joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b97d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [edi + 0x112]
add esi, 4
lea eax, [esi + 1]
push 1
push eax
mov ebp, ecx
call fcn.005acbd0
movzx ecx, byte [edi + 0x105]
mov ebx, dword [ebp + ecx*4 + 0x340]
add esp, 8
mov dword [esp + 0x1c], eax
cmp ebx, 0xffffffff
jne 0x5b9824
push 0
push 0x31e
push str..SourceFileSystem_r3dFileSystem.cpp
push str.h___INVALID_HANDLE_VALUE
call fcn.005aaf90
add esp, 0x10
mov edx, dword [edi + 0x10a]
push 0
push 0
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], esi
je 0x5b9882
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RelocateFile_read_failed__d_n
call fcn.005aac80
mov edx, dword [esp + 0x24]
push edx
call fcn.005acc10
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
mov al, byte [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx edx, al
mov byte [edi + 0x105], al
mov dword [edi + 0x10a], ecx
mov ebx, dword [ebp + edx*4 + 0x340]
cmp ebx, 0xffffffff
jne 0x5b98be
push 0
push 0x32f
push str..SourceFileSystem_r3dFileSystem.cpp
push str.h___INVALID_HANDLE_VALUE
call fcn.005aaf90
add esp, 0x10
mov eax, dword [edi + 0x10a]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], esi
je 0x5b9918
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RelocateFile_write_failed__d_n
call fcn.005aac80
push edi
call fcn.005acc10
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
push edi
call fcn.005acc10
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x5b9a50
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x60a0e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x775754
lea ecx, [esp + 0x2c]
call fcn.005ada70
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
xor ebp, ebp
sar eax, 2
mov dword [esp + 0x50], ebp
test eax, eax
ja 0x5b9aa7
push ebp
push 0xf8
push str..SourceFileSystem_r3dFileSystem.cpp
push str.IsValid__
call fcn.005aaf90
add esp, 0x10
cmp dword [esp + 0x58], ebp
jne 0x5b9ac5
push ebp
push 0xf9
push str..SourceFileSystem_r3dFileSystem.cpp
push 0x68f6d4
call fcn.005aaf90
add esp, 0x10
mov esi, dword [ebx + 0x14]
sub esi, dword [ebx + 0x10]
push 1
sar esi, 2
imul esi, esi, 0x128
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x34], 0x6c667261
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], esi
call fcn.005acbd0
mov edx, dword [ebx + 0x14]
sub edx, dword [ebx + 0x10]
add esp, 8
sar edx, 2
mov edi, eax
mov dword [esp + 0x24], edi
test edx, edx
jbe 0x5b9b51
mov dword [esp + 0x14], edi
lea ecx, [ecx]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
sar eax, 2
cmp ebp, eax
jb 0x5b9b22
call fcn.005d21d7
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + ebp*4]
mov edi, dword [esp + 0x14]
add dword [esp + 0x14], 0x128
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
inc ebp
sar eax, 2
cmp ebp, eax
jb 0x5b9b10
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x13]
call fcn.005ab8a0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push edi
lea ecx, [esp + 0x23]
call fcn.005ab6b0
test eax, eax
jne 0x5b9b80
push str.failed_to_compres_file_list_n
call fcn.005aae50
add esp, 4
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x18]
sar eax, 2
push esi
push edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x4c], edx
call fcn.005ab680
mov esi, dword [esp + 0x60]
push esi
push 8
mov dword [esp + 0x50], eax
lea eax, [esp + 0x3c]
push 1
push eax
call fcn.005d260f
push esi
push 0x14
lea ecx, [esp + 0x54]
push 1
push ecx
call fcn.005d260f
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push esi
push 1
push edx
push eax
call fcn.005d260f
push edi
call fcn.005acc10
mov ecx, dword [esp + 0x58]
push ecx
call fcn.005acc10
add esp, 0x40
lea ecx, [esp + 0x28]
mov dword [esp + 0x50], 0xffffffff
call fcn.005aca90
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x5b9db0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x60a12b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
push 0x775754
lea ecx, [esp + 0xc]
call fcn.005ada70
mov edi, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x12c], 0
call fcn.005b9500
mov edx, dword [esp + 0x12c]
push edi
push edx
lea eax, [esp + 0x1c]
push 0x6b7b5c
push eax
call fcn.00401aa0
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea edx, [esp + 0x14]
push 0x6b5c24
push edx
call fcn.005d19b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5b9e73
mov eax, dword [esp + 0xc]
push eax
call fcn.005acc10
lea ecx, [esp + 0x18]
push ecx
push str.r3dFS:_unable_to_open__s_for_writing_n
call fcn.005aac80
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.005aca90
xor al, al
jmp 0x5b9eaa
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push esi
push edx
push 1
push edi
call fcn.005d260f
push esi
call fcn.005d1270
push edi
call fcn.005acc10
add esp, 0x18
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.005aca90
mov al, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x5bc180
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x60a10b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov ebx, ecx
push 0x775754
lea ecx, [esp + 0xc]
call fcn.005ada70
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
mov dword [esp + 0x120], 0
call fcn.005b8e50
lea ecx, [esp + 0xc]
push 0x68d09c
push ecx
call fcn.005d19b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5bc21d
lea edx, [esp + 0xc]
push edx
push str.r3dFS:_there_is_no_volume_file__s_n
call fcn.005aac80
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x118], 0xffffffff
call fcn.005aca90
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.005d6b97
push esi
call fcn.005d6dd1
push 0
push 0
push esi
mov edi, eax
call fcn.005d6b97
lea eax, [edi + 1]
push 1
push eax
call fcn.005acbd0
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.005d7147
push esi
call fcn.005d1270
add esp, 0x38
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
lea ecx, [ebx + 0x104]
call fcn.005bbe90
push ebp
mov bl, al
call fcn.005acc10
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.005aca90
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x5c4520
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c4541
xor eax, eax
pop esi
add esp, 0x224
ret
push edi
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x224
xor edi, edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x5c459b
jmp 0x5c4560
lea ecx, [esp + 0x28]
push str..exe
push ecx
call fcn.005c5c90
add esp, 8
test eax, eax
jne 0x5c4597
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x5c4560
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret

Function at 0x5c64c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60a618
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x5c6593
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
lea ebx, [eax + 1]
mov dword [esp + 0x24], ebp
mov eax, SysReAllocString
test ebx, ebx
js 0x5c650e
shr eax, 1
test ebx, eax
je 0x5c6508
add eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.005c63a0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.005c6310
mov eax, dword [esi + 4]
lea edx, [eax + eax*2]
lea eax, [edi + edx*8]
add esp, 0xc
cmp eax, ebp
je 0x5c655b
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [ecx]
movq qword [eax], xmm0
movq xmm0, qword [ecx + 8]
movq qword [eax + 8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push 1
mov dword [esi], edi
push 1
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.005acb70
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, dword [esi]
lea edx, [eax + eax*2]
lea ecx, [ecx + edx*8]
inc eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x5c65c3
mov eax, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
movq xmm0, qword [eax + 8]
movq qword [ecx + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5cb7a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x5cb7d4
mov cl, byte [edx]
test cl, cl
je 0x5cb7d4
mov eax, 0x811c9dc5
movsx ecx, cl
or ecx, 0x20
xor ecx, eax
imul ecx, ecx, 0x1000193
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x5cb7b3
xor eax, 0x2a
imul eax, eax, 0x1000193
ret
xor eax, eax
ret
Function at 0x5d0de7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6e5e14]
jne 0x5d0df1
repz ret
jmp fcn.005da8a3

Function at 0x5d100e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5d103f
call fcn.005d83d6
mov dword [eax], esi
call fcn.005d83c3
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005d21b1
add esp, 0x14
push 0x16
pop eax
jmp 0x5d1094
test dword [ebp + 0xc], 0xfffffff9
jne 0x5d101b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5d106c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005d83e9
pop ecx
call fcn.005d83c3
mov eax, dword [eax]
jmp 0x5d1094
test al, 0x10
jne 0x5d1092
test al, 1
je 0x5d1092
test byte [ebp + 0xc], 2
je 0x5d1092
call fcn.005d83d6
mov dword [eax], 5
call fcn.005d83c3
mov dword [eax], 0xd
jmp 0x5d1063
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5e69c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005daa1b
and dword [ebp - 4], 0
cmp dword [0x791350], 0
mov ebx, eax
jne 0x5e6a75
push 0x6a3bd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5e6b26
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6a3bc4
push edi
call esi
test eax, eax
je 0x5e6b26
push eax
call fcn.005da9a9
mov dword [esp], 0x6a3bb4
push edi
mov dword [0x791350], eax
call esi
push eax
call fcn.005da9a9
mov dword [esp], 0x6a3ba0
push edi
mov dword [0x791354], eax
call esi
push eax
call fcn.005da9a9
mov dword [esp], 0x6a3b84
push edi
mov dword [0x791358], eax
call esi
push eax
call fcn.005da9a9
pop ecx
mov dword [0x791360], eax
test eax, eax
je 0x5e6a75
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005da9a9
pop ecx
mov dword [0x79135c], eax
mov eax, dword [0x79135c]
cmp eax, ebx
je 0x5e6acd
cmp dword [0x791360], ebx
je 0x5e6acd
push eax
call fcn.005daa24
push dword [0x791360]
mov esi, eax
call fcn.005daa24
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5e6acd
test edi, edi
je 0x5e6acd
call esi
test eax, eax
je 0x5e6ac4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5e6ac4
test byte [ebp - 0xc], 1
jne 0x5e6acd
or dword [ebp + 0x10], 0x200000
jmp 0x5e6b06
mov eax, dword [0x791354]
cmp eax, ebx
je 0x5e6b06
push eax
call fcn.005daa24
pop ecx
test eax, eax
je 0x5e6b06
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5e6b06
mov eax, dword [0x791358]
cmp eax, ebx
je 0x5e6b06
push eax
call fcn.005daa24
pop ecx
test eax, eax
je 0x5e6b06
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x791350]
call fcn.005daa24
pop ecx
test eax, eax
je 0x5e6b26
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5e6b28
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5f2bc0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
lea eax, [ebp - 0x28]
push eax
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.005f2d50
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x10]
push edx
call sub.gdiplus.dll_GdiplusStartup
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x5c], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x34], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x48], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x30]
push edx
push 0
push 0
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x58]
call fcn.005f3090
mov dword [ebp - 4], 0
lea edx, [ebp - 0x70]
push edx
push str.image_jpeg
call fcn.005f2a90
add esp, 8
push 0
lea eax, [ebp - 0x70]
push eax
push 0x6ae788
lea ecx, [ebp - 0x58]
call fcn.005f2d90
push 0
lea ecx, [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x58]
call fcn.005f2df0
push 0
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x44]
call fcn.005f2fa0
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x70]
push ecx
push str.survey.info
lea ecx, [ebp - 0x44]
call fcn.005f2d90
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x5c]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.005f2e20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.005f2e20
mov edx, dword [ebp - 0x10]
push edx
call fcn.005f6f80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5f53a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x3c], 0
je 0x5f53d3
mov ecx, dword [ebp - 0x64]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x5f53df
mov al, 1
jmp 0x5f5582
mov dword [ebp - 0x10], 8
call fcn.005f36e0
push eax
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x38], eax
call fcn.005f36e0
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.005f36c0
add esp, 8
movzx eax, al
test eax, eax
je 0x5f5422
xor al, al
jmp 0x5f5582
push 0
push 8
lea ecx, [ebp - 0x30]
call fcn.005f4a30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x30]
call fcn.00406970
mov ecx, eax
call fcn.005f5760
mov esi, eax
lea ecx, [ebp - 0x30]
call fcn.00406b00
add esi, eax
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406970
mov ecx, eax
call fcn.005f5760
push eax
mov ecx, dword [ebp - 0x64]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x64]
mov ecx, dword [edx + 0x3c]
call fcn.005f5bc0
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x5f549d
cmp dword [ebp - 0x68], 1
je 0x5f54a4
cmp dword [ebp - 0x68], 3
je 0x5f553e
jmp 0x5f5556
mov eax, dword [ebp - 0x64]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00406970
mov ecx, eax
call fcn.005f5760
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x5f5507
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406970
mov ecx, eax
call fcn.005f5760
push eax
call fcn.005d260f
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x5f5507
mov byte [ebp - 0x5d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00407080
mov al, byte [ebp - 0x5d]
jmp 0x5f5582
mov ecx, dword [ebp - 0x64]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x5f552a
mov byte [ebp - 0x5e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00407080
mov al, byte [ebp - 0x5e]
jmp 0x5f5582
cmp dword [ebp - 0x34], 0
jne 0x5f553c
push 0
push 8
lea ecx, [ebp - 0x30]
call fcn.005f4a70
jmp 0x5f556e
mov byte [ebp - 0x5f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00407080
mov al, byte [ebp - 0x5f]
jmp 0x5f5582
mov byte [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00407080
mov al, byte [ebp - 0x60]
jmp 0x5f5582
jmp 0x5f5435
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5f6690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xdd
mov dword [ebp - 8], 0
jmp 0x5f66b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x5f66f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x50efdffd]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5f66ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5f66a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5f6710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x1b
mov dword [ebp - 8], 0
jmp 0x5f6732
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x5f6771
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x45d8504a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5f676c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5f6729
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5f6790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xfd
mov dword [ebp - 8], 0
jmp 0x5f67b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x5f67f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x41d48c26]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5f67ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5f67a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x5f6810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 6
mov dword [ebp - 8], 0
jmp 0x5f6832
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x5f6871
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5c2284f6]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x5f686c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x5f6829
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4