joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00446c60
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x61d071]
test cl, cl
je 0x466709
call fcn.004368b0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00454960
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
jmp 0x46673f
call fcn.004368a0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00454960
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
mov eax, dword [0x5f6c34]
mov dword [esp], eax
lea eax, [ecx + 0x190]
mov dword [esp + 4], eax
call fcn.00404930
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x19c]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x46677b
mov eax, dword [eax + 0x1a4]
mov dword [esp + 0x30], eax
call fcn.00446cf0
add esp, 0x20
ret
Function at 0x468830
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x61d460]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x466ffb
je 0x46704e
cmp ebx, 0x20
jbe 0x467054
cmp ebx, 0x40
jbe 0x46709a
jmp 0x46713b
test ebx, ebx
je 0x467044
add eax, 0x10
test ax, 0xff0
je 0x467030
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x527340]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x527440]
jmp 0x467018
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x467018
pxor xmm1, xmmword [0x61d470]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x61d470]
pxor xmm2, xmmword [0x61d480]
pxor xmm3, xmmword [0x61d490]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x61d470]
pxor xmm2, xmmword [0x61d480]
pxor xmm3, xmmword [0x61d490]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46719a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x61d06f], 0
je 0x46884a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x466fc0
jmp fcn.00409670
Function at 0x468850
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4035de
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409670
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00467570
jmp 0x4035a0
cmp byte [0x61d06f], 0
je 0x46886b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x466fc0
jmp 0x4035a0
Function at 0x486190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x486407
sub esp, 0x70
mov eax, dword [esp + 0x8c]
and eax, dword [esp + 0x78]
test eax, 0x80000000
je 0x486293
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov ebp, eax
sub eax, edx
mov esi, ecx
sbb ecx, ebx
test ecx, ecx
jge 0x48622b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edx
cmp ebx, esi
xchg edi, ebx
setl bl
xchg edi, ebx
sete bl
cmp edx, ebp
setb dl
and edx, ebx
or edx, edi
test dl, dl
jne 0x486211
test ecx, ecx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x48622b
mov dword [esp + 0xa0], 0x7fffffff
mov dword [esp + 0x9c], 0xffffffff
add esp, 0x70
ret
mov dword [esp + 0x44], ecx
mov dword [esp + 0x3c], eax
xchg edi, ebx
setg bl
xchg edi, ebx
sete cl
test eax, eax
seta al
and eax, ecx
or eax, edi
test al, al
je 0x486279
cmp ebx, esi
setg al
sete cl
cmp edx, ebp
seta dl
and edx, ecx
or edx, eax
test dl, dl
je 0x486279
mov dword [esp + 0xa0], 0x80000000
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov eax, dword [esp + 0x44]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x9c], eax
add esp, 0x70
ret
lea eax, [esp + 0x74]
mov dword [esp], eax
call fcn.00484b30
mov eax, dword [esp + 4]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x54], ecx
lea edx, [esp + 0x88]
mov dword [esp], edx
call fcn.00484b30
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov edx, ecx
sub ecx, eax
mov ebx, eax
mov eax, ecx
mov ebp, 0x3b9aca00
mov ecx, edx
mul ebp
mov dword [esp + 0x58], edx
mov dword [esp + 0x50], eax
mov ebp, dword [esp + 8]
sub ecx, ebx
mov ecx, dword [esp + 0x54]
sbb ecx, ebp
mov dword [esp + 0x4c], ecx
lea ebx, [esp + 0x74]
mov dword [esp], ebx
call fcn.00484b00
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x88]
mov dword [esp], ecx
call fcn.00484b00
mov eax, dword [esp + 0x4c]
imul eax, eax, 0x3b9aca00
mov ecx, dword [esp + 0x58]
add eax, ecx
mov ecx, dword [esp + 0x48]
sub ecx, dword [esp + 4]
mov edx, ecx
sar ecx, 0x1f
mov ebx, dword [esp + 0x50]
add ebx, edx
mov dword [esp + 0x38], ebx
adc eax, ecx
mov dword [esp + 0x40], eax
lea edi, [esp]
lea esi, [esp + 0x88]
call fcn.0046903e
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
call fcn.00485fc0
lea edi, [esp + 0x5c]
lea esi, [esp + 0x1c]
call fcn.0046903e
lea edi, [esp]
lea esi, [esp + 0x5c]
call fcn.0046903e
lea edi, [esp + 0x14]
lea esi, [esp + 0x74]
call fcn.0046903e
call fcn.00485030
movzx eax, byte [esp + 0x28]
test al, al
jne 0x4863ed
lea edi, [esp]
lea esi, [esp + 0x74]
call fcn.0046903e
lea edi, [esp + 0x14]
lea esi, [esp + 0x88]
call fcn.0046903e
call fcn.00484f30
movzx eax, byte [esp + 0x28]
test al, al
je 0x4863d3
mov dword [esp + 0xa0], 0x80000000
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov dword [esp + 0xa0], 0x7fffffff
mov dword [esp + 0x9c], 0xffffffff
add esp, 0x70
ret
mov eax, dword [esp + 0x40]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x9c], eax
add esp, 0x70
ret
call fcn.00467570
jmp fcn.00486190
Function at 0x498910
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x498948
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x49893f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x498932
mov dword [esp + 0x14], edx
ret
call fcn.00467570
jmp fcn.00498910
Function at 0x4a5160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a5377
sub esp, 0x10
mov ecx, dword [esp + 0x18]
cmp ecx, 2
jl 0x4a5247
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
cmp byte [edx + 1], 0x3a
jne 0x4a51c1
lea ebp, [ebx - 0x30]
xchg ebp, eax
cmp al, 9
xchg ebp, eax
jbe 0x4a51b1
lea ebp, [ebx - 0x61]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
jbe 0x4a51b1
lea ebp, [ebx - 0x41]
xchg ebp, eax
cmp al, 0x19
xchg ebp, eax
ja 0x4a51c1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 2
add esp, 0x10
ret
cmp ecx, 5
jge 0x4a51ca
xor eax, eax
jmp 0x4a51df
mov byte [esp], bl
call fcn.004a4fb0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
test al, al
jne 0x4a51e7
xor eax, eax
jmp 0x4a5200
movzx eax, byte [edx + 1]
mov byte [esp], al
call fcn.004a4fb0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
test al, al
je 0x4a522b
cmp ecx, 2
jbe 0x4a536a
movzx eax, byte [edx + 2]
mov byte [esp], al
call fcn.004a4fb0
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
jmp 0x4a522d
xor eax, eax
test al, al
je 0x4a525b
cmp ecx, 2
jbe 0x4a535e
cmp byte [edx + 2], 0x2e
je 0x4a525b
mov eax, 3
jmp 0x4a527e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
add esp, 0x10
ret
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
add esp, 0x10
ret
mov ebx, dword [esp + 8]
lea eax, [ebx + 1]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea ebx, [ecx - 1]
cmp eax, ebx
jge 0x4a525b
cmp ecx, eax
jbe 0x4a5359
mov dword [esp + 8], eax
movzx ecx, byte [edx + eax]
mov byte [esp], cl
call fcn.004a4fb0
movzx eax, byte [esp + 4]
test al, al
je 0x4a526f
mov edx, dword [esp + 8]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x4a5354
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
movzx ecx, byte [edx + eax + 1]
mov byte [esp], cl
call fcn.004a4fb0
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
lea edx, [edx + ecx + 1]
test al, al
jne 0x4a525b
cmp byte [edx], 0x2e
je 0x4a525b
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
jmp 0x4a5309
mov ebx, dword [esp + 8]
lea eax, [ebx + 1]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp edx, eax
jle 0x4a5338
jbe 0x4a534d
mov dword [esp + 8], eax
movzx edx, byte [ecx + eax]
mov byte [esp], dl
call fcn.004a4fb0
movzx eax, byte [esp + 4]
test al, al
je 0x4a52fa
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 8]
cmp edx, ecx
mov eax, ecx
mov ecx, dword [esp + 0x14]
jb 0x4a5346
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov ecx, eax
call fcn.00468a20
mov ecx, edx
call fcn.00468a00
call fcn.00468a00
call fcn.00468a00
mov eax, 2
mov ecx, eax
call fcn.00468a00
mov eax, 2
mov ecx, eax
call fcn.00468a00
nop
call fcn.00467570
jmp fcn.004a5160
Function at 0x4a7770
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a784b
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4a782d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4a782d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.00472220
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
sub ecx, dword [esp + 8]
movzx edx, byte [eax + 6]
test dl, dl
je 0x4a77ff
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004a93b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004a7510
jmp 0x4a7829
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004a7510
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a93b0
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a93b0
add esp, 0x10
ret
call fcn.00467570
jmp fcn.004a7770
Function at 0x4ae300
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ae347
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call fcn.00467570
jmp fcn.004ae300

Function at 0x4aed20
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aed6e
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.00467570
jmp fcn.004aed20
Function at 0x4b5000
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b512a
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov word [esp + 0xc], cx
call fcn.004b79f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b79f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b79f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 6]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b79f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b79f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebx, word [ebx + 0xa]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bx
call fcn.004b79f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
add esp, 0x1c
ret
call fcn.00467570
jmp fcn.004b5000
Function at 0x4b66b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b680f
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00468b57
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4b66ea
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4b6713
lea eax, [0x4f9460]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044f8e0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00468b57
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call fcn.004b4ee0
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x46], cx
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x38]
cmp ebx, edx
jae 0x4b67b9
mov dword [esp + 0x24], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xc
lea eax, [0x4f9460]
mov dword [esp + 0x10], eax
call fcn.0044f980
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], ebp
lea eax, [ebp + ecx]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00469250
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00469016
add esp, 0x5c
ret
call fcn.00467570
jmp fcn.004b66b0
Function at 0x4cb550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4cb6c3
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4cb5e9
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4cb588
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4cb5f5
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4cb5b3
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4cb5f5
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4cb5f5
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004cb3a0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004d23b0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.00467570
jmp fcn.004cb550
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xe09008], 0x8088405
inc edx
mov dword [ebx + 0xe09008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d2ec
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d31d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d305
add dl, dl
jne 0x41d328
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d379
xor eax, eax
add dl, dl
jne 0x41d335
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d416
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d35a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d365
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d36f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d314
mov eax, 1
add dl, dl
jne 0x41d387
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d392
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d37e
sub eax, ebx
mov ebx, 1
jne 0x41d3c5
mov ecx, 1
add dl, dl
jne 0x41d3ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3b6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3a2
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d3dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3e7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3d3
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d437
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d314
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0xdec9f2
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f553
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
jmp 0x41f572
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f5e4
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f5cd
test esi, esi
jbe 0x41f5e4
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f5bf
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f5e4
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f59c
jmp 0x41f5e4
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f5e4
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xdec9f9
ret