joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90c4770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d4bd2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.09038232
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09038232
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09009307
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.09038232
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90c4820
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09038232
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x90c499a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x90c4891
xor eax, eax
jmp 0x90c48be
cmp eax, ecx
jb 0x90c489c
mov eax, 0x8000
jmp 0x90c48be
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x90c4881
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.090198a7
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901e58a
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x280
mov dword [ebp - 0xb2c], eax
call fcn.09038232
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90c492a
push esi
mov ecx, eax
call fcn.09038232
mov edx, eax
jmp 0x90c492c
xor edx, edx
movsd xmm1, qword [ebx + 0x10]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mulsd xmm1, qword [0x90e7a70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
comisd xmm0, xmm1
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
jbe 0x90c495a
subsd xmm1, qword [0x90dd3d8]
jmp 0x90c4962
addsd xmm1, qword [0x90dd3d8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x7a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x78], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.09038232
int3
Function at 0x402f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x402f40
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f4005
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x402f47
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x413610
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 0
mov esp, ebp
pop ebp
ret
Function at 0x413d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jne 0x413d46
movzx eax, byte [ebp + 8]
xor eax, 0x20
sub eax, 0xa1
cmp eax, 0x3c
jae 0x413d41
cmp dword [ebp + 0xc], 0
je 0x413d3a
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
mov al, 1
jmp 0x413dd3
jmp 0x413dd1
cmp dword [ebp + 0x10], 1
jne 0x413d84
movzx edx, byte [ebp + 8]
cmp edx, 0xa1
jl 0x413d63
movzx eax, byte [ebp + 8]
cmp eax, 0xf4
jle 0x413d6f
movzx ecx, byte [ebp + 8]
cmp ecx, 0x8e
jne 0x413d82
cmp dword [ebp + 0xc], 0
je 0x413d7e
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov al, 1
jmp 0x413dd3
jmp 0x413dd1
cmp dword [ebp + 0x10], 2
jne 0x413dd1
movsx eax, byte [ebp + 8]
and eax, 0x80
je 0x413dd1
cmp dword [ebp + 0xc], 0
je 0x413dcd
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov dword [ebp - 4], 0x80
jmp 0x413db5
mov edx, dword [ebp - 4]
sar edx, 1
mov dword [ebp - 4], edx
movsx eax, byte [ebp + 8]
and eax, dword [ebp - 4]
je 0x413dcd
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x413dad
mov al, 1
jmp 0x413dd3
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4169c0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x673fdb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x82fa48]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0x280
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0x1e0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x18], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0xff
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0x10000
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0x10000
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x30], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0xff
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0x10000
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0x10000
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], 0
push 0x7b55f4
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00404eb0
mov dword [ebp - 4], 0
push 0x7b55f4
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.00404eb0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x7c], 0x18
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x7d], 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x80], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x84], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x88], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x90], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x94], 0xffffff
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x98], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x9c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xa0], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xa4], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0xa8], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xa9], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4376e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.00445650
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], 1
jmp 0x437722
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], edx
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x9c0], 0x270
jae 0x437777
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx*4 - 4]
shr edx, 0x1e
mov ecx, dword [ebp - 8]
xor edx, dword [ecx + eax*4 - 4]
imul edx, edx, 0x6c078965
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x9c0]
and edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], edx
jmp 0x43770d
mov esp, ebp
pop ebp
ret 4

Function at 0x465190
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [0x846365]
test eax, eax
je 0x4651a7
jmp 0x465256
mov dword [ebp - 8], 0x80000000
mov byte [ebp - 2], 0x80
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0x80
jmp 0x4651cb
mov cl, byte [ebp - 0xd]
shr cl, 1
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x465215
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
je 0x4651eb
mov edx, dword [ebp - 0xc]
xor edx, 0x80000000
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000000
je 0x46520b
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor edx, 0x4c11db7
mov dword [ebp - 0xc], edx
jmp 0x465213
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4651c3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004607d0
add esp, 4
mov esi, eax
movzx edx, byte [ebp - 1]
push edx
call fcn.00468a90
add esp, 4
movzx eax, al
mov dword [eax*4 + 0x846368], esi
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x4651b6
mov byte [0x846365], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46b280
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9c0], 0x270
jne 0x46b2a0
mov ecx, dword [ebp - 8]
call fcn.004703f0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cf440
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xca
jne 0x4cf482
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d0d10
add esp, 4
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x40]
test eax, eax
je 0x4cf478
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0xcf
mov al, 1
jmp 0x4cf598
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xcb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcb
jne 0x4cf558
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a0]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x4cf547
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x4cf4bf
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
call dword [ecx]
add esp, 4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1a0]
call dword [ecx]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cf4e1
xor al, al
jmp 0x4cf598
cmp dword [ebp - 4], 2
jne 0x4cf4e9
jmp 0x4cf547
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
je 0x4cf542
cmp dword [ebp - 4], 3
je 0x4cf4fe
cmp dword [ebp - 4], 1
jne 0x4cf542
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
add edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [eax + 4]
cmp eax, dword [edx + 8]
jl 0x4cf542
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x120]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 8]
mov dword [ecx + 8], eax
jmp 0x4cf4a7
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x7c]
mov dword [edx + 0x84], ecx
jmp 0x4cf58c
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 0xcc
je 0x4cf58c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ecx + 0x14], 0x15
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.004cf5a0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4cf5a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x4cf5d6
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x190]
call dword [eax]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xcc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
movzx edx, byte [ecx + 8]
test edx, edx
je 0x4cf69b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x78]
cmp edx, dword [ecx + 0x60]
jae 0x4cf667
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x4cf62f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov dword [edx + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x60]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp + 8]
add edx, 0x78
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x194]
call dword [edx + 4]
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
cmp ecx, dword [ebp - 4]
jne 0x4cf665
xor al, al
jmp 0x4cf6b6
jmp 0x4cf5eb
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
call dword [ecx + 4]
add esp, 4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
call dword [ecx]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x78], 0
jmp 0x4cf5d6
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x41]
neg ecx
sbb ecx, ecx
neg ecx
add ecx, 0xcd
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x570f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 0x10]
cmp ecx, dword [eax + 0x130]
jge 0x570f7e
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x231]
test eax, eax
je 0x570f79
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x81
jmp 0x57101d
mov edx, dword [ebp + 8]
cmp dword [edx + 0x130], 0
jle 0x57101d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
sub ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
mov cx, word [eax + ecx*4]
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x98]
cmp edx, ecx
jb 0x570fdf
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x231]
test eax, eax
je 0x570fdd
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x86
jmp 0x571036
jmp 0x571003
movzx edx, word [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa8]
movzx edx, byte [ecx + edx]
xor edx, 1
movzx eax, word [ebp - 4]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xa8]
mov byte [eax + ecx], dl
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x130]
sub eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x130], eax
jmp 0x570f7e
mov edx, dword [ebp + 8]
mov dword [edx + 0x130], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x20], edx
mov esp, ebp
pop ebp
ret
Function at 0x5d5aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x178
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp + 8]
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5d5ac9
xor eax, eax
jmp 0x5d5c78
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x78
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 4], 8
mov edx, dword [ebp - 8]
mov byte [edx + 0x14], 0x21
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x14]
and ecx, 3
mov edx, dword [ebp - 0x10]
mov byte [edx + 5], cl
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 5]
or ecx, 0x60
mov edx, dword [ebp - 0x10]
mov byte [edx + 5], cl
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005d5540
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x70], ecx
mov edx, dword [ebp - 8]
add edx, 0x78
mov eax, dword [ebp - 8]
mov dword [eax + 0x88], edx
mov ecx, dword [ebp - 8]
add ecx, 0x78
mov edx, dword [ebp - 8]
mov dword [edx + 0x8c], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x58], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x15], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
add ecx, 0x1c
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], 0x178
mov edx, dword [ebp - 8]
mov dword [edx + 0x50], 0xc8
mov eax, dword [ebp - 8]
mov dword [eax + 0x54], 0xc8
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0
jmp 0x5d5c32
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 9
jge 0x5d5c4b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4 + 0x98], 0
jmp 0x5d5c29
push 0
push 0x5d5870
mov edx, dword [ebp - 0x10]
push edx
call fcn.005df780
add esp, 0xc
test eax, eax
je 0x5d5c75
mov eax, dword [ebp - 0x10]
push eax
call fcn.005d5950
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5de300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x14]
xor eax, 3
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x5de3d0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
test eax, eax
jbe 0x5de3d0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 4]
cmp eax, 8
jne 0x5de363
push 0xfffffffffffffffd
mov ecx, dword [ebp - 4]
add ecx, 0x68
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005de300
add esp, 0xc
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 5]
xor ecx, 3
and ecx, dword [ebp - 0xc]
je 0x5de39b
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 5]
and eax, 0xf8
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x14]
and edx, 3
movzx ecx, dl
or eax, ecx
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
jmp 0x5de3cb
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x1c]
jne 0x5de3bb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005de110
add esp, 8
jmp 0x5de31c
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x6001f0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6664cd
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x82fa48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a8], ecx
mov eax, dword [ebp - 0x1a8]
mov dword [eax], vtable.artemis::CClientSocket.0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1a8]
add ecx, 8
call fcn.00404eb0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1a8]
mov ax, word [ebp + 0xc]
mov word [edx + 0x24], ax
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x1a8]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x1a8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + 0x34], 0
mov ecx, dword [ebp - 0x1a8]
add ecx, 0x38
call fcn.004c7430
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1a8]
mov dword [edx + 0x58], 0xffffffff
mov eax, dword [ebp - 0x1a8]
mov dword [eax + 0x5c], 0
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + 0x60], 0
mov edx, dword [ebp - 0x1a8]
mov byte [edx + 0x64], 0
mov eax, dword [ebp - 0x1a8]
mov byte [eax + 0x65], 0
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + 0x68], 0
mov edx, dword [ebp - 0x1a8]
mov dword [edx + 0x6c], 0
mov ecx, dword [ebp - 0x1a8]
add ecx, 0x70
call fcn.00481440
mov eax, dword [ebp - 0x1a8]
mov dword [eax + 0x90], 0xfff
mov ecx, dword [ebp - 0x1a8]
add ecx, 0x98
call fcn.004b15e0
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + 0xb8], 0
cmp dword [0x846778], 0
jne 0x600346
lea edx, [ebp - 0x1a4]
push edx
push 2
call dword [0x685330]
mov eax, dword [0x846778]
add eax, 1
mov dword [0x846778], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1e40
mov esp, ebp
pop ebp
ret 8