joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fb3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x6cd05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], eax
nop dword [eax]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.0063c4d0
mov edx, dword [ebx]
add esp, 0x10
xor edi, edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x5fb4f5
mov eax, edi
mov ebx, edi
xor eax, 1
cmp edi, 2
cmovl ebx, eax
test esi, esi
je 0x5fb48b
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x5fb4bd
mov ecx, dword [ebp - 0x20]
mov cl, byte [ecx]
test cl, cl
je 0x5fb470
nop dword [eax]
movzx edx, byte [eax]
movzx ecx, cl
mov cl, byte [ecx + 0x69d1b0]
cmp cl, byte [edx + 0x69d1b0]
jne 0x5fb46d
mov cl, byte [esi + 1]
inc esi
inc eax
test cl, cl
jne 0x5fb450
mov edx, dword [ebp - 0x28]
movzx eax, byte [eax]
movzx ecx, byte [eax + 0x69d1b0]
movzx eax, byte [esi]
movzx eax, byte [eax + 0x69d1b0]
sub eax, ecx
jne 0x5fb4bd
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x40]
add ebx, ebx
push eax
mov eax, dword [edx + 0x10]
lea edx, [ebp - 0x1c]
mov ecx, dword [eax + ebx*8 + 0xc]
add ecx, 8
call fcn.00639cb0
add esp, 4
test eax, eax
je 0x5fb4b6
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x5fb4d4
jmp 0x5fb4c0
xor ecx, ecx
mov dword [ebp - 0x24], ecx
jmp 0x5fb4c0
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
inc edi
mov edx, dword [ebp - 0x28]
cmp edi, dword [ebp - 0x34]
jl 0x5fb420
test ecx, ecx
je 0x5fb4f2
push dword [ebp - 0x38]
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x3c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.005fe800
add esp, 0x18
jmp 0x5fb4f5
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 4
jle 0x5fb3f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00583e60
mov esp, ebp
pop ebp
ret
Function at 0x6189f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.00626ed0
mov edi, dword [esi + 0x10]
mov edx, edi
mov eax, dword [esi + 0x14]
add edx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x618abf
jb 0x618a2b
cmp edx, 0x7ffffffe
ja 0x618abf
mov esi, dword [ebx]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [esi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovb ecx, eax
cmp edi, ecx
ja 0x618a6e
mov eax, 0x1010
mov dword [ebp - 0x20], edx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x24], edi
jmp 0x618a8b
lea eax, [ebp - 0x30]
xor edx, edx
push eax
push 1
push edi
mov ecx, esi
call fcn.0061e160
add esp, 0xc
test eax, eax
jne 0x618ae6
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.00619060
mov ecx, dword [ebp + 0xc]
add esp, 8
test dword [ebp - 0x28], 0x2460
mov dword [ecx], eax
jne 0x618aae
cmp dword [ebp - 0x18], 0
je 0x618ab6
lea ecx, [ebp - 0x30]
call fcn.0061ecc0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0x6d24b0
push 0x112a4
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.0063c420
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61b910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, edx
test esi, esi
je 0x61b94e
mov ecx, dword [ecx]
call fcn.0060daf0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x61b92b
pop esi
jmp fcn.00628bf0
mov ecx, dword [esi]
test ecx, ecx
je 0x61b937
pop esi
jmp fcn.00626f10
mov edx, dword [esi + 0x24]
test edx, edx
je 0x61b94e
mov eax, dword [edx]
push edx
mov ecx, dword [eax]
dec dword [eax + 4]
mov eax, dword [ecx + 0x1c]
call eax
add esp, 4
pop esi
ret
Function at 0x625c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [esp + 0x14], ebx
mov al, byte [esi + 0x42]
cmp al, 1
je 0x625c61
cmp al, 3
jb 0x625c38
call fcn.0062aa20
test eax, eax
jne 0x625c46
cmp byte [esi + 0x42], 0
jne 0x625c4d
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x625c61
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x625c44
movsx eax, byte [esi + 0x44]
mov edi, dword [esi + eax*4 + 0x78]
cmp byte [edi + 5], 0
jne 0x625ca9
movzx ecx, word [esi + eax*2 + 0x50]
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.00626870
test eax, eax
jne 0x625c46
mov ecx, esi
call fcn.00626500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi + eax*2 + 0x50], 0
jne 0x625d5c
mov cl, byte [esi + 0x44]
test cl, cl
je 0x625d97
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x10], ebx
je 0x625d2a
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00584790
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x10
jmp 0x625d2f
call fcn.006354d0
cmp dword [ebx + 0x78], 0
jne 0x625d48
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x625d48
mov ecx, ebx
call fcn.00632620
movsx eax, byte [esi + 0x44]
cmp word [esi + eax*2 + 0x50], 0
je 0x625cb5
mov ebx, dword [esp + 0x14]
movsx eax, byte [esi + 0x44]
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x625c44
cmp byte [eax + 5], 0
jne 0x625c44
push ebx
push esi
call fcn.00625bb0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [eax], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x625e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [esp + 0x14], ebx
mov al, byte [esi + 0x42]
cmp al, 1
je 0x625e75
cmp al, 3
jb 0x625e4c
call fcn.0062aa20
test eax, eax
jne 0x625fb2
cmp byte [esi + 0x42], 0
jne 0x625e61
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x625e75
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
jg 0x625e58
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
inc word [esi + eax*2 + 0x50]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [edx + 0x12]
jb 0x625fa1
cmp byte [edx + 5], 0
jne 0x625ec1
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
call fcn.00626870
test eax, eax
jne 0x625fb2
mov ecx, esi
call fcn.006265c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [esi + 0x44]
test cl, cl
je 0x625f8a
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x10], ebx
je 0x625f36
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00584790
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x10
jmp 0x625f3b
call fcn.006354d0
cmp dword [ebx + 0x78], 0
jne 0x625f54
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x625f54
mov ecx, ebx
call fcn.00632620
movsx eax, byte [esi + 0x44]
mov ecx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [ecx + 0x12]
jae 0x625ec1
cmp byte [ecx + 2], 0
je 0x625e58
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00625db0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov dword [eax], 1
xor eax, eax
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx + 5], 0
jne 0x625e58
mov ecx, esi
call fcn.006265c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x626670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov al, byte [esi + 0x42]
cmp al, 3
jb 0x6266a4
cmp al, 4
jne 0x626693
mov eax, dword [esi + 0x3c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x30]
call fcn.0063e5f0
add esp, 4
mov dword [esi + 0x30], ebx
mov byte [esi + 0x42], bl
mov al, byte [esi + 0x44]
test al, al
js 0x626744
je 0x62678c
mov cl, byte [esi + 0x44]
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0xc], ebx
je 0x626718
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xc]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00584790
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x1c]
add esp, 0x10
jmp 0x62671d
call fcn.006354d0
cmp dword [ebx + 0x78], 0
jne 0x626736
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x626736
mov ecx, ebx
call fcn.00632620
cmp byte [esi + 0x44], 0
jne 0x6266b5
xor ebx, ebx
jmp 0x62678c
mov edx, dword [esi + 0x34]
test edx, edx
jne 0x626757
mov byte [esi + 0x42], bl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0x41]
lea edi, [esi + 0x78]
mov ecx, dword [esi]
push eax
push 0
push edi
mov ecx, dword [ecx + 4]
call fcn.00629600
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x626780
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x44], 0
mov eax, dword [edi]
mov al, byte [eax + 2]
mov byte [esi + 0x45], al
mov edx, dword [esi + 0x78]
cmp byte [edx], 0
je 0x62680e
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x48], ecx
sete cl
cmp ecx, eax
jne 0x62680e
xor eax, eax
mov word [esi + 0x50], ax
and byte [esi + 0x40], 0xf1
mov word [esi + 0x24], ax
cmp word [edx + 0x12], ax
jbe 0x6267c5
mov byte [esi + 0x42], 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx + 5], al
jne 0x626802
cmp dword [edx + 0x54], 1
je 0x6267e1
mov ecx, 0xe5d5
call fcn.005c0b30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
mov byte [esi + 0x42], 1
call fcn.00626870
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x42], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6d24b0
push 0xe5ca
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.0063c420
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x626f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov ebx, dword [esi]
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x6270c6
cmp byte [ebx + 9], 0
mov edi, dword [esi + 4]
mov dword [esp + 0x1c], edi
je 0x626f4d
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], 0
jne 0x626f4d
mov ecx, ebx
call fcn.0062b310
push dword [esi + 0x30]
call fcn.0063e5f0
mov dword [esi + 0x30], 0
add esp, 4
mov byte [esi + 0x42], 0
mov ecx, dword [edi + 8]
cmp ecx, esi
jne 0x626f72
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
jmp 0x626f87
mov eax, dword [ecx + 8]
cmp eax, esi
je 0x626f81
mov ecx, eax
test ecx, ecx
jne 0x626f72
jmp 0x626f87
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
cmp byte [esi + 0x44], 0
mov dword [esp + 0xc], 0
jl 0x627038
lea edi, [esi + 0x78]
mov dword [esp + 0x10], edi
mov ecx, dword [edi]
test ecx, ecx
je 0x627014
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
je 0x626ff6
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x98]
mov esi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00584790
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov edi, dword [esp + 0x10]
jmp 0x626ffb
call fcn.006354d0
cmp dword [ebx + 0x78], 0
jne 0x627014
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x627014
mov ecx, ebx
call fcn.00632620
mov ecx, dword [esp + 0xc]
add edi, 4
movsx eax, byte [esi + 0x44]
inc ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edi
cmp ecx, eax
jle 0x626fa0
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [edi + 0x14], 0
jne 0x627054
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x627054
mov dword [edi + 0xc], 0
mov ecx, dword [ecx + 0x48]
call fcn.0062f820
mov esi, dword [esi + 0xc]
test esi, esi
je 0x6270b3
cmp dword [0x6d3468], 0
je 0x6270a9
mov eax, dword [0x6e87d0]
test eax, eax
je 0x627077
push eax
call dword [0x6d34bc]
add esp, 4
push esi
call dword [0x6d3498]
sub dword [0x6e87f8], eax
add esp, 4
dec dword [0x6e881c]
push esi
call dword [0x6d3490]
mov eax, dword [0x6e87d0]
add esp, 4
test eax, eax
je 0x6270b3
push eax
call dword [0x6d34c4]
jmp 0x6270b0
push esi
call dword [0x6d3490]
add esp, 4
cmp byte [ebx + 9], 0
je 0x6270c6
add dword [ebx + 0xc], 0xffffffff
jne 0x6270c6
mov ecx, ebx
call fcn.0062b3d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x627430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edx
xor ebx, ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebx
test edi, edi
je 0x627634
cmp byte [edi + 9], bl
je 0x627466
inc dword [edi + 0xc]
cmp byte [edi + 0xa], bl
jne 0x627466
call fcn.0062b310
mov esi, dword [edi + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x627621
cmp dword [ebp + 8], 0
je 0x6274df
test byte [esi + 0x40], 1
jne 0x6274df
mov al, byte [esi + 0x42]
cmp al, 1
je 0x62748f
cmp al, 2
jne 0x627550
cmp al, 2
jne 0x627499
mov byte [esi + 0x42], 1
jmp 0x6274a0
mov dword [esi + 0x3c], 0
mov ecx, esi
call fcn.0062adc0
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
jne 0x6274bc
mov ecx, esi
call fcn.0062ae30
mov byte [esi + 0x42], 3
and byte [esi + 0x40], 0xf1
test ebx, ebx
je 0x627550
mov edi, dword [esp + 0x20]
mov edx, ebx
push 0
mov ecx, edi
call fcn.00627430
add esp, 4
jmp 0x627621
mov edi, dword [esi + 0x30]
test edi, edi
je 0x62753e
cmp dword [0x6d3468], 0
je 0x627534
mov eax, dword [0x6e87d0]
test eax, eax
je 0x627502
push eax
call dword [0x6d34bc]
add esp, 4
push edi
call dword [0x6d3498]
sub dword [0x6e87f8], eax
add esp, 4
dec dword [0x6e881c]
push edi
call dword [0x6d3490]
mov eax, dword [0x6e87d0]
add esp, 4
test eax, eax
je 0x62753e
push eax
call dword [0x6d34c4]
jmp 0x62753b
push edi
call dword [0x6d3490]
add esp, 4
mov eax, dword [esp + 0x24]
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
cmp byte [esi + 0x44], 0
mov dword [esp + 0x14], 0
jl 0x62760e
lea edi, [esi + 0x78]
mov dword [esp + 0x18], edi
nop dword [eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x6275ec
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x10], ebx
je 0x6275ce
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00584790
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [esp + 0x18]
jmp 0x6275d3
call fcn.006354d0
cmp dword [ebx + 0x78], 0
jne 0x6275ec
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x6275ec
mov ecx, ebx
call fcn.00632620
mov ecx, dword [esp + 0x14]
mov dword [edi], 0
inc ecx
movsx eax, byte [esi + 0x44]
add edi, 4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
cmp ecx, eax
jle 0x627570
mov esi, dword [esi + 8]
test esi, esi
jne 0x627474
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp byte [edi + 9], 0
je 0x627634
add dword [edi + 0xc], 0xffffffff
jne 0x627634
mov ecx, edi
call fcn.0062b3d0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62ae30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
cmp byte [ecx + 0x44], 0
mov dword [esp + 0xc], edi
jl 0x62aeed
lea ebx, [ecx + 0x78]
mov dword [esp + 0x10], ebx
mov ecx, dword [ebx]
test ecx, ecx
je 0x62aecb
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
je 0x62aead
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x98]
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00584790
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [esp + 0xc]
jmp 0x62aeb2
call fcn.006354d0
cmp dword [esi + 0x78], 0
jne 0x62aecb
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x62aecb
mov ecx, esi
call fcn.00632620
mov ecx, dword [esp + 0x14]
inc edi
mov dword [ebx], 0
add ebx, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
movsx eax, byte [ecx + 0x44]
cmp edi, eax
jle 0x62ae57
pop edi
pop esi
mov byte [ecx + 0x44], 0xff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x639cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push esi
push edi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x639d05
mov al, byte [edx]
xor esi, esi
mov edi, edx
test al, al
je 0x639cee
nop
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x69d1b0]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x639cd0
xor edx, edx
mov eax, esi
div dword [ebx]
mov ebx, dword [ebx + 0xc]
mov ecx, edx
mov edx, dword [ebp - 4]
mov edi, dword [ebx + ecx*8 + 4]
mov ebx, dword [ebx + ecx*8]
jmp 0x639d0d
mov edi, dword [ebx + 8]
xor ecx, ecx
mov ebx, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ebx, ebx
je 0x639d72
mov eax, dword [edi + 0xc]
dec ebx
test eax, eax
jne 0x639d26
mov eax, edx
neg eax
sbb eax, eax
jmp 0x639d68
test edx, edx
je 0x639d6c
mov cl, byte [eax]
mov esi, edx
test cl, cl
je 0x639d52
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x69d1b0]
cmp cl, byte [edx + 0x69d1b0]
jne 0x639d4f
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x639d32
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x69d1b0]
movzx ecx, byte [ecx + 0x69d1b0]
sub eax, ecx
test eax, eax
je 0x639d7b
mov edi, dword [edi]
test ebx, ebx
jne 0x639d16
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x639d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [edx*8]
mov esi, ecx
push edi
cmp eax, 0x400
mov dword [ebp - 4], esi
mov edi, 0x80
cmovbe edi, edx
cmp edi, dword [esi]
jne 0x639dbf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6e87f0]
test eax, eax
je 0x639dca
call eax
lea eax, [edi*8]
push 0
push eax
call fcn.0063e930
mov ecx, dword [0x6e87f4]
add esp, 8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ecx, ecx
je 0x639ded
call ecx
test ebx, ebx
je 0x639db6
push dword [esi + 0xc]
call fcn.0063e5f0
add esp, 4
mov dword [esi + 0xc], ebx
push ebx
call dword [0x6d3498]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [esi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.00586ff0
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [esi + 8], 0
test ecx, ecx
je 0x639ed0
mov edi, dword [ecx + 0xc]
xor ebx, ebx
mov al, byte [edi]
test al, al
je 0x639e5f
movzx eax, al
lea edx, [ebx*8]
lea edi, [edi + 1]
movzx esi, byte [eax + 0x69d1b0]
mov al, byte [edi]
xor esi, edx
xor ebx, esi
test al, al
jne 0x639e41
xor edx, edx
mov edi, dword [ecx]
mov eax, ebx
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x639eaa
mov eax, dword [esi]
test eax, eax
je 0x639e7d
mov edx, dword [esi + 4]
jmp 0x639e7f
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x639eaa
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x639e9f
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x639ec6
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x639ec6
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x639ebc
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [esi + 8], ecx
mov ecx, edi
test edi, edi
jne 0x639e36
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x639f50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x639f7e
nop dword [eax + eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x69d1b0]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x639f60
pop esi
ret