joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505460
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50562c
sub esp, 0x34
mov edx, dword [esp + 0x38]
mov ebx, dword [edx + 0x18]
dec ebx
mov dword [esp + 8], ebx
mov ebp, dword [edx + 0x1c]
dec ebp
mov dword [esp + 0xc], ebp
mov esi, dword [edx + 0x10]
mov dword [esp + 0x20], esi
mov edi, dword [edx + 0x14]
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
jmp 0x5055b2
mov dword [eax + edi*4], ecx
mov ecx, dword [esp + 0x48]
test byte [ecx], al
mov dword [ecx + edi*4], edx
mov edx, dword [esp + 0x4c]
test byte [edx], al
mov dword [edx + edi*4], ebx
lea ebx, [esi + 1]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x10]
mov eax, esi
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov ebp, edi
mov esi, dword [esp + 8]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x18]
cmp edi, 8
jge 0x50559b
lea ebx, [eax + edi]
cmp esi, ebx
jge 0x505590
mov ebx, esi
mov ebx, dword [edx + 4]
mov edi, dword [edx]
mov edx, dword [edx + 8]
lea esi, [ebp + esi*4]
cmp esi, ebx
ja 0x505622
sub ebx, esi
sub edx, esi
neg edx
sar edx, 0x1f
and esi, edx
test ebx, ebx
jbe 0x505619
movzx edx, byte [edi + esi]
cmp ebx, 1
jbe 0x50560d
movzx ebp, byte [edi + esi + 1]
cmp ebx, 2
jbe 0x505601
movzx eax, byte [edi + esi + 2]
mov byte [esp], dl
xchg ebp, eax
mov byte [esp + 1], al
xchg ebp, eax
mov byte [esp + 2], al
call fcn.004beb30
mov eax, dword [esp + 0x44]
test byte [eax], al
movzx ecx, byte [esp + 4]
movzx edx, byte [esp + 5]
movzx ebx, byte [esp + 6]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
lea edi, [esi + ebp*8]
cmp edi, 0x40
jb 0x5054b6
jmp 0x5055f5
mov esi, ebx
mov ebx, dword [esp + 8]
jmp 0x50550c
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [esp + 0x1c]
mov ebx, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
cmp ebx, 8
jge 0x5055f1
add ebx, ecx
cmp ebp, ebx
jge 0x5055e9
mov ebx, ebp
sub ebp, edi
imul ebp, dword [edx + 0xc]
shl esi, 2
sub ebp, esi
mov dword [esp + 0x10], ebp
mov esi, dword [esp + 8]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
jmp 0x5054f2
mov ebp, ebx
mov ebx, dword [esp + 0xc]
jmp 0x5055c3
add esp, 0x34
ret
mov eax, edi
mov ecx, 0x40
call fcn.0045ad60
mov eax, 2
mov ecx, ebx
call fcn.0045ad60
mov eax, 1
mov ecx, ebx
call fcn.0045ad60
xor eax, eax
mov ecx, ebx
call fcn.0045ad60
mov eax, esi
mov ecx, ebx
call fcn.0045adc0
nop
call fcn.00459790
jmp fcn.00505460
Function at 0x51af80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x51b191
sub esp, 0x84
mov byte [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea eax, [esp + 0x74]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 0
call fcn.0050afe0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov byte [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
xor ebp, ebp
lea esi, [esp + 0x44]
lea edi, [esp + 0x54]
lea ebp, [esp + 0x64]
mov dword [esp + 0x3c], ebp
xor ebp, ebp
jmp 0x51b13c
mov ebp, dword [esp + 0x2c]
inc ebp
shl ebx, 1
mov dword [esp + 0x2c], ebp
mov esi, edx
mov edi, ecx
mov dword [esp + 0x3c], eax
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x94]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
cmp ebx, 8
jge 0x51b125
mov byte [esp + 0x2b], al
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0051a740
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx ebx, byte [esp + 0x2b]
test bl, 0x80
je 0x51b069
mov ebx, dword [esp + 0x88]
mov dword [esp], ebx
mov ebp, dword [esp + 0x8c]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x90]
mov dword [esp + 8], esi
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.005191f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x2b]
jmp 0x51b069
inc ebp
mov eax, dword [esp + 0x94]
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x94]
cmp ebp, ecx
jge 0x51b15c
mov dword [esp + 0x30], ebp
movzx eax, byte [ebx + ebp]
mov byte [esp + 0x34], al
xor eax, eax
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 0x34]
jmp 0x51b097
mov dword [esp], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.00518f60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
add esp, 0x84
ret
call fcn.00459790
jmp fcn.0051af80
Function at 0x524330
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52454d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5243e7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x524460
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5243c8
cmp ecx, 0xf
jne 0x5244d9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5243c8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x5243c8
call fcn.00459790
jmp fcn.00524330
Function at 0x527be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x527ddd
sub esp, 0x70
lea edi, [esp + 0x80]
xor eax, eax
call fcn.0045af8b
mov dword [esp], 0
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 8], ecx
call fcn.00445ea0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], edx
lea edi, [esp + 0x5c]
xor eax, eax
call fcn.0045af8b
lea ecx, [0x67424f]
mov dword [esp], ecx
mov dword [esp + 4], 0x13
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov ebp, dword [0x815904]
mov dword [esp + 0x10], ebp
mov ebp, dword [0x815900]
mov dword [esp + 0x14], ebp
call fcn.00498210
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x30]
lea esi, [esp + 0x18]
lea edi, [esp + 0x5c]
call fcn.0045b46e
lea edi, [esp + 0x80]
lea esi, [esp + 0x5c]
call fcn.0045b46e
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x527dcb
mov dword [esp + 0x48], edx
mov edi, esp
lea esi, [esp + 0x5c]
call fcn.0045b46e
lea eax, [0x67424f]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x13
call fcn.00496500
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x34]
cmp eax, edx
je 0x527d9b
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x633ac0]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call fcn.00408c10
mov eax, dword [esp + 8]
lea ecx, [0x633ac0]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], eax
lea eax, [0x6838fc]
mov dword [esp], eax
mov dword [esp + 4], 0x6a
lea eax, [esp + 0x4c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004a95f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
add esp, 0x70
ret
mov dword [esp], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.00402950
movzx eax, byte [esp + 0xc]
test al, al
je 0x527dc2
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
jmp 0x527d89
mov edx, dword [esp + 0x34]
jmp 0x527ceb
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], edx
add esp, 0x70
ret
call fcn.00459790
jmp fcn.00527be0
Function at 0x52b9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52bb9b
sub esp, 0x6c
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x52bb8a
nop
movzx edx, byte [0x81c0d8]
test dl, dl
je 0x52bb7e
mov dword [0x81c0dc], ecx
mov edx, dword [0x8326a0]
test edx, edx
jne 0x52bb67
mov eax, dword [esp + 0x80]
mov dword [0x81c0e0], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x52bb5c
nop
movzx edx, byte [ecx + 0xf]
mov ebx, edx
and edx, 0x1f
test bl, 0x20
jne 0x52ba2f
or edx, 0x80
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0047dd80
mov eax, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x40], edx
mov ebx, dword [esp + 0x84]
mov dword [esp], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 4], ebx
call fcn.0052bbb0
lea esi, [esp + 8]
lea edi, [esp + 0x54]
call fcn.0045b464
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
lea edi, [esp + 0x1c]
lea esi, [esp + 0x54]
call fcn.0045b464
call fcn.00528b50
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
test ecx, ecx
jne 0x52bb29
mov ecx, dword [esp + 0x74]
cmp eax, ecx
ja 0x52bb95
mov edx, dword [esp + 0x78]
sub edx, eax
mov ebx, edx
neg edx
sar edx, 0x1f
and edx, eax
mov ebp, dword [esp + 0x70]
add edx, ebp
mov dword [esp + 0x8c], edx
sub ecx, eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
add esp, 0x6c
ret
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x6c
ret
xor edx, edx
xor ecx, ecx
xor eax, eax
jmp 0x52ba2f
lea edi, [0x81c0e0]
mov eax, dword [esp + 0x80]
call fcn.0045ace0
jmp 0x52ba06
mov eax, dword [esp + 0x80]
jmp 0x52ba06
xor edx, edx
xor ecx, ecx
xor eax, eax
jmp 0x52ba2f
call fcn.0045adc0
nop
call fcn.00459790
jmp fcn.0052b9b0
Function at 0x54d420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54d5e4
sub esp, 0x34
lea eax, [0x62f600]
mov dword [esp], eax
call fcn.0040b4f0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x54d4bf
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edi, dword [esp + 0x2c]
mov ebx, edi
cmp esi, edx
jge 0x54d49c
cmp eax, ebp
jle 0x54d49c
jbe 0x54d5da
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x54d457
jmp 0x54d5d1
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
je 0x54d592
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ecx, ebp
jge 0x54d5cd
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x54d480
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x54d4b7
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x54d4b7
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x54d4b7
add esp, 0x34
ret
mov eax, esi
mov ecx, edx
call fcn.0045ad60
mov ecx, eax
mov eax, ebp
call fcn.0045ad60
nop
call fcn.00459790
jmp fcn.0054d420
Function at 0x553e00
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x553ea8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x553e6f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x553e59
call fcn.00459790
jmp fcn.00553e00
Function at 0x55b8c0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55ba75
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x55b8e9
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x55b8e3
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x55b8e3
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x55ba67
cmp al, 0x2c
ja 0x55ba44
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x55b91d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x55b917
cmp al, 0x26
jae 0x55b917
cmp al, 0x2f
ja 0x55ba0a
cmp al, 0x26
ja 0x55b9e2
cmp al, 0x24
jne 0x55b9d7
cmp ecx, 2
jg 0x55b99b
cmp ecx, 1
je 0x55b990
cmp ecx, 2
jne 0x55b972
cmp al, 0x2f
jne 0x55b960
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x55b956
cmp al, 0x2c
je 0x55b956
cmp al, 0x3f
sete al
jmp 0x55b95b
cmp ecx, 7
jne 0x55b98a
cmp al, 0x21
jne 0x55b982
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x55b97c
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x55b9c1
cmp al, 0x40
jne 0x55b9af
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x55b9a5
cmp al, 0x3f
je 0x55b9a5
cmp al, 0x3a
sete al
jmp 0x55b9aa
cmp ecx, 6
je 0x55b9d1
cmp ecx, 7
jne 0x55b972
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x55b942
jmp 0x55b972
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x55b942
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x55b9fc
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x55b942
jmp 0x55b972
cmp al, 0x3d
ja 0x55ba29
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x55b942
cmp al, 0x3d
je 0x55b942
jmp 0x55b972
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x55b942
cmp al, 0x5f
je 0x55b9f6
cmp al, 0x7e
je 0x55b9f6
jmp 0x55b972
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x55b917
cmp al, 0x5b
je 0x55b917
cmp al, 0x5d
je 0x55b917
jmp 0x55b927
cmp ecx, 4
je 0x55b906
jmp 0x55b927
call fcn.00459790
jmp fcn.0055b8c0
Function at 0x56f780
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56f964
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov ebx, edx
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, edx
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
mov esi, edx
shl edx, 0x18
or edx, ecx
and edx, 0xfffffff
movzx ecx, byte [eax + 4]
movzx edi, byte [eax + 5]
mov dword [esp + 4], edi
movzx edi, byte [eax + 6]
movzx eax, byte [eax + 7]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [eax + 0x18], edx
shr ebx, 0x18
shr ebp, 0x10
or ebx, ebp
shr esi, 8
or ebx, esi
or ecx, ebx
mov edx, dword [esp + 4]
shl edx, 8
or ecx, edx
shl edi, 0x10
or edi, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edi, ecx
and edi, 0xffffffc
mov dword [eax + 0x1c], edi
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 8]
movzx ebx, byte [ecx + 9]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0xa]
mov esi, ebx
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [ecx + 0xb]
mov edi, ebx
shl ebx, 0x18
or edx, ebx
and edx, 0xffffffc
movzx ebx, byte [ecx + 0xc]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0xd]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0xe]
movzx ecx, byte [ecx + 0xf]
mov dword [eax + 0x20], edx
shr ebp, 0x18
shr esi, 0x10
or ebp, esi
shr edi, 8
or ebp, edi
mov edx, dword [esp + 4]
or edx, ebp
mov ebp, dword [esp]
shl ebp, 8
or edx, ebp
shl ebx, 0x10
or ebx, edx
shl ecx, 0x18
or ebx, ecx
and ebx, 0xffffffc
mov dword [eax + 0x24], ebx
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 0x10]
movzx ebx, byte [ecx + 0x11]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0x12]
mov esi, ebx
shl ebx, 0x10
or ebx, edx
movzx edx, byte [ecx + 0x13]
mov edi, edx
shl edx, 0x18
or edx, ebx
movzx ebx, byte [ecx + 0x14]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0x15]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0x16]
movzx ecx, byte [ecx + 0x17]
mov dword [eax + 0x28], edx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or esi, edi
mov edx, dword [esp + 4]
or edx, esi
mov ebp, dword [esp]
shl ebp, 8
or edx, ebp
shl ebx, 0x10
or ebx, edx
shl ecx, 0x18
or ebx, ecx
mov dword [eax + 0x2c], ebx
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + 0x18]
movzx ebx, byte [ecx + 0x19]
mov ebp, ebx
shl ebx, 8
or edx, ebx
movzx ebx, byte [ecx + 0x1a]
mov esi, ebx
shl ebx, 0x10
or ebx, edx
movzx edx, byte [ecx + 0x1b]
mov edi, edx
shl edx, 0x18
or edx, ebx
movzx ebx, byte [ecx + 0x1c]
mov dword [esp + 4], ebx
movzx ebx, byte [ecx + 0x1d]
mov dword [esp], ebx
movzx ebx, byte [ecx + 0x1e]
movzx ecx, byte [ecx + 0x1f]
mov dword [eax + 0x30], edx
shr ebp, 0x18
shr esi, 0x10
or esi, ebp
shr edi, 8
or esi, edi
mov edx, dword [esp + 4]
or edx, esi
mov ebp, dword [esp]
shl ebp, 8
or edx, ebp
shl ebx, 0x10
or ebx, edx
shl ecx, 0x18
or ebx, ecx
mov dword [eax + 0x34], ebx
add esp, 8
ret
call fcn.00459790
jmp fcn.0056f780
Function at 0x57c980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57ca88
sub esp, 0x20
mov ecx, dword [esp + 0x28]
cmp ecx, 1
jl 0x57ca6d
mov edx, dword [esp + 0x24]
movzx ebx, byte [ecx + edx - 1]
lea eax, [ecx - 1]
movzx ebp, bl
mov esi, eax
sub eax, ebp
cmp ecx, 0x100
jge 0x57ca61
mov edi, ecx
mov dword [esp + 0x14], esi
mov byte [esp + 0xb], bl
mov dword [esp + 0x10], ebp
not eax
sar eax, 0x1f
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
jmp 0x57ca21
inc ebx
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
movzx esi, byte [edx + esi]
movzx edx, byte [esp + 0xb]
and edx, ebp
and esi, ebp
xor edx, esi
not edx
and eax, edx
movzx edx, byte [esp + 0xb]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov edx, ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
movzx ebx, byte [esp + 0xb]
mov ebx, dword [esp + 0xc]
cmp ebx, ecx
jge 0x57ca33
sub ebp, ebx
sub esi, ebx
cmp esi, edi
jb 0x57c9e8
jmp 0x57ca7e
mov ecx, eax
shl eax, 4
and ecx, eax
mov eax, ecx
shl ecx, 2
and ecx, eax
mov eax, ecx
shl ecx, 1
and ecx, eax
sar cl, 7
movzx eax, byte [esp + 0xb]
and eax, ecx
movzx eax, al
inc eax
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], cl
add esp, 0x20
ret
mov edi, ecx
mov ecx, 0x100
jmp 0x57c9c7
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov eax, esi
mov ecx, edi
call fcn.0045ad60
nop
call fcn.00459790
jmp fcn.0057c980