joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5af6e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1ac
mov eax, dword [esp + 0x1cc]
mov dword [esp + 4], 0x6bbec0
mov edi, dword [esp + 0x1c4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c0]
mov dword [esp], eax
call fcn.004a0230
test eax, eax
je 0x5af828
mov dword [esp + 0x10], eax
mov ebx, eax
mov eax, dword [esp + 0x1c8]
lea ebp, [esp + 0xc0]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x20
mov dword [esp], eax
call fcn.0049f7e0
mov dword [esp], ebx
mov esi, eax
call fcn.004a02b0
test esi, esi
je 0x5af818
movzx eax, byte [esp + 0xdf]
mov edx, ebp
and byte [esp + 0xc0], 0xf8
and eax, 0x3f
or eax, 0x40
mov byte [esp + 0xdf], al
lea eax, [esp + 0x100]
call fcn.005a7920
lea edx, [esp + 0x150]
lea eax, [esp + 0x48]
call fcn.005a36f0
lea ecx, [esp + 0x48]
lea edx, [esp + 0x100]
lea eax, [esp + 0x70]
call fcn.005a2520
lea ecx, [esp + 0x48]
lea edx, [esp + 0x128]
lea eax, [esp + 0x98]
call fcn.005a2520
lea edx, [esp + 0x98]
mov eax, edi
call fcn.005a2250
lea edx, [esp + 0x70]
lea eax, [esp + 0x28]
call fcn.005a2250
movzx eax, byte [esp + 0x28]
shl eax, 7
xor byte [edi + 0x1f], al
mov dword [esp], ebp
mov dword [esp + 4], 0x40
call fcn.004ded70
add esp, 0x1ac
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x40
mov dword [esp], ebp
call fcn.004ded70
add esp, 0x1ac
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5af880
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x150
mov eax, dword [ebp + 0xc]
lea ebx, [esp + 0x10]
movdqu xmm2, xmmword [eax + 0x10]
movdqu xmm1, xmmword [eax]
mov edx, ebx
movups xmmword [esp + 0x20], xmm2
movzx eax, byte [esp + 0x2f]
movups xmmword [esp + 0x10], xmm1
and eax, 0x7f
and byte [esp + 0x10], 0xf8
or eax, 0x40
mov byte [esp + 0x2f], al
lea eax, [esp + 0xb0]
call fcn.005a7920
mov esi, dword [esp + 0xf8]
movdqu xmm0, xmmword [esp + 0xd8]
paddd xmm0, xmmword [esp + 0x100]
mov edx, dword [esp + 0x120]
movdqu xmm3, xmmword [esp + 0xd8]
mov ecx, dword [esp + 0xfc]
movups xmmword [esp + 0x30], xmm0
lea eax, [edx + esi]
sub edx, esi
movdqu xmm0, xmmword [esp + 0xe8]
paddd xmm0, xmmword [esp + 0x110]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0x80], edx
lea edx, [esp + 0x60]
movdqu xmm4, xmmword [esp + 0xe8]
movups xmmword [esp + 0x40], xmm0
movdqu xmm0, xmmword [esp + 0x100]
lea edi, [eax + ecx]
sub eax, ecx
psubd xmm0, xmm3
mov dword [esp + 0x84], eax
lea eax, [esp + 0x88]
movups xmmword [esp + 0x60], xmm0
movdqu xmm0, xmmword [esp + 0x110]
mov dword [esp + 0x54], edi
psubd xmm0, xmm4
movups xmmword [esp + 0x70], xmm0
call fcn.005a36f0
lea edx, [esp + 0x30]
lea ecx, [esp + 0x88]
mov eax, edx
call fcn.005a2520
mov eax, dword [ebp + 8]
lea edx, [esp + 0x30]
call fcn.005a2250
mov dword [esp], ebx
mov dword [esp + 4], 0x20
call fcn.004ded70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5efec0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x64]
test eax, eax
je 0x5effe7
movzx ebx, byte [eax + 1]
movzx esi, byte [eax + 2]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax]
or ebx, esi
movzx esi, byte [eax + 3]
shl esi, 0x18
or ebx, esi
mov dword [ecx], ebx
movzx ebx, byte [eax + 5]
movzx esi, byte [eax + 6]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 4]
or ebx, esi
movzx esi, byte [eax + 7]
shl esi, 0x18
or ebx, esi
mov dword [ecx + 4], ebx
movzx ebx, byte [eax + 9]
movzx esi, byte [eax + 0xa]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 8]
or ebx, esi
movzx esi, byte [eax + 0xb]
shl esi, 0x18
or ebx, esi
mov dword [ecx + 8], ebx
movzx ebx, byte [eax + 0xd]
movzx esi, byte [eax + 0xe]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 0xc]
or ebx, esi
movzx esi, byte [eax + 0xf]
shl esi, 0x18
or ebx, esi
mov dword [ecx + 0xc], ebx
movzx ebx, byte [eax + 0x11]
movzx esi, byte [eax + 0x12]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 0x10]
or ebx, esi
movzx esi, byte [eax + 0x13]
shl esi, 0x18
or ebx, esi
mov dword [ecx + 0x10], ebx
movzx ebx, byte [eax + 0x15]
movzx esi, byte [eax + 0x16]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 0x14]
or ebx, esi
movzx esi, byte [eax + 0x17]
shl esi, 0x18
or ebx, esi
mov dword [ecx + 0x14], ebx
movzx ebx, byte [eax + 0x19]
movzx esi, byte [eax + 0x1a]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 0x18]
or ebx, esi
movzx esi, byte [eax + 0x1b]
shl esi, 0x18
or ebx, esi
mov dword [ecx + 0x18], ebx
movzx ebx, byte [eax + 0x1d]
movzx esi, byte [eax + 0x1e]
shl ebx, 8
shl esi, 0x10
or ebx, esi
movzx esi, byte [eax + 0x1c]
movzx eax, byte [eax + 0x1f]
or ebx, esi
shl eax, 0x18
or eax, ebx
mov dword [ecx + 0x1c], eax
test edx, edx
je 0x5f0076
movzx eax, byte [edx + 1]
movzx ebx, byte [edx + 2]
shl eax, 8
shl ebx, 0x10
or eax, ebx
movzx ebx, byte [edx]
or eax, ebx
movzx ebx, byte [edx + 3]
shl ebx, 0x18
or eax, ebx
mov dword [ecx + 0x20], eax
movzx eax, byte [edx + 6]
movzx ebx, byte [edx + 5]
shl eax, 0x10
shl ebx, 8
or eax, ebx
movzx ebx, byte [edx + 4]
or eax, ebx
movzx ebx, byte [edx + 7]
shl ebx, 0x18
or eax, ebx
mov dword [ecx + 0x24], eax
movzx eax, byte [edx + 0xa]
movzx ebx, byte [edx + 9]
shl eax, 0x10
shl ebx, 8
or eax, ebx
movzx ebx, byte [edx + 8]
or eax, ebx
movzx ebx, byte [edx + 0xb]
shl ebx, 0x18
or eax, ebx
mov dword [ecx + 0x28], eax
movzx eax, byte [edx + 0xd]
movzx ebx, byte [edx + 0xe]
shl eax, 8
shl ebx, 0x10
or eax, ebx
movzx ebx, byte [edx + 0xc]
movzx edx, byte [edx + 0xf]
or eax, ebx
shl edx, 0x18
or eax, edx
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x70], 0
mov eax, 1
pop ebx
pop esi
ret
Function at 0x600630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x64]
mov ebp, dword [eax]
test ebp, ebp
js 0x600800
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x60]
mov eax, dword [eax]
mov ebx, dword [edi + 4]
mov ecx, eax
mov dword [esp + 0x1c], eax
mov edx, ebx
bswap ecx
mov esi, ecx
movzx eax, cl
mov dword [esp + 0x28], ecx
shr esi, 0x10
movzx ecx, ch
shl eax, 8
bswap edx
or eax, ecx
mov ecx, esi
mov edi, edx
mov dword [esp + 0x18], ebx
shl eax, 8
movzx esi, cl
shr edi, 0x10
mov dword [esp + 0x2c], edx
or eax, esi
mov ebx, edi
movzx esi, byte [esp + 0x1c]
shl eax, 8
movzx ebx, bl
mov edi, eax
movzx eax, dl
movzx edx, dh
shl eax, 8
or edi, esi
or eax, edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x20], edi
mov ecx, eax
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esp + 0x18]
shl ecx, 8
or ecx, ebx
mov dword [esp + 0x24], ecx
test edx, edx
je 0x6007eb
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov dword [esp + 0x1c], 0
jmp 0x600706
add edi, 1
movzx eax, byte [esi]
xor al, byte [esp + ebp + 0x20]
add esi, 1
mov byte [edi - 1], al
mov eax, dword [esp + 0x50]
add ebp, 1
and ebp, 7
sub eax, esi
add eax, dword [esp + 0x58]
je 0x600790
test ebp, ebp
jne 0x6006e0
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.005ff520
movzx edx, byte [esp + 0x28]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
movzx ebx, bh
shl edx, 8
add dword [esp + 0x1c], 1
shr eax, 0x10
or edx, ebx
mov ebx, dword [esp + 0x2c]
shr ecx, 0x10
movzx eax, al
shl edx, 8
movzx ecx, cl
or edx, eax
movzx eax, byte [esp + 0x2c]
movzx ebx, bh
shl eax, 8
or eax, ebx
shl eax, 8
or eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
shld edx, eax, 8
mov eax, dword [esp + 0x18]
mov ecx, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
shld eax, edx, 8
mov dword [esp + 0x24], eax
jmp 0x6006e0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6007eb
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, edi
mov eax, edi
mov ecx, esi
shr eax, 0x10
movzx edx, bl
mov ebx, edi
shr ecx, 0x10
movzx ebx, bh
shl edx, 8
movzx eax, al
movzx ecx, cl
or edx, ebx
mov ebx, esi
shl edx, 8
movzx ebx, bh
or edx, eax
mov eax, esi
movzx eax, al
shld edx, edi, 8
shl eax, 8
or eax, ebx
shl eax, 8
or eax, ecx
shld eax, esi, 8
mov ebx, eax
mov eax, dword [esp + 0x60]
mov dword [eax], edx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x64]
mov dword [eax], ebp
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x64]
mov ebp, 0xffffffff
mov dword [eax], ebp
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x605eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xe0
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x6060c8
mov edi, eax
movzx eax, byte [eax + 0xc]
mov dword [esp + 0x3c], 0
mov byte [esp + 0x37], al
movzx eax, byte [edi + 0x14]
mov byte [esp + 0x36], al
mov eax, edi
lea edi, [edi + 0xc]
add eax, 0x14
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
lea esi, [esi]
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov edx, dword [edi + eax + 4]
mov eax, dword [edi + eax]
mov dword [esp + 0x48], eax
mov edi, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], eax
movzx eax, byte [esp + 0x37]
mov dword [esp + 0x4c], edx
mov esi, dword [esp + 0x4c]
and eax, 0xffffff9f
mov dword [esp + 0x44], edx
or eax, 0x40
mov dword [esp + 0x5c], edx
mov byte [ebx + 0xc], al
movzx eax, byte [esp + 0x36]
mov dword [esp + 0x54], edx
and eax, 0xffffff9f
or eax, 0x20
mov byte [ebx + 0x14], al
mov ebx, dword [esp + 0x18]
mov dword [esp], ebx
call fcn.005969b0
lea ecx, [esp + 0x60]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.00596bf0
lea ecx, [esp + 0x60]
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
lea ecx, [esp + 0x50]
mov dword [esp], ecx
call fcn.00595840
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.005969b0
lea ecx, [esp + 0x60]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.00596bf0
lea ecx, [esp + 0x60]
lea edx, [esp + 0x58]
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00595840
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
xor edx, esi
xor eax, esi
mov ebx, edx
xor ecx, edi
xor edi, dword [esp + 0x50]
mov dword [esp + 0x30], eax
mov esi, ebx
mov edx, edi
shr eax, 0x10
mov byte [esp + 0x36], cl
shr esi, 0x10
shr edi, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], esi
mov esi, ecx
mov eax, edi
shr esi, 0x10
movzx edi, al
mov byte [esp + 0x37], dl
mov dword [esp + 0x28], esi
mov esi, edx
shr esi, 0x18
shl esi, 8
mov eax, esi
or eax, edi
movzx edi, dh
movzx edx, dl
shl eax, 8
or eax, edi
movzx edi, byte [esp + 0x2c]
shl eax, 8
or eax, edx
mov edx, ebx
shr edx, 0x18
movd xmm4, eax
mov eax, dword [esp + 0x30]
shl edx, 8
movdqa xmm0, xmm4
mov esi, edx
movzx edx, bh
movzx ebx, bl
or esi, edi
mov edi, dword [esp + 0x1c]
shl esi, 8
or esi, edx
mov edx, ecx
shl esi, 8
or esi, ebx
shr edx, 0x18
movzx ebx, byte [esp + 0x28]
add dword [esp + 0x3c], 8
shl edx, 8
movd xmm3, esi
or edx, ebx
movzx ebx, ch
punpckldq xmm0, xmm3
movzx ecx, cl
shl edx, 8
or edx, ebx
movzx ebx, byte [esp + 0x24]
shl edx, 8
or edx, ecx
mov ecx, eax
shr ecx, 0x18
movd xmm1, edx
shl ecx, 8
or ecx, ebx
movzx ebx, ah
shl ecx, 8
or ecx, ebx
movzx ebx, al
mov eax, dword [esp + 0x3c]
shl ecx, 8
or ecx, ebx
mov ebx, dword [esp + 0x38]
movd xmm2, ecx
punpckldq xmm1, xmm2
punpcklqdq xmm0, xmm1
movups xmmword [ebx + 0xc], xmm0
cmp eax, edi
jb 0x605f00
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x609c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x50
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
test ecx, ecx
je 0x609cb0
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
movdqu xmm0, xmmword [esi]
mov edi, dword [ebp + 0xc]
lea eax, [ebx + ecx]
test edx, edx
mov dword [esp + 0x1c], eax
je 0x609cc0
mov eax, edi
mov edi, ebx
mov ebx, eax
lea esi, [esi]
mov eax, dword [ebp + 0x14]
movups xmmword [esp + 0x2f], xmm0
add edi, 1
add ebx, 1
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [ebp + 0x24]
movzx eax, byte [edi - 1]
xor al, byte [esi]
mov byte [esp + 0x3f], al
movdqu xmm0, xmmword [esp + 0x30]
mov byte [ebx - 1], al
movups xmmword [esi], xmm0
cmp dword [esp + 0x1c], edi
jne 0x609c78
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x14]
movups xmmword [esp + 0x2f], xmm0
add ebx, 1
add edi, 1
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [ebp + 0x24]
movzx edx, byte [ebx - 1]
movzx ecx, byte [esi]
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x3f], dl
movdqu xmm0, xmmword [esp + 0x30]
xor ecx, edx
mov byte [edi - 1], cl
movups xmmword [esi], xmm0
cmp ebx, eax
jne 0x609cc0
jmp 0x609cb0
Function at 0x60d580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebx + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x30]
shld edx, eax, 3
shl eax, 3
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x2c], edx
mov edx, dword [ebx + 0x3c]
shld edx, eax, 3
shl eax, 3
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x164]
mov dword [esp + 0x3c], edx
mov edx, dword [ebx + 0x160]
mov dword [esp + 0x34], eax
mov eax, dword [ebx + 0x168]
test eax, eax
jne 0x60d6e8
mov eax, dword [ebx + 0x16c]
test eax, eax
jne 0x60d6c0
lea eax, [ebx + 0x178]
lea edi, [ebx + 0x40]
mov dword [esp + 0x30], eax
lea eax, [ebx + 0x60]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov esi, eax
mov ecx, edx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
bswap esi
bswap ecx
bswap edx
bswap eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], edx
movdqu xmm1, xmmword [esp + 0x40]
movups xmmword [ebx + eax + 0x178], xmm1
mov eax, dword [esp + 0x14]
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
call eax
movdqu xmm2, xmmword [ebx + 0x40]
movdqu xmm0, xmmword [ebx + 0x20]
mov eax, dword [esp + 0x24]
pxor xmm0, xmm2
movups xmmword [ebx + 0x40], xmm0
test eax, eax
je 0x60d768
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x10
ja 0x60d768
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004dedc0
lea eax, [ebx + 0x60]
lea edi, [ebx + 0x40]
mov dword [esp + 0x20], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call edx
lea eax, [ebx + 0x178]
mov dword [esp + 0x30], eax
jmp 0x60d607
lea edx, [eax + 0xf]
lea edi, [ebx + 0x178]
mov dword [esp + 4], 0
mov esi, edx
mov dword [esp + 0x30], edi
and esi, 0xfffffff0
mov edx, esi
mov dword [esp + 0x18], esi
sub edx, eax
add eax, edi
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memset
cmp esi, 0x30
je 0x60d738
lea eax, [esi + 0x10]
lea edi, [ebx + 0x40]
mov dword [esp + 0x14], eax
lea eax, [ebx + 0x60]
mov dword [esp + 0x20], eax
jmp 0x60d617
mov eax, dword [esp + 0x30]
lea edi, [ebx + 0x40]
mov dword [esp + 0xc], 0x30
mov dword [esp], edi
mov dword [esp + 8], eax
lea eax, [ebx + 0x60]
mov dword [esp + 0x20], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
call eax
jmp 0x60d607
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x611fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x1c], eax
mov eax, ebx
and eax, 7
jne 0x612100
mov esi, edx
lea edx, [ebx - 0x18]
cmp edx, 0x7ffffff0
jbe 0x611fd0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebx - 8]
mov dword [esp + 0x34], ecx
lea ebp, [esp + 0x40]
mov eax, edi
shr eax, 3
lea eax, [eax + eax*2]
add eax, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x70]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], edi
mov dword [esp], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x24], edx
add eax, 8
mov dword [esp + 0x44], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memmove
lea eax, [ebx - 0x10]
sub ebx, 9
mov dword [esp + 0x38], edi
shr ebx, 3
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], 6
mov dword [esp + 0x3c], esi
lea esi, [esi]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov esi, ebx
lea edx, [ebx*8]
sub esi, eax
lea eax, [esi - 1]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
sub eax, edx
lea edi, [ecx + eax]
jmp 0x612072
mov ebx, eax
xor byte [esp + 0x47], bl
cmp ebx, 0xff
jbe 0x61209e
mov edx, ebx
xor eax, eax
movzx ecx, word [esp + 0x44]
xor byte [esp + 0x46], bh
shr edx, 0x18
mov al, dl
mov edx, ebx
shr edx, 0x10
mov ah, dl
xor ecx, eax
mov word [esp + 0x44], cx
mov eax, dword [edi + ebx*8]
mov edx, dword [edi + ebx*8 + 4]
mov dword [esp + 4], ebp
mov dword [esp], ebp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x4c], edx
mov dword [esp + 8], eax
call dword [esp + 0x78]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [edi + ebx*8], eax
lea eax, [ebx - 1]
mov dword [edi + ebx*8 + 4], edx
cmp esi, ebx
jne 0x612070
sub dword [esp + 0x30], 1
jne 0x612040
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x5c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x5c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x619dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x64]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x70]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, eax
mov edi, eax
mov dword [esp + 0x2c], edx
shr edi, 0x10
mov dword [esp + 0x24], edx
movzx ebp, cl
mov dword [esp + 0x3c], edx
mov edx, ecx
mov ebx, edi
shr edx, 0x18
movzx edi, bl
mov dword [esp + 0x28], eax
shl edx, 8
mov dword [esp + 0x20], eax
or edx, edi
mov dword [esp + 0x38], eax
movzx edi, ch
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
shl edx, 8
shr eax, 0x10
or edx, edi
movzx edi, byte [esp + 0x2c]
shr ecx, 0x18
movzx eax, al
shl edx, 8
shl ecx, 8
mov ebx, edx
or ecx, eax
mov eax, dword [esp + 0x2c]
or ebx, ebp
shl ecx, 8
mov dword [esp + 0x30], ebx
movzx eax, ah
or ecx, eax
mov eax, dword [esp + 0x68]
shl ecx, 8
or ecx, edi
mov dword [esp + 0x34], ecx
test eax, eax
je 0x619ee6
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x68]
mov edi, ebp
jmp 0x619e8f
add esi, 1
movzx eax, byte [ebp]
xor al, byte [esp + ebx + 0x30]
add ebp, 1
mov byte [esi - 1], al
mov eax, edi
add ebx, 1
sub eax, ebp
and ebx, 7
add eax, edx
je 0x619ed0
test ebx, ebx
jne 0x619e70
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x68], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.006192a0
movq xmm0, qword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x68]
movq qword [esp + 0x30], xmm0
add ecx, 1
jmp 0x619e70
mov dword [esp + 0x1c], ebx
test ecx, ecx
je 0x619ee6
mov eax, dword [esp + 0x70]
movq xmm1, qword [esp + 0x38]
movq qword [eax], xmm1
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
mov dword [eax], esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x61b3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x50]
mov eax, dword [ecx + 0x38]
test eax, eax
je 0x61b3e8
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x61b420
cmp esi, 2
je 0x61b400
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
cmp esi, 2
jne 0x61b468
cmp ebp, 0x7ff
jle 0x61b468
test edi, edi
je 0x61b446
mov dword [esp], edi
mov dword [esp + 0x1c], edx
call fcn.0045a620
mov edx, dword [esp + 0x1c]
cmp eax, 0x10
jle 0x61b468
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004f3390
mov dword [esp + 0x44], edx
mov ecx, esi
mov edx, ebp
mov eax, ebx
mov dword [esp + 0x40], edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0061a710
Function at 0x61d600
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
cmp dword [esp + 0x20], 0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
je 0x61d640
mov dword [esp + 0x20], fcn.0061bd80
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp fcn.00606280
mov dword [esp + 0x20], fcn.0061c9c0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp fcn.00606720

Function at 0x61d6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
je 0x61d6e8
jmp fcn.0061bd80
jmp fcn.0061c9c0