joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55dd11
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi]
push 4
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QHashData::allocateNode_int_]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 1
test esi, esi
je 0x45c1b2
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esi + 0xc], edx
mov eax, esi
jmp 0x45c1b4
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [edi]
inc dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0x10

Function at 0x45fa00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55e34b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, 1
lock xadd dword [eax], ecx
push 0xffffffffffffffff
push 0
push 0x28
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 1
call dword [sym.imp.QtCore4.dll_public:_int___thiscall_QByteArray::indexOf_char__int_const]
inc eax
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
call dword [sym.imp.QtCore4.dll_public:_class_QByteArray___thiscall_QByteArray::mid_int__int_]
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 8]
dec eax
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QByteArray::truncate_int_]
mov esi, dword [esp + 0x24]
push 0x2c
push esi
lea ecx, [esp + 0x30]
call dword [sym.imp.QtCore4.dll_public:_class_QList_class_QByteArray____thiscall_QByteArray::split_char_]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], 1
mov byte [esp + 0x1c], 1
or edx, 0xffffffff
lock xadd dword [ecx], edx
mov edi, dword [sym.imp.QtCore4.dll_void___cdecl_qFree_void__]
jne 0x45fabc
mov eax, dword [esp + 0x28]
push eax
call edi
add esp, 4
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x1c], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x45fad8
mov eax, dword [esp + 0xc]
push eax
call edi
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 8
Function at 0x4637a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55eb4d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [sym.imp.QtCore4.dll_struct_QMapData_QMapData::shared_null]
mov dword [esi], eax
add eax, 0x34
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [sym.imp.QtCore4.dll_struct_QMapData_QMapData::shared_null]
xor edi, edi
mov eax, edx
mov dword [esp + 0x18], edi
mov dword [esi + 4], edx
add eax, 0x34
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [sym.imp.QtCore4.dll_struct_QMapData_QMapData::shared_null]
mov eax, edx
mov dword [esi + 8], edx
add eax, 0x34
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [sym.imp.QtCore4.dll_struct_QMapData_QMapData::shared_null]
mov eax, edx
mov dword [esi + 0xc], edx
add eax, 0x34
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [sym.imp.QtCore4.dll_struct_QMapData_QMapData::shared_null]
mov eax, edx
mov dword [esi + 0x10], edx
add eax, 0x34
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov ecx, dword [sym.imp.QtCore4.dll_struct_QByteArray::Data_QByteArray::shared_null]
mov dword [esi + 0x2c], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
push 0xffffffffffffffff
push str.HKEY_LOCAL_MACHINESoftwareClasses
mov byte [esp + 0x20], 5
call dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromLatin1_helper_char_const___int_]
add esp, 8
mov dword [esp + 0x20], eax
push edi
push edi
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 6
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QSettings::constructor_class_QString_const___enum_QSettings::Format__class_QObject__]
mov edx, dword [esp + 0x20]
mov byte [esp + 0x18], 8
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4638ba
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
mov edx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [esi + 0x38], edx
mov eax, edx
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [sym.imp.QtCore4.dll_struct_QByteArray::Data_QByteArray::shared_null]
mov dword [esi + 0x3c], edx
mov eax, edx
mov ecx, 1
lock xadd dword [eax], ecx
xor edx, edx
xor eax, eax
mov dword [esi + 0x40], edi
mov word [esi + 0x44], dx
mov word [esi + 0x46], ax
mov dword [esi + 0x48], edi
mov ecx, esi
mov byte [esp + 0x18], 0xa
mov dword [esi + 0x4c], edi
call fcn.0045fed0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x46fe50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55fdb3
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x48]
mov dword [esp + 0x20], 0
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x48], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
lea ecx, [esp + 0x10]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [esp + 0x30]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
lea ecx, [esp + 0x28]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x2c]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push esi
call edx
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
add esp, 0xc
mov ecx, eax
cmp dword [esp + 0x1c], 0
mov esi, 1
setne dl
movzx eax, dl
movsx edx, word [esp + 0xc]
push eax
mov eax, 0x151d07eb
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x35c5ebbb
mul dword [esp + 0x38]
shr edx, 0xb
push edx
push ecx
mov ecx, edi
mov dword [esp + 0x50], esi
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QFont::constructor_class_QString_const___int__int__bool_]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], esi
mov byte [esp + 0x40], 0
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x46ff70
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__]
add esp, 4
cmp dword [esp + 0x24], 0
setne al
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x19
add ecx, 0x32
push ecx
mov ecx, edi
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QFont::setWeight_int_]
cmp dword [esp + 0x28], 0
mov ecx, edi
setne dl
movzx eax, dl
push eax
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QFont::setStrikeOut_bool_]
cmp dword [esp + 0x2c], 0
setne cl
movzx edx, cl
push edx
mov ecx, edi
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QFont::setUnderline_bool_]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
Function at 0x470650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55fe09
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov ecx, esi
mov dword [esp + 0xc], 0
call dword [sym.imp.QtCore4.dll_public:_int___thiscall_QVariant::userType_void_const]
cmp eax, 0x41
jne 0x4706b7
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void_const____thiscall_QVariant::constData_void_const]
mov esi, dword [esp + 0x2c]
push eax
mov ecx, esi
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPixmap::constructor_class_QPixmap_const__]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
mov edi, dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPixmap::constructor_void_]
lea ecx, [esp + 0x10]
call edi
mov eax, dword [sym.imp.QtCore4.dll_struct_QVariant::Handler_const__const_QVariant::handler]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x18]
push 0
lea edx, [esp + 0x14]
push edx
push 0x41
push esi
mov dword [esp + 0x34], 0
call eax
add esp, 0x10
lea ecx, [esp + 0x10]
test al, al
je 0x47071f
mov esi, dword [esp + 0x2c]
push ecx
mov ecx, esi
call dword [sym.imp.QtGui4.dll_public:_void___thiscall_QPixmap::constructor_class_QPixmap_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QPixmap::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.QtGui4.dll_public_virtual:_void___thiscall_QPixmap::destructor_void_]
mov esi, dword [esp + 0x2c]
mov ecx, esi
call edi
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x47c120
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x47c14c
push edi
mov edi, edi
movsx edx, dl
mov edi, eax
shl edi, 4
and edx, 0xff
add edi, eax
add edx, edi
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x47c130
pop edi
mov ecx, dword [ecx + 0xc]
lea ecx, [ecx + ecx - 1]
xor edx, edx
div ecx
pop esi
mov eax, edx
ret 4

Function at 0x47c1b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
add eax, eax
push 0x20
push eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
push eax
call fcn.00497350
mov ecx, dword [esi + 0xc]
push 4
lea edx, [ecx + ecx - 1]
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
push edx
push eax
call fcn.00497350
mov ecx, dword [esi + 0xc]
add ecx, ecx
lea edx, [ecx*4 - 4]
push edx
xor edi, edi
push edi
push eax
mov dword [esi + 8], eax
call sub.MSVCR90.dll_memset
add esp, 0x24
cmp dword [esi + 0x10], edi
mov dword [esp + 8], edi
jle 0x47c264
push ebx
push ebp
mov ecx, dword [esi + 4]
mov edx, dword [edi + ecx]
lea ebx, [edi + ecx]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x47c232
movsx ecx, cl
mov ebp, eax
shl ebp, 4
and ecx, 0xff
add ebp, eax
add ecx, ebp
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x47c217
mov edx, dword [esi + 0xc]
lea ecx, [edx + edx - 1]
xor edx, edx
div ecx
mov eax, dword [esi + 8]
mov ecx, dword [eax + edx*4]
mov dword [ebx + 0x18], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
add eax, edi
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x10]
inc eax
add edi, 0x20
cmp eax, dword [esi + 0x10]
mov dword [esp + 0x10], eax
jl 0x47c206
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x480dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x560ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x40]
mov eax, 0xd
mov dword [esi], vtable.LinkLaunch.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
cmp dword [edi], 7
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
jne 0x480ef6
mov ecx, dword [edi + 8]
push 0
lea eax, [esp + 0x14]
push eax
push 0x57d404
call fcn.0047c300
cmp dword [eax], 5
lea ecx, [esp + 0x10]
je 0x480e5f
push ecx
call fcn.00480470
add esp, 4
mov dword [esi + 4], eax
jmp 0x480eed
call fcn.0047c660
mov ecx, dword [edi + 8]
push 0
lea edx, [esp + 0x14]
push edx
push 0x5c2fc0
call fcn.0047c300
cmp dword [eax], 7
jne 0x480edc
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x24]
push eax
push 0x57d404
call fcn.0047c300
lea ecx, [esp + 0x20]
push ecx
call fcn.00480470
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esi + 4], eax
call fcn.0047c660
mov ecx, dword [esp + 0x18]
push 0
lea edx, [esp + 0x24]
push edx
push 0x5c01c4
call fcn.0047c300
cmp dword [eax], 3
jne 0x480ed1
mov ecx, dword [esp + 0x28]
call fcn.0041b9d0
mov dword [esi + 8], eax
lea ecx, [esp + 0x20]
call fcn.0047c660
jmp 0x480eed
push str.Bad_launch_type_link_action
push 0xffffffffffffffff
push 0
call fcn.00489570
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.0047c660
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x489710
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x5612c6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push str.HOME
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
push 8
mov esi, eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
test esi, esi
je 0x489779
mov dword [esp + 0x14], 0
test eax, eax
je 0x4897a2
push esi
mov ecx, eax
call fcn.0047ab60
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov dword [esp + 0x14], 1
test eax, eax
je 0x4897a2
push 0x579368
mov ecx, eax
call fcn.0047ab60
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x497250
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x5c4828
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x499ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x5617db
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push 0x20
setne al
mov dword [esp + 0x44], eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x80], ebx
cmp eax, ebx
je 0x499d00
mov ecx, eax
call fcn.004ea7a0
mov dword [esp + 0x38], eax
jmp 0x499d04
mov dword [esp + 0x38], ebx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], ebx
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x3c], ebx
jle 0x499df5
mov ecx, dword [eax + 0x18]
mov edi, dword [ecx + ebx*4]
mov edx, dword [esp + 0x40]
cmp dword [edi + 0xc], edx
jle 0x499de4
mov eax, dword [edi + 4]
fld qword [eax]
mov ecx, dword [edi]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ecx]
mov ecx, dword [esp + 0x48]
fstp qword [esp]
call fcn.004ea8c0
mov esi, 1
cmp dword [edi + 0xc], esi
jle 0x499dd3
lea ebx, [esi + 0x17]
jmp 0x499d60
mov edx, dword [edi + 8]
cmp dword [edx + esi*4], 0
mov eax, dword [edi + 4]
mov ecx, dword [edi]
je 0x499dad
fld qword [ebx + eax]
sub esp, 0x30
fstp qword [esp + 0x28]
fld qword [ebx + ecx]
fstp qword [esp + 0x20]
fld qword [eax + esi*8 + 8]
fstp qword [esp + 0x18]
fld qword [ecx + esi*8 + 8]
fstp qword [esp + 0x10]
fld qword [eax + esi*8]
fstp qword [esp + 8]
fld qword [ecx + esi*8]
mov ecx, dword [esp + 0x68]
fstp qword [esp]
call fcn.004ea980
add esi, 3
add ebx, 0x18
jmp 0x499dca
fld qword [eax + esi*8]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ecx + esi*8]
mov ecx, dword [esp + 0x48]
fstp qword [esp]
call fcn.004ea920
inc esi
add ebx, 8
cmp esi, dword [edi + 0xc]
jl 0x499d60
mov ebx, dword [esp + 0x3c]
cmp dword [edi + 0x14], 0
je 0x499de4
mov ecx, dword [esp + 0x38]
push 0
call fcn.004eaa40
mov eax, dword [ebp + 0xc]
inc ebx
cmp ebx, dword [eax + 0x1c]
mov dword [esp + 0x3c], ebx
jl 0x499d1f
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a1000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x561c66
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov eax, dword [edi + 0xc]
mov dword [esp + 0x10], 0xd
cmp eax, 4
je 0x4a1060
push str.Bad_Separation_color_space
push 0xffffffffffffffff
push 1
call fcn.00489570
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x10]
push eax
push 1
mov ecx, edi
call fcn.0047c000
cmp dword [eax], 4
je 0x4a10a2
push str.Bad_Separation_color_space__name_
push 0xffffffffffffffff
push 1
call fcn.00489570
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.0047c660
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
push 8
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x4a10cc
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0047ab60
mov ebx, eax
jmp 0x4a10ce
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.0047c660
lea edx, [esp + 0x10]
push edx
push 2
mov ecx, edi
call fcn.0047c000
mov eax, dword [esp + 0x34]
inc eax
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004a63d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a1119
push str.Bad_Separation_color_space__alternate_color_space_
push 0xffffffffffffffff
push 1
call fcn.00489570
add esp, 0xc
jmp 0x4a114f
lea ecx, [esp + 0x10]
call fcn.0047c660
lea edx, [esp + 0x10]
push edx
push 3
mov ecx, edi
call fcn.0047c000
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004eff40
mov edi, eax
add esp, 8
test edi, edi
jne 0x4a1181
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
test ebx, ebx
je 0x4a1163
mov ecx, ebx
call fcn.0047ac70
push ebx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x10]
call fcn.0047c660
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea ecx, [esp + 0x10]
call fcn.0047c660
push 0x18
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 1
test eax, eax
je 0x4a104b
push edi
push esi
push ebx
mov ecx, eax
call fcn.004a0e30
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4a1e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x561d08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x63d20c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi + 4], 1
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esi], vtable.GfxTilingPattern.0
mov dword [esi + 0x40], 0xd
mov dword [esi + 0x80], 0xd
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x40]
mov dword [esi + 0xc], edx
fld qword [eax]
fstp qword [esi + 0x10]
lea edi, [esi + 0x80]
fld qword [eax + 8]
push ecx
mov ecx, dword [ebp + 0x24]
fstp qword [esi + 0x18]
fld qword [eax + 0x10]
mov dword [esp + 0x24], 0
fstp qword [esi + 0x20]
fld qword [eax + 0x18]
fstp qword [esi + 0x28]
fld qword [ebp + 0x14]
fstp qword [esi + 0x30]
fld qword [ebp + 0x1c]
fstp qword [esi + 0x38]
call fcn.0047c550
mov eax, dword [ebp + 0x28]
fld qword [eax]
mov ecx, dword [ebp + 0x2c]
fstp qword [esi + 0x50]
push edi
fld qword [eax + 8]
fstp qword [esi + 0x58]
fld qword [eax + 0x10]
fstp qword [esi + 0x60]
fld qword [eax + 0x18]
fstp qword [esi + 0x68]
fld qword [eax + 0x20]
fstp qword [esi + 0x70]
fld qword [eax + 0x28]
fstp qword [esi + 0x78]
call fcn.0047c550
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x28
Function at 0x4ab270
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
cmp dword [esi + 8], eax
jl 0x4ab32f
mov ebp, dword [esi]
lea eax, [edi + edi + 1]
push 8
push eax
mov dword [esp + 0x18], ebp
mov dword [esi + 4], eax
call fcn.00497310
mov dword [esi], eax
xor eax, eax
add esp, 8
cmp dword [esi + 4], eax
jle 0x4ab2bf
jmp 0x4ab2b0
mov ecx, dword [esi]
mov dword [ecx + eax*8], 0
inc eax
cmp eax, dword [esi + 4]
jl 0x4ab2b0
test edi, edi
jle 0x4ab326
mov edx, dword [ebp]
test edx, edx
je 0x4ab31a
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4ab2ed
movsx ecx, cl
mov ebx, eax
shl ebx, 4
and ecx, 0xff
add ebx, eax
add ecx, ebx
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4ab2d2
mov ecx, dword [esi + 4]
xor edx, edx
div ecx
mov eax, dword [esi]
cmp dword [eax + edx*8], 0
je 0x4ab30d
mov ebx, eax
mov edi, edi
inc edx
cmp edx, ecx
jne 0x4ab307
xor edx, edx
cmp dword [ebx + edx*8], 0
jne 0x4ab300
mov ecx, dword [ebp]
mov dword [eax + edx*8], ecx
mov ecx, dword [ebp + 4]
mov dword [eax + edx*8 + 4], ecx
add ebp, 8
sub edi, 1
jne 0x4ab2c3
mov ebp, dword [esp + 0x10]
push ebp
call fcn.00497230
add esp, 4
mov edx, dword [esp + 0x18]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4ab35b
jmp 0x4ab340
movsx ecx, cl
mov edi, eax
shl edi, 4
and ecx, 0xff
add edi, eax
add ecx, edi
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4ab340
mov ebp, dword [esi + 4]
xor edx, edx
div ebp
mov ebx, dword [esi]
mov edi, edx
cmp dword [ebx + edi*8], 0
je 0x4ab3b5
lea esp, [esp]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx + edi*8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ab397
test dl, dl
je 0x4ab393
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4ab397
add eax, 2
add ecx, 2
test dl, dl
jne 0x4ab377
xor eax, eax
jmp 0x4ab39c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ab3af
inc edi
cmp edi, ebp
jne 0x4ab3a7
xor edi, edi
mov edx, ebx
cmp dword [edx + edi*8], 0
jne 0x4ab370
cmp dword [ebx + edi*8], 0
jne 0x4ab3c7
mov eax, dword [esp + 0x18]
push eax
call fcn.004973b0
mov ecx, dword [esi]
add esp, 4
mov dword [ecx + edi*8], eax
mov edx, dword [esi]
mov eax, dword [esp + 0x1c]
mov dword [edx + edi*8 + 4], eax
inc dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x4ab570
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi + 4]
mov esi, dword [esi]
xor eax, eax
test esi, esi
jle 0x4ab59e
push ebx
push edi
movsx edi, byte [edx]
mov ebx, eax
shl ebx, 4
add ebx, eax
and edi, 0xff
add edi, ebx
inc edx
sub esi, 1
mov eax, edi
jne 0x4ab582
pop edi
pop ebx
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4

Function at 0x4ab5b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x4ab5dc
push edi
mov edi, edi
movsx edx, dl
mov edi, eax
shl edi, 4
and edx, 0xff
add edi, eax
add edx, edi
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x4ab5c0
pop edi
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4