joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x430a2b1c
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5db8612b
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x43d53667
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x33a416ef
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42f1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x54]
or edx, 0x10060
xor ebx, ebx
mov dword [esi + 0x2b8], 0xffffffff
mov byte [esi + 8], 1
mov dword [esi + 4], edx
mov byte [esi + 9], 3
mov byte [esi + 0x204], bl
mov ecx, dword [eax + 0x50]
mov dword [esi + 0x1e4], ecx
mov ecx, esi
call fcn.005ef660
push ebx
push 2
mov ecx, esi
call fcn.005ef8e0
mov eax, dword [esi + 0x1e4]
mov edx, dword [eax + 4]
mov ecx, 0xfffffffd
and edx, ecx
mov dword [eax + 4], edx
mov edx, dword [esi + 4]
and edx, ecx
mov ecx, esi
mov dword [esi + 4], edx
call fcn.004c85a0
mov ecx, esi
call fcn.00403440
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x116
mov ecx, esi
call fcn.0041b9a0
mov eax, 0x42c80000
mov dword [esi + 0x1e0], eax
mov dword [esi + 0x2b8], 0xffffffff
mov dword [esi + 0x1dc], eax
mov dword [esi + 0x1324], ebx
mov dword [esi + 0x142c], ebx
mov byte [esi + 0x8bd], bl
mov byte [esi + 0x1371], bl
mov byte [esi + 0x1f4], bl
mov dword [esi + 0x1374], ebx
push ebx
mov ecx, esi
mov dword [esi + 0x13b8], 0x7fffffff
call fcn.005ef7a0
push 1
mov ecx, esi
mov dword [esi + 0x9f0], eax
call fcn.005ef7a0
push 6
mov ecx, esi
mov dword [esi + 0x9f4], eax
call fcn.005ef7a0
push 7
mov ecx, esi
mov dword [esi + 0x9f8], eax
call fcn.005ef7a0
push 0x14
mov ecx, esi
mov dword [esi + 0x9fc], eax
call fcn.005ef7a0
push 0xf
mov ecx, esi
mov dword [esi + 0xa00], eax
call fcn.005ef7a0
push 0xe
mov ecx, esi
mov dword [esi + 0x9e8], eax
call fcn.005ef7a0
cmp eax, ebx
mov dword [esi + 0x9ec], eax
jne 0x42f303
mov edx, dword [esi + 0x9e8]
mov dword [esi + 0x9ec], edx
push 0xffffffffffffffff
mov ecx, 0x725b40
call fcn.005f0ec0
push eax
lea ecx, [esi + 0x20c]
call fcn.00401a50
push esi
mov ecx, 0x725c34
call fcn.00401cb0
mov dword [esi + 0x928], 0xffffffff
mov eax, dword [esi + 0x92c]
cmp eax, ebx
je 0x42f368
xor ecx, ecx
mov cx, word [eax + 0xa]
cmp cx, bx
lea edx, [ecx - 1]
mov word [eax + 0xa], dx
jne 0x42f362
mov eax, dword [eax + 0x5c]
push 0xae
push 0x68b520
push eax
call fcn.00620150
add esp, 0xc
mov dword [esi + 0x92c], ebx
mov dword [esi + 0x930], ebx
mov dword [esi + 0x934], ebx
mov dword [esi + 0x938], ebx
mov dword [esi + 0x93c], ebx
mov dword [esi + 0x940], ebx
mov dword [esi + 0x944], ebx
mov byte [esi + 0x95e], bl
mov byte [esi + 0x95f], bl
mov byte [esi + 0x960], bl
mov byte [esi + 0x954], bl
mov byte [esi + 0x95c], bl
mov dword [esi + 0x948], 0x4f000000
mov ecx, esi
pop esi
pop ebx
jmp fcn.0042afc0
Function at 0x42f1c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x54]
or edx, 0x10060
xor ebx, ebx
mov dword [esi + 0x2b8], 0xffffffff
mov byte [esi + 8], 1
mov dword [esi + 4], edx
mov byte [esi + 9], 3
mov byte [esi + 0x204], bl
mov ecx, dword [eax + 0x50]
mov dword [esi + 0x1e4], ecx
mov ecx, esi
call fcn.005ef660
push ebx
push 2
mov ecx, esi
call fcn.005ef8e0
mov eax, dword [esi + 0x1e4]
mov edx, dword [eax + 4]
mov ecx, 0xfffffffd
and edx, ecx
mov dword [eax + 4], edx
mov edx, dword [esi + 4]
and edx, ecx
mov ecx, esi
mov dword [esi + 4], edx
call fcn.004c85a0
mov ecx, esi
call fcn.00403440
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x116
mov ecx, esi
call fcn.0041b9a0
mov eax, 0x42c80000
mov dword [esi + 0x1e0], eax
mov dword [esi + 0x2b8], 0xffffffff
mov dword [esi + 0x1dc], eax
mov dword [esi + 0x1324], ebx
mov dword [esi + 0x142c], ebx
mov byte [esi + 0x8bd], bl
mov byte [esi + 0x1371], bl
mov byte [esi + 0x1f4], bl
mov dword [esi + 0x1374], ebx
push ebx
mov ecx, esi
mov dword [esi + 0x13b8], 0x7fffffff
call fcn.005ef7a0
push 1
mov ecx, esi
mov dword [esi + 0x9f0], eax
call fcn.005ef7a0
push 6
mov ecx, esi
mov dword [esi + 0x9f4], eax
call fcn.005ef7a0
push 7
mov ecx, esi
mov dword [esi + 0x9f8], eax
call fcn.005ef7a0
push 0x14
mov ecx, esi
mov dword [esi + 0x9fc], eax
call fcn.005ef7a0
push 0xf
mov ecx, esi
mov dword [esi + 0xa00], eax
call fcn.005ef7a0
push 0xe
mov ecx, esi
mov dword [esi + 0x9e8], eax
call fcn.005ef7a0
cmp eax, ebx
mov dword [esi + 0x9ec], eax
jne 0x42f303
mov edx, dword [esi + 0x9e8]
mov dword [esi + 0x9ec], edx
push 0xffffffffffffffff
mov ecx, 0x725b40
call fcn.005f0ec0
push eax
lea ecx, [esi + 0x20c]
call fcn.00401a50
push esi
mov ecx, 0x725c34
call fcn.00401cb0
mov dword [esi + 0x928], 0xffffffff
mov eax, dword [esi + 0x92c]
cmp eax, ebx
je 0x42f368
xor ecx, ecx
mov cx, word [eax + 0xa]
cmp cx, bx
lea edx, [ecx - 1]
mov word [eax + 0xa], dx
jne 0x42f362
mov eax, dword [eax + 0x5c]
push 0xae
push 0x68b520
push eax
call fcn.00620150
add esp, 0xc
mov dword [esi + 0x92c], ebx
mov dword [esi + 0x930], ebx
mov dword [esi + 0x934], ebx
mov dword [esi + 0x938], ebx
mov dword [esi + 0x93c], ebx
mov dword [esi + 0x940], ebx
mov dword [esi + 0x944], ebx
mov byte [esi + 0x95e], bl
mov byte [esi + 0x95f], bl
mov byte [esi + 0x960], bl
mov byte [esi + 0x954], bl
mov byte [esi + 0x95c], bl
mov dword [esi + 0x948], 0x4f000000
mov ecx, esi
pop esi
pop ebx
jmp fcn.0042afc0
Function at 0x436d40
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ax, word [esi + 0x80]
xor ebx, ebx
cmp ax, 0x46
je 0x436d60
cmp ax, 0x47
mov byte [esp + 9], bl
jne 0x436d65
mov byte [esp + 9], 1
cmp ax, 0x40
sete byte [esp + 0xa]
cmp ax, 0x41
sete byte [esp + 0xb]
cmp ax, 0x3e
je 0x436da7
cmp ax, 0x3f
je 0x436da7
cmp ax, 0x3a
je 0x436da7
cmp ax, 0x3c
je 0x436da7
cmp ax, 0x3b
je 0x436da7
cmp ax, 0x3d
je 0x436da7
cmp ax, 0x40
je 0x436da7
cmp ax, 0x41
jne 0x436e01
mov eax, dword [esi + 0x224]
mov ecx, dword [eax + 0x2a8]
cmp ecx, ebx
je 0x436e01
mov eax, ecx
mov dword [esp + 0xc], 0x3e9
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
cmp ecx, ebx
je 0x436df4
lea edx, [esp + 0xc]
push edx
push 0xb
push eax
call ecx
add esp, 0xc
cmp eax, ebx
jne 0x436e01
mov ecx, esi
call fcn.00432010
pop esi
pop ebx
add esp, 0x24
ret
mov eax, dword [esi + 0x224]
push eax
mov ecx, esi
call fcn.004cb8c0
mov ax, word [esi + 0x80]
cmp ax, 0x4a
je 0x436e52
cmp ax, 0x4b
je 0x436e52
cmp ax, 0x44
je 0x436e52
cmp ax, 0x45
je 0x436e52
cmp ax, 0x46
je 0x436e52
cmp ax, 0x47
je 0x436e52
cmp ax, 0x16
je 0x436e52
cmp ax, 0x17
je 0x436e52
cmp ax, 0x18
je 0x436e52
cmp ax, 0x54
jne 0x436e59
mov ecx, esi
call fcn.004019a0
cmp byte [esp + 0xa], bl
je 0x436ea0
mov eax, dword [esi + 0x1d8]
cmp eax, ebx
je 0x436ea0
mov dword [esp + 0xc], 0x5a0a
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
cmp ecx, ebx
je 0x436ea0
lea edx, [esp + 0xc]
push edx
push 0xb
push eax
call ecx
add esp, 0xc
cmp byte [esp + 0xb], bl
je 0x436ed0
mov ax, word [esi + 0x80]
cmp ax, 0x43
je 0x436eb9
cmp ax, 0x49
jne 0x436ed0
mov ecx, dword [esi + 0x224]
cmp byte [ecx + 0x3b4], bl
jne 0x436ed0
push esi
push 1
push ebx
call fcn.005a52f0
cmp byte [esp + 9], bl
je 0x436ef0
mov ax, word [esi + 0x80]
cmp ax, 0x4a
je 0x436ee9
cmp ax, 0x4b
jne 0x436ef0
mov ecx, esi
call fcn.00435fa0
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x436d44
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ax, word [esi + 0x80]
xor ebx, ebx
cmp ax, 0x46
je 0x436d60
cmp ax, 0x47
mov byte [esp + 9], bl
jne 0x436d65
mov byte [esp + 9], 1
cmp ax, 0x40
sete byte [esp + 0xa]
cmp ax, 0x41
sete byte [esp + 0xb]
cmp ax, 0x3e
je 0x436da7
cmp ax, 0x3f
je 0x436da7
cmp ax, 0x3a
je 0x436da7
cmp ax, 0x3c
je 0x436da7
cmp ax, 0x3b
je 0x436da7
cmp ax, 0x3d
je 0x436da7
cmp ax, 0x40
je 0x436da7
cmp ax, 0x41
jne 0x436e01
mov eax, dword [esi + 0x224]
mov ecx, dword [eax + 0x2a8]
cmp ecx, ebx
je 0x436e01
mov eax, ecx
mov dword [esp + 0xc], 0x3e9
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
cmp ecx, ebx
je 0x436df4
lea edx, [esp + 0xc]
push edx
push 0xb
push eax
call ecx
add esp, 0xc
cmp eax, ebx
jne 0x436e01
mov ecx, esi
call fcn.00432010
pop esi
pop ebx
add esp, 0x24
ret
mov eax, dword [esi + 0x224]
push eax
mov ecx, esi
call fcn.004cb8c0
mov ax, word [esi + 0x80]
cmp ax, 0x4a
je 0x436e52
cmp ax, 0x4b
je 0x436e52
cmp ax, 0x44
je 0x436e52
cmp ax, 0x45
je 0x436e52
cmp ax, 0x46
je 0x436e52
cmp ax, 0x47
je 0x436e52
cmp ax, 0x16
je 0x436e52
cmp ax, 0x17
je 0x436e52
cmp ax, 0x18
je 0x436e52
cmp ax, 0x54
jne 0x436e59
mov ecx, esi
call fcn.004019a0
cmp byte [esp + 0xa], bl
je 0x436ea0
mov eax, dword [esi + 0x1d8]
cmp eax, ebx
je 0x436ea0
mov dword [esp + 0xc], 0x5a0a
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
cmp ecx, ebx
je 0x436ea0
lea edx, [esp + 0xc]
push edx
push 0xb
push eax
call ecx
add esp, 0xc
cmp byte [esp + 0xb], bl
je 0x436ed0
mov ax, word [esi + 0x80]
cmp ax, 0x43
je 0x436eb9
cmp ax, 0x49
jne 0x436ed0
mov ecx, dword [esi + 0x224]
cmp byte [ecx + 0x3b4], bl
jne 0x436ed0
push esi
push 1
push ebx
call fcn.005a52f0
cmp byte [esp + 9], bl
je 0x436ef0
mov ax, word [esi + 0x80]
cmp ax, 0x4a
je 0x436ee9
cmp ax, 0x4b
jne 0x436ef0
mov ecx, esi
call fcn.00435fa0
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x458600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x681386
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4585e0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
xorps xmm0, xmm0
mov dword [esi + 0x8c], edi
movaps xmmword [esi + 0x90], xmm0
movaps xmmword [esi + 0xa0], xmm0
mov dword [esp + 8], edi
movss xmm0, dword [esp + 8]
shufps xmm0, xmm0, 0
mov dword [esp + 0x3c], edi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esi + 0xb0], xmm0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xe0], eax
movaps xmm0, xmmword [ecx]
movaps xmmword [esi + 0xf0], xmm0
movss xmm0, dword [0x68b4fc]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [0x68b4fc]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [0x68b4fc]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [0x68b500]
movss dword [esp + 0x1c], xmm0
movaps xmm2, xmmword [esp + 0x10]
mov dword [esi + 0x160], 0x3e490fdb
mov dword [esi + 0x1c8], 0x3fcccccd
mov dword [esi + 0x1cc], edi
mov byte [esi + 8], 0xa
mov dword [esi + 4], 0x10000
movaps xmm0, xmm2
shufps xmm0, xmm2, 0x39
movaps xmm1, xmm0
shufps xmm1, xmm0, 0x39
movaps xmm3, xmm1
shufps xmm3, xmm1, 0x39
mov ecx, 0x3f800000
mov dword [esi + 0x1b8], ecx
mov dword [esi + 0x1bc], ecx
movaps xmmword [esi + 0x10], xmm3
movaps xmmword [esi + 0x20], xmm1
movss xmm1, dword [0x68b500]
movaps xmmword [esi + 0x30], xmm0
movss dword [esp + 0x10], xmm1
movss xmm1, dword [0x68b4fc]
movaps xmmword [esi + 0x40], xmm2
movss dword [esp + 0x14], xmm1
movss xmm1, dword [0x68b4fc]
movss dword [esp + 0x18], xmm1
movss xmm1, dword [0x68b4fc]
push 0x41
movss dword [esp + 0x20], xmm1
movaps xmm1, xmmword [esp + 0x14]
mov dword [esi + 0x300], 0x3f000000
movaps xmm0, xmmword [eax + 0x40]
push 0x68c574
shufps xmm1, xmm0, 0xe0
shufps xmm0, xmm1, 0x24
movaps xmmword [esi + 0x40], xmm0
push 0x10
push 0x30
mov byte [esp + 0x4c], 1
mov dword [esi + 0x2ec], edi
mov dword [esi + 0x2f0], edi
mov dword [esi + 0x2d8], edi
mov dword [esi + 0x2dc], edi
mov dword [esi + 0x60], 0x3dcccccd
call fcn.0061fe40
add esp, 0x10
cmp eax, edi
je 0x4587fa
lea edx, [esp + 8]
mov dword [esp + 8], 0x3dcccccd
movss xmm0, dword [edx]
movaps xmm1, xmm0
movaps xmm0, xmmword [esp + 0x20]
mov dword [eax + 4], edi
shufps xmm1, xmm0, 0xe0
mov word [eax], 4
mov word [eax + 2], 0x1100
shufps xmm0, xmm1, 0x24
movaps xmmword [eax + 0x10], xmm0
mov dword [eax + 4], edi
mov word [eax + 0x20], di
jmp 0x4587fc
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x214], edi
mov dword [esi + 0x74], eax
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x47fb10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x124
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi + 0xe]
mov ecx, dword [edi + 0x70]
push 0xf
push eax
mov dword [esp + 0x1c], ecx
call fcn.0060da40
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x47fd20
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x6c]
mov eax, dword [edi + 0x5c]
lea ebx, [esi + esi*2]
shl ebx, 4
add ebx, edx
test eax, eax
je 0x47fb62
add eax, 0x1c
mov dword [esp + 0x1c], eax
jmp 0x47fb6a
mov dword [esp + 0x1c], 0
mov eax, dword [edi]
test eax, eax
je 0x47fb7a
push 0
push 0xa
push edi
call eax
add esp, 0xc
lea edx, [esp + 0xf0]
push edx
mov ecx, ebx
call fcn.0060f0c0
push eax
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x78]
push ecx
mov ecx, edi
call fcn.005efd90
mov ecx, eax
call fcn.006020a0
movaps xmm0, xmmword [eax]
movaps xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [eax + 0x10]
movaps xmmword [esp + 0x30], xmm0
movaps xmm0, xmmword [eax + 0x20]
movaps xmmword [esp + 0x40], xmm0
movaps xmm0, xmmword [eax + 0x30]
mov eax, dword [edi + 0x5c]
test eax, eax
movaps xmmword [esp + 0x50], xmm0
je 0x47fc27
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x70]
mov eax, dword [ecx + edx*4]
test byte [eax], 0x20
je 0x47fc27
movaps xmm0, xmmword [0x6bf190]
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x78]
push ecx
movaps xmmword [esp + 0x6c], xmm0
call fcn.005ffe50
movaps xmm0, xmmword [eax]
movaps xmmword [esp + 0x2c], xmm0
movaps xmm0, xmmword [eax + 0x10]
movaps xmmword [esp + 0x3c], xmm0
movaps xmm0, xmmword [eax + 0x20]
movaps xmmword [esp + 0x4c], xmm0
movaps xmm0, xmmword [eax + 0x30]
add esp, 0xc
movaps xmmword [esp + 0x50], xmm0
mov edx, dword [esp + 0x1c]
xor ecx, ecx
mov cx, word [ebx + 8]
push 0
push edx
lea eax, [esp + 0x28]
push eax
push ecx
push edi
call fcn.00480360
mov edx, dword [edi + 4]
and edx, 0xffffffbf
mov eax, edx
add esp, 0x14
test eax, 0x10000
mov dword [edi + 4], edx
je 0x47fc5d
or eax, 0x400000
mov dword [edi + 4], eax
mov ax, word [ebx + 0xa]
cmp ax, 0xaaaa
je 0x47fd04
test ax, ax
je 0x47fd04
cmp ax, 0x3e7
je 0x47fd17
push 0x90
call fcn.00401b00
mov esi, eax
add esp, 4
test esi, esi
je 0x47fd17
mov edx, dword [esp + 0x14]
mov ax, word [esp + 0x18]
mov dword [esi], 0x47e2d0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x6c], 0
lea ecx, [esi + 0x80]
mov dword [ecx], 0
mov byte [esi + 0x84], 0
push edi
mov dword [esi + 0x70], edx
mov word [esi + 0xe], ax
call fcn.00401a50
mov cx, word [esp + 0x18]
movzx edx, byte [ebp + 0xc]
mov word [edi + 0xe], cx
push edx
push ecx
movzx ecx, word [ebx + 0xa]
mov eax, esp
shl ecx, 8
mov dword [esp + 0x20], esp
mov dword [eax], ecx
push esi
mov ecx, 0x725b20
call fcn.005f2410
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x14]
push edx
push esi
push eax
push edi
call fcn.0047cb50
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4817e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x681668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
movaps xmm0, xmmword [esi + 0x10]
mov dword [esp + 8], eax
mov ecx, eax
mov dword [esp + 8], ecx
lea edx, [esp + 8]
movss xmm1, dword [edx]
shufps xmm1, xmm0, 0xe0
shufps xmm0, xmm1, 0x24
movaps xmmword [esi + 0x10], xmm0
movaps xmm2, xmmword [esi + 0x10]
push edi
mov edi, dword [ebp + 8]
movaps xmm0, xmmword [edi]
movaps xmm1, xmm0
xor ebx, ebx
unpckhps xmm1, xmm2
shufps xmm0, xmm1, 0xc4
movaps xmmword [esi + 0x10], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
mov dword [esp + 0xc], ebx
movss xmm0, dword [esp + 0xc]
shufps xmm0, xmm0, 0
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
movaps xmmword [esp + 0x70], xmm0
movaps xmm0, xmmword [edi]
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, 0x725b20
mov dword [esp + 0x98], ebx
movaps xmmword [esp + 0x1c], xmm0
call fcn.0052b4a0
fstp dword [esp + 0xc]
movaps xmm1, xmmword [esp + 0x10]
movaps xmm2, xmmword [edi]
lea eax, [esp + 0xc]
movss xmm0, dword [eax]
unpcklps xmm0, xmm1
shufps xmm0, xmm1, 0xe1
movaps xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x10], xmm0
subps xmm0, xmm2
mulps xmm0, xmm1
movaps xmm3, xmm0
shufps xmm3, xmm0, 0xaa
movaps xmm4, xmm0
shufps xmm4, xmm0, 0x55
addss xmm0, xmm4
addss xmm0, xmm3
shufps xmm0, xmm0, 0
movaps xmm3, xmm1
mulps xmm3, xmm0
addps xmm2, xmm3
movaps xmm3, xmmword [esi + 0x20]
movaps xmm0, xmm1
unpckhps xmm0, xmm3
shufps xmm1, xmm0, 0xc4
movaps xmmword [esi + 0x20], xmm1
movaps xmm0, xmmword [edi]
subps xmm0, xmm2
mulps xmm0, xmm0
movaps xmm1, xmm0
movaps xmm2, xmm0
shufps xmm1, xmm0, 0xaa
shufps xmm2, xmm0, 0x55
addss xmm0, xmm2
addss xmm0, xmm1
movaps xmmword [esp + 0x20], xmm0
mov eax, dword [esp + 0x4c]
cmp eax, ebx
sqrtss xmm0, xmm0
movss dword [esp + 0x20], xmm0
movaps xmm0, xmmword [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
mov ecx, dword [esp + 0x20]
movaps xmm0, xmmword [esi + 0x20]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
movss xmm1, dword [edx]
shufps xmm1, xmm0, 0xe0
shufps xmm0, xmm1, 0x24
movaps xmmword [esi + 0x20], xmm0
mov dword [esp + 0x8c], 0xffffffff
je 0x48198d
xor ecx, ecx
mov cx, word [eax + 0xa]
cmp cx, bx
lea edx, [ecx - 1]
mov word [eax + 0xa], dx
jne 0x48198d
mov eax, dword [eax + 0x5c]
push 0xae
push 0x68b520
push eax
call fcn.00620150
add esp, 0xc
mov ecx, dword [esp + 0x84]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x8f], ebx
movzx eax, byte [esi + 0x93]
mov dl, byte [eax + esi + 0x8f]
lea eax, [eax + esi + 0x8f]
inc dl
mov byte [eax], dl
movzx ecx, byte [esi + 0x94]
lea eax, [ecx + esi + 0x8f]
inc byte [eax]
movzx edx, byte [esi + 0x95]
lea eax, [edx + esi + 0x8f]
inc byte [eax]
movzx eax, byte [esi + 0x96]
mov cl, byte [eax + esi + 0x8f]
lea eax, [eax + esi + 0x8f]
mov ebp, 0xfffe7961
inc cl
push edi
mov dword [esp + 0x18], ebp
mov byte [eax], cl
lea edi, [esi + 0xc8]
mov al, byte [esi + ebx + 0x8f]
test al, al
jbe 0x489ad5
mov ecx, dword [edi]
mov edx, dword [edi - 0x10]
push ecx
push edx
push ebx
push str.__Team__i_:_Shields_i__Karma_i_r_n
call fcn.00569b60
mov eax, dword [edi - 0x10]
add esp, 0x10
cmp eax, ebp
jg 0x489ac6
jne 0x489ad5
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jg 0x489ac6
jne 0x489ad5
call fcn.005f2010
xor al, 0xff
and al, 1
mov byte [esp + 0x13], al
je 0x489ad5
mov byte [esi + 0x8e], bl
mov eax, dword [edi]
mov ebp, dword [edi - 0x10]
mov dword [esp + 0x18], eax
inc ebx
add edi, 4
cmp ebx, 4
jl 0x489a82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x489a17
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x8f], ebx
movzx eax, byte [esi + 0x93]
mov dl, byte [eax + esi + 0x8f]
lea eax, [eax + esi + 0x8f]
inc dl
mov byte [eax], dl
movzx ecx, byte [esi + 0x94]
lea eax, [ecx + esi + 0x8f]
inc byte [eax]
movzx edx, byte [esi + 0x95]
lea eax, [edx + esi + 0x8f]
inc byte [eax]
movzx eax, byte [esi + 0x96]
mov cl, byte [eax + esi + 0x8f]
lea eax, [eax + esi + 0x8f]
mov ebp, 0xfffe7961
inc cl
push edi
mov dword [esp + 0x18], ebp
mov byte [eax], cl
lea edi, [esi + 0xc8]
mov al, byte [esi + ebx + 0x8f]
test al, al
jbe 0x489ad5
mov ecx, dword [edi]
mov edx, dword [edi - 0x10]
push ecx
push edx
push ebx
push str.__Team__i_:_Shields_i__Karma_i_r_n
call fcn.00569b60
mov eax, dword [edi - 0x10]
add esp, 0x10
cmp eax, ebp
jg 0x489ac6
jne 0x489ad5
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jg 0x489ac6
jne 0x489ad5
call fcn.005f2010
xor al, 0xff
and al, 1
mov byte [esp + 0x13], al
je 0x489ad5
mov byte [esi + 0x8e], bl
mov eax, dword [edi]
mov ebp, dword [edi - 0x10]
mov dword [esp + 0x18], eax
inc ebx
add edi, 4
cmp ebx, 4
jl 0x489a82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret