joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58c4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58c68b
sub esp, 0x30
lea eax, [0x68dfc0]
mov dword [esp], eax
call fcn.0040d2a0
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x58c52f
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x58c65d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x58c677
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x58c525
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x58c525
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x58c525
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x58c525
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [esi + edx]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x58c5ff
cmp ebx, ebp
jle 0x58c5ff
ja 0x58c661
mov eax, ebp
mov ecx, ebx
call fcn.0046c910
nop
call fcn.0046b490
jmp fcn.0058c4f0
Function at 0x58f800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58f9aa
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0046cb2b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x58f82f
inc ebx
cmp edx, ebx
jle 0x58f94e
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x58f8f2
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x58f8a3
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x58f82e
lea edi, [esp + 0x28]
call fcn.0046cb2b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00590190
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0046d00e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0046d00e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.0046cb2b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0058fd80
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0046d00e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0046d00e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0046cb2a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x6d61c1]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.0046cb2b
lea ecx, [0x6b2900]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040a900
mov ecx, dword [esp + 8]
lea edx, [0x749b6c]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0046cb2a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x6d4f44]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.0046cb2b
lea ecx, [0x6b2900]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call fcn.0040a900
mov ecx, dword [esp + 8]
lea edx, [0x749b6c]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.0046b490
jmp fcn.0058f800
Function at 0x594c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x594e0d
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0046cb27
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x594c88
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x594cb1
lea eax, [0x692a40]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.004507f0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0046cb27
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
nop
or edx, ecx
test bl, bl
je 0x594cf5
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x594d04
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x594d13
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x594d22
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x594d31
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x594d3d
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x594d49
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x594db9
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x692a40]
mov dword [esp + 0x10], eax
call fcn.004508b0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call fcn.0046d220
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.0046cfe6
add esp, 0x5c
ret
call fcn.0046b490
jmp fcn.00594c50
Function at 0x5ab280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ab3f1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x5ab317
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x5ab2b6
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5ab323
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x24]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x5ab2e1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x5ab323
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x18]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x5ab323
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.005ab070
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.005b26a0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0046b490
jmp fcn.005ab280
Function at 0x5b9620
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b9791
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5b9651
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5b9651
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5b9657
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5b9665
cmp ecx, 4
jne 0x5b9696
cmp al, 0x2c
ja 0x5b967e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5b9690
cmp al, 0x24
je 0x5b9690
cmp al, 0x26
jae 0x5b9690
jmp 0x5b9696
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5b9690
cmp al, 0x5b
je 0x5b9690
cmp al, 0x5d
jne 0x5b9696
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5b96cd
cmp al, 0x26
ja 0x5b96af
cmp al, 0x24
je 0x5b96ec
cmp al, 0x26
je 0x5b96ec
jmp 0x5b9773
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5b96ec
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5b976d
cmp al, 0x2f
je 0x5b96ec
jmp 0x5b9773
cmp al, 0x3d
ja 0x5b96e4
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5b96ec
cmp al, 0x3d
je 0x5b96ec
jmp 0x5b9773
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5b9763
cmp ecx, 2
jg 0x5b9727
cmp ecx, 1
je 0x5b971c
cmp ecx, 2
jne 0x5b9773
cmp al, 0x2f
je 0x5b970a
cmp al, 0x3b
je 0x5b970a
cmp al, 0x2c
jne 0x5b9711
mov eax, 1
jmp 0x5b9717
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5b974d
cmp al, 0x40
je 0x5b973b
cmp al, 0x2f
je 0x5b973b
cmp al, 0x3f
jne 0x5b9742
mov eax, 1
jmp 0x5b9748
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5b975d
cmp ecx, 7
jne 0x5b9773
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5b976d
cmp al, 0x7e
jne 0x5b9773
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5b978b
cmp al, 0x21
je 0x5b9785
add eax, 0xffffffd8
cmp al, 2
ja 0x5b978b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.0046b490
jmp fcn.005b9620
Function at 0x5c6250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c639e
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.0057e5b0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5c62b9
nop
lea eax, [0x69de40]
mov dword [esp], eax
call fcn.0040d2a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x6dfa34]
mov dword [eax], ecx
lea ecx, [0x74924c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5c638a
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.0057ec00
movzx eax, byte [esp + 0x10]
test al, al
je 0x5c6356
movzx eax, byte [esp + 0x1b]
xor eax, 0xffffff80
movzx eax, al
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x38]
mov esi, dword [edx]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5c62b9
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
nop
lea eax, [0x69de40]
mov dword [esp], eax
call fcn.0040d2a0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x6df3dc]
mov dword [eax], ecx
lea ecx, [0x74924c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0046b490
jmp fcn.005c6250
Function at 0x5d1430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d166c
sub esp, 0x68
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0046cb25
lea ecx, [0x5d1680]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
lea ebx, [esp + 0x84]
mov dword [esp + 0x54], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005c2200
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5d1559
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov esi, dword [esp + 0x2c]
mov dword [esp], 2
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
lea edx, [esp + 0x2c]
call esi
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5d1527
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call fcn.005c2200
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5d15bf
mov dword [esp + 0x14], edx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov dword [esp], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
lea edx, [esp + 0x2c]
call ebp
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5d158b
mov eax, dword [esp + 0x88]
test eax, eax
je 0x5d15e4
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x5d1668
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x5d1668
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x64], eax
lea eax, [0x6b2800]
mov dword [esp], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call fcn.0040a900
mov eax, dword [esp + 8]
lea ecx, [0x749ae0]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x68
ret
call fcn.0046b490
jmp fcn.005d1430
Function at 0x5d62c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d645a
mov eax, dword [esp + 4]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov ebx, edx
shl edx, 8
or ecx, edx
shr ebx, 0x18
movzx edx, byte [eax + 2]
mov ebp, edx
shl edx, 0x10
or ecx, edx
shr ebp, 0x10
or ebx, ebp
movzx edx, byte [eax + 3]
mov ebp, edx
shr edx, 8
or ebx, edx
shl ebp, 0x18
or ecx, ebp
and ecx, 0xfffffff
movzx edx, byte [eax + 4]
or edx, ebx
movzx ebx, byte [eax + 5]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [eax + 7]
shl ebx, 0x18
or edx, ebx
and edx, 0xffffffc
mov ebx, dword [esp + 8]
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [eax + 9]
mov ebp, edx
shl edx, 8
or ecx, edx
shr ebp, 0x18
movzx edx, byte [eax + 0xa]
mov esi, edx
shr edx, 0x10
or ebp, edx
shl esi, 0x10
or ecx, esi
movzx edx, byte [eax + 0xb]
mov esi, edx
shr edx, 8
or ebp, edx
shl esi, 0x18
or esi, ecx
and esi, 0xffffffc
movzx ecx, byte [eax + 0xc]
or ecx, ebp
movzx edx, byte [eax + 0xd]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0xe]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [eax + 0xf]
shl ecx, 0x18
or ecx, edx
and ecx, 0xffffffc
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], ecx
movzx ecx, byte [eax + 0x10]
movzx edx, byte [eax + 0x11]
mov ebp, edx
shl edx, 8
or ecx, edx
shr ebp, 0x18
movzx edx, byte [eax + 0x12]
mov esi, edx
shr edx, 0x10
or ebp, edx
shl esi, 0x10
or ecx, esi
movzx edx, byte [eax + 0x13]
mov esi, edx
shr edx, 8
or ebp, edx
shl esi, 0x18
or esi, ecx
movzx ecx, byte [eax + 0x14]
or ecx, ebp
movzx edx, byte [eax + 0x15]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x16]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [eax + 0x17]
shl ecx, 0x18
or ecx, edx
nop
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], ecx
movzx ecx, byte [eax + 0x18]
movzx edx, byte [eax + 0x19]
mov ebp, edx
shl edx, 8
or ecx, edx
shr ebp, 0x18
movzx edx, byte [eax + 0x1a]
mov esi, edx
shr edx, 0x10
or ebp, edx
shl esi, 0x10
or ecx, esi
movzx edx, byte [eax + 0x1b]
mov esi, edx
shr edx, 8
or ebp, edx
shl esi, 0x18
or esi, ecx
movzx ecx, byte [eax + 0x1c]
or ecx, ebp
movzx edx, byte [eax + 0x1d]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 0x1e]
shl ecx, 0x10
or edx, ecx
movzx eax, byte [eax + 0x1f]
shl eax, 0x18
or eax, edx
nop
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], eax
ret
call fcn.0046b490
jmp fcn.005d62c0
Function at 0x5dce70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5dcf52
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5dcec1
mov edx, dword [esp + 0x18]
movzx ebx, byte [ecx + edx - 1]
movzx ebp, bl
mov esi, ebp
sub ebp, ecx
cmp ecx, 0x100
jge 0x5dceab
mov eax, ecx
jmp 0x5dceb2
mov eax, ecx
mov ecx, 0x100
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
sar ebp, 0x1f
xor edi, edi
jmp 0x5dcf04
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
add esp, 0x14
ret
xchg esi, ebx
not ebx
xchg esi, ebx
sar esi, 0x1f
movzx eax, byte [eax + edx - 1]
mov ecx, esi
and esi, ebx
and eax, ecx
xor esi, eax
xchg esi, ebx
not ebx
xchg esi, ebx
inc edi
movzx eax, byte [esp + 0xb]
and eax, esi
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jle 0x5dcf1f
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
sub eax, edi
lea ecx, [eax - 1]
sub esi, edi
mov ebp, dword [esp + 0x1c]
cmp ebp, ecx
ja 0x5dced2
jmp 0x5dcf48
mov eax, ebp
shl ebp, 4
and eax, ebp
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and ebx, eax
movzx ecx, bl
inc ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x28], al
add esp, 0x14
ret
mov eax, ecx
mov ecx, ebp
call fcn.0046c910
nop
call fcn.0046b490
jmp fcn.005dce70
Function at 0x5e57f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x9aee30]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e59ad
sub esp, 0x64
lea edi, [esp + 0x6c]
xor eax, eax
call fcn.0046cb19
lea edi, [esp + 8]
call fcn.0046cb19
mov ecx, dword [esp + 0x68]
test byte [ecx], al
lea edx, [ecx + 0x14]
mov dword [esp], edx
call fcn.00471150
mov ecx, dword [esp + 4]
test ecx, ecx
setne cl
mov byte [esp + 0xa], cl
mov ecx, dword [esp + 0x68]
movzx edx, word [ecx + 0x28]
mov word [esp + 8], dx
mov edx, dword [ecx + 0xc4]
mov ebx, dword [ecx + 0xc8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
movzx edx, byte [ecx + 0x35]
mov byte [esp + 0xb], dl
mov byte [esp + 0x18], 1
mov edx, dword [ecx + 0x74]
mov ebx, dword [ecx + 0x78]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
movzx edx, word [ecx + 0x36]
mov word [esp + 0xc], dx
mov edx, dword [ecx + 0x50]
mov ebx, dword [ecx + 0x54]
mov ebp, dword [ecx + 0x58]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov edx, dword [ecx + 0x68]
mov ebx, dword [ecx + 0x6c]
mov ebp, dword [ecx + 0x70]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x48]
mov ebp, dword [ecx + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebp
mov edx, dword [ecx + 0x38]
mov ebx, dword [ecx + 0x3c]
mov ebp, dword [ecx + 0x40]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
movzx edx, byte [ecx + 0x35]
test dl, dl
je 0x5e58e2
movzx eax, byte [ecx + 0x34]
test al, al
je 0x5e592b
cmp word [ecx + 0x28], 0x304
je 0x5e592b
movzx eax, byte [ecx + 0x9c]
test al, al
je 0x5e5911
lea eax, [ecx + 0xa9]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
jmp 0x5e592b
lea eax, [ecx + 0xb5]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0xc
mov dword [esp + 0x5c], 0xc
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x5e5944
lea eax, [0x6f9fcc]
mov dword [esp + 0x60], eax
jmp 0x5e599c
cmp word [ecx + 0x28], 0x304
je 0x5e5992
movzx eax, byte [ecx + 0x34]
test al, al
jne 0x5e5992
lea eax, [0x69cca0]
mov dword [esp], eax
call fcn.0040d2a0
mov eax, dword [esp + 4]
lea ecx, [0x5e59c0]
mov dword [eax], ecx
mov ecx, dword [0x9aef70]
test ecx, ecx
jne 0x5e597e
mov ecx, dword [esp + 0x68]
jmp 0x5e5989
call fcn.0046c890
mov ecx, dword [esp + 0x68]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x60], eax
jmp 0x5e599c
mov eax, dword [ecx + 0x80]
mov dword [esp + 0x60], eax
lea edi, [esp + 0x6c]
lea esi, [esp + 8]
call fcn.0046cf5a
add esp, 0x64
ret
call fcn.0046b490
jmp fcn.005e57f0