joyce8/EMBER2024-capa huggingface dataset:
Function at 0x610cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x610dd4
sub esp, 0x24
mov ecx, dword [esp + 0x2c]
cmp ecx, 1
jl 0x610db9
mov edx, dword [esp + 0x28]
movzx ebx, byte [ecx + edx - 1]
lea eax, [ecx - 1]
movzx ebp, bl
mov esi, eax
sub eax, ebp
cmp ecx, 0x100
jge 0x610dad
mov edi, ecx
mov dword [esp + 0x18], esi
mov byte [esp + 0xb], bl
mov dword [esp + 0x14], ebp
not eax
sar eax, 0x1f
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
jmp 0x610d6d
inc ebx
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
mov dword [esp + 0x10], ebp
movzx esi, byte [edx + esi]
movzx edx, byte [esp + 0xb]
and ebp, edx
mov edx, dword [esp + 0x10]
and esi, edx
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
and eax, ebp
movzx edx, byte [esp + 0xb]
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov edx, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
movzx ebx, byte [esp + 0xb]
mov ebx, dword [esp + 0xc]
cmp ebx, ecx
jge 0x610d7f
sub ebp, ebx
sub esi, ebx
cmp esi, edi
jb 0x610d28
jmp 0x610dca
mov ecx, eax
shl eax, 4
and ecx, eax
mov eax, ecx
shl ecx, 2
and ecx, eax
mov eax, ecx
shl ecx, 1
and ecx, eax
sar cl, 7
movzx eax, byte [esp + 0xb]
and eax, ecx
movzx eax, al
inc eax
mov dword [esp + 0x34], eax
mov byte [esp + 0x38], cl
add esp, 0x24
ret
mov edi, ecx
mov ecx, 0x100
jmp 0x610d07
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x24
ret
mov eax, esi
mov ecx, edi
call fcn.00456b30
nop
call fcn.00455270
jmp fcn.00610cc0
Function at 0x6165b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x6167a8
sub esp, 0x88
lea edi, [esp + 0x90]
xor eax, eax
call fcn.00456d69
mov ecx, dword [esp + 0x8c]
test byte [ecx], al
lea edx, [ecx + 0x10]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00462cc0
mov dword [esp + 8], 4
lea ecx, [0x9ffa24]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 8]
mov dword [esp], ecx
call fcn.0042c1c0
test eax, eax
jne 0x61679b
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.00456d69
mov ecx, dword [esp + 0x8c]
lea edx, [ecx + 0xc]
mov dword [esp], edx
call fcn.0045d5f0
cmp dword [esp + 4], 1
sete cl
mov byte [esp + 0x2e], cl
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 0x64]
mov ebx, dword [ecx + 0x60]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], edx
movzx edx, byte [esp + 0x2e]
test dl, dl
je 0x61671e
movzx eax, word [ecx + 0x20]
mov word [esp + 0x2c], ax
mov eax, dword [ecx + 0xa8]
mov edx, dword [ecx + 0xa4]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
movzx eax, byte [ecx + 0x2c]
mov byte [esp + 0x2f], al
movzx eax, byte [ecx + 0xac]
xor eax, 1
mov byte [esp + 0x3c], al
movzx eax, word [ecx + 0x2e]
mov word [esp + 0x30], ax
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x4c]
mov ebx, dword [ecx + 0x48]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0x54]
mov edx, dword [ecx + 0x5c]
mov ebx, dword [ecx + 0x58]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], edx
mov eax, dword [ecx + 0x40]
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x3c]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
mov eax, dword [ecx + 0x38]
mov edx, dword [ecx + 0x34]
mov ebx, dword [ecx + 0x30]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
movzx eax, byte [ecx + 0x2c]
test al, al
je 0x616744
mov eax, dword [ecx + 0x24]
mov eax, dword [eax + 0x9c]
test eax, eax
je 0x61673b
lea eax, [0x9fee68]
mov dword [esp + 0x78], eax
lea edi, [esp + 0x90]
lea esi, [esp + 0x2c]
call fcn.004571aa
nop
call fcn.0042c900
add esp, 0x88
ret
mov eax, dword [ecx + 0x6c]
mov dword [esp + 0x78], eax
jmp 0x61671e
cmp word [ecx + 0x20], 0x304
je 0x616707
movzx eax, byte [ecx + 0x7c]
test al, al
je 0x616776
lea eax, [ecx + 0x89]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 0xc
mov dword [esp + 0x84], 0xc
jmp 0x616707
lea eax, [ecx + 0x95]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 0xc
mov dword [esp + 0x84], 0xc
jmp 0x616707
nop
call fcn.0042c900
add esp, 0x88
ret
call fcn.00455270
jmp fcn.006165b0
Function at 0x61faf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x61fcc7
sub esp, 0x4c
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0x38]
mov ebx, dword [ecx + 0x15c]
mov ebp, dword [ecx + 0x158]
mov esi, dword [ecx + 0x154]
mov edi, dword [eax + 0x40]
mov ecx, dword [eax + 0x3c]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
call fcn.00632db0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.00456d7a
lea edi, [esp + 0x34]
call fcn.00456d7a
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00626a10
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + 0x40]
mov ecx, dword [ecx + 0x20]
mov dword [esp], edx
call ecx
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.00626a10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
mov byte [esp + 4], 0x16
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.006149e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x61fcbb
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0x108]
mov edx, dword [esp + 0x50]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x50]
mov esi, dword [edx + 0x54]
mov edi, dword [edx + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.00610a10
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x24]
movzx edx, byte [ecx + 0x5d]
test dl, dl
je 0x61fc38
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
add esp, 0x4c
ret
mov ecx, dword [ecx + 0x80]
test ecx, ecx
je 0x61fc24
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x44]
mov ebx, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov esi, dword [eax + 0x40]
mov eax, dword [eax + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
lea ecx, [0x9d16a4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
call fcn.00632970
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov dword [ebx + 0x74], ecx
mov dword [ebx + 0x78], edx
mov ecx, dword [0xe8ff30]
test ecx, ecx
jne 0x61fcae
mov dword [ebx + 0x70], eax
jmp 0x61fc24
lea edi, [ebx + 0x70]
call fcn.00456ab0
jmp 0x61fc24
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
add esp, 0x4c
ret
call fcn.00455270
jmp fcn.0061faf0
Function at 0x634050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x634227
sub esp, 0x40
lea eax, [0x92cb00]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.00440170
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x30]
cmp ecx, edx
ja 0x6341f4
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.00457480
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
ja 0x6341c1
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x5c]
add eax, edx
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.00457480
lea eax, [0x92cb00]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00440170
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.00633f70
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.master_secret]
mov ebx, dword [0xe7157c]
mov ebp, dword [0xe71580]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
lea edx, [0x92cb00]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004402d0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
jmp 0x6340d6
lea ebx, [0x92cb00]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.004402d0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
jmp 0x6340a6
call fcn.00455270
jmp fcn.00634050
Function at 0x6aab70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6aad89
sub esp, 0x70
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x6aad72
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00456d74
lea ecx, [0x9aece0]
mov dword [esp], ecx
mov edx, dword [esp + 0x74]
mov dword [esp + 4], edx
lea ebx, [esp + 0x40]
mov dword [esp + 8], ebx
call fcn.0040cd40
xor eax, eax
jmp 0x6aabe3
mov eax, dword [esp + 0x44]
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x40]
mov dword [esp], ecx
call fcn.0040cfb0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x6aabc2
lea ecx, [0x92c840]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.00440170
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx]
lea ebx, [0x9aece0]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], 0
call fcn.0040bad0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00456d74
lea eax, [0x9aece0]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 8], ecx
call fcn.0040cd40
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
jmp 0x6aac92
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040cfb0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
sub ecx, eax
mov edx, ecx
neg ecx
shl eax, 3
sar ecx, 0x1f
and eax, ecx
mov ecx, dword [esp + 0x38]
add eax, ecx
mov ecx, edx
mov edx, dword [esp + 0x40]
test edx, edx
je 0x6aad66
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 8]
mov esi, dword [ebx + 4]
mov ebx, dword [ebx]
mov edi, dword [edx + 4]
mov dword [esp + 0x2c], edi
mov edx, dword [edx]
mov dword [esp + 0x30], edx
lea edi, [0x92c840]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
call fcn.004113a0
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
cmp edx, ebx
ja 0x6aad83
mov dword [esp + 0x28], edx
lea eax, [0x9aece0]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x30]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
call fcn.00410630
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, dword [0xe8ff30]
test ecx, ecx
jne 0x6aad4b
mov edx, dword [esp + 0x38]
mov dword [edi], edx
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jbe 0x6aac68
jmp 0x6aad7e
mov ecx, eax
mov eax, dword [esp + 0x38]
call fcn.00456ab0
mov ebx, dword [esp + 0x24]
cmp ecx, ebx
mov eax, ecx
mov ecx, ebx
mov edx, dword [esp + 0x38]
jmp 0x6aad43
mov eax, dword [esp + 0x34]
mov dword [esp + 0x78], eax
add esp, 0x70
ret
mov dword [esp + 0x78], 0
add esp, 0x70
ret
call fcn.00456b90
call fcn.00456bd0
nop
call fcn.00455270
jmp fcn.006aab70
Function at 0x6bab40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6bacc6
sub esp, 0x5c
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x60]
test byte [eax], al
mov dword [esp], eax
call fcn.00464100
mov dword [esp + 0x1c], 4
lea eax, [0x9ffa2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
call fcn.0042c1c0
test eax, eax
jne 0x6bacbc
mov eax, dword [esp + 0x60]
movzx ecx, byte [eax + 0x28]
test cl, cl
jne 0x6bac48
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x6bac0b
mov eax, dword [esp + 0x74]
test eax, eax
je 0x6babe2
nop
call fcn.0042c900
add esp, 0x5c
ret
lea eax, [0xaa6210]
mov dword [esp + 0x74], eax
lea eax, [0x9ff690]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
jmp 0x6babd8
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.006ba290
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], ebx
jmp 0x6babd0
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x10], ecx
call fcn.00443570
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.006ba290
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], ebx
mov eax, dword [esp + 0x60]
jmp 0x6babc8
nop
call fcn.0042c900
add esp, 0x5c
ret
call fcn.00455270
jmp fcn.006bab40
Function at 0x6cd670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6cd7ab
sub esp, 0x54
lea edi, [esp + 0x70]
xor eax, eax
call fcn.00456d7b
mov ecx, dword [esp + 0x58]
test byte [ecx], al
lea edx, [ecx + 0x7c]
mov dword [esp + 0x3c], edx
mov dword [esp], edx
call fcn.00462cc0
mov dword [esp + 0x1c], 4
lea ecx, [0x9ffa24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
call fcn.0042c1c0
test eax, eax
jne 0x6cd7a1
mov eax, dword [esp + 0x58]
movzx ecx, byte [eax + 0x99]
mov byte [esp + 0x78], cl
mov ecx, dword [eax + 0x28]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
mov byte [esp + 0x79], 1
lea edi, [esp + 0x40]
lea esi, [esp + 0x5c]
call fcn.0045725e
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, eax
shr eax, 0x1f
shl eax, 0x1f
test eax, eax
je 0x6cd793
shl edx, 1
mov eax, ecx
shr ecx, 0x1f
or ecx, edx
mov edx, eax
shl eax, 1
shr eax, 0x1f
mov ebx, ecx
shl ecx, 1
or ecx, eax
mov eax, ecx
add ecx, 0xd7b17f80
shr ebx, 0x1f
add eax, 0xd7b17f80
adc ebx, 0xd
test ebx, ebx
sete al
test ecx, ecx
sete cl
and eax, ecx
test al, al
je 0x6cd78f
test edx, 0x3fffffff
sete al
test al, al
je 0x6cd76a
nop
call fcn.0042c900
add esp, 0x54
ret
mov edi, esp
lea esi, [esp + 0x5c]
call fcn.0045725e
call fcn.004bf3b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
jmp 0x6cd760
xor eax, eax
jmp 0x6cd75c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov edx, ecx
mov ecx, eax
jmp 0x6cd743
nop
call fcn.0042c900
add esp, 0x54
ret
call fcn.00455270
jmp fcn.006cd670
Function at 0x6ee390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ee4c5
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
je 0x6ee4bc
xor ecx, ecx
jmp 0x6ee3c1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jge 0x6ee4b3
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + ecx]
cmp ebx, 0x80
jge 0x6ee496
inc ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
lea eax, [0x9dee9c]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
mov dword [esp + 8], ebx
call fcn.00541830
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x6ee3b9
mov eax, dword [esp + 0x14]
cmp eax, 0xff
ja 0x6ee473
movzx ecx, al
lea edx, [0xe1a2c0]
movzx ecx, byte [edx + ecx]
test cl, 0x60
setne cl
test cl, cl
je 0x6ee439
xor eax, eax
test al, al
je 0x6ee3b9
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
cmp eax, 0xff
jg 0x6ee454
cmp eax, 0x30
jl 0x6ee450
cmp eax, 0x39
setle al
xor eax, 1
jmp 0x6ee42c
xor eax, eax
jmp 0x6ee44b
mov ecx, dword [0xe70f38]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00468290
movzx eax, byte [esp + 8]
lea edx, [0xe1a2c0]
jmp 0x6ee44b
mov ecx, dword [0xe70fec]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00468290
movzx ecx, byte [esp + 8]
mov eax, dword [esp + 0x14]
lea edx, [0xe1a2c0]
jmp 0x6ee426
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00450e30
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x6ee3de
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
call fcn.00455270
jmp fcn.006ee390
Function at 0x6ff6f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6ff839
sub esp, 0x58
lea edi, [esp + 4]
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x34], ecx
mov eax, dword [eax + 0x3c]
mov dword [esp + 0x40], eax
xor edx, edx
jmp 0x6ff73a
mov ebx, dword [esp + 0x30]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x44]
cmp edx, ecx
jge 0x6ff835
mov dword [esp + 0x30], edx
mov ecx, dword [eax + edx*4]
mov dword [esp + 0x38], ecx
mov ebx, dword [ecx]
mov ebp, dword [ecx + 4]
mov ebx, dword [ebx + 0x1c]
mov dword [esp], ebp
lea esi, [esp + 0x60]
call fcn.0045725e
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x20], ebp
call ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
test eax, eax
je 0x6ff727
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408790
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x6ff7b4
mov ecx, dword [ecx + 4]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
lea edx, [0x92c840]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
mov eax, dword [0xe7a1c4]
lea ecx, [0xaa5750]
mov dword [esp], ecx
mov dword [esp + 4], eax
lea eax, [0x9ea71e]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x2a
lea ebx, [esp + 0x48]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call fcn.004d9d20
jmp 0x6ff727
add esp, 0x58
ret
call fcn.00455270
jmp fcn.006ff6f0
Function at 0x718cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x718f0c
sub esp, 0x5c
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x54]
jmp 0x718e17
lea edx, [ecx + edi*8]
mov ebx, dword [edx + 4]
mov edx, dword [edx]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x18], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ebx, dword [0xe7b428]
mov edx, dword [0xe7b42c]
mov eax, dword [0xe7b430]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x40], eax
call fcn.00719100
mov eax, dword [esp + 0x50]
inc eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
mov edi, dword [esp + 0x64]
mov ebp, edi
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x78], ebx
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x7c]
mov edx, dword [esp + 0x88]
lea ebx, [edx - 1]
mov edi, dword [esp + 0x50]
cmp edi, ebx
jge 0x718e36
cmp edi, edx
jb 0x718d3e
jmp 0x718f02
cmp ebx, edx
jae 0x718ef9
lea ecx, [ecx + edx*8 - 8]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x40], eax
call fcn.00719100
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], edx
add esp, 0x5c
ret
mov eax, ebx
mov ecx, edx
call fcn.00456b30
mov eax, edi
mov ecx, edx
call fcn.00456b30
nop
call fcn.00455270
jmp fcn.00718cf0