joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x592e71
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
call fcn.00592bb0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x592d5b
mov edx, dword [esp + 0x38]
cmp edx, 8
jg 0x592d0f
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], ecx
mov ebx, dword [esp + 0x34]
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x592d95
lea eax, [0x706e62]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x11
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.0046b860
mov eax, dword [esp + 8]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
lea ecx, [0x734c20]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
add esp, 0x30
ret
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
add esp, 0x30
ret
shl edi, 8
shl esi, 8
mov ecx, dword [esp + 0x20]
shr ecx, 0x18
movzx eax, byte [ebx + ebp]
inc ebp
or edi, ecx
or esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x20], esi
cmp edx, ebp
jg 0x592d77
shl edx, 3
lea ebx, [edx - 0x40]
neg ebx
mov byte [esp + 0x17], bl
mov ecx, ebx
shl esi, cl
shl edi, cl
add edx, 0xffffffe0
mov byte [esp + 0x16], dl
mov ecx, edx
mov ebp, dword [esp + 0x20]
shr ebp, cl
mov dword [esp + 0x1c], ebp
neg ecx
mov byte [esp + 0x15], cl
mov eax, dword [esp + 0x20]
shl eax, cl
shr bl, 5
movzx ebx, bl
mov dword [esp + 0x20], ebx
movzx ebp, byte [esp + 0x17]
xchg ebp, eax
cmp al, 0x20
xchg ebp, eax
sbb edx, edx
sbb ebx, ebx
and edi, edx
and esi, edx
mov ecx, ebp
shr esi, cl
and esi, edx
not ebx
or ecx, ebx
movzx edx, byte [esp + 0x15]
cmp dl, 0x20
sbb ebx, ebx
sbb ebp, ebp
and ebx, eax
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
mov byte [esp + 0x17], al
xchg ebp, eax
mov eax, dword [esp + 0x20]
cmp eax, 1
sbb eax, eax
xor eax, 0xffffffff
mov dword [esp + 0x20], eax
movzx edx, byte [esp + 0x16]
cmp dl, 0x20
sbb eax, eax
mov ebp, dword [esp + 0x1c]
and ebp, eax
or ebp, edi
or ebp, ebx
mov ebx, ecx
mov ecx, edx
mov edi, ebp
shl ebp, cl
mov ecx, ebx
mov edx, edi
sar edi, cl
and ebp, eax
or ebp, esi
movzx ecx, byte [esp + 0x17]
sar edx, cl
mov eax, dword [esp + 0x20]
and eax, edx
or eax, ebp
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], eax
add esp, 0x30
ret
call fcn.00475ee0
jmp fcn.00592cb0
Function at 0x593be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x593dbc
sub esp, 0x68
lea edi, [esp + 0x78]
xor eax, eax
call fcn.004773db
mov dword [esp], 0
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 8], ecx
call fcn.00472c60
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x30], edx
lea edi, [esp + 0x50]
xor eax, eax
call fcn.004773db
lea ecx, [0x70e259]
mov dword [esp], ecx
mov dword [esp + 4], 0x1d
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
call fcn.004b2b50
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x28]
lea edi, [esp + 0x50]
lea esi, [esp + 0x10]
call fcn.004778be
lea edi, [esp + 0x78]
lea esi, [esp + 0x50]
call fcn.004778be
mov ecx, dword [esp + 0x34]
test ecx, ecx
jne 0x593daa
mov dword [esp + 0x64], edx
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.004778be
lea eax, [0x70e259]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x1d
call fcn.004b0870
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
cmp eax, edx
jne 0x593cfa
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004040c0
movzx eax, byte [esp + 0xc]
test al, al
je 0x593cf6
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x64]
jmp 0x593d98
mov edx, dword [esp + 0x30]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0046b860
mov eax, dword [esp + 8]
lea ecx, [0x6c0080]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0046b860
mov eax, dword [esp + 8]
lea ecx, [0x6c0080]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
lea eax, [0x71ab4a]
mov dword [esp], eax
mov dword [esp + 4], 0x6a
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004c8ee0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x68
ret
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x68
ret
call fcn.00475ee0
jmp fcn.00593be0
Function at 0x597670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5978bd
sub esp, 0x6c
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
mov ecx, dword [esp + 0x80]
mov dword [esp + 4], ecx
call fcn.0049a860
mov eax, dword [esp + 8]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x4c], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x44], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.004980e0
cmp dword [esp + 0xc], 0x16
jne 0x5976f6
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x44]
mov dword [esp + 8], edx
call fcn.00497fc0
movzx eax, byte [esp + 0xc]
test al, al
je 0x59778c
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
call fcn.004940e0
mov eax, dword [esp + 8]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x48], ecx
lea edx, [0x6cd0c0]
mov dword [esp], edx
call fcn.0040dea0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [eax], ecx
mov ecx, dword [0x8c88d8]
test ecx, ecx
jne 0x597745
mov ecx, dword [esp + 0x48]
jmp 0x597750
call fcn.004772e0
mov ecx, dword [esp + 0x48]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
lea ecx, [0x734c30]
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], eax
add esp, 0x6c
ret
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
call fcn.00497680
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x44], edx
mov ebx, dword [esp + 0x84]
mov dword [esp], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 4], ebx
call fcn.005978d0
lea edi, [esp + 0x54]
lea esi, [esp + 8]
call fcn.004778b4
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
lea edi, [esp + 0x1c]
lea esi, [esp + 0x54]
call fcn.004778b4
call fcn.00594e90
mov eax, dword [esp + 0x38]
test eax, eax
je 0x59786f
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x6c
ret
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x78]
sub ecx, eax
mov edx, dword [esp + 0x74]
sub edx, eax
mov ebx, ecx
neg ecx
sar ecx, 0x1f
and eax, ecx
mov ecx, dword [esp + 0x70]
add eax, ecx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
add esp, 0x6c
ret
call fcn.00475ee0
jmp fcn.00597670
Function at 0x59f650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59f77f
sub esp, 0x14
mov eax, dword [esp + 0x20]
cmp eax, 8
jg 0x59f67c
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x59f6a5
mov byte [esp + 0x28], 0
add esp, 0x14
ret
mov ebp, dword [edx]
mov esi, dword [edx + 4]
mov edi, ebp
shl ebp, 8
mov dword [edx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [edx + 4], edi
movzx esi, byte [ebx + ecx]
or esi, ebp
mov dword [edx], esi
inc ecx
cmp eax, ecx
jg 0x59f685
mov ebx, dword [edx]
mov dword [esp + 0xc], ebx
mov ebp, dword [edx + 4]
shl eax, 3
lea ecx, [eax - 0x20]
mov byte [esp + 3], cl
mov esi, ebx
shr ebx, cl
mov dword [esp + 8], ebx
mov edi, ecx
xchg edi, ebx
neg ebx
xchg edi, ebx
mov ecx, edi
shl esi, cl
mov dword [esp + 4], esi
add eax, 0xffffffc0
neg eax
mov ecx, eax
shl ebp, cl
mov ebx, dword [esp + 0xc]
shl ebx, cl
shr al, 5
movzx eax, al
mov dword [esp + 0xc], eax
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and ebx, eax
mov dword [edx], ebx
and ebp, eax
xchg esi, ebx
not ebx
xchg esi, ebx
or esi, ecx
xchg esi, eax
mov byte [esp + 2], al
xchg esi, eax
shr ebx, cl
and ebx, eax
mov dword [esp + 0x10], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb eax, eax
sbb ecx, ecx
mov esi, dword [esp + 4]
and esi, eax
not ecx
or ecx, edi
mov eax, dword [esp + 0xc]
cmp eax, 1
sbb eax, eax
xor eax, 0xffffffff
mov dword [esp + 0xc], eax
movzx edi, byte [esp + 3]
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb eax, eax
mov ebx, dword [esp + 8]
and ebx, eax
or ebx, ebp
or ebx, esi
mov dword [edx + 4], ebx
mov ebp, ecx
mov ecx, edi
mov esi, ebx
shl ebx, cl
and ebx, eax
mov eax, dword [esp + 0x10]
or ebx, eax
mov ecx, ebp
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0xc]
and ebp, esi
or ebp, ebx
mov dword [edx], ebp
movzx ecx, byte [esp + 2]
sar eax, cl
mov dword [edx + 4], eax
mov byte [esp + 0x28], 1
add esp, 0x14
ret
call fcn.00475ee0
jmp fcn.0059f650
Function at 0x5adef0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5adf96
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5adf49
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x5adf80
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00475ee0
jmp fcn.005adef0
Function at 0x5b3d80
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b3ef1
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5b3db1
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5b3db1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5b3db7
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5b3dc5
cmp ecx, 4
jne 0x5b3df6
cmp al, 0x2c
ja 0x5b3dde
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5b3df0
cmp al, 0x24
je 0x5b3df0
cmp al, 0x26
jae 0x5b3df0
jmp 0x5b3df6
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5b3df0
cmp al, 0x5b
je 0x5b3df0
cmp al, 0x5d
jne 0x5b3df6
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5b3e2d
cmp al, 0x26
ja 0x5b3e0f
cmp al, 0x24
je 0x5b3e4c
cmp al, 0x26
je 0x5b3e4c
jmp 0x5b3ed3
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5b3e4c
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5b3ecd
cmp al, 0x2f
je 0x5b3e4c
jmp 0x5b3ed3
cmp al, 0x3d
ja 0x5b3e44
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5b3e4c
cmp al, 0x3d
je 0x5b3e4c
jmp 0x5b3ed3
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5b3ec3
cmp ecx, 2
jg 0x5b3e87
cmp ecx, 1
je 0x5b3e7c
cmp ecx, 2
jne 0x5b3ed3
cmp al, 0x2f
je 0x5b3e6a
cmp al, 0x3b
je 0x5b3e6a
cmp al, 0x2c
jne 0x5b3e71
mov eax, 1
jmp 0x5b3e77
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5b3ead
cmp al, 0x40
je 0x5b3e9b
cmp al, 0x2f
je 0x5b3e9b
cmp al, 0x3f
jne 0x5b3ea2
mov eax, 1
jmp 0x5b3ea8
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5b3ebd
cmp ecx, 7
jne 0x5b3ed3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5b3ecd
cmp al, 0x7e
jne 0x5b3ed3
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5b3eeb
cmp al, 0x21
je 0x5b3ee5
add eax, 0xffffffd8
cmp al, 2
ja 0x5b3eeb
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00475ee0
jmp fcn.005b3d80

Function at 0x5b8be0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b8c25
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call fcn.00475ee0
jmp fcn.005b8be0

Function at 0x5ba230
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ba27c
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.00475ee0
jmp fcn.005ba230
Function at 0x5ca790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca9c4
sub esp, 0x68
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.004773d5
lea ecx, [0x5ca9d0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
lea ebx, [esp + 0x84]
mov dword [esp + 0x54], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005bc960
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5ca8b9
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov esi, dword [esp + 0x2c]
mov dword [esp], 2
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
lea edx, [esp + 0x2c]
call esi
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5ca887
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call fcn.005bc960
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5ca91f
mov dword [esp + 0x14], edx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov dword [esp], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
lea edx, [esp + 0x2c]
call ebp
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5ca8eb
mov eax, dword [esp + 0x88]
test eax, eax
je 0x5ca944
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x5ca9c0
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x5ca9c0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], eax
lea eax, [0x6e3420]
mov dword [esp], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call fcn.0040b2d0
mov eax, dword [esp + 8]
lea ecx, [0x734b40]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x68
ret
call fcn.00475ee0
jmp fcn.005ca790
Function at 0x5e1c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e1d04
sub esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5e1c90
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx + eax - 1]
movzx ebx, dl
mov ebp, ebx
sub ebx, eax
cmp eax, 0x100
jge 0x5e1c7a
mov esi, eax
jmp 0x5e1c81
mov esi, eax
mov eax, 0x100
mov byte [esp + 3], dl
mov dword [esp + 8], ebp
sar ebx, 0x1f
xor edi, edi
jmp 0x5e1cd7
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
add esp, 0xc
ret
sub ebp, edi
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
mov dword [esp + 4], ebp
sub esi, edi
movzx esi, byte [esi + ecx - 1]
and ebp, edx
mov edx, dword [esp + 4]
and esi, edx
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
inc edi
and ebx, ebp
mov esi, dword [esp + 0x14]
movzx edx, byte [esp + 3]
mov ebp, dword [esp + 8]
cmp eax, edi
jg 0x5e1ca1
mov eax, ebx
shl ebx, 4
and eax, ebx
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and edx, eax
movzx ecx, dl
inc ecx
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x20], al
add esp, 0xc
ret
call fcn.00475ee0
jmp fcn.005e1c40
Function at 0x5e7d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e7ed5
sub esp, 0x6c
lea edi, [esp + 0x74]
xor eax, eax
call fcn.004773c7
lea edi, [esp + 8]
call fcn.004773c7
mov ecx, dword [esp + 0x70]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.0047b6f0
movzx ecx, byte [esp + 4]
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x70]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xcc]
mov ebx, dword [ecx + 0xd0]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
movzx edx, byte [ecx + 0x36]
mov byte [esp + 0x68], dl
movzx edx, word [ecx + 0x3a]
mov word [esp + 0x6a], dx
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x78]
mov ebx, dword [ecx + 0x7c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x38]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x54]
mov ebx, dword [ecx + 0x58]
mov ebp, dword [ecx + 0x5c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x6c]
mov ebx, dword [ecx + 0x70]
mov ebp, dword [ecx + 0x74]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x48]
mov ebx, dword [ecx + 0x4c]
mov ebp, dword [ecx + 0x50]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x3c]
mov ebx, dword [ecx + 0x40]
mov ebp, dword [ecx + 0x44]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x5e7dff
movzx eax, byte [ecx + 0x34]
test al, al
je 0x5e7e48
cmp word [ecx + 0x28], 0x304
je 0x5e7e48
movzx eax, byte [ecx + 0xa4]
test al, al
je 0x5e7e2e
lea eax, [ecx + 0xb1]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x5e7e48
lea eax, [ecx + 0xbd]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x5e7e61
lea eax, [0x720488]
mov dword [esp + 0x64], eax
jmp 0x5e7eb9
cmp word [ecx + 0x28], 0x304
je 0x5e7eaf
movzx eax, byte [ecx + 0x34]
test al, al
jne 0x5e7eaf
lea eax, [0x6cab80]
mov dword [esp], eax
call fcn.0040dea0
mov eax, dword [esp + 4]
lea ecx, [0x5e7ee0]
mov dword [eax], ecx
mov ecx, dword [0x8c88d8]
test ecx, ecx
jne 0x5e7e9b
mov ecx, dword [esp + 0x70]
jmp 0x5e7ea6
call fcn.004772e0
mov ecx, dword [esp + 0x70]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x64], eax
jmp 0x5e7eb9
mov eax, dword [ecx + 0x84]
mov dword [esp + 0x64], eax
movzx eax, byte [ecx + 0x94]
mov byte [esp + 0x60], al
lea edi, [esp + 0x74]
lea esi, [esp + 8]
call fcn.004777f6
add esp, 0x6c
ret
call fcn.00475ee0
jmp fcn.005e7d00
Function at 0x600a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8c8600]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x600c5e
sub esp, 0x40
lea eax, [0x6c0100]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x5c]
lea ebx, [edx + ecx]
mov dword [esp + 0x34], ebx
mov dword [esp + 8], ebx
call fcn.004726e0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x34]
cmp ecx, edx
ja 0x600ad4
mov ebx, ecx
jmp 0x600b04
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
lea eax, [0x6c0100]
mov dword [esp + 0x10], eax
call fcn.00472770
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp], eax
mov ebp, dword [esp + 0x58]
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.00477ad0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x68]
lea edx, [ecx + eax]
mov ebx, dword [esp + 0x34]
cmp ebx, edx
jb 0x600b3d
mov ebp, dword [esp + 0x38]
jmp 0x600b77
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea eax, [0x6c0100]
mov dword [esp + 0x10], eax
call fcn.00472770
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebp, eax
mov ebx, ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
add eax, ebp
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00477ad0
lea eax, [0x6c0100]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.004726e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.00600a40
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [str.master_secret]
mov ebx, dword [0x8a1c24]
mov ebp, dword [0x8a1c28]
mov esi, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov edi, dword [esp + 0x4c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
call eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
call fcn.00475ee0
jmp fcn.00600a80