joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62c950
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x62ca78
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0062c83c
mov eax, dword [esi]
call fcn.0040c1b0
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41edbc]
call fcn.0040c3cc
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004066d8
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004066d8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040c1b0
mov dword [ebp - 0xc], eax
mov eax, dword [0x7733c0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0061b9b4
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004074c0
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040c1b0
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.0061b990
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.0061b748
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0061b9ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ca7f
lea eax, [ebp - 4]
mov edx, dword [0x41edbc]
call fcn.0040c4f0
ret
Function at 0x674448
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x674460
add esp, 0xfffffff0
call 0x3e2a68
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x69a1c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call 0x3e0818
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x674564
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004dfdec
xor eax, eax
push ebp
push 0x69a19d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004dfdec
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call 0x3e5160
jmp 0x674522
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call 0x3e548c
mov eax, dword [ebx + 4]
call 0x3e46e8
dec eax
jle 0x674536
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x674510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push fcn.0069a1a4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a1cd
lea eax, [ebp - 4]
call 0x3e4238
ret
Function at 0x69c640
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c23a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0048ba74
mov esi, eax
lea edx, [ebp - 0x1c]
mov eax, dword [edi + 0x18]
add eax, 4
call fcn.0069bf88
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0xc]
call 0x3e4674
lea ecx, [ebp - 0x20]
mov eax, dword [edi + 0x18]
add eax, 0xc
mov dl, 1
call fcn.0069c060
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x14]
mov ecx, 0
call 0x3e4ddc
lea eax, [edi + 4]
lea edx, [ebp - 8]
push edx
push eax
call 0x3ed92c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call 0x3ed934
lea eax, [ebp - 0x18]
call fcn.00403f68
fstp qword [esi + 0x18]
wait
lea eax, [esi + 0x28]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x14]
mov ecx, 0
call 0x3e4978
lea eax, [esi + 0x2c]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x20]
mov ecx, 0
call 0x3e4978
lea ecx, [ebp - 0x24]
mov eax, dword [edi + 0x18]
add eax, 0x2c
xor edx, edx
call fcn.0069c060
mov edx, dword [ebp - 0x24]
lea eax, [esi + 0x30]
mov ecx, 0
call 0x3e4ddc
mov ebx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
dec eax
test eax, eax
jl 0x69c738
inc eax
mov edi, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x69c735
mov edx, dword [esi + 0x24]
xchg edx, eax
call fcn.0069c918
add ebx, 0x3c
dec edi
jne 0x69c722
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c23ae
lea eax, [ebp - 0x24]
mov edx, 2
call 0x3e4250
lea eax, [ebp - 0x1c]
call 0x3e4214
ret
Function at 0x69c918
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c26cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0048ba74
mov ebx, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov dword [ebx + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.0069bf20
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
call 0x3e4674
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 4
mov eax, esi
call fcn.0069bf20
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0xc]
call 0x3e4674
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 1
mov eax, esi
call fcn.0069bf20
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x14]
call 0x3e4674
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 0xc]
add eax, 4
mov dl, 1
call fcn.0069c060
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x28]
mov ecx, 0
call 0x3e4ddc
mov eax, dword [esi + 0xc]
add eax, 0x20
lea edx, [ebp - 8]
push edx
push eax
call 0x3ed92c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call 0x3ed934
lea eax, [ebp - 0x18]
call fcn.00403f68
fstp qword [ebx + 0x18]
wait
mov eax, dword [esi + 0xc]
add eax, 0x28
lea edx, [ebp - 8]
push edx
push eax
call 0x3ed92c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call 0x3ed934
lea eax, [ebp - 0x18]
call fcn.00403f68
fstp qword [ebx + 0x20]
wait
lea eax, [ebx + 0x30]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0xc]
mov ecx, 0
call 0x3e4978
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xc]
add eax, 0x44
xor edx, edx
call fcn.0069c060
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x34]
mov ecx, 0
call 0x3e4ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c26d4
lea eax, [ebp - 0x2c]
mov edx, 2
call 0x3e4250
lea eax, [ebp - 0x24]
mov edx, 3
call 0x3e4280
ret

Function at 0x6a0e98
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call 0x3ede88
cmp eax, 0x1c
jne 0x6a0f14
cmp dword [esp + 0x10], 0x1000
jne 0x6a0f14
cmp dword [esp + 4], 0
je 0x6a0f14
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call 0x3eda9c
test eax, eax
je 0x6a0f14
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x6a0f14
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x6a0f14
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6bbc18
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6bbc20
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6e19db
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x54], 0
jne 0x6bbd58
mov eax, ebx
call fcn.0059a09c
test al, al
je 0x6bbd58
mov eax, dword [ebx + 0x38]
mov edx, dword [eax]
call dword [edx + 0x94]
mov esi, eax
call 0x3ed9ec
cmp esi, eax
je 0x6bbc80
lea eax, [ebp - 0x30]
call fcn.0059c6e4
cmp byte [ebp - 0x20], 0
je 0x6bbc90
cmp dword [ebx + 0x3c], 0x80000000
jb 0x6bbc90
mov eax, dword [ebx + 0x3c]
call fcn.0059d3e8
mov dword [ebx + 0x54], eax
jmp 0x6bbd44
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x38]
call 0x3e7e34
lea ecx, [ebp - 8]
mov edx, 0x10
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xbc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x6bbd23
push 2
lea ecx, [ebp - 0xa]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6bbd44
cmp word [ebp - 0xa], 0x5a4d
jne 0x6bbd44
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x3c]
add edx, 0x3c
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6bbd44
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebx + 0x54], eax
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x54]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x6bbd1c
cmp dword [ebp - 0x10], 0x4550
je 0x6bbd44
xor eax, eax
mov dword [ebx + 0x54], eax
jmp 0x6bbd44
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.005999dc
cmp dword [ebx + 0x54], 0
jne 0x6bbd58
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.005999dc
mov ebx, dword [ebx + 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e19e2
lea eax, [ebp - 0x34]
call 0x3e41f0
lea eax, [ebp - 0x30]
mov edx, dword [0x5c1d9c]
call 0x3e5a40
lea eax, [ebp - 8]
call 0x3e7e1c
lea eax, [ebp - 4]
call 0x3e7e1c
ret

Function at 0x6ca08c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x771654]
cmp eax, 0x1c
jne 0x6ca107
cmp dword [ebp - 0xc], 0x1000
jne 0x6ca102
cmp dword [ebp - 0x18], 0
je 0x6ca102
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x6ca102
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x6ca0e1
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x6ca107
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x771628]
cmp eax, 0
je 0x6ca102
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x77169c]
add ebx, dword [ebp - 0x10]
jmp 0x6ca0a3
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x6f40d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6f40fe
mov eax, ebx
call fcn.006f4b8c
cmp dword [ebx + 0x40], 0
je 0x6f40f7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6f416f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6f4161
cmp dword [ebx + 8], 0
je 0x6f4120
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6f4132
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6f4161
cmp dword [ebx + 8], 0
je 0x6f4113
cmp eax, 3
je 0x6f4145
dec eax
jne 0x6f4113
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6f4113
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6f4113
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6f418d
cmp dword [ebx + 0x14], 0xcc
je 0x6f418d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006f4198
pop ebx
ret

Function at 0x70e7ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x70e7fb
add esp, 0xfffffff0
call 0x3e2a68
mov esi, ecx
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call 0x3e2408
mov dword [edi + 0x94], esi
mov word [edi + 4], 0xffeb
mov dl, 1
mov eax, dword [0x4f391c]
call fcn.004d3f48
mov esi, eax
mov dword [edi + 8], esi
mov dword [esi + 0xc], edi
mov dword [esi + 8], 0x734634
mov edx, 0xffffff
mov eax, esi
call fcn.004d4134
mov edx, 0x7345c8
mov eax, esi
call fcn.004d445c
mov edx, 8
mov eax, esi
call fcn.004d44d4
movzx edx, byte [0x7345d8]
mov eax, esi
call fcn.004d4500
mov byte [edi + 0xc], 1
mov byte [edi + 0xd], 0
mov byte [edi + 0xe], 1
mov byte [edi + 0xf], 1
mov byte [edi + 0x10], 1
mov byte [edi + 0x11], 0
mov dword [edi + 0x14], 0x9f6c36
mov dword [edi + 0x18], 0xc59d62
mov dword [edi + 0x1c], 0xc59d62
mov dword [edi + 0x20], 0xd0b387
mov dword [edi + 0x24], 0x80520c
mov dword [edi + 0x28], 0xff000011
mov dword [edi + 0x2c], 0xff000011
mov dword [edi + 0x30], 0xff000011
mov dword [edi + 0x34], 0xff000011
mov dword [edi + 0x38], 0xc59147
mov dword [edi + 0x3c], 0xffffff
mov dword [edi + 0x48], 0xac732e
mov dword [edi + 0x4c], 0xba7c32
mov dword [edi + 0x40], 0xccb19d
mov eax, dword [edi + 0x48]
mov dword [edi + 0x44], eax
mov dword [edi + 0x50], 0xd0b387
mov dword [edi + 0x54], 0xd0b387
mov dword [edi + 0x58], 0xc59147
mov dword [edi + 0x5c], 0x80520c
mov dword [edi + 0x60], 0xc59d62
mov dword [edi + 0x64], 0xc59d62
mov dword [edi + 0x68], 0xd0b387
mov dword [edi + 0x6c], 0x80520c
mov dword [edi + 0x70], 0xd0b387
mov dword [edi + 0x74], 0xd0b387
mov dword [edi + 0x78], 0xc59147
mov dword [edi + 0x7c], 0x80520c
mov eax, dword [edi + 0x6c]
mov dword [edi + 0x88], eax
mov eax, dword [edi + 0x64]
mov dword [edi + 0x8c], eax
mov dword [edi + 0x84], 7
mov eax, edi
test bl, bl
je 0x70e968
call 0x3e2ac0
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4041aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x5e0
call fcn.004041be

Function at 0x4063ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
cmp dword [edx], 0
je 0x40641f
mov esi, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
lea eax, [edx + 8]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 0x3c]
mov edx, eax
je 0x406512
push 0
jmp 0x406514
xor eax, eax
cmp byte [edx + 0xe], 0
jne 0x406555
mov dword [ebp - 0x1c], ecx
mov ecx, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov al, byte [edx + 0xc]
mov ebx, dword [edx + 4]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ecx
xor al, 1
test ebx, ebx
mov byte [ebp - 0x14], al
mov eax, esi
je 0x406465
mov eax, esi
sub eax, ebx
jbe 0x40645f
cmp byte [ecx + ebx], 0xbf
jg 0x406465
jmp 0x40655f
jne 0x40655f
test eax, eax
je 0x406524
movzx eax, byte [ecx + ebx]
test al, al
jns 0x4064d0
movzx ecx, byte [ecx + ebx + 1]
mov edi, eax
and edi, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x4064b7
mov esi, dword [ebp - 0x18]
shl ecx, 6
movzx esi, byte [esi + ebx + 2]
and esi, 0x3f
or esi, ecx
cmp al, 0xf0
jb 0x4064c3
mov ecx, dword [ebp - 0x18]
shl esi, 6
and edi, 7
shl edi, 0x12
movzx eax, byte [ecx + ebx + 3]
and eax, 0x3f
or eax, esi
mov esi, dword [ebp - 0x20]
or eax, edi
jmp 0x4064d0
shl edi, 6
or edi, ecx
mov ecx, dword [ebp - 0x18]
mov eax, edi
jmp 0x4064d0
shl edi, 0xc
mov ecx, dword [ebp - 0x18]
or esi, edi
mov eax, esi
mov esi, dword [ebp - 0x20]
cmp byte [ebp - 0xd], 0
jne 0x406532
cmp eax, 0x110000
je 0x406546
cmp eax, 0x80
mov edi, 1
jb 0x406502
mov edi, 2
cmp eax, 0x800
jb 0x406502
cmp eax, 0x10000
mov edi, 4
sbb edi, 0
mov al, byte [ebp - 0x14]
add ebx, edi
mov dword [edx + 4], ebx
mov byte [ebp - 0xd], al
jmp 0x406443
push 1
push esi
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00403989
add esp, 0x28
jmp 0x40655a
cmp byte [ebp - 0xd], 0
mov al, byte [ebp - 0x14]
mov byte [edx + 0xc], al
jne 0x406538
jmp 0x40654c
mov al, byte [ebp - 0x14]
mov byte [edx + 0xc], al
mov ecx, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
jmp 0x406555
mov al, byte [ebp - 0x14]
mov byte [edx + 0xc], al
mov ecx, dword [ebp - 0x1c]
mov byte [edx + 0xe], 1
xor eax, eax
mov dword [ecx], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x14]
mov byte [edx + 0xc], al
mov edx, esi
push 0x56a700
push esi
push ebx
call fcn.0044a570
add esp, 0xc
ud2
Function at 0x41dc1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov dword [ebp - 0x14], ecx
je 0x41dc54
mov ecx, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
mov esi, dword [edx + 0x3c]
lea eax, [edx + 8]
mov dword [ebp - 0x18], ecx
je 0x41dd4c
mov ecx, dword [ebp - 0x14]
mov edx, eax
push 0
jmp 0x41dd53
mov al, byte [edx + 0xe]
mov ecx, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov edi, dword [edx + 4]
mov bl, byte [edx + 0xc]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xd], al
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], esi
cmp byte [ebp - 0xd], 0
jne 0x41dd79
mov eax, ebx
xor al, 1
test edi, edi
mov byte [ebp - 0xe], al
mov byte [edx + 0xc], al
mov eax, esi
je 0x41dca0
mov eax, esi
sub eax, edi
jbe 0x41dc9a
cmp byte [ecx + edi], 0xbf
jg 0x41dca0
jmp 0x41dd88
jne 0x41dd88
test eax, eax
je 0x41dd63
mov byte [ebp - 0x18], bl
mov ebx, ecx
movzx ecx, byte [ecx + edi]
test cl, cl
jns 0x41dd06
movzx eax, byte [ebx + edi + 1]
mov esi, ecx
and esi, 0x1f
and eax, 0x3f
cmp cl, 0xdf
jbe 0x41dcf0
movzx edx, byte [ebx + edi + 2]
shl eax, 6
and edx, 0x3f
or edx, eax
cmp cl, 0xf0
jb 0x41dcf9
movzx ecx, byte [ebx + edi + 3]
and esi, 7
shl edx, 6
shl esi, 0x12
and ecx, 0x3f
or ecx, edx
or ecx, esi
jmp 0x41dd00
shl esi, 6
or esi, eax
mov ecx, esi
jmp 0x41dd00
shl esi, 0xc
or edx, esi
mov ecx, edx
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
cmp byte [ebp - 0x18], 0
jne 0x41dd67
cmp ecx, 0x110000
je 0x41dd75
cmp ecx, 0x80
mov eax, 1
jb 0x41dd3c
mov eax, 2
cmp ecx, 0x800
jb 0x41dd3c
cmp ecx, 0x10000
mov eax, 4
sbb eax, 0
mov bl, byte [ebp - 0xe]
mov ecx, dword [ebp - 0x24]
add edi, eax
mov dword [edx + 4], edi
jmp 0x41dc6f
mov ecx, dword [ebp - 0x14]
mov edx, eax
push 1
push esi
push ebx
push edi
push dword [ebp - 0x18]
call fcn.00452f9d
add esp, 0x2c
jmp 0x41dd83
test bl, bl
je 0x41dd75
mov eax, dword [ebp - 0x14]
xor ecx, ecx
inc ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edi
jmp 0x41dd7b
mov byte [edx + 0xe], 1
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, esi
push 0x56a700
push esi
push edi
call fcn.0044a570
add esp, 0xc
ud2
Function at 0x44a9b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x44aa00
cmp edi, esi
jb 0x44aa6b
cmp edi, dword [ebp + 0x10]
ja 0x44aa7e
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x44aa02
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x44a9f0
jmp 0x44aa5f
ja 0x44aa09
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x44a9c5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x44aa40
mov ebx, esi
sub ecx, edx
jns 0x44aa57
jmp 0x44aa61
cmp esi, edi
je 0x44aa92
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x44aa61
xor al, 1
cmp ebx, edi
jne 0x44aa20
jmp 0x44aa61
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x54b6f4
call fcn.00446290
add esp, 4
ud2
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x54b6f4
call fcn.00445020
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_home_vi_.cargo_registry_src_index.crates.io_6f17d22bba15001f_url_1.7.2_src_lib.rsURL_has_no_host
mov edx, 0x2b
push 0x54b6e4
call fcn.00445340
add esp, 4
ud2
Function at 0x451deb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
mov eax, ecx
not eax
cmp edi, 0x40
jb 0x451f11
add edx, 0x10
xor ecx, ecx
cmp edi, 0xf
jbe 0x451f34
movzx ebx, byte [edx - 2]
movzx esi, byte [edx - 1]
mov dword [ebp - 0x10], ecx
mov ecx, eax
mov dword [ebp - 0x14], edi
mov edi, 0xff
shr ecx, 0x18
mov ebx, dword [ebx*4 + 0x54f7d0]
xor ebx, dword [esi*4 + 0x54f3d0]
movzx esi, byte [edx - 3]
xor ebx, dword [esi*4 + 0x54fbd0]
movzx esi, byte [edx - 4]
xor ebx, dword [esi*4 + 0x54ffd0]
movzx esi, byte [edx - 5]
xor ebx, dword [esi*4 + 0x5503d0]
movzx esi, byte [edx - 6]
xor ebx, dword [esi*4 + 0x5507d0]
movzx esi, byte [edx - 7]
xor ebx, dword [esi*4 + 0x550bd0]
movzx esi, byte [edx - 8]
xor ebx, dword [esi*4 + 0x550fd0]
movzx esi, byte [edx - 9]
xor ebx, dword [esi*4 + 0x5513d0]
movzx esi, byte [edx - 0xa]
xor ebx, dword [esi*4 + 0x5517d0]
movzx esi, byte [edx - 0xb]
xor ebx, dword [esi*4 + 0x551bd0]
movzx esi, byte [edx - 0xc]
xor ebx, dword [esi*4 + 0x551fd0]
movzx esi, byte [edx - 0xd]
xor ecx, esi
mov esi, eax
xor ebx, dword [ecx*4 + 0x5523d0]
movzx ecx, byte [edx - 0xe]
shr esi, 0x10
and esi, edi
xor esi, ecx
movzx ecx, byte [edx - 0xf]
xor ebx, dword [esi*4 + 0x5527d0]
mov esi, eax
and eax, edi
shr esi, 8
and esi, edi
mov edi, dword [ebp - 0x14]
xor esi, ecx
movzx ecx, byte [edx - 0x10]
xor ebx, dword [esi*4 + 0x552bd0]
mov esi, eax
xor esi, ecx
mov ecx, dword [ebp - 0x10]
mov eax, ebx
lea ebx, [edi - 0x10]
xor eax, dword [esi*4 + 0x552fd0]
inc ecx
cmp ecx, 4
jne 0x451f04
xor ecx, ecx
cmp ebx, 0x3f
jbe 0x451f0e
add edx, 0x10
mov edi, ebx
jmp 0x451e09
add edi, 0xfffffff0
test edi, edi
je 0x451f2a
mov bl, byte [edx]
inc edx
xor bl, al
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x54f3d0]
dec edi
jne 0x451f15
not eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0xf
mov edx, edi
push 0x54f3c0
call fcn.00444440
add esp, 4
ud2