joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441310
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0
call dword [0x4c80a4]
push 0x4ed200
push 1
push 0
push 0x441450
push 0
push 0
mov dword [0x4ed208], eax
call fcn.0048d1c6
add esp, 0x18
mov dword [0x4ed1fc], eax
test eax, eax
jne 0x441355
push dword [0x4ed208]
call dword [0x4c80dc]
xor eax, eax
ret
mov eax, 1
ret

Function at 0x442a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x28]
movzx edx, word [edi + 0x2c]
mov ecx, esi
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
mov eax, edx
mov edx, dword [esi]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [edx + 0x2c]
mov dword [ebp - 8], eax
mov ecx, edi
mov eax, dword [edi + 0x14]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0044b030
mov esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub ebx, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], ebx
test esi, esi
js 0x442c17
test ebx, ebx
js 0x442c17
jle 0x442c09
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 8]
imul eax, edx
lea ecx, [edx*4]
mov dword [ebp + 0x10], ecx
lea ecx, [edi*4]
mov dword [ebp + 0xc], ecx
add eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*4]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
imul eax, edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], edx
add eax, dword [ebp - 0x3c]
lea ecx, [ecx + eax*4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
nop dword [eax + eax]
test esi, esi
jle 0x442bf3
sub edx, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov dword [ebp - 0x10], edx
movzx esi, byte [edx + eax + 3]
lea eax, [eax + 4]
mov ebx, dword [edx + eax - 4]
cmp word [ebp - 0x18], si
mov ecx, dword [ebp - 0x14]
movzx edx, cx
mov ecx, esi
cmovbe edx, ecx
mov edi, dword [eax - 4]
movzx edx, dx
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
shl edx, 8
add edx, sym.RScript.exe_unsigned_char____256__CMath::m_ppAddTable
movzx esi, byte [ecx + edx]
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
shl esi, 8
movzx ecx, byte [ecx + edx]
add esi, ecx
movzx ecx, bl
shl esi, 8
movzx ecx, byte [ecx + edx]
mov edx, edi
add esi, ecx
mov ecx, edi
xor ecx, esi
and edx, esi
and ecx, 0xfefefe
lea ecx, [ecx + edx*2]
mov edx, dword [ebp - 0x10]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub edi, ecx
add edi, esi
or edi, ecx
sub dword [ebp + 8], 1
mov dword [eax - 4], edi
jne 0x442b52
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add ecx, edi
add edx, eax
sub ebx, 1
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ebx
jne 0x442b40
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x442fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x28]
movzx edx, word [edi + 0x2c]
mov ecx, esi
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
mov eax, edx
mov edx, dword [esi]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [edx + 0x2c]
mov dword [ebp - 8], eax
mov ecx, edi
mov eax, dword [edi + 0x14]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0044b030
mov esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub ebx, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], ebx
test esi, esi
js 0x443147
test ebx, ebx
js 0x443147
jle 0x443139
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 8]
imul eax, edx
lea ecx, [edx*4]
mov dword [ebp + 0x10], ecx
lea ecx, [edi*4]
mov dword [ebp + 0xc], ecx
add eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*4]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
imul eax, edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], edx
add eax, dword [ebp - 0x3c]
lea ecx, [ecx + eax*4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
nop dword [eax + eax]
test esi, esi
jle 0x443123
sub edx, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov dword [ebp - 0x10], edx
movzx esi, byte [edx + eax + 3]
lea eax, [eax + 4]
mov edi, dword [edx + eax - 4]
cmp word [ebp - 0x18], si
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax - 4]
movzx edx, cx
mov ecx, esi
cmovbe edx, ecx
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
movzx edx, dx
shl edx, 8
add edx, sym.RScript.exe_unsigned_char____256__CMath::m_ppAddTable
movzx esi, byte [ecx + edx]
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
shl esi, 8
movzx ecx, byte [ecx + edx]
add esi, ecx
movzx ecx, bl
shl esi, 8
movzx ecx, byte [ecx + edx]
add esi, ecx
mov ecx, esi
mov edx, esi
xor ecx, edi
and edx, edi
and ecx, 0xfefefe
lea ecx, [ecx + edx*2]
mov edx, dword [ebp - 0x10]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub esi, ecx
add esi, edi
or esi, ecx
sub dword [ebp + 8], 1
mov dword [eax - 4], esi
jne 0x443082
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add ecx, edi
add edx, eax
sub ebx, 1
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ebx
jne 0x443070
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x445670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c4468
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4eb5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [esi + 0x64]
mov dword [ebp - 0x24], vtable.CCriticalLock.0
mov dword [ebp - 0x20], eax
add eax, 4
push eax
mov dword [ebp - 0x1c], eax
call dword [0x4c80bc]
mov edx, dword [esi + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], edx
test edx, edx
jne 0x4456ce
xor esi, esi
jmp 0x44581c
mov edi, dword [esi + 0x18]
xor eax, eax
imul edi, dword [esi + 0x14]
test edi, edi
jle 0x4457bc
cmp edi, 0x10
jb 0x445796
mov ecx, edi
and ecx, 0x8000000f
jns 0x4456f7
dec ecx
or ecx, 0xfffffff0
inc ecx
movaps xmm2, xmmword [0x4cc570]
movaps xmm3, xmmword [0x4cc590]
movaps xmm4, xmmword [0x4cc5a0]
mov dword [ebp - 0x10], edi
sub dword [ebp - 0x10], ecx
lea ecx, [edx + 0x20]
mov edx, dword [ebp - 0x10]
nop dword [eax + eax]
movups xmm1, xmmword [ecx - 0x20]
add eax, 0x10
lea ecx, [ecx + 0x40]
movaps xmm0, xmm1
pand xmm1, xmm3
pandn xmm0, xmm4
pand xmm0, xmm2
por xmm0, xmm1
movups xmmword [ecx - 0x60], xmm0
movups xmm1, xmmword [ecx - 0x50]
movaps xmm0, xmm1
pand xmm1, xmm3
pandn xmm0, xmm4
pand xmm0, xmm2
por xmm0, xmm1
movups xmmword [ecx - 0x50], xmm0
movups xmm1, xmmword [ecx - 0x40]
movaps xmm0, xmm1
pand xmm1, xmm3
pandn xmm0, xmm4
pand xmm0, xmm2
por xmm0, xmm1
movups xmmword [ecx - 0x40], xmm0
movups xmm1, xmmword [ecx - 0x30]
movaps xmm0, xmm1
pand xmm1, xmm3
pandn xmm0, xmm4
pand xmm0, xmm2
por xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
cmp eax, edx
jl 0x445720
cmp eax, edi
jge 0x4457bc
mov esi, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [esi + eax*4]
mov edx, ecx
not edx
xor edx, ecx
and edx, 0xffffff
xor edx, ecx
mov dword [esi + eax*4], edx
inc eax
cmp eax, edi
jl 0x4457a0
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0xc], 0
je 0x445817
mov ecx, dword [esi + 0x20]
lea edi, [esi + 0x3c]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
add eax, ecx
push eax
mov eax, dword [esi + 0x14]
add eax, edx
push eax
push ecx
push edx
push edi
call dword [0x4c8354]
cmp dword [esi + 0x10], 0
movups xmm0, xmmword [edi]
je 0x44580c
sub esp, 0x10
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [esi + 0x4c]
movups xmmword [eax], xmm0
lea eax, [ebp - 0x34]
push eax
call fcn.00441820
add esp, 0x24
movups xmm0, xmmword [eax]
mov eax, dword [esi]
mov ecx, esi
movups xmmword [esi + 0x4c], xmm0
call dword [eax + 0x20]
mov esi, 1
push dword [ebp - 0x1c]
call dword [0x4c80b8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44baa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x28]
mov edx, dword [esi]
mov ecx, esi
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 8]
mov dword [ebp - 8], eax
call dword [edx + 0x2c]
mov ebx, eax
mov ecx, edi
mov eax, dword [edi + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0044b030
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
sub edx, esi
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub edi, eax
mov dword [ebp + 0x10], edx
mov dword [ebp + 8], edi
test edx, edx
js 0x44bc8e
test edi, edi
js 0x44bc8e
jle 0x44bc80
mov ecx, dword [ebp - 4]
imul eax, ecx
movups xmm5, xmmword [0x4cc5a0]
lea edx, [ecx*4]
mov ecx, dword [ebp - 8]
mov dword [ebp + 0xc], edx
lea edx, [ebx*4]
add eax, esi
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0x10]
lea esi, [ecx + eax*4]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
imul eax, ebx
mov dword [ebp - 4], esi
add eax, dword [ebp - 0x30]
lea ebx, [ecx + eax*4]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test edx, edx
jle 0x44bc6c
cmp edx, 0x10
jb 0x44bc35
lea eax, [edx - 1]
lea eax, [esi + eax*4]
lea edi, [edx - 1]
lea edi, [ebx + edi*4]
cmp ebx, eax
ja 0x44bb7b
cmp edi, esi
jae 0x44bc32
mov eax, edx
and eax, 0x8000000f
jns 0x44bb89
dec eax
or eax, 0xfffffff0
inc eax
movaps xmm3, xmmword [0x4cc570]
mov edi, edx
movaps xmm4, xmmword [0x4cc590]
sub edi, eax
mov edx, esi
mov dword [ebp - 8], edi
sub edx, ebx
lea edi, [esi + 0x30]
mov dword [ebp - 0xc], edx
lea eax, [ebx + 0x10]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 0xc]
movups xmm1, xmmword [edi - 0x30]
add ecx, 0x10
lea eax, [eax + 0x40]
lea edi, [edi + 0x40]
movaps xmm0, xmm1
pand xmm1, xmm4
pandn xmm0, xmm5
pand xmm0, xmm3
por xmm0, xmm1
movups xmm1, xmmword [eax + esi - 0x40]
movups xmmword [eax - 0x50], xmm0
movaps xmm2, xmm1
movaps xmm0, xmm4
pand xmm0, xmm1
pandn xmm2, xmm5
pand xmm2, xmm3
por xmm2, xmm0
movups xmm1, xmmword [edi - 0x50]
movups xmmword [eax - 0x40], xmm2
movaps xmm0, xmm1
pand xmm1, xmm4
pandn xmm0, xmm5
pand xmm0, xmm3
por xmm0, xmm1
movups xmm1, xmmword [edi - 0x40]
movups xmmword [eax - 0x30], xmm0
movaps xmm0, xmm1
pand xmm1, xmm4
pandn xmm0, xmm5
pand xmm0, xmm3
por xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp ecx, dword [ebp - 8]
jl 0x44bbb1
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 8]
cmp ecx, edx
jge 0x44bc69
mov edi, esi
lea eax, [ebx + ecx*4]
mov esi, edx
sub edi, ebx
sub esi, ecx
mov ecx, dword [edi + eax]
lea eax, [eax + 4]
mov edx, ecx
not edx
xor edx, ecx
and edx, 0xffffff
xor edx, ecx
mov dword [eax - 4], edx
sub esi, 1
jne 0x44bc44
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
add ebx, dword [ebp - 0x10]
add esi, eax
sub edi, 1
mov dword [ebp - 4], esi
mov dword [ebp + 8], edi
jne 0x44bb50
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46f9a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c61be
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4eb5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CLwgLoader.0
mov dword [ebp - 4], 0
mov dword [edi + 4], vtable.CFile.0
mov dword [edi + 8], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 2
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004819d6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46fa60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c61fe
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4eb5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CPsdLoader.0
mov dword [ebp - 4], 0
mov dword [edi + 4], vtable.CFile.0
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
lea esi, [edi + 0x38]
mov byte [ebp - 4], 2
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004819d6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46fdc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6260
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4eb5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CLwgLoader.0
mov dword [ebp - 0x14], ecx
call dword [eax + 0xc]
mov eax, dword [esi + 0x24]
lea ebx, [esi + 0x24]
lea edi, [esi + 0x30]
mov dword [ebx + 4], eax
mov esi, dword [edi]
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.0046f8f0
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov esi, dword [ebp - 0x10]
mov dword [edi + 4], 0
push dword [esi + 0x3c]
lea ecx, [esi + 0x38]
push dword [esi + 0x38]
call fcn.00470410
mov eax, dword [esi + 0x38]
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], eax
call fcn.0045f850
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
push edi
call fcn.0046f8f0
push 0x2c
push dword [edi]
call fcn.00481a06
add esp, 8
mov ecx, ebx
call fcn.0046fb90
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
mov dword [esi], vtable.CFile.0
test ecx, ecx
je 0x46fe8a
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], 0
test byte [ebp + 8], 1
mov ebx, dword [ebp - 0x10]
mov dword [esi], vtable.IFile.0
mov dword [ebx], vtable.IGrapLoader.0
je 0x46feaa
push 0x44
push ebx
call fcn.00481a06
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x473750
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c66f7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4eb5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
test edi, edi
js 0x473898
movsx eax, word [eax + 0x26]
cmp edi, eax
jge 0x473898
push 0x70
call fcn.004819d6
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x473881
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x30]
sub ecx, eax
mov dword [ebp + 8], eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jbe 0x4738ad
mov ecx, dword [ebp + 8]
lea eax, [edi*8]
sub eax, edi
lea edi, [ecx + eax*8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x28]
mov dword [ebp + 8], ecx
lea ecx, [eax + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CPsdLoader::CPsdLayer.0
mov dword [esi + 4], 0
test ecx, ecx
je 0x473883
test edi, edi
je 0x473883
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esi + 4], eax
movups xmm0, xmmword [edi]
mov eax, dword [ebp + 8]
movups xmmword [esi + 0x38], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [esi + 0x48], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x58], xmm0
movq xmm0, qword [edi + 0x30]
mov dword [esi + 8], eax
movq qword [esi + 0x68], xmm0
mov eax, dword [esi + 0x44]
neg eax
mov dword [esi + 0xc], 0x28
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x10], eax
imul eax, dword [esi + 0x44]
mov dword [esi + 0x18], 0x200001
mov dword [esi + 0x1c], 0
shl eax, 2
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00474c60
int3
Function at 0x4747e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
mov edi, dword [ebx + 0x44]
lea esi, [edi + edi]
push esi
call fcn.0048c9b8
mov ecx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ecx]
push esi
push eax
call dword [edx + 0x14]
test edi, edi
jle 0x47482e
mov edx, dword [ebp - 4]
test edx, edx
je 0x474826
mov ax, word [edx]
movzx ecx, byte [edx + 1]
shl ax, 8
xor cx, ax
mov word [edx], cx
add edx, 2
sub edi, 1
jne 0x474811
movsx eax, word [ebp + 0xc]
sub eax, 0
je 0x474853
sub eax, 1
je 0x47484c
sub eax, 1
je 0x474848
mov esi, 3
jmp 0x474858
xor esi, esi
jmp 0x474858
mov esi, 1
jmp 0x474858
mov esi, 2
push dword [ebx + 0x40]
mov dword [ebp + 0xc], esi
call fcn.0048c9b8
mov ecx, dword [ebp - 8]
add esp, 4
mov ebx, eax
mov eax, dword [ecx + 0x44]
mov edi, dword [ecx + 0x40]
mov dword [ebp - 0x10], eax
cmp esi, 3
jne 0x474913
xor esi, esi
mov dword [ebp - 0xc], esi
test eax, eax
jle 0x4749ac
mov eax, dword [ebp + 8]
add eax, 3
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + esi*2]
push eax
call fcn.0048c9b8
mov ecx, dword [ebp - 8]
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ecx + 4]
movzx edx, word [eax + edx*2]
mov esi, dword [ecx]
mov eax, dword [ebp + 0xc]
push edx
push eax
call dword [esi + 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ecx, word [eax + esi*2]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ebx
call fcn.004749d0
xor ecx, ecx
test edi, edi
jle 0x4748f0
mov edx, dword [ebp + 8]
mov al, byte [ecx + ebx]
lea edx, [edx + 4]
not al
inc ecx
mov byte [edx - 4], al
cmp ecx, edi
jl 0x4748e0
push dword [ebp + 0xc]
call fcn.0048c99d
inc esi
lea eax, [edi*4]
add dword [ebp + 8], eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x10]
jl 0x474893
jmp 0x4749ac
xor esi, esi
mov dword [ebp - 0xc], esi
test eax, eax
jle 0x4749ac
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
nop dword [eax]
mov eax, dword [ebp - 4]
movzx eax, word [eax + esi*2]
push eax
call fcn.0048c9b8
mov ecx, dword [ebp - 8]
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ecx + 4]
movzx edx, word [eax + edx*2]
mov esi, dword [ecx]
mov eax, dword [ebp + 0xc]
push edx
push eax
call dword [esi + 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
movzx ecx, word [eax + esi*2]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ebx
call fcn.004749d0
xor eax, eax
test edi, edi
jle 0x47498e
mov edx, dword [ebp + 8]
nop dword [eax]
mov cl, byte [eax + ebx]
lea edx, [edx + 4]
inc eax
mov byte [edx - 4], cl
cmp eax, edi
jl 0x474980
push dword [ebp + 0xc]
call fcn.0048c99d
inc esi
lea eax, [edi*4]
add dword [ebp + 8], eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x10]
jl 0x474930
push ebx
call fcn.0048c99d
push dword [ebp - 4]
call fcn.0048c99d
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x430002
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5c102e34
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xb4347c4
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219