internal_error__read_cbound____n
call sub.msvcrt.dll_fwrite
mov eax, 0
jmp 0x701e1cba
cmp dword [ebp + 0xc], 0
js 0x701e1bc2
cmp dword [ebp + 0xc], 6
jg 0x701e1bc2
cmp dword [ebp + 0xc], 3
jne 0x701e1bf4
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Internal_error__read_cbound____n
call sub.msvcrt.dll_fwrite
mov eax, 0
jmp 0x701e1cba
mov eax, dword [ebp + 0xc]
shl eax, 4
lea edx, [eax*8]
sub edx, eax
lea eax, [edx + 0x7084c2c0]
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shl eax, 2
mov dword [esp + 8], str..._.._source_twolame_0.3.13_libtwolame_psycho_1.c
mov dword [esp + 4], 0x40
mov dword [esp], eax
call fcn.701dd9e4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x701e1cad
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 1]
mov eax, dword [ebp + 0xc]
shl eax, 2
lea edx, [eax*8]
sub edx, eax
lea eax, [edx + ecx]
mov eax, dword [eax*4 + 0x7084c2c0]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x701e1c7e
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
add edx, eax
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
add dword [ebp - 0xc], 1
jmp 0x701e1cad
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Internal_error__read_cbound____n
call sub.msvcrt.dll_fwrite
mov eax, 0
jmp 0x701e1cba
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
jg 0x701e1c3c
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x701e1cbc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
cmp dword [ebp + 0x10], 0
js 0x701e1cd5
cmp dword [ebp + 0x10], 6
jg 0x701e1cd5
cmp dword [ebp + 0x10], 3
jne 0x701e1d02
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x22
mov dword [esp + 4], 1
mov dword [esp], str.Internal_error__read_freq_band____n
call sub.msvcrt.dll_fwrite
jmp 0x701e1e43
mov eax, dword [ebp + 0x10]
mov eax, dword [eax*4 + 0x70846bf8]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
shl eax, 5
mov dword [esp + 8], str..._.._source_twolame_0.3.13_libtwolame_psycho_1.c
mov dword [esp + 4], 0x5d
mov dword [esp], eax
call fcn.701dd9e4
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
fldz
fstp qword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
fldz
fstp qword [eax + 0x10]
mov dword [ebp - 0xc], 1
jmp 0x701e1e35
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov ecx, dword [ebp + 0x10]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
imul edx, ecx, 0xc60
add eax, edx
add eax, 0x70846c20
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x701e1e0b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
shl edx, 5
add edx, eax
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
shl edx, 5
lea ecx, [eax + edx]
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov ebx, dword [ebp + 0x10]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
imul edx, ebx, 0xc60
add eax, edx
add eax, 0x70846c20
fld qword [eax + 8]
fstp qword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
shl edx, 5
lea ecx, [eax + edx]
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov ebx, dword [ebp + 0x10]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
imul edx, ebx, 0xc60
add eax, edx
add eax, 0x70846c30
fld qword [eax]
fstp qword [ecx + 0x10]
add dword [ebp - 0xc], 1
jmp 0x701e1e35
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x22
mov dword [esp + 4], 1
mov dword [esp], str.Internal_error__read_freq_band____n
call sub.msvcrt.dll_fwrite
jmp 0x701e1e43
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
jg 0x701e1d64
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x701e3b5c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 0
js 0x701e3b6e
cmp dword [ebp + 0xc], 3
jle 0x701e3b98
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x22
mov dword [esp + 4], 1
mov dword [esp], 0x7084c898
call sub.msvcrt.dll_fwrite
jmp 0x701e3bd7
mov dword [ebp - 0xc], 0
jmp 0x701e3bcd
mov eax, dword [ebp - 0xc]
lea edx, [eax*8]
mov eax, dword [ebp + 8]
lea ecx, [edx + eax]
mov edx, dword [ebp + 0xc]
mov eax, edx
shl eax, 9
add eax, edx
mov edx, dword [ebp - 0xc]
add eax, edx
fld qword [eax*8 + 0x7084c9c0]
fstp qword [ecx]
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x200
jle 0x701e3ba1
nop
leave
ret
Function at 0x701e6abf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], str.3_Ton:
call sub.msvcrt.dll_fwrite
mov dword [ebp - 0xc], 1
jmp 0x701e6b44
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 8]
add eax, edx
mov eax, dword [eax]
cmp eax, 0x14
jne 0x701e6b40
mov eax, dword [ebp - 0xc]
lea edx, [eax*8]
mov eax, dword [ebp + 0xc]
add eax, edx
fld qword [eax]
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edx, [eax + 0x40]
fstp qword [esp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__i___3.0f
mov dword [esp], edx
call fcn.6fef8058
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x1ff
jle 0x701e6af6
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], str.3_Nos:
call sub.msvcrt.dll_fwrite
mov dword [ebp - 0xc], 1
jmp 0x701e6be4
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
cmp eax, 0xa
jne 0x701e6be0
mov eax, dword [ebp - 0xc]
lea edx, [eax*8]
mov eax, dword [ebp + 0x14]
add eax, edx
fld qword [eax]
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edx, [eax + 0x40]
fstp qword [esp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__i___3.0f
mov dword [esp], edx
call fcn.6fef8058
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x1ff
jle 0x701e6b96
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
leave
ret
Function at 0x702aa890
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.ORC_CODE
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x702aa8c3
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.702c886c
mov dword [0x70ef0414], eax
mov dword [esp], str.backup
call fcn.702aa909
mov dword [0x710829b8], eax
mov dword [esp], str.emulate
call fcn.702aa909
mov dword [0x710829b4], eax
mov dword [esp], str.debug
call fcn.702aa909
mov dword [0x710829b0], eax
mov dword [esp], str.randomize
call fcn.702aa909
mov dword [0x710829ac], eax
leave
ret

Function at 0x702adfec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.ORC_DEBUG
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x702ae03b
mov dword [ebp - 0x14], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jbe 0x702ae03b
mov eax, dword [ebp - 0x10]
mov dword [0x70477ac4], eax
mov dword [esp + 0x10], str.orc_0.4.16_debug_init
mov dword [esp + 0xc], 0x42
mov dword [esp + 8], str._orc_debug_init
mov dword [esp + 4], str..._.._source_orc_0.4.16_orc_orcdebug.c
mov dword [esp], 3
call fcn.702ae10c
leave
ret
Function at 0x702c90ff
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x10000
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x10000
leave
ret
Function at 0x70327b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov eax, dword [eax + 4]
test edx, edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x2c]
je 0x70327cc3
mov edi, dword [ebp + 0x24]
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 0
imul edi, eax
shl eax, 2
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x70]
add edx, edi
lea ebx, [edi*4]
lea esi, [edx*4]
mov dword [esp + 0x38], eax
lea eax, [ebp + 0x40]
mov dword [esp + 0x48], edi
mov edi, ebp
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov esi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
test eax, eax
jle 0x70327be5
mov eax, edi
mov edi, ebx
mov ebx, eax
nop
lea esi, [esi]
mov ecx, dword [esp + 0x28]
add edi, 1
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 8], esi
add esi, 4
mov dword [esp + 4], ebp
mov dword [esp], edx
mov dword [esp + 0xc], ecx
call fcn.7032cad0
add ebp, dword [esp + 0x2c]
cmp edi, dword [esp + 0x20]
jne 0x70327ba0
mov edi, ebx
mov eax, dword [esp + 0x44]
add dword [esp + 0x34], 1
add dword [esp + 0x3c], eax
mov eax, dword [esp + 0x40]
add dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x78]
jl 0x70327b83
cmp dword [esp + 0x78], 2
jne 0x70327c16
cmp dword [esp + 0x74], 1
je 0x70327c89
cmp dword [esp + 0x80], 1
je 0x70327c81
mov eax, dword [esp + 0x48]
xor esi, esi
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x48]
cdq
idiv dword [esp + 0x80]
lea edi, [eax*4]
lea esi, [esi]
test eax, eax
jle 0x70327cbf
fild dword [esp + 0x80]
lea ebp, [ecx + edi]
mov edx, ecx
fld dword [edx]
add edx, 4
fmul st(1)
fstp dword [edx - 4]
cmp edx, ebp
jne 0x70327c50
fstp st(0)
mov edx, eax
cmp edx, ebx
jge 0x70327c74
mov dword [ecx + edx*4], 0
add edx, 1
cmp edx, ebx
jne 0x70327c66
add esi, 1
add ecx, dword [esp + 0x40]
cmp dword [esp + 0x74], esi
jg 0x70327c40
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x48]
test ecx, ecx
jle 0x70327c16
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x70]
add edx, dword [esp + 0x70]
fld dword [0x708b0448]
fld dword [eax]
fmul st(1)
fld dword [eax + ecx*4]
add eax, 4
fmul st(2)
faddp st(1)
fstp dword [eax - 4]
cmp eax, edx
jne 0x70327ca3
fstp st(0)
jmp 0x70327c16
xor edx, edx
jmp 0x70327c62
movzx ecx, byte [esp + 0x7c]
mov esi, dword [ebp + 0x24]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x20], 1
shl eax, cl
mov dword [esp + 0x28], esi
sub dword [esp + 0x28], edi
jmp 0x70327b38
Function at 0x70330a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x70]
fldz
mov esi, dword [esp + 0x7c]
fst dword [esp + 0x38]
mov edi, dword [esp + 0x64]
fst dword [esp + 0x3c]
mov ebp, dword [esp + 0x74]
imul ecx, ebx, 0x2a
imul eax, esi, 0x54
test ebx, ebx
lea eax, [ecx + eax + 0x708b06c0]
mov dword [esp + 0x28], eax
jne 0x70330c68
fstp st(0)
fld dword [esi*4 + 0x708b0810]
fstp dword [esp + 0x18]
fld dword [esi*4 + 0x708b0820]
fstp dword [esp + 0x14]
mov eax, dword [ebp + 4]
fldz
shl eax, 3
cmp edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
jge 0x70330c5b
mov esi, edi
mov edi, dword [esp + 0x6c]
nop
mov edx, dword [esp + 0x28]
cmp esi, 0x14
mov eax, 0x14
cmovle eax, esi
mov dword [esp + 0x74], ebp
mov ebp, edi
mov edi, esi
mov esi, dword [esp + 0x74]
add eax, eax
lea ebx, [edx + eax + 1]
add eax, edx
mov dword [esp + 0x20], ebx
xor ebx, ebx
mov dword [esp + 0x24], eax
bsr eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x10]
xor eax, 0x1f
lea eax, [eax + ecx - 0x20]
sub edx, eax
cmp edx, 0xe
jg 0x70330c22
cmp edx, 1
jle 0x70330bd8
mov dword [esp + 8], 2
fstp dword [esp + 0x1c]
mov dword [esp + 4], 0x708b06a0
mov dword [esp], esi
call fcn.70331ab0
mov ecx, eax
and eax, 1
sar ecx, 1
neg eax
xor eax, ecx
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fld dword [esp + 0x1c]
jmp 0x70330b90
fxch st(1)
lea esi, [esi]
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + 8]
imul eax, ebx
add eax, edi
lea eax, [ebp + eax*4]
fld dword [eax]
fld dword [0x708b08a8]
fucomi st(1)
fcmovbe st(0), st(1)
fstp st(1)
fmul dword [esp + 0x14]
fadd st(1)
fadd st(2)
fstp dword [eax]
fadd st(1)
fxch st(1)
fmul dword [esp + 0x18]
fsubp st(1)
fstp dword [esp + ebx*4 + 0x38]
add ebx, 1
cmp ebx, dword [esp + 0x78]
jge 0x70330c04
fld dword [esp + ebx*4 + 0x38]
jmp 0x70330b2d
fld1
fchs
jne 0x70330b88
fstp st(0)
mov dword [esp + 4], 1
fstp dword [esp + 0x1c]
mov dword [esp], esi
call fcn.70331a70
neg eax
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fld dword [esp + 0x1c]
jmp 0x70330b90
mov dword [esp + 0x74], esi
mov esi, edi
mov edi, ebp
add esi, 1
mov ebp, dword [esp + 0x74]
cmp esi, dword [esp + 0x68]
je 0x70330c60
fld dword [esp + 0x38]
jmp 0x70330b00
mov eax, dword [esp + 0x20]
fstp dword [esp + 0x1c]
movzx eax, byte [eax]
shl eax, 6
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
movzx eax, byte [eax]
mov dword [esp], esi
shl eax, 7
mov dword [esp + 4], eax
call fcn.7033b650
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fld dword [esp + 0x1c]
jmp 0x70330b90
fstp st(0)
lea esi, [esi]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
fld dword [0x708b08a4]
fstp dword [esp + 0x18]
fstp dword [esp + 0x14]
jmp 0x70330ae2
Function at 0x70348290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
movzx edx, word [0x708b3860]
mov ebp, 0x7fffffff
mov dword [esp], 0
mov edi, dword [esp]
movsx ecx, dx
movsx eax, word [edi + edi + 0x708b3862]
mov word [esp + 0x12], ax
sub eax, ecx
mov ebx, eax
movzx eax, ax
sar ebx, 0x10
imul eax, eax, 0x199a
imul ebx, ebx, 0x199a
sar eax, 0x10
lea edx, [ebx + eax]
lea eax, [edx + edx]
add edx, ecx
mov dword [esp + 8], eax
mov eax, edi
xor ecx, ecx
mov byte [esp + 0x11], al
mov ebx, dword [esp + 4]
mov edi, edx
mov eax, dword [esp + 0x28]
mov eax, dword [eax + ebx*4]
sub eax, edx
mov ebx, eax
sar ebx, 0x1f
xor eax, ebx
sub eax, ebx
cmp eax, ebp
jge 0x70348360
movzx ebx, byte [esp]
mov byte [esi + 1], cl
add ecx, 1
movzx ebp, byte [esp + 0x11]
add edx, dword [esp + 8]
cmp ecx, 5
mov byte [esi], bl
je 0x70348340
mov dword [esp + 0xc], edi
mov ebp, eax
jmp 0x703482fe
add dword [esp], 1
mov ebx, ebp
cmp dword [esp], 0xf
je 0x703483b3
movzx edx, word [esp + 0x12]
mov ebp, eax
mov dword [esp + 0xc], edi
jmp 0x703482be
movzx ebx, byte [esi]
movsx ax, bl
mov edx, ebx
mov edi, dword [esp + 4]
imul eax, eax, 0x56
mov ecx, dword [esp + 0xc]
add esi, 3
sar dl, 7
add dword [esp + 4], 1
shr ax, 8
sub eax, edx
mov byte [esi - 1], al
lea eax, [eax + eax*2]
sub ebx, eax
mov eax, dword [esp + 0x28]
mov byte [esi - 3], bl
cmp dword [esp + 4], 2
mov dword [eax + edi*4], ecx
jne 0x703482ab
mov edi, dword [esp + 0x28]
mov eax, dword [eax + 4]
sub dword [edi], eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edi
jmp 0x70348363
Function at 0x70348d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
mov esi, dword [esp + 0xb0]
movsx eax, byte [eax]
movsx edx, word [edi + 2]
mov ecx, eax
imul ecx, edx
add ecx, dword [edi + 8]
test edx, edx
jle 0x70348dd4
xor eax, eax
movzx edx, byte [ecx + eax]
shl edx, 7
mov word [esi + eax*2], dx
movsx edx, word [edi + 2]
add eax, 1
cmp edx, eax
jg 0x70348db4
mov eax, dword [esp + 0xb4]
movsx eax, byte [eax]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 8], edi
call fcn.70344580
movsx eax, word [edi + 2]
movsx ebx, word [edi + 4]
test eax, eax
mov dword [esp + 0x1c], eax
jle 0x70348e7e
lea ecx, [esp + 0x50]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0xb0], esi
mov esi, dword [esp + 0xb4]
mov dword [esp + 0xb8], edi
mov edi, ecx
jmp 0x70348e45
sub ecx, 0x66
mov ebp, ecx
movzx ecx, cx
sar ebp, 0x10
imul ecx, ebx
imul ebp, ebx
sar ecx, 0x10
add ebp, ecx
add edx, ebp
mov word [edi + eax*2 - 2], dx
sub eax, 1
je 0x70348e70
movzx ecx, byte [esp + eax + 0x1f]
movsx edx, dx
imul edx, ecx
movsx ecx, byte [esi + eax]
shl ecx, 0xa
sar edx, 8
cmp ecx, 0
jg 0x70348e23
mov ebp, 0
je 0x70348e39
add ecx, 0x66
jmp 0x70348e26
mov esi, dword [esp + 0xb0]
mov edi, dword [esp + 0xb8]
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.7034f970
movsx eax, word [edi + 2]
lea edx, [esp + 0x50]
mov dword [esp + 0x1c], edx
test eax, eax
jg 0x70348f38
jmp 0x70348f61
bsr edx, eax
mov ecx, 0x18
xor edx, 0x1f
mov ebp, eax
sub ecx, edx
jne 0x70348f4c
mov eax, edx
and ebp, 0x7f
and eax, 1
cmp eax, 1
sbb eax, eax
and eax, 0x3486
sar edx, 1
add eax, 0x8000
mov ecx, edx
sar eax, cl
imul ecx, ebp, 0xd5
mov edx, eax
sar edx, 0x10
movzx ebp, ax
imul edx, ecx
imul ecx, ebp
sar ecx, 0x10
add ecx, edx
add ecx, eax
mov eax, dword [esp + 0x1c]
movsx ebp, word [esi + ebx*2]
movsx eax, word [eax + ebx*2]
shl eax, 0xe
cdq
idiv ecx
add ebp, eax
mov eax, 0x7fff
cmp ebp, 0x7fff
jg 0x70348f29
test ebp, ebp
mov eax, 0
cmovns eax, ebp
mov word [esi + ebx*2], ax
movsx eax, word [edi + 2]
add ebx, 1
cmp eax, ebx
jle 0x70348f61
movsx eax, word [esp + ebx*2 + 0x70]
shl eax, 0x10
test eax, eax
jg 0x70348eb1
xor ecx, ecx
jmp 0x70348efe
ror ebp, cl
test ecx, ecx
jns 0x70348ec6
neg ecx
rol eax, cl
mov ebp, eax
jmp 0x70348ec6
mov dword [esp + 8], eax
mov eax, dword [edi + 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.7034fa90
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7035b228
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.70352810
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 4
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.70352a75
mov dword [esp + 0xc], 4
mov dword [esp + 4], 0x70727879
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov eax, dword [ebp + 8]
cdq
mov dword [esp + 0xc], 8
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov eax, dword [ebp + 0xc]
cdq
mov dword [esp + 0xc], 4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov dword [esp + 0xc], 4
mov dword [esp + 4], 0x6a703263
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov dword [esp + 0xc], 1
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov eax, dword [ebp + 0x10]
cdq
mov dword [esp + 0xc], 8
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov eax, dword [ebp + 0x14]
cdq
mov dword [esp + 0xc], 4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov dword [esp + 0xc], 4
mov dword [esp + 4], 0x63696478
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.70352810
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.70352827
mov eax, dword [ebp - 0x10]
cdq
mov dword [esp + 0xc], 4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.703529ca
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.70352827
leave
ret