joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x524c78
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.00525350
movzx eax, byte [esp + 0xc]
test al, al
je 0x524b51
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
test ecx, ecx
je 0x524b51
cmp ecx, 1
je 0x524b44
movzx ebx, byte [edx]
test bl, bl
jne 0x524b36
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x524b51
cmp bl, 0xff
jne 0x524b44
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x524b51
cmp ecx, 8
jg 0x524b5a
mov ebx, dword [esp + 0x3c]
xor eax, eax
jmp 0x524b71
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x524b51
mov byte [esp + 0x40], 1
add esp, 0x34
ret
movzx esi, byte [edx + eax]
or esi, ebp
mov dword [ebx], esi
mov dword [ebx + 4], edi
inc eax
cmp eax, ecx
jge 0x524b95
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
cmp eax, ecx
jb 0x524b65
jmp 0x524c72
mov dword [esp + 0x14], ecx
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
mov byte [esp + 0x13], dl
cmp dl, 0x20
sbb ebp, ebp
mov dword [esp + 0x24], ebp
add ecx, 0xffffffe0
mov esi, ecx
neg ecx
mov byte [esp + 0x12], cl
cmp cl, 0x20
sbb edi, edi
mov dword [esp + 0x20], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
mov dword [esp + 0x1c], eax
mov edi, dword [ebx]
mov dword [esp + 0x18], edi
mov ebx, dword [ebx + 4]
shl edi, cl
mov ecx, edx
shl ebx, cl
and ebx, ebp
mov ecx, esi
mov ebp, dword [esp + 0x18]
shr ebp, cl
and ebp, eax
or ebp, ebx
mov ebx, dword [esp + 0x20]
and ebx, edi
or ebp, ebx
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 4], ebp
movzx edi, byte [esp + 0x12]
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov dword [esp + 0x20], edx
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp + 0x18]
shl edx, cl
mov eax, dword [esp + 0x24]
and edx, eax
not ebx
or ebx, edi
mov edi, ecx
mov ecx, esi
mov esi, ebp
shl ebp, cl
mov ecx, edi
shr edx, cl
and edx, eax
mov eax, dword [esp + 0x1c]
and ebp, eax
or edx, ebp
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x20]
xor ebx, 0xffffffff
and ebx, esi
or ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [edx], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ecx, ecx
not ecx
or ecx, edi
sar eax, cl
mov dword [edx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x524b5a
call fcn.0045e650
nop
call fcn.0045d190
jmp fcn.00524ac0
Function at 0x5284f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5286d4
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045ed2c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00527aa0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045e876
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x5285a2
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x528675
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x5286a6
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x52859b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x52859b
test byte [eax], al
cmp ebp, 0x20
jb 0x528698
mov eax, ebp
mov ecx, 0x20
call fcn.0045e650
nop
call fcn.0045d190
jmp fcn.005284f0
Function at 0x531fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5321a1
sub esp, 0x34
lea eax, [0x609c80]
mov dword [esp], eax
call fcn.0040b5f0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x53201f
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x532148
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x532173
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x532017
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x532017
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x532017
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x532017
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x5320f2
cmp eax, ebp
jle 0x5320f2
jbe 0x532197
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x53214c
mov eax, esi
mov ecx, edx
call fcn.0045e650
mov ecx, eax
mov eax, ebp
call fcn.0045e650
nop
call fcn.0045d190
jmp fcn.00531fe0
Function at 0x537940
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5379e8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x53799b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x5379d2
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.0045d190
jmp fcn.00537940
Function at 0x53c530
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53c714
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov ebx, edx
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, edx
shl edx, 0x10
or edx, ecx
movzx ecx, byte [eax + 3]
mov esi, ecx
shl ecx, 0x18
or ecx, edx
and ecx, 0xfffffff
movzx edx, byte [eax + 4]
movzx edi, byte [eax + 5]
mov dword [esp + 4], edi
movzx edi, byte [eax + 6]
movzx eax, byte [eax + 7]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [eax + 0x18], ecx
shr ebx, 0x18
shr ebp, 0x10
or ebx, ebp
shr esi, 8
or esi, ebx
or edx, esi
mov ecx, dword [esp + 4]
shl ecx, 8
or edx, ecx
shl edi, 0x10
or edi, edx
mov ecx, dword [esp]
shl ecx, 0x18
or edi, ecx
and edi, 0xffffffc
mov dword [eax + 0x1c], edi
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 8]
movzx ebx, byte [ecx + 9]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0xa]
mov esi, ebx
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [ecx + 0xb]
mov edi, ebx
shl ebx, 0x18
or ebx, edx
and ebx, 0xffffffc
movzx edx, byte [ecx + 0xc]
mov dword [esp + 4], edx
movzx edx, byte [ecx + 0xd]
mov dword [esp], edx
movzx edx, byte [ecx + 0xe]
movzx ecx, byte [ecx + 0xf]
mov dword [eax + 0x20], ebx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or edi, esi
mov ebx, dword [esp + 4]
or ebx, edi
mov ebp, dword [esp]
shl ebp, 8
or ebp, ebx
shl edx, 0x10
or edx, ebp
shl ecx, 0x18
or ecx, edx
and ecx, 0xffffffc
mov dword [eax + 0x24], ecx
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 0x10]
movzx ebx, byte [ecx + 0x11]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0x12]
mov esi, ebx
shl ebx, 0x10
or ebx, edx
movzx edx, byte [ecx + 0x13]
mov edi, edx
shl edx, 0x18
or edx, ebx
movzx ebx, byte [ecx + 0x14]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0x15]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0x16]
movzx ecx, byte [ecx + 0x17]
mov dword [eax + 0x28], edx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or edi, esi
mov edx, dword [esp + 4]
or edx, edi
mov ebp, dword [esp]
shl ebp, 8
or ebp, edx
shl ebx, 0x10
or ebx, ebp
shl ecx, 0x18
or ecx, ebx
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 0x18]
movzx ebx, byte [ecx + 0x19]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0x1a]
mov esi, ebx
shl ebx, 0x10
or ebx, edx
movzx edx, byte [ecx + 0x1b]
mov edi, edx
shl edx, 0x18
or edx, ebx
movzx ebx, byte [ecx + 0x1c]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0x1d]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0x1e]
movzx ecx, byte [ecx + 0x1f]
mov dword [eax + 0x30], edx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or edi, esi
mov edx, dword [esp + 4]
or edx, edi
mov ebp, dword [esp]
shl ebp, 8
or ebp, edx
shl ebx, 0x10
or ebx, ebp
shl ecx, 0x18
or ecx, ebx
mov dword [eax + 0x34], ecx
add esp, 8
ret
call fcn.0045d190
jmp fcn.0053c530
Function at 0x541080
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5411f3
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5410b3
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5410b3
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5410b9
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5410c7
cmp ecx, 4
jne 0x5410f8
cmp al, 0x2c
ja 0x5410e0
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5410f2
cmp al, 0x24
je 0x5410f2
cmp al, 0x26
jae 0x5410f2
jmp 0x5410f8
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5410f2
cmp al, 0x5b
je 0x5410f2
cmp al, 0x5d
jne 0x5410f8
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x54112f
cmp al, 0x26
ja 0x541111
cmp al, 0x24
je 0x54114e
cmp al, 0x26
je 0x54114e
jmp 0x5411d5
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x54114e
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5411cf
cmp al, 0x2f
je 0x54114e
jmp 0x5411d5
cmp al, 0x3d
ja 0x541146
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x54114e
cmp al, 0x3d
je 0x54114e
jmp 0x5411d5
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5411c5
cmp ecx, 2
jg 0x541189
cmp ecx, 1
je 0x54117e
cmp ecx, 2
jne 0x5411d5
cmp al, 0x2f
je 0x54116c
cmp al, 0x3b
je 0x54116c
cmp al, 0x2c
jne 0x541173
mov eax, 1
jmp 0x541179
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5411af
cmp al, 0x40
je 0x54119d
cmp al, 0x2f
je 0x54119d
cmp al, 0x3f
jne 0x5411a4
mov eax, 1
jmp 0x5411aa
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5411bf
cmp ecx, 7
jne 0x5411d5
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5411cf
cmp al, 0x7e
jne 0x5411d5
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5411ed
cmp al, 0x21
je 0x5411e7
add eax, 0xffffffd8
cmp al, 2
ja 0x5411ed
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.0045d190
jmp fcn.00541080
Function at 0x549780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5498d4
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00525350
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5497ea
lea eax, [0x615300]
mov dword [esp], eax
call fcn.0040b5f0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x64a4e7]
mov dword [eax], ecx
lea ecx, [0x69f4b0]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5498c0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00525b80
movzx eax, byte [esp + 0x10]
test al, al
je 0x54988d
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
movzx esi, byte [esp + 0x1b]
xor esi, 0xffffff80
xchg esi, eax
movzx eax, al
xchg esi, eax
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x5497ea
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x615300]
mov dword [esp], eax
call fcn.0040b5f0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x64a057]
mov dword [eax], ecx
lea ecx, [0x69f4b0]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045d190
jmp fcn.00549780
Function at 0x5538e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x553b18
sub esp, 0x6c
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045e874
lea ecx, [0x553b30]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x84]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x98]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x54], ecx
lea edx, [esp + 0x24]
mov dword [esp + 0x58], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x60], edx
lea ebx, [esp + 0x8c]
mov dword [esp + 0x64], ebx
lea ebx, [esp + 0x74]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.00546cd0
mov ecx, dword [esp + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x553a10
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x3c]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x3c]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5539e7
mov eax, dword [esp + 0x88]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.00546cd0
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x553a6d
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x3c]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x3c]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x553a42
mov eax, dword [esp + 0x90]
test eax, eax
jle 0x553a92
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x553b14
mov eax, dword [esp + 0x98]
test eax, eax
jne 0x553b14
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
lea eax, [0x69f938]
mov dword [esp], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.00409020
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x6c
ret
call fcn.0045d190
jmp fcn.005538e0
Function at 0x5614d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5615c2
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
cmp ecx, 1
jl 0x561524
mov edx, dword [esp + 0x18]
movzx ebx, byte [edx + ecx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x56150e
mov eax, ecx
jmp 0x561515
mov eax, ecx
mov ecx, 0x100
mov byte [esp + 0xa], bl
mov dword [esp + 0x10], esi
sar ebp, 0x1f
xor edi, edi
jmp 0x561574
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
inc edi
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
mov dword [esp + 0xc], esi
movzx ebp, byte [eax + edx - 1]
movzx eax, byte [esp + 0xa]
and esi, eax
mov eax, dword [esp + 0xc]
and ebp, eax
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
movzx eax, byte [esp + 0xb]
and ebp, eax
movzx eax, byte [esp + 0xa]
mov esi, dword [esp + 0x10]
mov eax, ebx
movzx ebx, byte [esp + 0xa]
cmp ecx, edi
jle 0x56158f
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub esi, edi
sub eax, edi
lea ebp, [eax - 1]
mov ebx, dword [esp + 0x1c]
cmp ebx, ebp
ja 0x561535
jmp 0x5615b8
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ebp
mov ecx, ebx
call fcn.0045e650
nop
call fcn.0045d190
jmp fcn.005614d0
Function at 0x568660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x14]
cmp eax, dword [ecx + 8]
jbe 0x56884d
sub esp, 0x94
mov eax, 0
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov byte [esp + 0x33], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov eax, dword [esp + 0x98]
test byte [eax], al
lea ecx, [eax + 0x114]
mov dword [esp + 0x38], ecx
mov dword [esp], ecx
call fcn.0046f740
lea eax, [0x656668]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x8c], eax
mov byte [esp + 0x33], 1
mov eax, dword [esp + 0x98]
movzx ecx, byte [eax + 0x98]
test cl, cl
jne 0x56880c
call fcn.004a00f0
lea edi, [esp + 0x78]
lea esi, [esp]
call fcn.0045ed5e
lea edi, [esp]
lea esi, [esp + 0x78]
call fcn.0045ed5e
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x2a05f200
call fcn.0049f4d0
lea edi, [esp + 0x64]
lea esi, [esp + 0x1c]
call fcn.0045ed5e
lea edi, [esp + 0x3c]
lea esi, [esp + 0x64]
call fcn.0045ed5e
mov eax, dword [esp + 0x98]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x34], ecx
mov dword [esp], edx
lea edi, [esp + 4]
lea esi, [esp + 0x3c]
call fcn.0045ed5e
mov ecx, dword [esp + 0x34]
call ecx
mov eax, dword [esp + 0x98]
mov dword [esp], eax
mov byte [esp + 4], 0
call fcn.00565b60
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x98]
mov dword [edx + 0x90], ecx
mov ecx, dword [0x816df0]
test ecx, ecx
jne 0x5687ac
mov dword [edx + 0x94], eax
jmp 0x5687b7
lea edi, [edx + 0x94]
call fcn.0045e5d0
mov byte [edx + 0x98], 1
call fcn.004a00f0
lea edi, [esp + 0x78]
lea esi, [esp]
call fcn.0045ed5e
lea edi, [esp + 0x50]
lea esi, [esp + 0x78]
call fcn.0045ed5e
mov eax, dword [esp + 0x98]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x34], ecx
mov dword [esp], edx
lea edi, [esp + 4]
lea esi, [esp + 0x50]
call fcn.0045ed5e
mov ecx, dword [esp + 0x34]
call ecx
mov eax, dword [esp + 0x98]
mov ecx, dword [eax + 0x90]
mov eax, dword [eax + 0x94]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], eax
mov byte [esp + 0x33], 0
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.0046fae0
add esp, 0x94
ret
call fcn.0045d190
jmp fcn.00568660
Function at 0x585280
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x58539d
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045e868
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x8c]
test ecx, ecx
jle 0x585303
mov eax, dword [esp + 0x88]
xor edx, edx
jmp 0x58535d
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00535700
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
mov ebx, dword [esp + 0x80]
add ebx, 0xc
mov edx, eax
mov eax, ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x80], eax
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
lea esi, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.00535500
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x8c]
cmp ecx, eax
jg 0x58534f
jmp 0x585303
call fcn.0045d190
jmp fcn.00585280