joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc166
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x4dc196
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x4dc195
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x4dc185
pop edi
pop esi
pop ebp
ret 8

Function at 0x4dc3b7
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x67f10c
call fcn.0042e344
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], ebx
je 0x4dc542
mov eax, dword [ebp + 0x10]
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x4dc488
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x71a3d0], 0x10
mov ecx, 0x71a3bc
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x71a3bc]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.00419210
inc edi
cmp edi, 4
jl 0x4dc450
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4dc3f2
mov dword [ebp + 0x10], edi
test edi, edi
je 0x4dc53f
mov eax, edi
cmp edi, esi
jge 0x4dc4be
cmp eax, esi
jae 0x4dc548
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x4dc4a6
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4dc52a
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x71a3d0], 0x10
mov ecx, 0x71a3bc
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x71a3bc]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.00419210
inc ebx
cmp ebx, edi
jl 0x4dc4fb
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x4dc53f
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.00419210
sub esi, 1
jne 0x4dc530
mov eax, dword [ebp + 8]
call fcn.0042e31e
ret
call fcn.0042dff0
int3
Function at 0x4eba90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x72c840], eax
inc edx
cmp edx, 0x100
jb 0x4eba92
push esi
mov eax, 0x72c844
mov esi, 0x1c0
mov edx, dword [eax - 4]
lea eax, [eax + 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x72c840]
mov dword [eax + 0x3ec], edx
mov edx, dword [eax - 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x72c840]
mov dword [eax + 0x3f0], edx
mov edx, dword [eax - 0xc]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x72c840]
mov dword [eax + 0x3f4], edx
mov edx, dword [eax - 8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x72c840]
mov dword [eax + 0x3f8], edx
sub esi, 1
jne 0x4ebb37
mov dword [0x72c830], 0x4ed0f0
mov dword [0x72c828], 0x4ed0f0
mov dword [0x72c82c], 0x4ed190
call fcn.004ecf00
mov ecx, dword [0x72c828]
test eax, eax
mov edx, 0x4ed190
cmove ecx, edx
mov dword [0x72c828], ecx
pop esi
ret
Function at 0x4ed5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x4ed5e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
mov ecx, dword [ebp + 8]
push ebx
lea ebx, [eax - 4]
add ebx, ecx
mov dword [ebp - 4], ebx
lea eax, [edi + ecx]
cmp eax, ebx
jae 0x4ed609
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x4ed606
inc eax
cmp eax, ebx
jb 0x4ed5f7
mov ecx, dword [ebp + 8]
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ecx
sub edi, ecx
cmp eax, ebx
jae 0x4ed70d
cmp edx, 2
jbe 0x4ed692
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x4ed6f9
movzx ecx, byte [eax + 3]
mov ebx, dword [ebp + 0x10]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [ebp + 0x18], 0
cmove edx, ecx
mov dword [ebp + 0xc], edx
mov ebx, edx
test esi, esi
je 0x4ed6c9
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x4ed6c7
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [ebp + 0x10]
dec ebx
xor ebx, dword [ebp + 0xc]
add ecx, edi
cmp dword [ebp + 0x18], 0
je 0x4ed6c5
add ebx, ecx
jmp 0x4ed6c7
mov ecx, edx
shr esi, cl
test esi, esi
je 0x4ed622
cmp esi, 4
ja 0x4ed6b7
cmp esi, 3
je 0x4ed6b7
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x4ed622
mov ecx, dword [ebp + 8]
or esi, 8
shr esi, 1
inc edi
jmp 0x4ed5f0
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov ecx, dword [ebp + 8]
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 4]
add edi, eax
jmp 0x4ed5f0
mov ecx, dword [ebp + 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x4ed5f0
mov eax, dword [ebp + 0x14]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebx
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x529129
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00528dec

Function at 0x529134
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00528f6d
Function at 0x53cce0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x53cd29
mov al, byte [esi]
push eax
call fcn.0054c0b0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x53cd07
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x547250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f2], 0
je 0x5472d3
cmp dword [edi + 0x1b0], 0
je 0x54729d
push esi
push 1
push edi
call fcn.00538fb0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00538fb0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x5472d3
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x6a59f0
push 2
push eax
call fcn.00511c57
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00511c57
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x549900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00403480
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00529684

Function at 0x54d7e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x54d7fe
cmp dword [esi + 0x78], 0
je 0x54d7fe
push 2
push 3
push esi
call fcn.0054cda0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.0054d1d0
add esp, 4
test esi, esi
je 0x54d81e
cmp dword [esi + 0x78], 0
je 0x54d81e
push 3
push esi
call fcn.0054cde0
add esp, 8
pop esi
pop ebp
ret
Function at 0x559ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0050d5c0
add esp, 0x18
test eax, eax
je 0x559ee2
cmp eax, 0xffffffff
jne 0x559ee4
xor eax, eax
pop ebp
ret

Function at 0x55d740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x71a06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x7287fd], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x158], ebx
jne 0x55d776
call fcn.0055dfb0
test al, al
je 0x55d787
mov byte [0x7287fd], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d815
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5a8]
test eax, eax
je 0x55d7a8
push 0x400
push eax
call fcn.005b4cc0
add esp, 8
call fcn.0055dfb0
test al, al
jne 0x55d776
push esi
push edi
nop word [eax + eax]
mov ebx, 2
mov dword [ebp - 0x150], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], eax
nop
lea eax, [ebp - 0x188]
push eax
call fcn.0054ce20
push 0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x178], xmm0
movups xmmword [ebp - 0x168], xmm0
call fcn.00556670
lea eax, [ebp - 0x198]
push eax
call fcn.0054ce20
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1a8]
push eax
call fcn.0054ce20
add esp, 0x14
mov ecx, eax
mov eax, esi
inc ebx
cdq
mov dword [ebp - 0x154], ebx
add eax, dword [ecx]
push 0
adc edx, dword [ecx + 4]
push ebx
push edx
push eax
call fcn.0042e4c0
movups xmm1, xmmword [ebp - 0x178]
mov esi, dword [ebp - 0x148]
mov edi, eax
mov ebx, edx
dec esi
movaps xmm0, xmm1
movd eax, xmm1
psrldq xmm0, 4
movd ecx, xmm0
shld ebx, edi, 8
push ecx
push eax
push 0
push esi
shl edi, 8
call fcn.0042e4c0
xor edi, eax
xor ebx, edx
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x168], edi
push eax
mov dword [ebp - 0x164], ebx
call fcn.0054ce20
lea esi, [eax + 8]
lea eax, [ebp - 0x1c8]
push eax
call fcn.0054ce20
mov edx, dword [ebp - 0x148]
add esp, 8
mov ebx, dword [ebp - 0x154]
mov dword [ebp - 0x148], ebx
mov ecx, dword [eax]
add ecx, dword [esi]
lea eax, [edx + 2]
imul edx, dword [ebp - 0x160]
imul ecx, eax
mov eax, dword [ebp - 0x14c]
shl ecx, 0x10
xor ecx, edx
mov dword [ebp - 0x160], ecx
movups xmm0, xmmword [ebp - 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x150], 1
mov dword [ebp - 0x14c], eax
jne 0x55d7d0
movsd xmm0, qword [0x6aa080]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.005b4900
add esp, 0x10
call fcn.0055dfb0
test al, al
je 0x55d7b0
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.005b4b10
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x55d956
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.005b4cc0
add esp, 8
call fcn.0055dfb0
test al, al
jne 0x55d776
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [ebp - 0x158]
call fcn.005473a0
add esp, 8
call fcn.0055dfb0
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d815
mov esp, ebp
pop ebp
ret
Function at 0x567750
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x567782
push str.Couldnt_set_desired_mode
push esi
call fcn.005472e0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x567799
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.005473a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x5677b2
push ebx
push esi
call fcn.005673f0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x5677c7
push esi
call fcn.00566410
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x5677dc
push esi
call fcn.005673d0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x5677ec
push esi
call fcn.00567630
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x57a7d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x71adec]
mov edi, eax
add esp, 4
test edi, edi
jne 0x57a7fd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x57a847
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x57a84d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x57a8ab
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x57a870
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x57a8d7
mov eax, dword [esi + 4]
push 1
push 0x6adc80
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6adc81
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x57a8b0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58ff00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x58ff6b
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x58ff30
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5b4cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0042eb50
mov eax, dword [0x71a06c]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x44], edi
test eax, eax
jne 0x5b4d05
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0042d815
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5b4cee
push 0x6b411c
push eax
call fcn.005bf980
mov ebx, eax
add esp, 8
mov dword [esp + 0x40], ebx
test ebx, ebx
je 0x5b4e25
push 0x30
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.00507d20
add esp, 0xc
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00526f71
add esp, 4
push eax
call fcn.005a7b23
add esp, 8
test eax, eax
js 0x5b4e1c
mov eax, 8
call fcn.0042eb50
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.005b4900
add esp, 0x10
test dword [esp + 0x4e], 0x2000
je 0x5b4da0
mov eax, 0x800
cmp esi, 0xffffffff
push 0
push ebx
cmove esi, eax
call fcn.00674848
add esp, 8
nop dword [eax]
mov edi, 0x400
test esi, esi
jle 0x5b4dae
cmp esi, edi
cmovl edi, esi
push ebx
push edi
lea eax, [esp + 0x80]
push 1
push eax
call fcn.0051222c
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x5b4e02
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.0042eb50
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push ebx
push eax
call fcn.005b4900
add dword [esp + 0x54], ebx
add esp, 0x10
mov ebx, dword [esp + 0x40]
test esi, esi
jle 0x5b4da0
sub esi, edi
test esi, esi
jg 0x5b4da0
lea eax, [esp + 0x78]
push 0x400
push eax
call fcn.005bf4b0
mov ebx, dword [esp + 0x48]
add esp, 8
mov edi, dword [esp + 0x44]
push ebx
call fcn.00511856
add esp, 4
mov ecx, dword [esp + 0x47c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d815
mov esp, ebp
pop ebp
ret
Function at 0x5dca80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x5dcab1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x5dcab8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x5dcaa0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x5dcaf3
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x5dcaf3
cmp ecx, 0xfffffffd
je 0x5dcaf3
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x5dcaf3
cmp ecx, 0xfffffffe
je 0x5dcaf3
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x5dcaf3
cmp ecx, 0xffffffff
je 0x5dcaf3
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x5dcb0e
push 0x157
push 0x6cbff0
push 0x6cc020
call fcn.005c05f0
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x5dcb2d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x5dcb2d
inc ecx
inc edx
cmp ecx, ebx
jl 0x5dcb20
lea edx, [ebx - 1]
test edx, edx
js 0x5dcb51
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x5dcb51
cmp byte [eax], 0xff
jne 0x5dcb51
dec eax
sub edx, 1
jns 0x5dcb40
cmp ecx, edx
jl case.0x5dcb7d.2
jle 0x5dcb63
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x5dcb7d.2
movzx eax, byte [eax + 0x5dcbf0]
jmp dword [eax*4 + 0x5dcbd0]
mov eax, 7
jmp 0x5dcbb3
mov eax, 6
jmp 0x5dcbb3
mov eax, 5
jmp 0x5dcbb3
mov eax, 4
jmp 0x5dcbb3
mov eax, 3
jmp 0x5dcbb3
mov eax, 2
jmp 0x5dcbb3
mov eax, 1
test dl, dh
jne case.0x5dcb7d.2
and bl, dl
cmp bl, dl
jne case.0x5dcb7d.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x6099e0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x609acc
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x609a5d
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x6d6b50]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x6d6b50]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6d6b50]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x6d6b50]
mov byte [edx], al
jmp 0x609ab1
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x609a71
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x6d6b50]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x6d6b50]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x609a9b
lea eax, [esi + 0x3c]
jmp 0x609aa8
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6d6b50]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x609a00
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x60ac10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0042eb50
mov eax, dword [0x71a06c]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x60ac76
cmp edi, dword [esi]
je 0x60ac6d
test ebp, ebp
je 0x60acf0
test ebx, ebx
js 0x60acf0
mov eax, 1
mov dword [esi], edi
jmp 0x60ac7c
mov edi, dword [esi]
test edi, edi
je 0x60acf0
test ebp, ebp
je 0x60ae0a
push edi
call fcn.005b3550
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x60acb0
push 0x28
push 0x6d6e58
push 0x6d6e80
call fcn.005c05f0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x60ad0b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.005af9a0
add esp, 0xc
test eax, eax
je 0x60acf0
push ebx
push ebp
push dword [esi + 4]
call fcn.005afb50
add esp, 0xc
test eax, eax
je 0x60acf0
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.005af900
add esp, 0xc
test eax, eax
jne 0x60ad27
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042d815
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x60acf0
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.00507f70
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x60ad4a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.00507d20
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x60ad50
push edx
push edi
push dword [esi + 8]
call fcn.005af9a0
add esp, 0xc
test eax, eax
je 0x60acf0
push edi
call fcn.005b3550
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.005afb50
add esp, 0x10
test eax, eax
je 0x60acf0
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x60ada0
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.005af9a0
add esp, 0xc
test eax, eax
je 0x60acf0
push edi
call fcn.005b3550
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.005afb50
add esp, 0x10
test eax, eax
je 0x60acf0
push dword [esi + 8]
push dword [esi + 4]
call fcn.005afb80
add esp, 8
test eax, eax
je 0x60acf0
mov eax, 1
jmp 0x60acf2
test eax, eax
je 0x60adea
jmp 0x60ad4e