joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e5aad0
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 0
mov qword [rbp - 8], 0
nop
add dword [0x100f49d40], 1
cmp qword [0x100f49d30], 0
jne 0x100e5ac42
call sub.kernel32.dll_GetVersion
cmp ax, 6
jb 0x100e5ac42
lea rcx, [rbp - 8]
call fcn.100c8d4f0
lea rdx, [rbp - 0x28]
mov rcx, rbp
call fcn.100e5ac70
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
lea rax, [0x100efe590]
mov qword [rbp - 0x18], rax
lea rax, str.Rstrtmgr.dll
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 8]
mov r9d, 0
movabs r8, 2
call fcn.100c8d9a0
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x100e5ab72
lea rcx, [0x100f45460]
call sub.kernel32.dll_LoadLibraryA
mov qword [0x100f49d30], rax
cmp qword [0x100f49d30], 0
je 0x100e5ac42
lea rdx, str.RmAddFilter
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49cc0], rax
lea rdx, str.RmStartSession
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49cd0], rax
lea rdx, str.RmRegisterResources
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49ce0], rax
lea rdx, str.RmGetList
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49cf0], rax
lea rdx, str.RmShutdown
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49d00], rax
lea rdx, str.RmRestart
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49d10], rax
lea rdx, str.RmEndSession
mov rcx, qword [0x100f49d30]
call sub.kernel32.dll_GetProcAddress
mov qword [0x100f49d20], rax
cmp qword [0x100f49d30], 0
setne bl
nop
mov rcx, rbp
call fcn.100e5aaa0
movzx eax, bl
mov rbx, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret
Function at 0x406404
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
push rsi
test rdx, rdx
mov r10d, r8d
mov r11, rdx
mov r9d, ecx
jne 0x40641c
xor eax, eax
jmp 0x40650d
cmp r10d, 8
not r9d
lea rsi, [0x006905c0]
jb 0x4064e3
mov rbx, r10
shr rbx, 3
mov cl, byte [r11]
add r10d, 0xfffffff8
add r11, 8
xor cl, r9b
shr r9d, 8
movzx eax, cl
mov cl, byte [r11 - 7]
mov edx, dword [rsi + rax*4]
xor edx, r9d
xor cl, dl
shr edx, 8
movzx eax, cl
mov cl, byte [r11 - 6]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
mov cl, byte [r11 - 5]
mov edx, dword [rsi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov cl, byte [r11 - 4]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
mov cl, byte [r11 - 3]
mov edx, dword [rsi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov cl, byte [r11 - 2]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
mov cl, byte [r11 - 1]
mov edx, dword [rsi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov r9d, dword [rsi + rax*4]
xor r9d, edx
dec rbx
jne 0x406437
test r10d, r10d
je 0x406507
mov cl, byte [r11]
mov eax, r9d
inc r11
xor cl, r9b
shr eax, 8
movzx edx, cl
mov r9d, dword [rsi + rdx*4]
xor r9d, eax
add r10d, 0xffffffff
jne 0x4064e8
not r9d
mov eax, r9d
pop rsi
pop rbx
ret
Function at 0x4142d8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov edi, 0x1600
mov ecx, edi
call fcn.004af6ac
mov ebx, 0x100
mov ecx, ebx
mov qword [0x008d11a0], rax
call fcn.004af6ac
xor ecx, ecx
cmp qword [0x008d11a0], rcx
mov qword [0x008d1198], rax
je 0x414386
cmp rax, rcx
je 0x414386
mov rdx, rcx
jmp 0x414321
mov rax, qword [0x008d1198]
xor byte [rdx + rax], 0x5a
mov rax, qword [0x008d1198]
add byte [rdx + rax], cl
inc ecx
inc rdx
cmp ecx, ebx
jb 0x41431a
mov rdx, qword [0x008d11a0]
lea rcx, [0x00741900]
mov rax, rcx
xor byte [rax], 0x5a
inc rax
dec rdi
jne 0x414349
lea rax, [0x00741a00]
mov r8d, 0xb00
add byte [rax], bl
inc ebx
inc rax
cmp ebx, r8d
jl 0x414361
mov al, byte [rcx]
inc rcx
mov byte [rdx], al
mov al, byte [rcx + 0xaff]
add rdx, 2
dec r8
mov byte [rdx - 1], al
jne 0x41436d
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x43ea94
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
test r8, r8
not ecx
mov rdi, r8
mov rsi, rdx
lea r12, [0x007c0630]
mov ebx, ecx
je 0x43ead5
test sil, 7
je 0x43ead5
mov al, byte [rsi]
inc rsi
xor al, bl
shr rbx, 8
movzx ecx, al
mov eax, dword [r12 + rcx*4]
xor rbx, rax
dec rdi
jne 0x43eab5
cmp rdi, 8
jb 0x43ebaf
mov rbp, rdi
shr rbp, 3
mov rax, rbp
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
lea rcx, [rsp + 0x58]
mov r8d, 8
mov rdx, rsi
call fcn.00553680
xor rbx, qword [rsp + 0x58]
add rsi, 8
mov rax, rbx
shr rax, 0x30
movzx ecx, al
mov rax, rbx
mov edx, dword [r12 + rcx*4 + 0x400]
shr rax, 0x28
movzx ecx, al
mov eax, dword [r12 + rcx*4 + 0x800]
xor rdx, rax
mov rax, rbx
shr rax, 0x20
movzx ecx, al
mov eax, dword [r12 + rcx*4 + 0xc00]
xor rdx, rax
mov rax, rbx
shr rax, 0x18
movzx ecx, al
mov eax, dword [r12 + rcx*4 + 0x1000]
xor rdx, rax
mov rax, rbx
shr rax, 0x10
movzx ecx, al
mov eax, dword [r12 + rcx*4 + 0x1400]
xor rdx, rax
mov rax, rbx
shr rax, 8
movzx ecx, al
mov eax, dword [r12 + rcx*4 + 0x1800]
xor rdx, rax
mov rax, rbx
shr rax, 0x38
mov eax, dword [r12 + rax*4]
xor rdx, rax
movzx eax, bl
mov eax, dword [r12 + rax*4 + 0x1c00]
mov rbx, rdx
xor rbx, rax
dec rbp
jne 0x43eaf0
test rdi, rdi
je 0x43ebce
mov al, byte [rsi]
inc rsi
xor al, bl
shr rbx, 8
movzx ecx, al
mov edx, dword [r12 + rcx*4]
xor rbx, rdx
dec rdi
jne 0x43ebb4
not ebx
mov eax, ebx
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x440bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x28
mov eax, dword [r8 + 0x10]
mov r12d, dword [r8 + 8]
mov rbp, rcx
test al, 2
mov ecx, dword [r8 + 0xc]
mov rsi, r8
mov rbx, rdx
mov dword [rdx], eax
je 0x440c14
bt eax, 0x12
jb 0x440c14
bt eax, 0x13
jb 0x440c14
bt eax, 0x11
jb 0x440c14
bt eax, 0x15
jae 0x440e05
cmp ecx, 0xe00
jne 0x440c23
mov edi, 1
jmp 0x440c5e
mov eax, 0x10900
cmp ecx, eax
jb 0x440e05
mov edi, 1
jne 0x440c3a
mov dword [rbp + 0x5c], edi
cmp ecx, 0x10a00
ja 0x440c45
mov dword [rbp + 0x54], edi
cmp ecx, 0x10b00
jne 0x440c56
cmp r12d, 0x60
jne 0x440c61
mov dword [rbp + 0x54], edi
cmp ecx, 0x10d00
jb 0x440c61
mov dword [rbp + 0x58], edi
mov ecx, dword [r8 + 0x14]
xor r13d, r13d
cmp ecx, r13d
jne 0x440c83
mov dword [0x0074811c], 0x8000
mov dword [0x00748118], 0xf
jmp 0x440c94
mov dword [0x0074811c], ecx
call fcn.0043eefc
mov dword [0x00748118], eax
cmp dword [rbp + 0x54], r13d
je 0x440cc3
cmp r12d, 0x60
jne 0x440e05
lea rcx, [rbx + 0xc]
lea r8d, [r12 - 0x50]
xor edx, edx
call fcn.00553530
lea r11d, [r12 - 0x48]
mov word [rbx + 4], di
mov word [rbx + 6], di
jmp 0x440d2a
cmp r12d, 0x74
jb 0x440e05
lea rdx, [rsi + 0x18]
lea rcx, [rbx + 0xc]
mov r8d, 0x10
call fcn.00553680
movzx eax, word [rsi + 0x28]
mov r11d, 0x2c
mov word [rbx + 4], ax
cmp word [rbx + 4], r13w
movzx eax, word [rsi + 0x2a]
mov word [rbx + 6], ax
je 0x440e05
cmp word [rbx + 4], ax
ja 0x440e05
cmp dword [rbp + 0x58], r13d
je 0x440d2a
cmp r12d, 0xd0
jne 0x440e05
mov eax, dword [rsi + 0x2c]
mov r11d, 0x30
mov dword [rbx + 8], eax
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x28], r13
mov qword [rbx + 0x30], r13
mov byte [rbx + 0x38], r13b
mov dword [rbx + 0x3c], r13d
movsxd rdx, r11d
mov ecx, 0xffffffff
movabs r8, 0xffffffffffffff
mov dword [rbx + 0x40], ecx
mov al, byte [rdx + rsi + 7]
mov byte [rbx + 0x38], al
mov rax, qword [rdx + rsi]
and rax, r8
mov qword [rbx + 0x20], rax
mov rax, qword [rdx + rsi + 8]
mov qword [rbx + 0x28], rax
mov rax, qword [rdx + rsi + 0x10]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x48], r13
mov qword [rbx + 0x50], r13
mov qword [rbx + 0x58], r13
mov byte [rbx + 0x60], r13b
mov dword [rbx + 0x68], ecx
mov dword [rbx + 0x64], r13d
mov al, byte [rdx + rsi + 0x1f]
mov byte [rbx + 0x60], al
mov rax, qword [rdx + rsi + 0x18]
and rax, r8
mov qword [rbx + 0x48], rax
mov rax, qword [rdx + rsi + 0x20]
mov qword [rbx + 0x50], rax
mov rax, qword [rdx + rsi + 0x28]
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x70], r13
mov qword [rbx + 0x78], r13
mov qword [rbx + 0x80], r13
mov byte [rbx + 0x88], r13b
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x8c], r13d
mov cl, byte [rdx + rsi + 0x37]
mov eax, edi
mov byte [rbx + 0x88], cl
mov rcx, qword [rdx + rsi + 0x30]
and rcx, r8
mov qword [rbx + 0x70], rcx
mov rcx, qword [rdx + rsi + 0x38]
mov qword [rbx + 0x78], rcx
mov rcx, qword [rdx + rsi + 0x40]
mov qword [rbx + 0x80], rcx
jmp 0x440e07
xor eax, eax
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x44553c
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rcx + 0x10], 0
mov dword [rcx + 0x80], edx
add rcx, 0x18
jmp 0x445dc4
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
mov dword [rcx + 0x20], 0
ret
Function at 0x445ef8
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov esi, dword [rcx + 0x20]
mov rbp, qword [rcx + 0x18]
mov rbx, rcx
shl rbp, 6
mov r8d, esi
mov ecx, 3
add rbp, rsi
shr esi, 2
mov rdi, rdx
shl rbp, 3
and r8d, ecx
jne 0x445f2e
mov dword [rbx + rsi*4 + 0x24], r8d
sub ecx, r8d
mov eax, pe_nt_image_headers64
shl ecx, 3
shl eax, cl
or dword [rbx + rsi*4 + 0x24], eax
jmp 0x445f56
and esi, 0xf
jne 0x445f4e
mov rcx, rbx
call fcn.00445df8
mov dword [rbx + rsi*4 + 0x24], 0
inc esi
cmp esi, 0xe
jne 0x445f41
lea eax, [rsi + 1]
mov rcx, rbp
shr rcx, 0x20
mov dword [rbx + rsi*4 + 0x24], ecx
mov rcx, rbx
mov dword [rbx + rax*4 + 0x24], ebp
call fcn.00445df8
xor r11d, r11d
mov ecx, dword [rbx + r11*4]
inc r11
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
add rdi, 4
shr eax, 0x10
mov byte [rdi - 3], al
mov eax, ecx
shr eax, 8
cmp r11, 5
mov byte [rdi - 2], al
mov byte [rdi - 1], cl
jl 0x445f7a
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov qword [rbx + 0x18], 0
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x44f578
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov edi, ecx
lea rcx, [0x008c09c0]
xor edx, edx
mov r8d, 0x10000
call fcn.00553530
xor ebx, ebx
cmp dword [0x007c36ec], ebx
mov dword [0x008d09c4], ebx
mov dword [0x008d09c0], ebx
mov dword [0x007c36d4], ebx
jne 0x44f5b9
mov dword [0x007c36e0], edi
jmp 0x44f615
mov eax, dword [0x007c36e8]
movsxd rdx, dword [0x007c36d0]
mov rcx, qword [0x008b09b0]
mov edi, 0x10000
cmp eax, edi
cmovl edi, eax
add rdx, qword [0x007c36d8]
movsxd r8, edi
call fcn.00553680
add dword [0x007c36d0], edi
sub dword [0x007c36e8], edi
mov dword [0x007c36e0], edi
jmp 0x44f60d
cmp dword [0x007c36d4], ebx
jne 0x44f615
call fcn.0044f444
mov edi, dword [0x007c36e0]
cmp edi, 0x106
jb 0x44f5fa
cmp edi, ebx
je 0x44f641
mov rcx, qword [0x008b09b0]
mov edx, 2
movzx eax, byte [rcx]
shl ebx, 5
inc rcx
xor ebx, eax
and ebx, 0x7fff
dec rdx
jne 0x44f625
mov dword [0x007c36e4], ebx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x452314
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
mov r11d, 0xffffffff
mov r10d, edx
mov r9d, r11d
je 0x45234a
mov r8b, byte [rcx]
mov edx, r9d
inc rcx
xor r8b, r9b
shr edx, 8
movzx eax, r8b
lea r8, [0x006905c0]
mov r9d, dword [r8 + rax*4]
xor r9d, edx
add r10d, r11d
jne 0x452324
not r9d
mov eax, r9d
ret

Function at 0x45236c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r10d, dword [r9]
xor r15d, r15d
mov esi, r8d
and r10d, 7
cmp rdx, 5
mov r12, rcx
mov r11, r15
jae 0x45239d
xor eax, eax
jmp 0x452510
add esi, 5
mov rbx, 0xffffffffffffffff
lea rbp, [rcx + rdx - 4]
lea r13, [0x00400000]
lea r8, [r11 + r12]
jmp 0x4523c5
mov al, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x4523ca
inc r8
cmp r8, rbp
jb 0x4523b9
mov r11, r8
sub r11, r12
cmp r8, rbp
mov rax, r11
jae 0x4524ef
sub rax, rbx
cmp rax, 3
jbe 0x452408
mov r10d, r15d
mov al, byte [r8 + 4]
mov rbx, r11
cmp al, r15b
je 0x45243e
cmp al, 0xff
je 0x45243e
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x4523b3
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x4523e8
movzx eax, byte [r10 + r13 + 0x2909c8]
mov rcx, r8
sub rcx, rax
cmp byte [r10 + r13 + 0x2909c0], r15b
mov al, byte [rcx + 4]
je 0x452439
cmp al, r15b
je 0x452439
cmp al, 0xff
jne 0x4523e8
mov rbx, r11
jmp 0x4523f8
movzx r9d, al
movzx eax, byte [r8 + 3]
movsxd r14, r10d
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 2]
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 1]
shl r9d, 8
or r9d, eax
cmp dword [rsp + 0x68], r15d
je 0x452478
lea edx, [r11 + r9]
add edx, esi
jmp 0x452480
mov edx, r9d
sub edx, r11d
sub edx, esi
cmp r10d, r15d
je 0x4524c1
movzx edi, byte [r14 + r13 + 0x2909c8]
mov ecx, 0x18
mov r9d, edx
shl edi, 3
sub ecx, edi
shr r9d, cl
cmp r9b, r15b
je 0x4524a9
cmp r9b, 0xff
jne 0x4524c1
mov ecx, 0x20
mov r9d, 1
sub ecx, edi
shl r9d, cl
dec r9d
xor r9d, edx
jmp 0x452469
mov eax, edx
mov byte [r8 + 1], dl
shr eax, 0x18
and al, 1
dec al
not al
mov byte [r8 + 4], al
mov eax, edx
shr eax, 0x10
mov byte [r8 + 3], al
mov eax, edx
shr eax, 8
add r11, 5
mov byte [r8 + 2], al
jmp 0x4523b3
mov r13, qword [rsp + 0x60]
mov rdx, r11
sub rdx, rbx
lea ecx, [rdx - 1]
shl r10d, cl
and r10d, 7
cmp rdx, 3
cmova r10d, r15d
mov dword [r13], r10d
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4525ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov dword [rcx + 0x3c], 0x20
mov dword [rcx + 0x68], 1
mov dword [rcx + 0x60], 4
lea r8, [rcx + 0x84]
mov qword [rcx + 0x40], rdx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x64], edx
mov dword [rcx + 0x6c], edx
mov r9d, edx
mov r10d, 8
mov ecx, r9d
mov eax, r9d
and ecx, 1
shr eax, 1
dec ecx
not ecx
and ecx, 0xedb88320
mov r9d, ecx
xor r9d, eax
dec r10
jne 0x452621
inc edx
mov dword [r8], r9d
add r8, 4
cmp edx, 0x100
jb 0x452618
ret
Function at 0x4558ec
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
mov rdi, r9
mov r11d, edx
mov r9d, r8d
xor r8d, r8d
mov rsi, rcx
mov ebx, 0x100
bts r11d, 8
add r9d, r9d
mov r10d, r11d
mov ecx, r11d
shr ecx, 7
shr r10d, 8
mov eax, ebx
and ecx, 1
and eax, r9d
add r11d, r11d
neg rcx
add eax, ebx
sar rcx, 4
add r10d, eax
movzx edx, word [rsi + r10*2]
and ecx, 0x7f
shr rdx, 4
xor rdx, rcx
mov ecx, r11d
add r8d, dword [rdi + rdx*4]
xor ecx, r9d
not ecx
and ebx, ecx
cmp r11d, 0x10000
jb 0x455909
mov eax, r8d
pop rdi
pop rsi
pop rbx
ret

Function at 0x455a4c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
xor r10d, r10d
mov ebx, r8d
mov rdi, r9
cmp edx, r10d
mov r11d, edx
mov rsi, rcx
lea r8d, [r10 + 1]
je 0x455a9b
mov eax, r8d
mov r9d, ebx
add r8d, r8d
movzx edx, word [rsi + rax*2]
and r9d, 1
shr ebx, 1
shr rdx, 4
mov ecx, r9d
or r8d, r9d
neg rcx
sar rcx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [rdi + rdx*4]
dec r11d
jne 0x455a68
mov eax, r10d
pop rdi
pop rsi
pop rbx
ret
Function at 0x4579e4
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
mov r10, rcx
xor r8d, r8d
lea r9, [rcx + 0x33b84]
xor r11d, r11d
mov edi, r8d
lea ebx, [r11 + 1]
lea esi, [rbx + 3]
mov eax, ebx
mov edx, edi
add ebx, ebx
movzx ecx, word [r10 + rax*2 + 0x3422c]
and edx, 1
shr edi, 1
shr rcx, 4
mov eax, edx
or ebx, edx
neg rax
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r11d, dword [r10 + rcx*4 + 0x324d4]
dec esi
jne 0x457a02
inc r8d
mov dword [r9], r11d
add r9, 4
cmp r8d, 0x10
jb 0x4579f5
mov dword [r10 + 0x33bc4], esi
pop rdi
pop rsi
pop rbx
ret
Function at 0x4698a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov r9, qword [0x00890928]
mov eax, ecx
mov r10d, ecx
xor al, byte [r9 + 0xccec]
mov edx, dword [r9 + 0xccec]
movzx r8d, al
mov rax, qword [r9 + 0xca98]
shr edx, 8
mov eax, dword [rax + r8*4]
xor eax, edx
mov dword [r9 + 0xccec], eax
mov rdx, qword [0x00890928]
movzx eax, byte [rdx + 0xccec]
add dword [rdx + 0xccf0], eax
mov rcx, qword [0x00890928]
mov eax, dword [rcx + 0xccf0]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 0xccf0], eax
mov r8, qword [0x00890928]
mov al, byte [r8 + 0xccf3]
mov ecx, dword [r8 + 0xccf4]
xor al, byte [r8 + 0xccf4]
shr ecx, 8
movzx edx, al
mov rax, qword [r8 + 0xca98]
mov eax, dword [rax + rdx*4]
xor eax, ecx
mov dword [r8 + 0xccf4], eax
mov eax, r10d
ret

Function at 0x4699a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x007a1a88]
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, rdx
call fcn.00469948
lea rcx, [rsp + 0x20]
mov r8d, 0xc
mov rdx, rbx
call fcn.00553680
xor r11d, r11d
mov rax, qword [0x00890928]
mov ecx, dword [rax + 0xccf4]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [rsp + r11 + 0x20], al
movzx ecx, byte [rsp + r11 + 0x20]
call fcn.004698a8
inc r11
cmp r11, 0xc
jl 0x4699d3
mov rcx, qword [0x00890928]
movzx r8d, byte [rsp + 0x2b]
mov rax, qword [rcx + 0xa90]
test byte [rax + 0x18], 2
je 0x469a30
movzx edx, byte [rcx + 0xcb09]
jmp 0x469a37
movzx edx, byte [rcx + 0xcb0f]
cmp r8d, edx
je 0x469a43
mov eax, 0xffffffff
jmp 0x469a96
mov r11d, dword [rcx + 0xcab8]
mov rbx, qword [rcx + 0xcab0]
cmp r11d, dword [rcx + 0x74]
cmovg r11d, dword [rcx + 0x74]
test r11d, r11d
je 0x469a94
jmp 0x469a68
mov rcx, qword [0x00890928]
mov ecx, dword [rcx + 0xccf4]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.004698a8
inc rbx
dec r11d
jne 0x469a61
xor eax, eax
mov rcx, qword [rsp + 0x30]
call fcn.00577820
add rsp, 0x40
pop rbx
ret
Function at 0x46a6e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rcx, qword [0x00890928]
cmp dword [rcx + 0x74], 0
jg 0x46a70a
dec dword [rcx + 0x74]
mov rcx, qword [0x00890928]
mov dword [rcx + 0xcab8], 0
jmp 0x46a75d
cmp dword [rcx + 0xcab8], 0
jg 0x46a7a7
mov rdx, qword [rcx + 0xcaa8]
mov rcx, qword [rcx + 0xcad8]
mov ebx, 0x2000
mov r9d, ebx
mov r8, 0xffffffffffffffff
call fcn.004afb50
mov rcx, qword [0x00890928]
mov dword [rcx + 0xcab8], eax
mov rax, qword [0x00890928]
mov ecx, dword [rax + 0xcab8]
test ecx, ecx
jne 0x46a767
mov dword [rax + 0xcab8], ecx
mov eax, 0xffffffff
jmp 0x46a805
jns 0x46a780
lea rcx, str.read_file_failed.
call fcn.00556ec0
mov ecx, 3
call fcn.00552b30
int3
add dword [rax + 0xcae4], ebx
mov rcx, qword [0x00890928]
mov rax, qword [rcx + 0xcaa8]
mov qword [rcx + 0xcab0], rax
call fcn.0046a568
mov rcx, qword [0x00890928]
mov rax, qword [rcx + 0xa90]
test byte [rax + 0x18], 1
je 0x46a7e2
mov edi, dword [rcx + 0xcab8]
mov rbx, qword [rcx + 0xcab0]
test edi, edi
je 0x46a7e2
call fcn.00469880
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.004698a8
inc rbx
dec edi
jne 0x46a7c5
mov rcx, qword [0x00890928]
dec dword [rcx + 0xcab8]
mov rdx, qword [0x00890928]
mov rax, qword [rdx + 0xcab0]
movzx ecx, byte [rax]
inc rax
mov qword [rdx + 0xcab0], rax
mov eax, ecx
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x46ad8c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rcx, qword [0x00890928]
mov ebx, 0x2000
mov r8, 0xffffffffffffffff
mov rdx, qword [rcx + 0xcaa8]
mov rcx, qword [rcx + 0xcad8]
mov r9d, ebx
call fcn.004afb50
mov rcx, qword [0x00890928]
mov dword [rcx + 0xcab8], eax
mov rax, qword [0x00890928]
cmp dword [rax + 0xcab8], 0
jg 0x46addd
xor eax, eax
jmp 0x46ae45
add dword [rax + 0xcae4], ebx
mov rcx, qword [0x00890928]
mov rax, qword [rcx + 0xcaa8]
mov qword [rcx + 0xcab0], rax
call fcn.0046a568
mov rdx, qword [0x00890928]
mov rax, qword [rdx + 0xa90]
test byte [rax + 0x18], 1
je 0x46ae3f
mov edi, dword [rdx + 0xcab8]
mov rbx, qword [rdx + 0xcab0]
test edi, edi
je 0x46ae3f
call fcn.00469880
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.004698a8
inc rbx
dec edi
jne 0x46ae22
mov rdx, qword [0x00890928]
mov eax, dword [rdx + 0xcab8]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x46f2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xa0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r13d, r9d
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x60]
mov rax, qword [rcx + 8]
mov rdx, qword [0x007caab0]
cmp rax, rdx
je 0x46f332
cmp qword [rax + 0x18], rbp
jae 0x46f327
mov rax, qword [rax + 0x10]
jmp 0x46f32d
mov rcx, rax
mov rax, qword [rax]
cmp rax, rdx
jne 0x46f31b
mov qword [rsp + 0xe0], rcx
mov rax, qword [rdi + 0x60]
cmp rcx, rax
je 0x46f353
cmp rbp, qword [rcx + 0x18]
jb 0x46f353
lea rax, [rsp + 0xe0]
jmp 0x46f35d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rax, qword [rax]
cmp rax, qword [rdi + 0x60]
je 0x46f373
mov rsi, qword [rax + 0x20]
test rsi, rsi
jne 0x46f535
mov qword [rsp + 0x58], rbp
mov r9, qword [rdi + 0x50]
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x68], 0
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
cmp qword [rdi + 0x18], 0
je 0x46f3e4
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov r8, rbp
lea rdx, [rsp + 0x58]
call qword [rax + 8]
test al, al
jne 0x46f3e4
xor ecx, ecx
call fcn.0057d6bc
xor eax, eax
jmp 0x46f538
mov byte [rsp + 0xe0], 0
mov rax, qword [rdi]
mov edx, dword [rax + 0x3c]
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x78]
call fcn.0046ee48
mov rcx, qword [rdi + 8]
mov rsi, qword [rsp + 0x88]
test rcx, rcx
je 0x46f487
mov eax, dword [rsp + 0x68]
and al, 4
neg al
sbb rdx, rdx
mov r8, qword [rsp + 0x70]
and rdx, r8
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov rbx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.00471eac
test al, al
jne 0x46f456
mov rcx, rbx
call fcn.0057d6bc
xor eax, eax
jmp 0x46f538
test byte [rsp + 0x68], 8
jne 0x46f4b2
test rbx, rbx
jne 0x46f466
xor edx, edx
jmp 0x46f46c
mov rdx, rsi
sub rdx, rbx
mov rcx, rbx
call fcn.0046fbe8
test al, al
jne 0x46f4b2
mov rcx, rbx
call fcn.0057d6bc
xor eax, eax
jmp 0x46f538
mov r8, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
mov rdx, rbx
mov rcx, qword [rdi]
call fcn.0046fd8c
test al, al
jne 0x46f4b2
mov rcx, rbx
call fcn.0057d6bc
xor eax, eax
jmp 0x46f538
test rbx, rbx
jne 0x46f4bb
xor esi, esi
jmp 0x46f4be
sub rsi, rbx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x70]
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0046f180
mov rsi, rax
cmp qword [rdi + 0x70], 0x800
jbe 0x46f503
mov r8, qword [rdi + 0x60]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0xe0]
lea rcx, [rdi + 0x58]
call fcn.0046ec54
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
lea rcx, [rdi + 0x58]
call fcn.0046ed48
mov r11, qword [rsp + 0x48]
mov qword [r11 + 0x20], rsi
mov rcx, rbx
call fcn.0057d6bc
mov rax, rsi
add rsp, 0xa0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret