joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fc3d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6402b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x717f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x5fc4dc
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x5fc417
cmp ebx, 1
jne 0x5fc4dc
cmp edi, 4
ja 0x5fc4dc
push 0xfa74
mov dword [ebp - 4], 0
call fcn.006222af
add esp, 4
test eax, eax
je 0x5fc4c3
mov dword [eax], esi
mov dword [esi + 0x20], eax
mov dword [eax + 4], 0xa
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc64], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [eax + 0x28], bl
mov dword [eax + 0xc54], 0
mov dword [eax + 0xc50], 0
mov dword [eax + 0xc4c], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x606c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
call fcn.004a2ca0
lea ecx, [esi + 0x20]
mov edi, eax
call fcn.004a2ca0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ecx + edx*4]
lea edx, [ecx + edx*4]
mov ecx, dword [edx + 4]
xor ebx, dword [edi]
xor esi, esi
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
mov edx, ebx
mov ecx, ebx
and edx, 0xff0000
shr ecx, 0x18
or edx, 0x1000000
shr edx, 0x10
mov edx, dword [eax + edx*4]
add edx, dword [eax + ecx*4]
mov ecx, ebx
and ecx, 0xff00
or ecx, 0x20000
shr ecx, 8
xor edx, dword [eax + ecx*4]
movzx ecx, bl
or ecx, 0x300
add edx, dword [eax + ecx*4]
xor edx, dword [edi + esi*4 + 4]
add esi, 2
mov ecx, dword [ebp + 0xc]
xor ecx, edx
mov edx, ecx
mov dword [ebp + 0xc], ecx
and edx, 0xff0000
shr ecx, 0x18
or edx, 0x1000000
shr edx, 0x10
mov edx, dword [eax + edx*4]
add edx, dword [eax + ecx*4]
mov ecx, dword [ebp + 0xc]
and ecx, 0xff00
or ecx, 0x20000
shr ecx, 8
xor edx, dword [eax + ecx*4]
mov ecx, dword [ebp + 0xc]
movzx ecx, cl
or ecx, 0x300
add edx, dword [eax + ecx*4]
xor edx, dword [edi + esi*4]
xor ebx, edx
cmp esi, 0xe
jbe 0x606cc3
mov eax, dword [edi + 0x44]
mov ecx, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx + 4], ebx
mov dword [ecx], eax
pop ebx
pop ebp
ret 8
Function at 0x606ff0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0
push esi
push edi
mov dword [ebp - 0x14], ebx
lea ecx, [ebx + 4]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.0046e290
cdq
lea ecx, [ebx + 0x20]
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 4], eax
call fcn.0046e290
cdq
lea ecx, [ebx + 4]
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x18], eax
call fcn.004a2ca0
lea ecx, [ebx + 0x20]
mov dword [ebp - 0x10], eax
call fcn.004a2ca0
mov edi, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
test edi, edi
jle 0x6070f4
mov esi, dword [ebp + 0xc]
mov ebx, edi
nop dword [eax + eax]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edi]
inc eax
cdq
idiv esi
shl ecx, 8
movzx esi, byte [edx + edi]
lea eax, [edx + 1]
cdq
or esi, ecx
idiv dword [ebp + 0xc]
shl esi, 8
movzx edi, byte [edx + edi]
lea eax, [edx + 1]
cdq
or edi, esi
mov esi, dword [ebp + 0xc]
idiv esi
mov eax, dword [ebp + 8]
shl edi, 8
movzx ecx, byte [edx + eax]
lea eax, [edx + 1]
cdq
or ecx, edi
idiv esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0xc]
xor dword [eax + edx*4], ecx
inc edx
mov dword [ebp - 0xc], edx
cmp edx, ebx
jl 0x607070
mov ebx, dword [ebp - 0x14]
xor esi, esi
mov edi, dword [ebp - 4]
nop
push 0
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00606c90
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + esi*4 + 4], eax
add esi, 2
cmp esi, edi
jl 0x6070d0
mov edi, dword [ebp - 0x18]
xor esi, esi
test edi, edi
jle 0x607124
nop dword [eax]
push 0
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00606c90
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + esi*4 + 4], eax
add esi, 2
cmp esi, edi
jl 0x607100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x60d4f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
lea edx, [edi + 0x4e0]
push edx
lea edx, [ebp - 0x14]
push edx
call dword [eax + 0x10]
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [edi + 0x520], xmm0
xor esi, esi
movups xmmword [edi + 0x4f0], xmm0
mov dword [edi + 0x534], 0
mov dword [edi + 0x530], 0
mov dword [edi + 0x538], 0
mov dword [edi + 0x540], 0
mov dword [edi + 0x544], 0
mov dword [edi + 0x548], 0
mov dword [edi + 0x54c], 0
movups xmmword [ebp - 0x14], xmm0
nop dword [eax]
mov eax, dword [edi + 0x550]
add eax, 4
mov byte [ebp - 0x14], bl
add eax, esi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0x4e0]
push eax
call fcn.0060bd40
add esi, 0x10
add esp, 0xc
inc ebx
cmp esi, 0x1000
jl 0x60d580
mov eax, 0x1000
mov ebx, 0x100
nop dword [eax + eax]
mov edx, dword [edi + 0x550]
movzx esi, byte [edx + eax - 0xfed]
movzx ecx, byte [edx + eax - 0xfee]
mov byte [edx + eax + 0x13], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xfef]
mov byte [edx + eax + 0x12], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff0]
mov byte [edx + eax + 0x11], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff1]
mov byte [edx + eax + 0x10], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff2]
mov byte [edx + eax + 0xf], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff3]
mov byte [edx + eax + 0xe], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff4]
mov byte [edx + eax + 0xd], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff5]
mov byte [edx + eax + 0xc], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff6]
mov byte [edx + eax + 0xb], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff7]
mov byte [edx + eax + 0xa], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff8]
mov byte [edx + eax + 9], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xff9]
mov byte [edx + eax + 8], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xffa]
mov byte [edx + eax + 7], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xffb]
mov byte [edx + eax + 6], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [edx + eax - 0xffc]
mov byte [edx + eax + 5], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [esi*2 + 0x6cdfa0]
mov byte [edx + eax + 4], cl
mov edx, dword [edi + 0x550]
movzx ecx, byte [esi*2 + 0x6cdfa1]
xor byte [edx + eax + 5], cl
add eax, 0x10
sub ebx, 1
jne 0x60d5c0
cmp eax, 0x10000
jl 0x60d5b3
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6126d0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x716a20
ret

Function at 0x6126e0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 0x716a68
ret
Function at 0x613770
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
sub eax, 2
je 0x613848
sub eax, 1
je 0x6137f8
sub eax, 1
jne 0x6137e4
movzx eax, byte [ebp - 8]
mov cl, byte [edi + edx*4 + 0x18]
xor cl, byte [eax + 0x6ce988]
movzx eax, byte [ebp - 7]
mov bl, byte [eax + 0x6ce888]
movzx eax, byte [ebp - 6]
xor bl, byte [edi + edx*4 + 0x19]
mov ch, byte [eax + 0x6ce888]
movzx eax, byte [ebp - 5]
xor ch, byte [edi + edx*4 + 0x1a]
mov bh, byte [eax + 0x6ce988]
xor bh, byte [edi + edx*4 + 0x1b]
jmp 0x613804
mov cl, byte [ebp - 8]
mov al, byte [ebp - 5]
mov bl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov byte [ebp - 9], cl
jmp 0x6138f4
mov bh, byte [ebp - 5]
mov ch, byte [ebp - 6]
mov bl, byte [ebp - 7]
mov cl, byte [ebp - 8]
movzx eax, cl
mov cl, byte [edi + edx*4 + 0x10]
xor cl, byte [eax + 0x6ce988]
movzx eax, bl
mov byte [ebp - 9], cl
mov bl, byte [eax + 0x6ce988]
xor bl, byte [edi + edx*4 + 0x11]
movzx eax, ch
mov al, byte [eax + 0x6ce888]
xor al, byte [edi + edx*4 + 0x12]
mov byte [ebp - 0xa], al
movzx eax, bh
mov bh, byte [ebp - 0xa]
mov al, byte [eax + 0x6ce888]
xor al, byte [edi + edx*4 + 0x13]
mov byte [ebp - 0xb], al
mov al, cl
jmp 0x613857
mov al, byte [ebp - 5]
mov bh, byte [ebp - 6]
mov bl, byte [ebp - 7]
mov byte [ebp - 0xb], al
mov al, byte [ebp - 8]
movzx ecx, byte [edi + edx*4 + 8]
movzx eax, al
movzx eax, byte [eax + 0x6ce888]
xor ecx, eax
movzx eax, byte [edi + edx*4]
movzx ecx, byte [ecx + 0x6ce888]
xor ecx, eax
mov al, byte [ecx + 0x6ce988]
mov byte [ebp - 9], al
movzx eax, bl
movzx ecx, byte [eax + 0x6ce988]
movzx eax, byte [edi + edx*4 + 9]
xor ecx, eax
movzx eax, byte [edi + edx*4 + 1]
movzx ecx, byte [ecx + 0x6ce888]
xor ecx, eax
mov al, byte [ecx + 0x6ce888]
mov byte [ebp - 0xa], al
movzx eax, bh
mov bh, byte [ebp - 0xa]
movzx ecx, byte [eax + 0x6ce888]
movzx eax, byte [edi + edx*4 + 0xa]
xor ecx, eax
movzx eax, byte [edi + edx*4 + 2]
movzx ecx, byte [ecx + 0x6ce988]
xor ecx, eax
movzx eax, byte [ebp - 0xb]
mov bl, byte [ecx + 0x6ce988]
movzx ecx, byte [eax + 0x6ce988]
movzx eax, byte [edi + edx*4 + 0xb]
xor ecx, eax
movzx eax, byte [edi + edx*4 + 3]
movzx ecx, byte [ecx + 0x6ce988]
xor ecx, eax
mov al, byte [ecx + 0x6ce888]
movzx eax, al
movzx ecx, bl
pop edi
mov edx, dword [eax*4 + 0x6cf688]
xor edx, dword [ecx*4 + 0x6cf288]
mov ecx, dword [ebp - 4]
movzx eax, bh
xor ecx, ebp
xor edx, dword [eax*4 + 0x6cee88]
movzx eax, byte [ebp - 9]
xor edx, dword [eax*4 + 0x6cea88]
mov eax, edx
mov byte [esi], dl
shr eax, 0x18
mov byte [esi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 2], al
mov eax, edx
shr eax, 8
mov byte [esi + 1], al
pop esi
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x613a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62ae6d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 0x10]
push str.initCrypt_rc2
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], esi
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
call fcn.004b2490
mov dword [ebp - 4], 0
test esi, esi
je 0x613a9a
mov eax, dword [ebx + 8]
cmp eax, 3
je 0x613a74
cmp eax, 4
jne 0x613a9a
push dword [edi + 0x80]
lea ecx, [ebx + 0x34]
call fcn.0046e290
push eax
lea ecx, [ebx + 0x34]
call fcn.004a2ca0
mov ecx, dword [ebp - 0x28]
push eax
add ecx, 0x484
call fcn.0060e750
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebx + 0xc8]
mov eax, dword [ecx + 0x10]
cdq
and edx, 7
lea esi, [edx + eax]
sar esi, 3
lea eax, [ecx + 0x14]
mov dword [ebp - 0x20], eax
cmp esi, 0x80
jbe 0x613ac5
mov esi, 0x80
jmp 0x613acf
mov ecx, 1
cmp esi, ecx
cmovb esi, ecx
mov ecx, 0x400
test ebx, ebx
jne 0x613adc
mov ebx, ecx
jmp 0x613ae1
cmp ebx, ecx
cmova ebx, ecx
push esi
mov ecx, eax
call fcn.004a2730
mov ecx, dword [ebp - 0x20]
call fcn.004a2ca0
cmp esi, 0x80
jbe 0x613b00
xor bl, bl
jmp 0x613bde
test ebx, ebx
mov ecx, 0x400
push esi
cmove ebx, ecx
add edi, 0x88
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x24]
add esp, 0xc
cmp esi, 0x80
jae 0x613b54
mov al, byte [esi + edx + 0x87]
nop dword [eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [eax + 0x6d1b10]
mov byte [edx + esi + 0x88], al
inc esi
cmp esi, 0x80
jb 0x613b30
lea eax, [ebx + 7]
mov edi, 0x80
shr eax, 3
lea esi, [edx + 0x88]
sub edi, eax
mov dword [ebp - 0x20], eax
add esi, edi
neg ebx
and ebx, 7
mov edx, 0xff
mov ecx, ebx
sar edx, cl
movzx eax, byte [esi]
and edx, eax
mov al, byte [edx + 0x6d1b10]
mov byte [esi], al
test edi, edi
je 0x613baa
mov edx, dword [ebp - 0x20]
nop
movzx ecx, byte [edx + esi - 1]
lea esi, [esi - 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x6d1b10]
mov byte [esi], al
sub edi, 1
jne 0x613b90
mov edx, dword [ebp - 0x24]
mov esi, 0x3f
add edx, 0x106
mov edi, 0x100
nop dword [eax]
movzx ecx, byte [edx + 1]
lea edx, [edx - 2]
movzx eax, byte [edx + 2]
imul ecx, edi
add cx, ax
mov eax, esi
dec esi
mov word [edx + 2], cx
test eax, eax
jne 0x613bc0
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.004b2630
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6141a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov ecx, dword [eax + 0x440]
mov ebx, dword [eax + 0x43c]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x10], edi
jle 0x6141ff
push esi
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4 + 0x3c]
mov cl, dl
add cl, byte [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, cl
mov dword [ebp - 4], ecx
mov esi, dword [ebp - 4]
mov ecx, dword [eax + ecx*4 + 0x3c]
mov dword [eax + ebx*4 + 0x3c], ecx
mov dword [eax + esi*4 + 0x3c], edx
add dl, cl
movzx ecx, dl
mov edx, dword [ebp + 0xc]
mov cl, byte [eax + ecx*4 + 0x3c]
xor byte [edx + edi], cl
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x6141c0
mov ecx, dword [ebp - 4]
pop esi
pop edi
mov dword [eax + 0x43c], ebx
mov dword [eax + 0x440], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x616010
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
lea ebx, [esi + 8]
mov dword [eax], 0xffffffff
push edi
mov eax, dword [esi + 0x80c]
xor edi, edi
mov dword [ebp - 0x14], ecx
mov dword [ebx], eax
test eax, eax
je 0x616065
lea edx, [esi + 0xc]
nop dword [eax + eax]
mov eax, dword [edx + 0x804]
lea edx, [edx + 4]
mov dword [edx - 4], eax
inc edi
cmp edi, dword [esi + 0x80c]
jb 0x616050
cmp dword [ebx], 0
jne 0x616089
mov eax, dword [ecx]
push str.No_sockets_exists_for_fdSetSelect.
call dword [eax + 0x14]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [ebp - 0xc], edx
sub ecx, eax
imul eax, ecx, 0x3e8
cmp byte [ebp + 0xc], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
je 0x6160bb
push 0
push ebx
jmp 0x6160be
push ebx
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x6160fe
mov ecx, dword [ebp - 0x14]
push str.select_system_call_failed.
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 4]
mov dword [ebx], 0
mov dword [esi + 0x80c], 0
test ecx, ecx
je 0x616074
call fcn.00566da0
jmp 0x616074
cmp dword [ebx], 0
jne 0x616121
mov ecx, dword [esi + 4]
mov dword [ebx], 0
mov dword [esi + 0x80c], 0
test ecx, ecx
je 0x616191
call fcn.00566da0
jmp 0x616191
call fcn.00566db0
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x616074
mov eax, dword [ebx]
xor ebx, ebx
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x616181
nop
mov edx, dword [esi + 0x80c]
xor eax, eax
test edx, edx
jle 0x61617b
mov edi, dword [esi + ebx*4 + 0xc]
lea ecx, [esi + 0x810]
cmp edi, dword [ecx]
je 0x616167
inc eax
add ecx, 4
cmp eax, edx
jl 0x616156
mov edi, dword [ebp - 0x10]
jmp 0x61617b
mov ecx, dword [esi + 4]
push eax
call fcn.00566ec0
mov edi, dword [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00566d60
inc ebx
cmp ebx, dword [ebp - 0x14]
jl 0x616140
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x61618e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], edi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x10
Function at 0x61a1b0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov ecx, dword [esi + 0x18]
mov ebx, ecx
cmp ecx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x61a1da
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
sub ecx, ebx
cmp byte [esi + 0xc], 0
mov dword [esi + 0x18], ecx
je 0x61a2ff
push edi
mov edi, dword [esi + 0x14]
mov esi, dword [esi + 0x10]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x61a202
lea esi, [edi + 1]
jmp 0x61a2f3
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0xc], ebx
cmp edx, 0x10
jb 0x61a2b1
mov ebx, edx
shr ebx, 4
nop
movzx eax, byte [edi]
sub edx, 0x10
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x61a220
mov ebx, dword [ebp + 0xc]
test edx, edx
je 0x61a2c2
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x61a2b5
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
test ebx, ebx
jne 0x61a202
shl esi, 0x10
or esi, ecx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
pop edi
mov dword [eax + 0x10], esi
mov esi, eax
push ebx
push dword [esi + 0x14]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
add dword [esi + 0x14], ebx
add esp, 0xc
add dword [esi + 0x1c], ebx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x61fd10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov ebx, dword [esi + 0x1c]
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x64]
mov ecx, eax
mov edi, dword [esi + 0x2c]
mov edx, dword [esi + 0x6c]
sub edi, eax
sub edi, edx
jne 0x61fd44
test eax, eax
jne 0x61fd53
test edx, edx
jne 0x61fd53
mov edi, ebx
jmp 0x61fde7
cmp edi, 0xffffffff
jne 0x61fd53
mov edi, 0xfffffffe
jmp 0x61fde7
mov eax, dword [esi + 0x1c]
add eax, 0xfffffefa
add eax, ebx
cmp ecx, eax
jb 0x61fde7
mov ecx, dword [esi + 0x28]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
sub dword [esi + 0x68], ebx
add esp, 0xc
sub dword [esi + 0x64], ebx
sub dword [esi + 0x54], ebx
mov eax, dword [esi + 0x38]
mov ebx, dword [esi + 0x44]
lea edx, [eax + ebx*2]
mov eax, dword [ebp - 4]
movzx esi, ax
nop
mov cx, word [edx - 2]
lea edx, [edx - 2]
sub cx, si
mov ax, cx
not ax
sar ax, 0xf
and ax, cx
mov word [edx], ax
sub ebx, 1
jne 0x61fd90
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ebx, ecx
mov eax, dword [esi + 0x30]
movzx esi, cx
lea eax, [eax + ecx*2]
mov dx, word [eax - 2]
lea eax, [eax - 2]
sub dx, si
mov cx, dx
not cx
sar cx, 0xf
and cx, dx
mov word [eax], cx
sub ebx, 1
jne 0x61fdc0
mov ebx, dword [ebp - 4]
add edi, ebx
mov esi, dword [ebp - 8]
mov ecx, dword [esi + 4]
call fcn.004c73b0
test eax, eax
je 0x61fe48
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x28]
add eax, dword [esi + 0x64]
mov ecx, dword [esi + 4]
push edi
push eax
call fcn.0061a1b0
mov edi, dword [esi + 0x6c]
add edi, eax
mov dword [esi + 0x6c], edi
cmp edi, 3
jb 0x61fe30
mov eax, dword [esi + 0x28]
add eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x50]
movzx edx, byte [eax]
mov dword [esi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [esi + 0x4c]
mov dword [esi + 0x40], edx
cmp edi, 0x106
jae 0x61fe48
mov ecx, dword [esi + 4]
call fcn.004c73b0
test eax, eax
jne 0x61fd24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x621d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6413e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x717f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi], vtable.BufferedSource.0
mov dword [edi + 8], 0xfa0
mov dword [edi + 0xc], 0
call fcn.0049ead0
push 0x1388
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov byte [edi + 0x40], 0
call fcn.004a2730
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret