joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cd7a0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x24]
cmp eax, dword [ecx + 8]
jbe 0x5cd9da
sub esp, 0xa4
nop
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.00468269
nop
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov ecx, dword [esp + 0xb8]
lea edx, [0x662020]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.0044d740
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xa0], ecx
mov edx, dword [esp + 0xb8]
mov dword [esp + 0x1c], edx
xor eax, eax
xor ebx, ebx
xor ebp, ebp
xor esi, esi
jmp 0x5cd85a
add ecx, esi
mov edx, ebp
mov ebx, eax
mov ebp, edi
mov eax, ecx
mov ecx, dword [esp + 0xa0]
cmp eax, edx
jge 0x5cd9b4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x98], ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.005c21d0
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov ecx, dword [esp + 0x98]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call fcn.005c2780
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov ecx, dword [esp + 0xc0]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0xc4]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0xc8]
mov dword [esp + 0xc], ebx
call fcn.005c2780
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov ecx, dword [esp + 0xcc]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0xd0]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0xd4]
mov dword [esp + 0xc], ebx
call fcn.005c2780
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov ecx, dword [esp + 0x98]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
call fcn.005c2950
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
ja 0x5cd9d0
mov ebx, dword [esp + 0x14]
mov ebp, edx
sub edx, ecx
mov esi, edx
neg edx
sar edx, 0x1f
and edx, ecx
mov edi, dword [esp + 0xa0]
add edx, edi
cmp ebx, esi
jge 0x5cd95f
mov esi, ebx
jmp 0x5cd96d
mov dword [esp + 0x34], eax
mov eax, esi
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x10]
cmp edi, edx
je 0x5cd849
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x9c], edi
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
call fcn.00468970
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x9c]
jmp 0x5cd849
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xdc], edx
mov dword [esp + 0xe0], edx
add esp, 0xa4
ret
mov eax, ecx
mov ecx, edx
call fcn.004680f0
nop
call fcn.00466c30
jmp fcn.005cd7a0
Function at 0x5d5210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d543d
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00468275
lea ecx, [0x5d5450]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005c52f0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 8]
mov dword [esp + 0x24], edx
xor eax, eax
jmp 0x5d5333
mov dword [esp + 0x14], eax
mov ecx, dword [edx + eax*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
cmp eax, ecx
jl 0x5d530a
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005c52f0
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5d5390
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5d5365
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5d53b5
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x5d5439
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x5d5439
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x67ae20]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00409870
mov eax, dword [esp + 8]
lea ecx, [0x6f1ee0]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.00466c30
jmp fcn.005d5210
Function at 0x5e2820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e2902
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5e2871
mov edx, dword [esp + 0x18]
movzx ebx, byte [edx + ecx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x5e285b
mov eax, ecx
jmp 0x5e2862
mov eax, ecx
mov ecx, 0x100
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
sar ebp, 0x1f
xor edi, edi
jmp 0x5e28b4
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
movzx eax, byte [eax + edx - 1]
mov ecx, esi
and esi, ebx
and eax, ecx
xor esi, eax
xchg esi, ebx
not ebx
xchg esi, ebx
inc edi
movzx eax, byte [esp + 0xb]
and eax, esi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jle 0x5e28cf
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub eax, edi
lea ecx, [eax - 1]
sub esi, edi
mov ebp, dword [esp + 0x1c]
cmp ebp, ecx
ja 0x5e2882
jmp 0x5e28f8
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ecx
mov ecx, ebp
call fcn.00468090
nop
call fcn.00466c30
jmp fcn.005e2820
Function at 0x5eb670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5eb7df
sub esp, 0x64
lea edi, [esp + 0x6c]
xor eax, eax
call fcn.00468269
lea edi, [esp + 8]
call fcn.00468269
mov ecx, dword [esp + 0x68]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.0046c7d0
mov ecx, dword [esp + 4]
test ecx, ecx
setne cl
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x68]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xc4]
mov ebx, dword [ecx + 0xc8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x74]
mov ebx, dword [ecx + 0x78]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x36]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x50]
mov ebx, dword [ecx + 0x54]
mov ebp, dword [ecx + 0x58]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x68]
mov ebx, dword [ecx + 0x6c]
mov ebp, dword [ecx + 0x70]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x48]
mov ebp, dword [ecx + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x38]
mov ebx, dword [ecx + 0x3c]
mov ebp, dword [ecx + 0x40]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x5eb762
movzx eax, byte [ecx + 0x34]
test al, al
je 0x5eb7ab
cmp word [ecx + 0x28], 0x304
je 0x5eb7ab
movzx eax, byte [ecx + 0x9c]
test al, al
je 0x5eb791
lea eax, [ecx + 0xa9]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x5eb7ab
lea eax, [ecx + 0xb5]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x5eb7c4
lea eax, [0x6a679c]
mov dword [esp + 0x60], eax
jmp 0x5eb7ce
mov eax, dword [ecx + 0x80]
mov dword [esp + 0x60], eax
lea edi, [esp + 0x6c]
lea esi, [esp + 8]
call fcn.004686aa
add esp, 0x64
ret
call fcn.00466c30
jmp fcn.005eb670
Function at 0x604790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x604988
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov edx, dword [ecx]
test edx, edx
jne 0x604944
lea edi, [esp + 0x34]
xor eax, eax
call fcn.00468275
mov ecx, dword [esp + 0x4c]
nop
mov byte [esp + 0x23], 0
mov byte [esp + 0x23], 0x18
test ecx, ecx
jne 0x60496f
movzx eax, byte [esp + 0x48]
test al, al
je 0x60481f
mov eax, dword [esp + 0x40]
inc eax
lea ecx, [esp + 0x34]
cmp dword [ecx + 0x10], eax
jge 0x60481f
lea eax, [0x66a620]
mov dword [esp], eax
call fcn.0040c260
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x6a256f]
mov dword [eax], ecx
lea ecx, [0x6f1b20]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
jmp 0x60487e
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x3c]
cmp eax, edx
jae 0x604868
mov dword [esp + 0x24], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
lea eax, [0x662020]
mov dword [esp + 0x10], eax
call fcn.0044d800
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx + ecx], al
xchg ebp, eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea eax, [0x6049a0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x34]
mov dword [esp], ecx
mov dword [esp + 4], 3
mov byte [esp + 8], 0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], ecx
call fcn.005a1ef0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x6048d7
mov ecx, dword [esp + 0x38]
xor ebp, ebp
xor edx, edx
mov ebx, ecx
xor ecx, ecx
jmp 0x604902
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
cmp eax, ecx
ja 0x60496a
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x44]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and ebx, eax
sub ecx, eax
add edx, ebx
xor eax, eax
xor ebx, ebx
mov esi, dword [esp + 0x64]
mov dword [esi + 4], ecx
mov dword [esi + 8], ebp
mov edi, dword [0x85d680]
test edi, edi
je 0x60492a
mov dword [esp + 0x28], ebx
call fcn.00468040
mov dword [edi], edx
mov ebx, dword [esi]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [esi], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ebx
add esp, 0x60
ret
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x60
ret
call fcn.004680f0
lea eax, [0x661ce0]
mov dword [esp], eax
lea eax, [0x6f1268]
mov dword [esp + 4], eax
call fcn.00437e60
nop
call fcn.00466c30
jmp fcn.00604790
Function at 0x615f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61615f
sub esp, 0x58
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x10]
cmp ecx, 2
jl 0x61612f
mov edx, dword [eax + 0xc]
movzx ebx, word [edx]
rol bx, 8
movzx ebx, bx
add ecx, 0xfffffffe
cmp ebx, ecx
jne 0x6160ff
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x54], edx
mov eax, dword [eax + 0x14]
add eax, 0xfffffffe
mov dword [esp + 0x40], eax
neg eax
sar eax, 0x1f
and eax, 2
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x60]
mov ebx, dword [edx + 0xc]
mov edx, dword [edx + 0x10]
lea ebp, [0x66bd00]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
call fcn.00409de0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x54]
add ecx, edx
test eax, eax
je 0x6160b4
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x5c]
mov ebx, dword [edx]
test ebx, ebx
je 0x615fda
mov edx, dword [edx + 4]
jmp 0x615fe6
mov ebx, dword [0x8379c0]
mov edx, dword [0x8379c4]
mov dword [esp + 0x48], edx
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
lea ecx, [0x66ada0]
mov dword [esp], ecx
call fcn.0040c260
mov eax, dword [esp + 4]
mov dword [eax], 0x30
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + 0x10]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x14], edx
lea edx, [0x659680]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call ecx
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x616088
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x58
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x58
ret
lea eax, [0x66a620]
mov dword [esp], eax
call fcn.0040c260
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x40
lea ecx, [0x6a3cfb]
mov dword [eax], ecx
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
lea ecx, [0x6f1b20]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x58
ret
mov eax, dword [0x832898]
mov ecx, dword [0x83289c]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x58
ret
mov eax, dword [0x832898]
mov ecx, dword [0x83289c]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x58
ret
call fcn.00466c30
jmp fcn.00615f30
Function at 0x6164c0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x6165c7
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00468268
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
xor eax, eax
jmp 0x616570
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005c3a40
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
inc eax
mov edx, dword [esp + 0x8c]
cmp edx, eax
jg 0x616536
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005c3c10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call fcn.00466c30
jmp fcn.006164c0
Function at 0x6165e0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x616787
sub esp, 0x84
lea eax, [0x662020]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.0044d740
nop
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00468269
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x6166ab
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x7c], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005c2780
mov eax, dword [esp + 0x7c]
add eax, 0xc
mov ecx, dword [esp + 0x1c]
inc ecx
mov edx, dword [esp + 0x8c]
cmp edx, ecx
jg 0x616677
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005c2950
mov eax, dword [esp + 0x14]
cmp eax, 0x24
jl 0x6166e8
mov eax, 0x24
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x80]
cmp ecx, edx
je 0x616707
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00468970
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 8], eax
call fcn.006164c0
mov eax, dword [esp + 0x10]
cmp eax, 0x14
jl 0x61673a
mov eax, 0x14
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x80]
lea ebx, [edx + 0x10]
cmp ecx, ebx
je 0x616763
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00468970
mov edx, dword [esp + 0x80]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], 0x24
mov dword [esp + 0x9c], 0x24
add esp, 0x84
ret
call fcn.00466c30
jmp fcn.006165e0
Function at 0x61b3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x85d3cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61b598
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x61b41c
movzx ecx, byte [esp + 0x80]
jmp 0x61b429
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x61b461
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x61b57f
cmp cl, 0xe4
je 0x61b440
cmp ax, 0x303
jmp 0x61b465
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x61b4f3
cmp cl, 0xe3
jne 0x61b4bd
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0046870e
call fcn.0061b0d0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.005163d0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x661ce0]
mov dword [esp], eax
lea eax, [0x6f1280]
mov dword [esp + 4], eax
call fcn.00437e60
nop
call fcn.00466c30
jmp fcn.0061b3f0
Function at 0x1000d095
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000d0a4
pop dword [ebp - 0x30]
mov eax, 0x349a413c
add eax, 0xdb668f68
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3b823
push 0
mov eax, 0x7e37aed0
add eax, 0x91c9d280
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x179985d2
add ecx, 0xe866ca6b
xor edx, edx
add edx, eax
mov esi, 0x2d687bc7
add esi, 0xe29a3a39
add esi, dword [ebp - 0x30]
mov ebx, 0x6d697f89
add dword [ebp - 0x10], edi
mov edi, dword [esi]
sub dword [ebp - 0x1c], ebx
xor edi, ebx
sub dword [ebp - 0x1c], 0x1d4ad2c4
mov dword [edx], edi
sub dword [ebp - 0x14], edi
add edx, 0x943013e1
sub edx, 0x943013dd
add esi, 4
loop 0x1000d0ff
add eax, 0x133c7
xor ebx, ebx
add ebx, eax
add eax, 0xf88c4626
add eax, 0x773b9df
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret