joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467950
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov dword [eax], ecx
shr ecx, 2
and ebx, 3
test ecx, ecx
push esi
jbe 0x467992
push edi
mov edi, ecx
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
mov dword [eax], esi
shl ecx, 0x10
xor ecx, esi
add edx, 2
mov dword [eax], ecx
movzx esi, word [edx]
shl esi, 0xb
xor esi, ecx
mov dword [eax], esi
mov ecx, esi
shr esi, 0xb
add esi, ecx
add edx, 2
dec edi
mov dword [eax], esi
jne 0x467963
pop edi
mov ecx, ebx
dec ecx
je 0x4679d6
dec ecx
je 0x4679c1
dec ecx
jne 0x4679ec
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
shl ecx, 0x10
xor ecx, esi
mov dword [eax], ecx
movzx edx, byte [edx + 2]
shl edx, 0x12
xor edx, ecx
mov ecx, edx
shr ecx, 0xb
add ecx, edx
mov dword [eax], ecx
jmp 0x4679ec
movzx edx, word [edx]
mov ecx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xb
xor ecx, edx
mov edx, ecx
shr edx, 0x11
jmp 0x4679e8
movzx ecx, byte [edx]
mov edx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xa
xor ecx, edx
mov edx, ecx
shr edx, 1
add edx, ecx
mov dword [eax], edx
mov edx, dword [eax]
lea ecx, [edx*8]
xor ecx, edx
mov edx, ecx
shr edx, 5
add edx, ecx
lea ecx, [edx*4]
xor ecx, edx
mov edx, ecx
shr edx, 0xf
add ecx, edx
mov edx, ecx
shl edx, 0xa
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
ret
Function at 0x47b440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 0x50]
xor ebx, ebx
cmp ecx, ebx
mov dword [edi], 0x5db67c
je 0x47b459
push edi
call fcn.0047a9d0
cmp dword [edi + 0x6c], ebx
push esi
je 0x47b4cc
nop
mov esi, dword [edi + 0x6c]
cmp esi, ebx
mov eax, dword [esi + 0x44]
mov dword [edi + 0x6c], eax
je 0x47b4c7
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov ecx, dword [esi + 0x28]
push ecx
call fcn.0043f0a0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov edx, dword [esi + 0x1c]
push edx
call fcn.0043f0a0
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [esi + 0x10]
push eax
call fcn.0043f0a0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov ecx, dword [esi + 4]
push ecx
call fcn.0043f0a0
push esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0043f0a0
add esp, 0x14
cmp dword [edi + 0x6c], ebx
jne 0x47b460
mov eax, dword [edi + 0x58]
cmp eax, ebx
lea esi, [edi + 0x58]
jne 0x47b4da
mov dword [esi], ebx
jmp 0x47b4e4
push ebx
push esi
call fcn.005bf350
add esp, 8
cmp dword [edi + 0x78], ebx
je 0x47b508
lea esp, [esp]
mov ecx, dword [edi + 0x78]
cmp ecx, ebx
mov edx, dword [ecx + 0x5c]
mov dword [edi + 0x78], edx
je 0x47b503
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [edi + 0x78], ebx
jne 0x47b4f0
mov eax, dword [edi + 0x64]
cmp eax, ebx
je 0x47b527
mov ecx, dword [eax + 0x10]
add eax, 0x10
cmp ecx, ebx
jne 0x47b51d
mov dword [eax], ebx
jmp 0x47b527
push ebx
push eax
call fcn.005bf350
add esp, 8
mov eax, dword [edi + 0x64]
cmp eax, ebx
je 0x47b56b
mov ecx, dword [eax + 4]
test ecx, 0x40000000
jne 0x47b568
cmp ecx, ebx
je 0x47b568
mov edx, ecx
and edx, 0xff
dec edx
je 0x47b568
dec ecx
mov dword [eax + 4], ecx
and ecx, 0xff
dec ecx
jne 0x47b568
push eax
and eax, 0xfffff000
mov ecx, dword [eax]
add ecx, 0x340
call fcn.005be8f0
mov dword [edi + 0x64], ebx
mov dword [edi + 0x60], ebx
mov ecx, dword [edi + 0x5c]
cmp ecx, ebx
je 0x47b5b1
mov eax, dword [ecx + 4]
test eax, 0x40000000
jne 0x47b5ae
cmp eax, ebx
je 0x47b5ae
mov edx, eax
and edx, 0xff
dec edx
je 0x47b5ae
dec eax
mov dword [ecx + 4], eax
and eax, 0xff
dec eax
jne 0x47b5ae
push ecx
and ecx, 0xfffff000
mov ecx, dword [ecx]
add ecx, 0x340
call fcn.005be8f0
mov dword [edi + 0x5c], ebx
mov dword [esi], ebx
mov eax, dword [edi + 0x54]
cmp eax, ebx
pop esi
je 0x47b5f8
mov ecx, dword [eax + 4]
test ecx, 0x40000000
jne 0x47b5f5
cmp ecx, ebx
je 0x47b5f5
mov edx, ecx
and edx, 0xff
dec edx
je 0x47b5f5
dec ecx
mov dword [eax + 4], ecx
and ecx, 0xff
dec ecx
jne 0x47b5f5
push eax
and eax, 0xfffff000
mov ecx, dword [eax]
add ecx, 0x340
call fcn.005be8f0
mov dword [edi + 0x54], ebx
lea ecx, [edi + 8]
call fcn.00434920
mov dword [edi], 0x5d8860
pop edi
pop ebx
ret
Function at 0x484d00
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push 0x3c
mov ebx, ecx
call fcn.0043f080
mov esi, eax
add esp, 4
test esi, esi
je 0x484d56
mov ecx, ebx
call fcn.00448700
test eax, eax
je 0x484d2f
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x20]
mov cl, byte [eax + 0x129]
test cl, cl
jne 0x484d45
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 8]
cmp eax, dword [ecx + 0x3e8]
jne 0x484d45
mov eax, dword [ecx + 0x3e4]
jmp 0x484d48
add eax, 0x10
push eax
mov ecx, esi
call fcn.00458ea0
mov esi, eax
test esi, esi
jne 0x484d5d
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, dword [ebx + 0x50]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], ecx
mov dword [ebx + 0x50], esi
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
mov dword [esi + 0x1c], edx
movzx cx, byte [eax + 3]
mov word [esi + 0xa], cx
movzx dx, byte [eax]
mov word [esi + 8], dx
movzx cx, byte [eax + 1]
mov word [esi + 6], cx
movzx dx, byte [eax + 2]
mov eax, dword [esp + 0x14]
test eax, eax
push edi
lea edi, [esi + 4]
mov word [edi], dx
je 0x484db3
lea ecx, [eax + 0x1c]
cmp dword [ecx], 0
je 0x484db3
push 1
push edi
call fcn.004618a0
movzx eax, word [edi + 6]
cmp eax, 0xff
jge 0x484dee
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
inc eax
imul ecx, eax
imul edx, eax
sar ecx, 8
mov word [edi + 4], cx
movzx ecx, word [edi]
imul ecx, eax
sar edx, 8
sar ecx, 8
mov word [edi + 2], dx
mov word [edi], cx
mov eax, 1
jmp 0x484df0
xor eax, eax
mov ecx, ebx
mov byte [esi + 0x24], al
call fcn.00448700
test eax, eax
je 0x484e13
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x20]
mov cl, byte [eax + 0x129]
test cl, cl
je 0x484e13
add eax, 0x10
jmp 0x484e2c
mov ebx, dword [ebx + 0x2c]
mov eax, dword [ebx + 8]
cmp ebx, dword [eax + 0x3e8]
jne 0x484e29
mov eax, dword [eax + 0x3e4]
jmp 0x484e2c
lea eax, [ebx + 0x10]
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x484e3a
mov ecx, esi
call fcn.00465720
mov eax, dword [ebp]
inc eax
pop edi
mov dword [ebp], eax
pop ebp
mov eax, esi
pop esi
pop ebx
ret 0xc
Function at 0x487820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x487841
mov eax, dword [esp + 0x30]
push eax
call fcn.0043bfe0
add esp, 4
pop esi
add esp, 0x24
ret 8
mov eax, dword [eax + 0x78]
cmp eax, 7
push edi
jne 0x4878a8
mov ecx, dword [esi + 4]
movzx edi, word [ecx + 0x5a]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
lea ecx, [eax + 0x10]
push edi
push ecx
add eax, 0x3c
push eax
call fcn.0044d9f0
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
push edi
push eax
add eax, 0x4c
push eax
call fcn.0044d9f0
mov eax, dword [esi + 0x18]
movzx ecx, byte [eax + 0x20]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
add esp, 0x20
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00484a40
pop edi
pop esi
add esp, 0x24
ret 8
test eax, eax
mov ecx, esi
jne 0x4878e1
push eax
call fcn.00486220
push 1
mov ecx, esi
mov edi, eax
call fcn.00486220
mov ecx, dword [esi + 0x18]
movzx edx, byte [ecx]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push eax
push edi
mov ecx, esi
call fcn.00484a40
pop edi
pop esi
add esp, 0x24
ret 8
push ebx
push ebp
push 0
call fcn.00486220
push 1
mov ecx, esi
mov ebp, eax
call fcn.00486220
mov edi, eax
push 0
push edi
push ebp
call fcn.0043c300
add esp, 0xc
test eax, eax
jne 0x487954
mov eax, dword [esp + 0x38]
push eax
call fcn.0043d890
add esp, 4
test eax, eax
jne 0x487954
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x28]
test ecx, ecx
je 0x487939
mov ecx, dword [ecx + 0x48]
test cl, 2
je 0x48792f
mov eax, 1
test cl, 1
je 0x48793e
or eax, 2
jmp 0x48793e
mov eax, 0xff
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ebx
push edx
push edi
push ebp
mov ecx, esi
call fcn.00484a40
jmp 0x487967
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push edi
push eax
call fcn.0043cc10
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x487986
mov ecx, esi
call fcn.00482e30
mov edx, dword [eax]
neg edx
push ebx
push edx
call fcn.0043dfd0
add esp, 8
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0x78], 4
jne 0x4879e8
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4879e8
mov edx, dword [eax + 0xc]
test edx, edx
jbe 0x4879e8
mov ecx, dword [ecx + 0x68]
mov eax, dword [ecx + 0x210]
test eax, eax
jne 0x4879b2
call fcn.00494a20
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], eax
call fcn.0043bfe0
mov eax, dword [esp + 0x3c]
add esp, 4
lea edx, [esp + 0x20]
push edx
push 0x481210
push eax
mov ecx, esi
call fcn.00484340
push ebx
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.0043e0f0
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x48bf30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x18]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x48bfbe
cmp dword [eax + 0x78], 9
jne 0x48bfbe
mov eax, dword [ebp + 0x2c]
cmp eax, ebx
je 0x48bf5e
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x48bf5e
mov eax, dword [eax + 0x3e0]
jmp 0x48bf60
xor eax, eax
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.0043e2e0
add esp, 0xc
test al, al
je 0x48c008
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0043c700
mov edx, dword [ebp + 4]
mov ecx, dword [edx + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call fcn.00431980
push eax
call fcn.0043c2a0
add esp, 8
test eax, eax
je 0x48c008
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
cmp dword [esp + 0x44], ebx
je 0x48c014
mov ecx, ebp
call fcn.00482550
test eax, eax
je 0x48c008
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push ecx
push edx
sub esp, 0xdc
mov ecx, esp
push eax
call fcn.00487790
mov ecx, ebp
call fcn.0048c790
test eax, eax
je 0x48c008
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
lea ecx, [ebp + 0x7c]
push edi
push ecx
mov dword [esp + 0x4c], ebx
call fcn.0043c2a0
add esp, 8
test eax, eax
je 0x48c10a
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push edx
push eax
mov ecx, ebp
call fcn.0048ab10
mov esi, dword [ebp + 0x4c]
test esi, esi
je 0x48c10a
movsx eax, word [esi + 0x12]
mov edx, dword [edi + 4]
cmp eax, edx
jg 0x48c0da
movsx ecx, word [esi + 0x1a]
cmp edx, ecx
jge 0x48c0da
movsx edx, word [esi + 0x10]
mov dword [esp + 0x1c], eax
movsx eax, word [esi + 0x14]
mov dword [esp + 0x18], edx
movsx edx, word [esi + 0x16]
mov dword [esp + 0x20], eax
movsx eax, word [esi + 0x18]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [esi + 0x1c]
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x1c]
push edi
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ecx
call fcn.0041f310
add esp, 0xc
test ax, ax
je 0x48c0da
movzx eax, byte [esi + 0x1d]
sub eax, 0
mov ebx, 1
je 0x48c0cc
dec eax
je 0x48c0c7
dec eax
jne 0x48c0da
mov eax, dword [esi + 8]
mov cl, byte [esi + 0x1e]
add byte [eax + 0x25], cl
jmp 0x48c0da
mov eax, dword [esi + 8]
jmp 0x48c0d6
mov eax, dword [esi + 8]
xor byte [eax + 0x25], 1
mov eax, dword [esi + 0xc]
xor byte [eax + 0x25], 1
mov esi, dword [esi]
test esi, esi
jne 0x48c050
test ebx, ebx
je 0x48c10a
mov eax, dword [ebp + 0x50]
test eax, eax
je 0x48c10a
nop
mov cl, byte [eax + 0x25]
test cl, cl
je 0x48c0ff
mov dword [esp + 0x44], 1
mov byte [eax + 0x25], 0
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x48c0f0
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
Function at 0x493d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov edx, ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
push esi
push edi
lea edi, [edx + 4]
add eax, ecx
add ecx, 2
mov dword [edi + 4], ecx
xor ecx, ecx
mov ch, byte [eax + 1]
mov dword [esp + 0x10], edx
mov cl, byte [eax]
push ecx
mov ecx, dword [edx + 0x2c]
call fcn.00491880
mov esi, eax
test esi, esi
je 0x493efa
cmp dword [esi + 0x78], 3
jne 0x493efa
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov cl, byte [eax + edx]
inc eax
mov dword [edi + 4], eax
movzx eax, cl
shr eax, 6
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x493efa
cmp word [esi + 0x36], 0
je 0x493efa
push ebx
push ebp
mov ecx, esi
call fcn.00491530
mov ebp, dword [esi + 0x74]
mov ebx, eax
cmp ebx, ebp
ja 0x493ee8
lea ecx, [esp + 0x1c]
call fcn.00401570
mov ecx, dword [esi + 0x70]
push ebp
push ebx
push ecx
lea ecx, [esp + 0x28]
call fcn.00490d80
xor ebx, ebx
cmp word [esi + 0x36], bx
jbe 0x493ea6
push 0x14
call fcn.0043f080
add esp, 4
cmp eax, ebx
je 0x493df3
movzx edx, word [esi + 0x36]
push 1
push edx
mov ecx, eax
call fcn.0043f0d0
jmp 0x493df5
xor eax, eax
cmp word [esi + 0x36], bx
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], ebx
jbe 0x493ea6
test byte [esi + 0x38], 4
lea ecx, [esp + 0x1c]
je 0x493e1b
call fcn.00423d20
mov dword [esp + 0x10], eax
jmp 0x493e29
call fcn.00423cf0
movzx ax, al
mov word [esp + 0x10], ax
push 0xc
call fcn.0043f080
add esp, 4
mov ecx, edi
mov ebp, eax
call fcn.00423cf0
mov bl, al
cmp bl, 1
jbe 0x493e5a
mov ecx, edi
call fcn.00405b90
mov ecx, edi
mov dword [ebp], eax
call fcn.00405b90
mov dword [ebp + 4], eax
add bl, 0xfe
movzx ecx, bl
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 8]
shl ecx, 2
add eax, ecx
mov ecx, edi
mov dword [ebx + 8], eax
call fcn.00423cf0
movzx edx, al
movzx eax, word [esp + 0x10]
push ebp
mov dword [ebp + 8], edx
mov ecx, dword [esi + 0x24]
push eax
call fcn.0043f4b0
mov al, byte [ebx + 0x24]
test al, al
jne 0x493ea4
mov eax, dword [esp + 0x14]
movzx ecx, word [esi + 0x36]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x493e06
xor ebx, ebx
mov edi, dword [esp + 0x18]
mov al, byte [edi + 0x24]
test al, al
jne 0x493eb9
mov al, byte [esp + 0x3c]
test al, al
je 0x493ef8
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x493ec6
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x70], ebx
mov word [esi + 0x36], bx
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax + 0xd0]
push 1
call fcn.004a7310
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
mov ecx, dword [esi + 0x68]
mov ecx, dword [ecx + 0xd0]
push 1
call fcn.004a7310
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4a6960
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
push ebx
mov bl, byte [eax]
test bl, bl
push esi
mov byte [esp + 0xb], 0
mov esi, eax
je 0x4a69bc
cmp bl, 0x3d
mov byte [esp + 0xc], bl
je 0x4a69bc
cmp bl, 0x3b
je 0x4a69bc
cmp bl, 0x2f
je 0x4a69bc
cmp bl, 0x23
je 0x4a69bc
cmp bl, 0x3f
je 0x4a69bc
cmp bl, 0x20
je 0x4a69bc
cmp bl, 0x3a
je 0x4a69c4
mov eax, dword [esp + 0xc]
push eax
call fcn.004a6790
add esp, 4
test al, al
jne 0x4a69b4
cmp bl, 0x2d
je 0x4a69b4
mov byte [esp + 0xb], 1
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x4a6972
pop esi
xor al, al
pop ebx
add esp, 8
ret
mov al, byte [esp + 0xb]
test al, al
pop esi
setne al
pop ebx
add esp, 8
ret

Function at 0x4a75e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x4a760e
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x4a75f1
pop esi
ret 4

Function at 0x4a7620
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx + 0xb90]
mov ecx, dword [ebx + 0xb94]
push edi
lea edi, [esi*4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.0043f080
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xb90], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
add esp, 4
cmp ecx, eax
mov dword [ebx + 0xb94], esi
mov dword [ebx + 0xb9c], eax
lea ebp, [esi - 1]
mov dword [esp + 0x1c], eax
jle 0x4a7729
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + eax*4]
and edi, 0xfffffff8
cmp edi, 1
jbe 0x4a7718
mov ecx, edi
xor esi, esi
call fcn.0043b0d0
mov cx, word [eax]
test cx, cx
je 0x4a76ce
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x4a76b0
mov edx, dword [ebx + 0xb90]
and esi, ebp
and esi, 0x7fffffff
cmp dword [edx + esi*4], 0
mov eax, 7
je 0x4a76fc
mov ecx, edx
lea esp, [esp]
add esi, eax
and esi, ebp
mov edx, dword [ecx + esi*4]
inc eax
test edx, edx
jne 0x4a76f0
mov ecx, edi
call fcn.0043b0d0
movzx eax, byte [eax]
mov ecx, dword [ebx + 0xb90]
and eax, 7
or eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x4a7690
mov edx, dword [esp + 0x14]
push edx
call fcn.0043f0a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4af9a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.0043b0d0
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.0043b0d0
mov cx, word [eax]
test cx, cx
je 0x4af9e2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x4af9c4
push esi
push ebp
mov ecx, edi
call fcn.004abf30
mov edx, dword [edi + 0xb90]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x4afa11
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.004abe90
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x4b1cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.0047b000
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x54]
test esi, esi
mov byte [esp + 0x13], 0
je 0x4b1ee2
mov ebx, dword [esi + 0x18]
test ebx, ebx
mov dword [esp + 0x18], ebx
je 0x4b1ee2
mov eax, dword [ebp + 0xb4]
mov ecx, dword [eax + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.0047ba50
mov eax, dword [ebx + 0x78]
add eax, 0xfffffffe
cmp eax, 0x5f
ja case.0x4b1d27.3
movzx edx, byte [eax + 0x4b1f24]
jmp dword [edx*4 + 0x4b1f10]
mov ecx, dword [edi + 0x690]
test ecx, ecx
jne 0x4b1d3c
xor esi, esi
jmp 0x4b1d43
call fcn.0047c080
mov esi, eax
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4b1d8f
test esi, esi
je 0x4b1d8f
mov ecx, dword [edi + 0xa48]
mov dl, byte [ecx + 0x215]
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x3c], dl
call fcn.004b13b0
mov ecx, dword [esp + 0x34]
mov eax, dword [eax]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.0049c330
test eax, eax
mov dword [esp + 0x18], 0
jne case.0x4b1d27.3
mov ecx, dword [ebp + 0xb4]
push 0
push str.MovieClip
push ecx
mov ecx, edi
call fcn.004b1770
jmp 0x4b1ee2
mov ebx, str.Button
jmp 0x4b1dbc
mov ebx, str.TextField
jmp 0x4b1dbc
mov ebx, str.Video
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.0040dc40
test al, al
je 0x4b1ee2
mov esi, dword [edi + 0x690]
test esi, esi
je 0x4b1ee2
mov ecx, esi
call fcn.0047c050
test eax, eax
jne 0x4b1df4
mov ecx, edi
call fcn.004b0f30
mov ecx, esi
call fcn.0047c050
test eax, eax
je 0x4b1ee2
push ebx
mov ecx, eax
call fcn.0049d160
mov esi, eax
test esi, esi
je 0x4b1ee2
mov ecx, esi
call fcn.00492250
test al, al
je 0x4b1ee2
mov ecx, esi
call fcn.0040bfc0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b1ee2
mov ecx, ebp
call fcn.0040c8a0
mov esi, eax
mov ecx, dword [esi + 4]
push 1
inc ecx
push 0
mov dword [esi + 4], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0xa90]
mov edx, dword [ebp + 0xb4]
push eax
push 1
push 0
push ecx
push ebp
push edx
mov ecx, edi
mov byte [esp + 0x33], 1
call fcn.004aa4a0
mov ecx, edi
call fcn.0040df60
cmp ebp, dword [esi]
je 0x4b1e84
xor ebp, ebp
mov ecx, dword [esi + 4]
dec ecx
mov eax, ecx
test eax, eax
mov dword [esi + 4], ecx
jg 0x4b1e9a
push esi
call fcn.0043f0a0
add esp, 4
mov eax, dword [ebx + 0x78]
cmp eax, 6
je 0x4b1ea7
cmp eax, 0x61
jne 0x4b1ee2
test ebp, ebp
je 0x4b1efc
mov eax, dword [ebp + 0x5c]
test eax, eax
je 0x4b1eb7
cmp dword [eax], 0
jne 0x4b1ee2
mov ecx, dword [ebp + 0xb4]
call fcn.0049e8c0
test al, 1
je 0x4b1ee2
mov ecx, dword [edi + 0x420]
push closesocket
push 0
push 0
push 0
push ebp
push 0
push 0
push edi
call fcn.004703d0
test ebp, ebp
je 0x4b1efc
mov al, byte [esp + 0x13]
test al, al
jne 0x4b1efc
mov ecx, ebp
call fcn.00498610
mov ecx, ebp
call fcn.0049eac0
lea ecx, [esp + 0x1c]
call fcn.0047b020
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4cf600
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x1c], 0xca
jne 0x4cf63b
push esi
call fcn.004d3f60
add esp, 4
test eax, eax
jl 0x4cf6b5
mov al, byte [esi + 0x48]
test al, al
je 0x4cf634
mov dword [esi + 0x1c], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x1c], 0xcb
mov eax, dword [esi + 0x1c]
cmp eax, 0xcb
jne 0x4cf6b7
mov eax, dword [esi + 0x198]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4cf6a4
mov eax, dword [esi + 8]
test eax, eax
je 0x4cf65f
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x198]
push esi
call dword [ecx]
add esp, 4
test eax, eax
jl 0x4cf6b5
je 0x4cf6a0
cmp eax, 2
je 0x4cf6a4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4cf652
cmp eax, 3
je 0x4cf687
cmp eax, 1
jne 0x4cf652
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4cf652
mov ecx, dword [esi + 0x124]
add dword [eax + 8], ecx
jmp 0x4cf652
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x84]
mov dword [esi + 0x8c], edx
call fcn.004cf4e0
pop esi
ret
cmp eax, 0xcc
je 0x4cf6b0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov edx, dword [esi + 0x1c]
mov dword [ecx + 0x18], edx
mov eax, 0xffffffec
pop esi
ret