joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405dde
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x14], ebx
xor edi, edi
jmp 0x405edd
cmp al, 0x24
je 0x405e3a
cmp al, 0x26
je 0x405e3a
cmp al, 0x2b
je 0x405e3a
cmp al, 0x2c
je 0x405e3a
cmp al, 0x2f
je 0x405e3a
cmp al, 0x3a
je 0x405e3a
cmp al, 0x3b
je 0x405e3a
cmp al, 0x3d
je 0x405e3a
cmp al, 0x3f
je 0x405e3a
cmp al, 0x40
je 0x405e3a
cmp al, 0x23
je 0x405e3a
cmp al, 0x20
je 0x405e3a
mov byte [esi], al
inc esi
inc edi
jmp 0x405ed1
movsx eax, al
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xa], 0x3025
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
mov word [ebp - 7], 0x78
push 4
push eax
mov word [ebp - 0xc], 0x2525
mov byte [ebp - 8], 0x32
call fcn.0061068c
lea ecx, [ebp - 0x10]
add esp, 0x14
and dword [ebp - 0x18], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405e72
sub ecx, edx
je 0x405ea7
mov ebx, dword [ebp - 0x18]
movsx eax, byte [ebp + ebx - 0x10]
push eax
call fcn.00610b38
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp + ebx - 0x10], al
inc ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405e97
sub ecx, edx
cmp ebx, ecx
jb 0x405e80
mov ebx, dword [ebp - 0x14]
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
mov eax, 0x800
sub eax, edi
push eax
push esi
call fcn.0061043f
lea ecx, [ebp - 0x10]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405ec4
sub ecx, edx
add esi, ecx
add edi, ecx
inc ebx
mov dword [ebp - 0x14], ebx
cmp edi, 0x7ff
jae 0x405ee7
mov al, byte [ebx]
test al, al
jne 0x405e01
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi], 0
xor ecx, ebp
pop esi
pop ebx
call fcn.0060f253
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40629f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x84], 0
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [eax + 0x4c]
mov dword [ebp - 0x14], 0x37363534
push 8
pop ecx
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x80], esi
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [ebp - 0xf], 0x63626139
mov word [ebp - 0xa], 0x6665
mov word [ebp - 0x17], 0x3231
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 8], 0
mov byte [ebp - 0x10], 0x38
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0xb], 0x64
call fcn.00406166
mov esi, dword [ebp - 0x80]
xor edx, edx
xor edi, edi
mov ecx, dword [esi]
mov eax, ecx
shr eax, 0x1c
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x5c], al
mov eax, ecx
shr eax, 0x18
and eax, 0xf
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x5b], al
mov eax, ecx
shr eax, 0x14
and eax, 0xf
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x5a], al
mov eax, ecx
shr eax, 0x10
and eax, 0xf
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x59], al
mov eax, ecx
shr eax, 0xc
and eax, 0xf
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x58], al
mov eax, ecx
shr eax, 8
and eax, 0xf
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x57], al
mov eax, ecx
shr eax, 4
and ecx, 0xf
and eax, 0xf
mov al, byte [ebp + eax - 0x18]
mov byte [ebp + edx - 0x56], al
mov al, byte [ebp + ecx - 0x18]
mov byte [ebp + edx - 0x55], al
add edx, 8
mov eax, dword [ebp + edi*4 - 0x7c]
inc edi
mov dword [esi], eax
lea esi, [esi + 4]
cmp edi, 8
jl 0x40630b
cmp edx, 0x41
jae 0x4063c5
lea eax, [ebp - 0x5c]
mov byte [ebp + edx - 0x5c], 0
push eax
mov ecx, ebx
call fcn.0040d5ca
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060f253
mov esp, ebp
pop ebp
ret 4
call fcn.0060f39a
int3
Function at 0x408d9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0xf], 0x7265
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x6c65
push eax
mov word [ebp - 9], 0x32
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xa], 0x33
mov dword [ebp - 0x20], 0x6f577349
mov dword [ebp - 0x1b], 0x72503436
mov dword [ebp - 0x15], 0x737365
mov word [ebp - 0x17], 0x636f
mov byte [ebp - 0x1c], 0x77
call dword [0x646404]
push eax
call dword [0x646408]
mov esi, eax
test esi, esi
je 0x408e15
lea eax, [ebp - 0x24]
push eax
call dword [0x646400]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret
Function at 0x40bf64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x468
mov eax, 0x633e0f
call fcn.00611c5e
mov dword [ebp - 0x460], ecx
xor ebx, ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
push 0x10
pop edi
mov dword [ebp - 4], ebx
mov esi, edi
lea eax, [ebp - 0x449]
mov byte [ebp - 0x449], bl
push eax
lea ecx, [ebp - 0x458]
call fcn.0040c154
dec esi
jne 0x40bf95
mov esi, dword [ebp + 8]
jmp 0x40bfce
mov byte [ebp - 0x449], al
lea ecx, [ebp - 0x458]
lea eax, [ebp - 0x449]
push eax
call fcn.0040c154
inc esi
mov al, byte [esi]
test al, al
jne 0x40bfb5
lea eax, [ebp - 0x449]
mov byte [ebp - 0x449], bl
push eax
lea ecx, [ebp - 0x458]
call fcn.0040c154
dec edi
jne 0x40bfd4
mov edi, dword [ebp - 0x454]
mov eax, edi
mov ebx, dword [ebp - 0x458]
sub eax, ebx
cdq
and edx, 0xf
lea esi, [edx + eax]
and esi, 0xfffffff0
add esi, ebx
cmp esi, ebx
jne 0x40c013
mov edi, ebx
jmp 0x40c025
cmp esi, edi
je 0x40c02b
push 0
push edi
push esi
call fcn.0060f480
add esp, 0xc
mov edi, esi
mov dword [ebp - 0x454], edi
xor eax, eax
mov dword [ebp - 0x17], 0x44454445
mov dword [ebp - 0x1d], 0x46314238
mov dword [ebp - 0x22], 0x44424433
mov dword [ebp - 0x26], 0x39313537
mov dword [ebp - 0x2f], 0x33463746
mov dword [ebp - 0x2b], 0x36434142
mov byte [ebp - 0x30], 0x33
mov word [ebp - 0x19], 0x3134
mov byte [ebp - 0x1e], 0x32
mov byte [ebp - 0x13], al
mov byte [ebp - 0x27], 0x36
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], eax
mov byte [ebp - 4], 1
mov esi, eax
mov al, byte [ebp + esi - 0x30]
lea ecx, [ebp - 0x474]
mov byte [ebp - 0x449], al
lea eax, [ebp - 0x449]
push eax
call fcn.0040c154
inc esi
cmp esi, 0x1d
jl 0x40c084
mov eax, dword [ebp - 0x470]
sub edi, ebx
mov esi, dword [ebp - 0x474]
sub eax, esi
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x430]
mov dword [ebp - 0x45c], 0x400
push eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x464], edi
push eax
push esi
lea eax, [ebp - 0x464]
push eax
push ebx
call fcn.0040bdc6
push dword [ebp - 0x45c]
lea edx, [ebp - 0x430]
lea ecx, [ebp - 0x448]
call fcn.0040bbab
pop ecx
mov eax, dword [ebp - 0x460]
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 2
cmp eax, ecx
je 0x40c127
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.0040c548
push 0
push 1
lea ecx, [ebp - 0x448]
call fcn.0040c64e
test esi, esi
je 0x40c141
push esi
call fcn.004f4df8
pop ecx
test ebx, ebx
je 0x40c14c
push ebx
call fcn.004f4df8
pop ecx
call fcn.00611c0d
ret 4

Function at 0x40c875
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x5c
mov esi, ecx
push 0
push esi
call fcn.006125f0
add esp, 0xc
mov dword [esi], 0x67452301
xor eax, eax
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
inc eax
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x418eb9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x18
mov eax, 0x6342a2
call fcn.00611c5e
mov edi, ecx
and dword [ebp - 0x24], 0
test dl, dl
je 0x418fa0
call fcn.004f5dba
push eax
lea ecx, [ebp - 0x20]
call fcn.0040d74c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push 0x70
call fcn.00418e8e
push 0x72
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x6f
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x67
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x72
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x61
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x6d
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x69
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x6e
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x66
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x6f
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x73
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x2e
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x63
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x6f
lea ecx, [ebp - 0x20]
call fcn.00418e8e
push 0x6d
lea ecx, [ebp - 0x20]
call fcn.00418e8e
mov esi, dword [ebp - 0x20]
add esi, 0xfffffff0
push esi
call fcn.0041a974
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.0040d912
jmp 0x418fc1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x616f7373
push eax
mov dword [ebp - 0x18], 0x632e6d70
mov word [ebp - 0x13], 0x6d
mov byte [ebp - 0x14], 0x6f
call fcn.0040db5c
mov eax, edi
call fcn.00611c0d
ret

Function at 0x43ac79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x69724372
push eax
push ecx
mov esi, ecx
mov dword [ebp - 0x1c], 0x65746e45
mov dword [ebp - 0x12], 0x536c6163
mov word [ebp - 9], 0x6e
mov dword [ebp - 0xe], 0x69746365
mov word [ebp - 0x14], 0x6974
mov byte [ebp - 0xa], 0x6f
call fcn.0043af84
mov ecx, eax
call fcn.0043b08f
pop ecx
push eax
call dword [0x646408]
test eax, eax
je 0x43acd8
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret

Function at 0x43ace7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x13], 0x6c616369
push eax
push ecx
mov esi, ecx
mov word [ebp - 0xb], 0x6f69
mov word [ebp - 0x1c], 0x654c
mov dword [ebp - 0x19], 0x72436576
mov word [ebp - 0x15], 0x7469
mov word [ebp - 0xe], 0x6365
mov byte [ebp - 0xc], 0x74
mov word [ebp - 9], 0x6e
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0xf], 0x53
call fcn.0043af84
mov ecx, eax
call fcn.0043b08f
pop ecx
push eax
call dword [0x646408]
test eax, eax
je 0x43ad52
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret
Function at 0x43ad9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x19], 0x43657a69
push eax
mov esi, ecx
mov word [ebp - 0xf], 0x536c
mov word [ebp - 0xc], 0x7463
mov dword [ebp - 0x1e], 0x61697469
mov word [ebp - 9], 0x6e6f
mov byte [ebp - 0xa], 0x69
mov dword [ebp - 0x15], 0x69746972
mov word [ebp - 0x20], 0x6e49
mov byte [ebp - 7], 0
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0xd], 0x65
mov word [ebp - 0x11], 0x6163
call fcn.0043af84
mov ecx, eax
call fcn.0043b08f
push eax
call dword [0x646408]
test eax, eax
je 0x43ae13
push esi
call eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret

Function at 0x43ae24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x6f697463
push eax
push ecx
mov esi, ecx
mov dword [ebp - 0x12], 0x6c616369
mov dword [ebp - 0x1b], 0x74656c65
mov dword [ebp - 0x17], 0x69724365
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x1c], 0x44
mov word [ebp - 8], 0x6e
mov word [ebp - 0xe], 0x6553
call fcn.0043af84
mov ecx, eax
call fcn.0043b08f
pop ecx
push eax
call dword [0x646408]
test eax, eax
je 0x43ae87
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret

Function at 0x43aee8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 0xc
cmp byte [edx + 4], 0
je 0x43af21
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x43af1a
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x43af0a
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0xeb4548
lea ecx, [ebp - 0xc]
call fcn.00610d8f
push 0x69faac
lea eax, [ebp - 0xc]
push eax
call fcn.00611b96
int3
Function at 0x513bf2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x513c40
push esi
mov ebx, 0x811c9dc5
xor edi, edi
call fcn.00611960
xor edx, edx
mov dword [ebp + 8], 0xa
pop ecx
mov ecx, eax
div dword [ebp + 8]
inc eax
test ecx, ecx
je 0x513c35
mov edx, ecx
movsx ecx, byte [edi + esi]
add edi, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
cmp edi, edx
jb 0x513c23
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004f5805
int3
Function at 0x62995d
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0062bd3c
pop ecx
test eax, eax
js 0x629b39
push esi
push edi
mov edi, dword [ebx + 0xf0]
shl edi, 2
test edi, edi
jle 0x6299cc
lea edx, [ebx + 8]
lea esi, [ebx + 8]
xor ebx, ebx
lea edx, [edx + edi*4]
mov ecx, dword [esi - 8]
add ebx, 4
mov eax, dword [edx - 8]
sub edi, 4
mov dword [esi - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], ecx
mov ecx, dword [esi - 4]
mov dword [esi - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], ecx
mov ecx, dword [esi]
mov dword [esi], eax
lea esi, [esi + 0x10]
mov eax, dword [edx + 4]
mov dword [edx], ecx
lea edx, [edx - 0x10]
mov ecx, dword [esi - 0xc]
mov dword [esi - 0xc], eax
mov dword [edx + 0x14], ecx
cmp ebx, edi
jl 0x62998d
mov ebx, dword [ebp + 8]
xor edi, edi
inc edi
cmp dword [ebx + 0xf0], edi
jle 0x629b35
lea esi, [ebx + 2]
lea esi, [esi + 0x10]
mov edx, dword [esi - 2]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x676d90]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676590]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676990]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676190]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x676d90]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676590]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676990]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676190]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x676d90]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676590]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676990]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676190]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x676d90]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676590]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676990]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x676190]
inc edi
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x6299de
pop edi
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x629d19
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x637]
xor ebx, ebx
push 0x3ff
push ebx
push eax
mov byte [ebp - 0x638], bl
call fcn.006125f0
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x638]
push 0x400
push eax
call fcn.0061043f
add esp, 0x10
mov dword [ebp - 0x13], 0x6e6570
lea eax, [ebp - 0x638]
mov byte [ebp - 0x14], 0x6f
lea edx, [ebp - 0x14]
push eax
call fcn.0040a0a1
mov esi, eax
add esp, 0x10
cmp esi, 0x20
ja 0x629e92
push ecx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x1c], 0x6d74682e
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x18], bl
push eax
push ecx
call fcn.004055e0
test eax, eax
jne 0x629e92
lea edx, [ebp - 0x30]
mov word [ebp - 0x2f], 0x6873
lea ecx, [ebp - 0x238]
mov word [ebp - 0x2c], 0x6c6c
mov dword [ebp - 0x27], 0x635c6e65
mov dword [ebp - 0x22], 0x6e616d6d
mov word [ebp - 0x29], 0x706f
mov byte [ebp - 0x2a], 0x5c
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x2d], 0x65
mov word [ebp - 0x1e], 0x64
mov byte [ebp - 0x30], 0x5c
call fcn.004038aa
push ecx
lea eax, [ebp - 0x238]
push eax
push eax
push ecx
call fcn.004055e0
test eax, eax
jne 0x629e92
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x22312522
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 8], bl
push eax
call fcn.006104e3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x629e6b
lea eax, [ebp - 0x63c]
mov word [ebp - 0x63b], 0x31
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 0x63c], 0x25
push eax
call fcn.006104e3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x629e6b
lea ecx, [ebp - 0x238]
call fcn.0062e0ec
lea esi, [ebp + eax - 0x239]
jmp 0x629e6d
mov byte [esi], bl
mov edx, 0x68232c
mov ecx, esi
call fcn.004038aa
mov edx, edi
mov ecx, esi
call fcn.004038aa
push 5
pop edx
lea ecx, [ebp - 0x238]
call fcn.0062b1c7
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0060f253
mov esp, ebp
pop ebp
ret 8
Function at 0x62ad18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push esi
push eax
mov esi, ecx
mov dword [ebp - 0xa], 0x64657a69
mov word [ebp - 0xd], 0x6169
mov dword [ebp - 0x16], 0x746f6e20
mov dword [ebp - 0x12], 0x696e4920
mov dword [ebp - 0x1c], 0x656a624f
mov byte [ebp - 6], 0
mov byte [ebp - 0xe], 0x74
mov word [ebp - 0x18], 0x7463
mov byte [ebp - 0xb], 0x6c
call fcn.0040d5ca
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret

Function at 0x62ad7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6a4080]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x24]
push esi
push eax
mov esi, ecx
mov dword [ebp - 0x11], 0x6c422066
mov dword [ebp - 0x1e], 0x6d20746f
mov dword [ebp - 0xc], 0x53206b63
mov dword [ebp - 8], 0x657a69
mov dword [ebp - 0x22], 0x6e206174
mov word [ebp - 0x24], 0x6144
mov dword [ebp - 0x17], 0x656c7069
mov word [ebp - 0x13], 0x6f20
mov byte [ebp - 0xd], 0x6f
mov word [ebp - 0x19], 0x746c
mov byte [ebp - 0x1a], 0x75
call fcn.0040d5ca
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0060f253
mov esp, ebp
pop ebp
ret
Function at 0x62d01e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x128
mov eax, 0x63492c
call fcn.00611c5e
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x681ab4
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x130], ebx
call fcn.0040db5c
push 0x103
lea eax, [ebp - 0x127]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x130], 1
mov byte [ebp - 0x128], bl
call fcn.006125f0
push 0xffffffffffffffff
push 0x6825f0
mov edi, 0x104
mov dword [ebp - 0x20], 0x6b636954
lea eax, [ebp - 0x128]
mov dword [ebp - 0x24], 0x5f4f5353
push edi
push eax
mov word [ebp - 0x1b], 0x74
mov byte [ebp - 0x1c], 0x65
call fcn.0061043f
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x128]
push edi
push eax
call fcn.006105da
lea eax, [ebp - 0x128]
push edi
push eax
call fcn.0060fe48
add esp, 0x34
mov dword [ebp - 0x17], 0x25783830
lea ecx, [ebp - 0x12c]
mov byte [ebp - 0x18], 0x25
mov edx, eax
mov word [ebp - 0x13], 0x73
mov dword [ebp - 0x12c], 0x74745f
push ecx
lea ecx, [ebp - 0x128]
call fcn.006301ec
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.0041aabc
add esp, 0x10
mov eax, esi
call fcn.00611c0d
ret

Function at 0x62d8fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x24
mov eax, 0x635147
call fcn.00611c5e
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x30]
push 4
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], 1
push 4
push eax
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x25], 0x54495c65
mov ecx, 0x80000002
mov dword [ebp - 0x2c], 0x74666f53
mov word [ebp - 0x28], 0x6177
mov word [ebp - 0x21], 0x41
mov byte [ebp - 0x26], 0x72
mov dword [ebp - 0x14], 0x454964
mov dword [ebp - 0x1b], 0x6174736e
mov byte [ebp - 0x1c], 0x49
mov word [ebp - 0x17], 0x6c6c
mov byte [ebp - 0x15], 0x65
call fcn.00406530
mov ecx, dword [ebp + 0x14]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x40]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x44]
lea ecx, [ecx - 0x10]
call fcn.0040d912
mov ecx, dword [ebp + 0x48]
lea ecx, [ecx - 0x10]
call fcn.0040d912
call fcn.00611c0d
ret 0x44
Function at 0x62e92b
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x680330]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x680330]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x62f4b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x20
mov eax, 0x635e68
call fcn.00611c5e
mov esi, ecx
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov dword [ebp - 0x2c], esi
mov byte [esi], al
mov dword [ebp - 4], eax
mov byte [esi + 0x18], al
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x28]
push eax
mov word [ebp - 0x18], 0x6c6c
mov word [ebp - 0x28], 0x534e
mov dword [ebp - 0x25], 0x6e495f53
mov dword [ebp - 0x1f], 0x4d282063
mov word [ebp - 0x15], 0x29
mov word [ebp - 0x21], 0x7465
mov word [ebp - 0x1b], 0x7a6f
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x16], 0x61
call fcn.0040d5ad
pop ecx
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040d534
mov eax, esi
call fcn.00611c0d
ret

Function at 0x62f616
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [ecx]
or edx, 0xffffffff
test al, al
je 0x62f643
push esi
movzx eax, al
push 7
xor edx, eax
pop esi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
dec esi
jns 0x62f628
inc ecx
mov al, byte [ecx]
test al, al
jne 0x62f620
pop esi
not edx
mov eax, edx
ret