joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ccb2a
sub esp, 0x54
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x58]
test byte [eax], al
mov dword [esp], eax
call fcn.004c63c0
movzx eax, byte [esp + 4]
test al, al
je 0x4ccaf8
xor eax, eax
xor ecx, ecx
test ecx, ecx
jne 0x4ccae3
mov dword [esp + 0x2c], 0xc
lea eax, [0x9ff508]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x2c]
mov dword [esp], ecx
call fcn.0042c1c0
test eax, eax
jne 0x4ccad9
mov eax, dword [esp + 0x58]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x20], eax
call fcn.004a9ef0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
nop
call fcn.0042c900
add esp, 0x54
ret
nop
call fcn.0042c900
add esp, 0x54
ret
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
nop
call fcn.0042c900
add esp, 0x54
ret
mov eax, dword [esp + 0x58]
movzx ecx, byte [eax + 0x137]
test cl, cl
je 0x4ccb1c
mov ecx, dword [0xe7ac94]
mov edx, dword [0xe7ac90]
mov eax, ecx
mov ecx, edx
jmp 0x4cca3b
mov ecx, dword [0xe7ac9c]
mov edx, dword [0xe7ac98]
jmp 0x4ccb13
call fcn.00455270
jmp fcn.004cc9f0
Function at 0x4ed660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ed781
sub esp, 0x6c
lea edi, [esp + 0x90]
xor eax, eax
call fcn.00456d7b
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx + 4]
test edx, edx
setne bl
mov ebp, dword [ecx]
test ebp, ebp
setne cl
or ebx, ecx
test bl, bl
jne 0x4ed754
mov eax, dword [esp + 0x74]
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x78]
mov dword [esp], ecx
call eax
movzx eax, byte [esp + 0x18]
lea esi, [esp + 4]
lea edi, [esp + 0x44]
call fcn.0045725e
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x3c], edx
test al, al
jne 0x4ed71e
mov eax, dword [esp + 0x70]
lea esi, [eax + 8]
lea edi, [esp + 0x58]
call fcn.0045725e
mov edi, esp
lea esi, [esp + 0x90]
call fcn.0045725e
mov edi, dword [esp + 0x40]
lea esi, [esp + 0x58]
call fcn.0045725e
call fcn.004ed4b0
lea edi, [esp + 0x90]
mov esi, dword [esp + 0x3c]
call fcn.0045725e
add esp, 0x6c
ret
mov edi, esp
lea esi, [esp + 0x90]
call fcn.0045725e
mov edi, dword [esp + 0x40]
lea esi, [esp + 0x44]
call fcn.0045725e
call fcn.004ed4b0
lea edi, [esp + 0x90]
mov esi, dword [esp + 0x3c]
call fcn.0045725e
mov ecx, dword [esp + 0x40]
jmp 0x4ed6da
mov edi, esp
lea esi, [esp + 0x7c]
call fcn.0045725e
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
call fcn.004bee70
lea esi, [esp + 0x1c]
lea edi, [esp + 0x90]
call fcn.0045725e
jmp 0x4ed6a4
call fcn.00455270
jmp fcn.004ed660
Function at 0x4fd8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fda12
sub esp, 0x40
mov eax, dword [esp + 0x70]
cmp eax, 4
jne 0x4fda07
mov ecx, dword [esp + 0x6c]
cmp dword [ecx], 0x6c616964
je 0x4fd9e5
xor edx, edx
test dl, dl
jne 0x4fd9b0
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004fd6d0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
call fcn.005055c0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], ecx
add esp, 0x40
ret
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
call eax
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4fd8e8
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
call ecx
movzx edx, byte [esp + 4]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4fd8d8
mov ecx, dword [esp + 0x6c]
xor edx, edx
jmp 0x4fd8d8
call fcn.00455270
jmp fcn.004fd8a0
Function at 0x53bb90
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53bbde
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.00455270
jmp fcn.0053bb90
Function at 0x56be60
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56bea7
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call fcn.00455270
jmp fcn.0056be60
Function at 0x571aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x571c66
sub esp, 0x34
lea eax, [0x919580]
mov dword [esp], eax
call fcn.0040af00
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x571b41
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edi, dword [esp + 0x2c]
mov ebx, edi
cmp esi, edx
jge 0x571b1c
cmp ebp, eax
jge 0x571b1c
jae 0x571c5c
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x571ad7
jmp 0x571c53
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
je 0x571c14
mov eax, edx
mov ecx, ebp
mov edx, ebx
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ecx, ebp
jge 0x571c4f
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x571b00
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x571b37
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x571b37
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x571b37
add esp, 0x34
ret
mov eax, esi
mov ecx, edx
call fcn.00456b30
mov ecx, eax
mov eax, ebp
call fcn.00456b30
nop
call fcn.00455270
jmp fcn.00571aa0
Function at 0x574af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x574cfa
sub esp, 0x74
lea edi, [esp + 0x84]
xor eax, eax
call fcn.00456d7b
mov dword [esp], 0
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0xc], ecx
call fcn.004436f0
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], edx
lea edi, [esp + 0x60]
xor eax, eax
call fcn.00456d7b
lea ecx, [0x9d8026]
mov dword [esp], ecx
mov dword [esp + 4], 0x13
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov ebp, dword [0xe70e94]
mov dword [esp + 0x10], ebp
mov ebp, dword [0xe70e90]
mov dword [esp + 0x14], ebp
call fcn.004b8800
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x2c]
lea esi, [esp + 0x18]
lea edi, [esp + 0x60]
call fcn.0045725e
lea edi, [esp + 0x84]
lea esi, [esp + 0x60]
call fcn.0045725e
test edx, edx
jne 0x574ce4
mov dword [esp + 0x3c], edx
mov edi, esp
lea esi, [esp + 0x60]
call fcn.0045725e
lea eax, [0x9d8026]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x13
call fcn.004b6a80
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x34]
cmp ecx, edx
je 0x574cb4
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00408790
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
call fcn.00408790
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea ecx, [0x92c840]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
lea eax, [0x9f4999]
mov dword [esp], eax
mov dword [esp + 4], 0x6a
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004d7200
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x74
ret
mov dword [esp], eax
mov edx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00402350
movzx eax, byte [esp + 0xc]
test al, al
je 0x574cdb
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x3c]
jmp 0x574ca2
mov edx, dword [esp + 0x34]
jmp 0x574c02
mov dword [esp + 0x98], edx
mov eax, dword [esp + 0x48]
mov dword [esp + 0x9c], eax
add esp, 0x74
ret
call fcn.00455270
jmp fcn.00574af0
Function at 0x5787f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5789dd
sub esp, 0x6c
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x5789ca
nop
movzx edx, byte [0xe7b378]
test dl, dl
je 0x5789be
mov dword [0xe7b37c], ecx
mov edx, dword [0xe8ff30]
test edx, edx
jne 0x5789a7
mov eax, dword [esp + 0x80]
mov dword [0xe7b380], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x57899c
nop
movzx edx, byte [ecx + 0xf]
mov ebx, edx
and edx, 0x1f
test bl, 0x20
jne 0x57886f
or edx, 0x80
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0048c4c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x44], edx
mov ebx, dword [esp + 0x84]
mov dword [esp], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 4], ebx
call fcn.005789f0
lea esi, [esp + 8]
lea edi, [esp + 0x54]
call fcn.00457254
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
lea edi, [esp + 0x1c]
lea esi, [esp + 0x54]
call fcn.00457254
call fcn.00575930
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
test ecx, ecx
jne 0x578969
mov ecx, dword [esp + 0x74]
cmp edx, ecx
ja 0x5789d5
mov eax, dword [esp + 0x78]
sub eax, edx
mov ebx, eax
neg eax
sar eax, 0x1f
and eax, edx
mov ebp, dword [esp + 0x70]
add eax, ebp
mov dword [esp + 0x8c], eax
sub ecx, edx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
add esp, 0x6c
ret
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], eax
add esp, 0x6c
ret
xor edx, edx
xor eax, eax
xor ecx, ecx
jmp 0x57886f
lea edi, [0xe7b380]
mov eax, dword [esp + 0x80]
call fcn.00456ab0
jmp 0x578846
mov eax, dword [esp + 0x80]
jmp 0x578846
xor ecx, ecx
xor edx, edx
xor eax, eax
jmp 0x57886f
mov eax, edx
call fcn.00456b90
nop
call fcn.00455270
jmp fcn.005787f0
Function at 0x58a510
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58a72d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x58a5c7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x58a640
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x58a5a8
cmp ecx, 0xf
jne 0x58a6b9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x58a5a8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x58a5a8
call fcn.00455270
jmp fcn.0058a510
Function at 0x5a4bf0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a4dce
movzx eax, byte [esp + 4]
cmp al, 0x61
jb 0x5a4c1b
cmp al, 0x7a
ja 0x5a4c1b
mov byte [esp + 0xc], 0
ret
cmp al, 0x41
jb 0x5a4dc7
cmp al, 0x5a
setbe cl
test cl, cl
jne 0x5a4c15
cmp al, 0x30
jb 0x5a4dc0
cmp al, 0x39
setbe cl
test cl, cl
jne 0x5a4c15
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x5a4db2
cmp al, 0x2c
ja 0x5a4d8f
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x5a4c65
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x5a4c5f
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x5a4c5f
cmp al, 0x2f
ja 0x5a4d55
cmp al, 0x26
ja 0x5a4d2d
cmp al, 0x24
jne 0x5a4d22
cmp ecx, 2
jg 0x5a4ce6
cmp ecx, 1
je 0x5a4cdb
cmp ecx, 2
jne 0x5a4cbd
cmp al, 0x2f
jne 0x5a4cab
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x5a4ca1
cmp al, 0x2c
je 0x5a4ca1
cmp al, 0x3f
sete al
jmp 0x5a4ca6
cmp ecx, 7
jne 0x5a4cd5
cmp al, 0x21
jne 0x5a4ccd
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x5a4cc7
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5a4d0c
cmp al, 0x40
jne 0x5a4cfa
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x5a4cf0
cmp al, 0x3f
je 0x5a4cf0
cmp al, 0x3a
sete al
jmp 0x5a4cf5
cmp ecx, 6
je 0x5a4d1c
cmp ecx, 7
jne 0x5a4cbd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x5a4c8d
jmp 0x5a4cbd
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5a4c8d
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x5a4d47
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x5a4c8d
jmp 0x5a4cbd
cmp al, 0x3d
ja 0x5a4d74
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5a4c8d
cmp al, 0x3d
je 0x5a4c8d
jmp 0x5a4cbd
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x5a4c8d
cmp al, 0x5f
je 0x5a4d41
cmp al, 0x7e
je 0x5a4d41
jmp 0x5a4cbd
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5a4c5f
cmp al, 0x5b
je 0x5a4c5f
cmp al, 0x5d
je 0x5a4c5f
jmp 0x5a4c72
cmp ecx, 4
je 0x5a4c4e
jmp 0x5a4c72
xor ecx, ecx
jmp 0x5a4c3d
xor ecx, ecx
jmp 0x5a4c2a
call fcn.00455270
jmp fcn.005a4bf0
Function at 0x5ab660
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ab708
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5ab6cf
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x5ab6b9
call fcn.00455270
jmp fcn.005ab660
Function at 0x5e1b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e1bb7
sub esp, 0xc
lea eax, [0x936dc0]
mov dword [esp], eax
call fcn.0040af00
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.005e1a40
mov eax, dword [esp + 8]
xor ecx, ecx
jmp 0x5e1b82
mov esi, ebx
shl ebx, 0xa
lea edi, [eax + ebx]
mov dword [edi + ecx*4], ebp
lea ebx, [esi + 1]
mov edx, ebp
cmp ebx, 8
jge 0x5e1b81
mov ebp, edx
and edx, 0xff
shr ebp, 8
xor ebp, dword [eax + edx*4]
cmp ebx, 8
jb 0x5e1b57
jmp 0x5e1b9e
inc ecx
cmp ecx, 0x100
jge 0x5e1b96
jae 0x5e1baa
mov edx, dword [eax + ecx*4]
mov ebx, 1
jmp 0x5e1b67
mov dword [esp + 0x14], eax
add esp, 0xc
ret
mov eax, ebx
mov ecx, 8
call fcn.00456b30
mov eax, ecx
mov ecx, 0x100
call fcn.00456b30
nop
call fcn.00455270
jmp fcn.005e1b10
Function at 0x60f6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60f8b5
sub esp, 0x48
mov eax, dword [0xe715cc]
mov dword [esp + 0x28], eax
lea ecx, [0x92ca40]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call fcn.00440170
mov eax, dword [esp + 0xc]
mov ecx, dword [0xe715cc]
mov dword [esp + 0x34], ecx
mov edx, dword [0xe715c8]
mov dword [esp + 0x44], edx
movzx ebx, byte [esp + 0x50]
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x28]
xor edi, edi
xor edi, edi
mov dword [esp + 0x24], edi
jmp 0x60f74e
inc edi
mov ebx, dword [esp + 0x44]
movzx ebx, byte [esp + 0x50]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x44]
cmp edi, ecx
jge 0x60f8a1
movzx ebx, word [edx + edi*2]
test ebp, ebp
je 0x60f76e
movzx edx, word [ebp + 0x88]
test dx, dx
jne 0x60f89a
cmp bx, 0x301
jae 0x60f77b
mov edx, dword [esp + 0x24]
jmp 0x60f73c
test ebp, ebp
je 0x60f79c
movzx edx, word [ebp + 0x88]
test dx, dx
je 0x60f893
cmp bx, dx
jae 0x60f79a
mov edx, dword [esp + 0x24]
jmp 0x60f73c
test ebp, ebp
je 0x60f7b5
movzx edx, word [ebp + 0x8a]
test dx, dx
je 0x60f7b5
cmp bx, dx
jbe 0x60f7b5
mov edx, dword [esp + 0x24]
jmp 0x60f73c
movzx edx, byte [esp + 0x50]
test dl, dl
je 0x60f7ce
cmp bx, 0x301
jae 0x60f7ce
mov edx, dword [esp + 0x24]
jmp 0x60f73c
mov dword [esp + 0x30], edi
mov word [esp + 0x22], bx
cmp bx, 0x304
je 0x60f858
mov dword [esp + 0x38], eax
xor eax, eax
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x38]
movzx edx, byte [esp + 0x21]
test dl, dl
je 0x60f7fe
mov edx, dword [esp + 0x24]
jmp 0x60f73c
mov edx, dword [esp + 0x24]
lea ebp, [edx + 1]
cmp ebp, esi
ja 0x60f818
mov word [eax + edx*2], bx
mov edx, ebp
mov ebp, dword [esp + 0x4c]
jmp 0x60f73c
lea ecx, [0x92ca40]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
call fcn.004402d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea ebp, [ecx + 1]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
movzx ebx, word [esp + 0x22]
mov edi, dword [esp + 0x30]
jmp 0x60f809
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], eax
call fcn.0060f8c0
movzx eax, byte [esp]
xor eax, 1
mov ecx, dword [esp + 0x34]
movzx edx, byte [esp + 0x50]
movzx ebx, word [esp + 0x22]
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x40]
jmp 0x60f7ec
test ebp, ebp
jmp 0x60f79c
test ebp, ebp
jmp 0x60f77d
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], esi
add esp, 0x48
ret
call fcn.00455270
jmp fcn.0060f6d0