joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433463
Capabilities:
Get number of processors

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x97c]
test eax, eax
jne 0x43347d
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.00433100
mov eax, dword [esi + 0xc4]
lea edi, [esi + 0xc4]
mov ecx, edi
call dword [eax + 4]
lea ecx, [esi + 0x520]
push ecx
mov ecx, edi
call fcn.00421c60
mov eax, dword [esi + 0xac]
cmp eax, 0x64
jge 0x43352e
mov cl, byte [edi + 0x42c]
test cl, cl
je 0x4334bd
mov ebx, dword [edi + 0x434]
jmp 0x4334c3
mov ebx, dword [edi + 0x430]
mov ecx, eax
xor ebp, ebp
shl ecx, 8
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esi + 0xd8]
test eax, eax
mov byte [esp + 0x10], dl
jle 0x43352e
mov ecx, dword [esi + 0xd4]
xor eax, eax
test ecx, ecx
jle 0x433523
mov edi, dword [esp + 0x10]
and edi, 0xff
imul ecx, ebp
add ecx, eax
xor edx, edx
mov dl, byte [ebx + ecx*4 + 3]
lea ecx, [ebx + ecx*4 + 3]
imul edx, edi
sar edx, 8
mov byte [ecx], dl
mov ecx, dword [esi + 0xd4]
inc eax
cmp eax, ecx
jl 0x433501
mov eax, dword [esi + 0xd8]
inc ebp
cmp ebp, eax
jl 0x4334f1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x43d410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aa0ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [0x628100]
mov dword [esp + 0x10], 0
mov dword [esi + 0xc], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x30], edx
mov eax, dword [0x628100]
mov dword [esi + 0x38], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x3c], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x40], edx
mov eax, dword [0x628100]
mov dword [esi + 0x48], eax
push 0xa
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 7
call fcn.0058e570
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 8
call fcn.0049b5d0
lea ecx, [esi + 0xb0]
mov byte [esp + 0x10], 9
call fcn.00493620
lea ecx, [esi + 0x118]
mov byte [esp + 0x10], 0xa
call fcn.004a5190
push 0xa
lea ecx, [esi + 0x120]
mov byte [esp + 0x14], 0xb
call fcn.0058e125
mov ecx, dword [0x628100]
mov dword [esi + 0x13c], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x140], edx
mov eax, dword [0x628100]
mov dword [esi + 0x144], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x148], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x14c], edx
mov eax, dword [0x628100]
mov dword [esi + 0x150], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x154], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x158], edx
lea ecx, [esi + 0x15c]
mov byte [esp + 0x10], 0x14
call fcn.004457f0
mov eax, dword [0x628100]
mov dword [esi + 0x1a4], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x1a8], ecx
mov ecx, esi
mov byte [esp + 0x10], 0x17
mov dword [esi], vtable.CAutoPlayProjectInfo.0
call fcn.0043d760
mov ecx, dword [esp + 8]
mov dword [esi + 0x1ac], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43d426
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aa0ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [0x628100]
mov dword [esp + 0x10], 0
mov dword [esi + 0xc], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x30], edx
mov eax, dword [0x628100]
mov dword [esi + 0x38], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x3c], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x40], edx
mov eax, dword [0x628100]
mov dword [esi + 0x48], eax
push 0xa
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 7
call fcn.0058e570
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 8
call fcn.0049b5d0
lea ecx, [esi + 0xb0]
mov byte [esp + 0x10], 9
call fcn.00493620
lea ecx, [esi + 0x118]
mov byte [esp + 0x10], 0xa
call fcn.004a5190
push 0xa
lea ecx, [esi + 0x120]
mov byte [esp + 0x14], 0xb
call fcn.0058e125
mov ecx, dword [0x628100]
mov dword [esi + 0x13c], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x140], edx
mov eax, dword [0x628100]
mov dword [esi + 0x144], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x148], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x14c], edx
mov eax, dword [0x628100]
mov dword [esi + 0x150], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x154], ecx
mov edx, dword [0x628100]
mov dword [esi + 0x158], edx
lea ecx, [esi + 0x15c]
mov byte [esp + 0x10], 0x14
call fcn.004457f0
mov eax, dword [0x628100]
mov dword [esi + 0x1a4], eax
mov ecx, dword [0x628100]
mov dword [esi + 0x1a8], ecx
mov ecx, esi
mov byte [esp + 0x10], 0x17
mov dword [esi], vtable.CAutoPlayProjectInfo.0
call fcn.0043d760
mov ecx, dword [esp + 8]
mov dword [esi + 0x1ac], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43d5a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aa23f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], vtable.CAutoPlayProjectInfo.0
mov eax, dword [esi + 0x5c]
mov dword [esp + 0x10], 0x17
test eax, eax
je 0x43d5f2
push edi
lea edi, [esi + 0x58]
mov ecx, edi
call int.0058e693
test eax, eax
je 0x43d5ea
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 4]
mov eax, dword [esi + 0x5c]
test eax, eax
jne 0x43d5d6
pop edi
lea ecx, [esi + 0x1a8]
mov byte [esp + 0x10], 0x16
call fcn.0058f6df
lea ecx, [esi + 0x1a4]
mov byte [esp + 0x10], 0x15
call fcn.0058f6df
lea ecx, [esi + 0x15c]
mov byte [esp + 0x10], 0x14
call fcn.00445870
lea ecx, [esi + 0x158]
mov byte [esp + 0x10], 0x13
call fcn.0058f6df
lea ecx, [esi + 0x154]
mov byte [esp + 0x10], 0x12
call fcn.0058f6df
lea ecx, [esi + 0x150]
mov byte [esp + 0x10], 0x11
call fcn.0058f6df
lea ecx, [esi + 0x14c]
mov byte [esp + 0x10], 0x10
call fcn.0058f6df
lea ecx, [esi + 0x148]
mov byte [esp + 0x10], 0xf
call fcn.0058f6df
lea ecx, [esi + 0x144]
mov byte [esp + 0x10], 0xe
call fcn.0058f6df
lea ecx, [esi + 0x140]
mov byte [esp + 0x10], 0xd
call fcn.0058f6df
lea ecx, [esi + 0x13c]
mov byte [esp + 0x10], 0xc
call fcn.0058f6df
lea ecx, [esi + 0x120]
mov byte [esp + 0x10], 0xb
call fcn.0058e199
lea ecx, [esi + 0x118]
mov byte [esp + 0x10], 0xa
call fcn.004a5200
lea ecx, [esi + 0xb0]
mov byte [esp + 0x10], 9
call fcn.004936c0
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 8
call fcn.0049b610
lea ecx, [esi + 0x58]
mov byte [esp + 0x10], 7
call fcn.0058e5cf
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 6
call fcn.0058f6df
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 5
call fcn.0058f6df
lea ecx, [esi + 0x3c]
mov byte [esp + 0x10], 4
call fcn.0058f6df
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 3
call fcn.0058f6df
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 2
call fcn.0058f6df
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 1
call fcn.0058f6df
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 0
call fcn.0058f6df
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43d760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x62cce0
lea ebx, [esi + 0xc]
mov dword [esi + 4], 0x276
mov ecx, ebx
mov dword [esi + 8], 0x1a9
call fcn.0058f868
xor edi, edi
mov ebp, 1
push 0x62cce0
lea ecx, [esi + 0x2c]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
call fcn.0058f868
lea ecx, [esi + 0x30]
call fcn.0058f66a
push 0x604980
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], ebp
call fcn.0058f868
lea ecx, [esi + 0x40]
call fcn.0058f66a
lea ecx, [esi + 0x3c]
call fcn.0058f66a
push 0x604974
mov ecx, ebx
call fcn.0058f868
mov ecx, 0x258
mov eax, 0x1e0
mov dword [esi + 0x78], ecx
mov dword [esi + 0x80], ecx
push 0x62cce0
lea ecx, [esi + 0x98]
mov dword [esi + 0x54], edi
mov dword [esi + 0x8c], ebp
mov dword [esi + 0x7c], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], 0xffffff
mov dword [esi + 0x94], ebp
mov dword [esi + 0x90], edi
call fcn.0058f868
push 0x62cce0
lea ecx, [esi + 0xac]
mov dword [esi + 0xa0], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa8], edi
call fcn.0058f868
cmp dword [esi + 0x5c], edi
je 0x43d86d
lea ebx, [esi + 0x58]
mov ecx, ebx
call int.0058e693
cmp eax, edi
je 0x43d868
mov edx, dword [eax]
push ebp
mov ecx, eax
call dword [edx + 4]
cmp dword [esi + 0x5c], edi
jne 0x43d855
mov ecx, esi
call fcn.0043d930
push 0x601568
lea ecx, [esi + 0x48]
mov dword [esi + 0x44], 4
call fcn.0058f868
lea ecx, [esi + 0xb0]
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
call fcn.00493740
lea ecx, [esi + 0x118]
call fcn.004a5240
lea ecx, [esi + 0x120]
call int.0058e164
lea ecx, [esi + 0x15c]
call fcn.00445920
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
jmp 0x43d8d0
push esi
mov esi, ecx
lea ecx, [esi + 0x140]
call fcn.0058f66a
lea ecx, [esi + 0x154]
call fcn.0058f66a
lea ecx, [esi + 0x13c]
call fcn.0058f66a
lea ecx, [esi + 0x144]
call fcn.0058f66a
lea ecx, [esi + 0x148]
call fcn.0058f66a
lea ecx, [esi + 0x14c]
call fcn.0058f66a
lea ecx, [esi + 0x150]
call fcn.0058f66a
lea ecx, [esi + 0x158]
pop esi
jmp fcn.0058f66a
Function at 0x49ee19
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b1f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov eax, dword [0x628100]
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
push ecx
lea ecx, [esp + 0x20]
call fcn.0058f454
lea edx, [esp + 0x38]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x34], 2
call fcn.0058f818
mov eax, dword [esp + 0xc]
mov eax, dword [eax - 8]
cmp eax, 2
jle 0x49efb7
lea ecx, [esp + 0x18]
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.0058c2ae
mov eax, dword [eax]
push 0x609d40
push eax
call fcn.00573e3e
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete bl
call fcn.0058f6df
test bl, bl
je 0x49efb7
push 0x609d30
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
call fcn.0058f74d
push 0x6044b4
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call fcn.0058f74d
mov edx, dword [0x62cf08]
lea ecx, [esp + 8]
add edx, 0x2a74
mov byte [esp + 0x30], 4
push edx
call fcn.0058f454
mov bl, 5
push 0x3e
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], bl
call fcn.0058c326
cmp eax, 0xffffffff
je 0x49ef2c
mov ecx, dword [esp + 8]
lea edx, [esp + 0x20]
mov ecx, dword [ecx - 8]
sub ecx, eax
sub ecx, 2
push ecx
push edx
lea ecx, [esp + 0x10]
call int.0058c232
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.0058f818
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.0058f6df
jmp 0x49ef45
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x49ef45
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
call fcn.0058f818
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0058f454
mov ecx, esi
call fcn.0049f030
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
dec eax
push ecx
mov dword [esp + 0x18], eax
push eax
push edx
lea eax, [esp + 0x28]
push 0x609d20
push eax
call fcn.0058c6ce
add esp, 0x14
lea ecx, [esp + 8]
mov byte [esp + 0x30], 4
call fcn.0058f6df
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.0058f6df
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.0058f6df
call fcn.005953c4
test eax, eax
je 0x49efcb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x49efcf
xor eax, eax
jmp 0x49efd2
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x1c]
push 0x30
push 0x602ae0
push ecx
push eax
call dword [fcn.005b76e4]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.0058f6df
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.0058f6df
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0058f6df
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 4

Function at 0x4a1af0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4a8488
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b3168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], 2
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4a84df
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
call fcn.0058f6df
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.0058f6df
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call fcn.0058f6df
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x30]
push 0x609d64
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0058f974
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 3
call fcn.0058f90e
push 0x603184
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x28], 4
push eax
call fcn.0058f974
lea ecx, [esp + 0x28]
lea edx, [esp + 4]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 5
call fcn.0058f90e
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 6
call fcn.0058f818
lea ecx, [esp + 4]
mov byte [esp + 0x20], 5
call fcn.0058f6df
lea ecx, [esp + 8]
mov byte [esp + 0x20], 4
call fcn.0058f6df
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.0058f6df
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.0058f6df
lea eax, [esp + 0x2c]
lea ecx, [esi + 0x2a74]
push eax
call fcn.0058f818
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0058f454
lea ecx, [esi + 0x60]
call fcn.0049ebe0
lea ecx, [esp + 0x28]
mov esi, eax
mov byte [esp + 0x20], 1
call fcn.0058f6df
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.0058f6df
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call fcn.0058f6df
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc

Function at 0x4a8930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b3227
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 8], 0
mov eax, dword [0x628100]
mov esi, dword [ecx + 0x64]
mov dword [esp + 0x14], 1
mov dword [esp + 4], eax
push 0x60ab4c
push esi
mov byte [esp + 0x1c], 2
call fcn.00508ae0
push 0xffffd8ef
push esi
call fcn.00508c60
mov ecx, dword [esp + 0x30]
push ecx
push esi
call fcn.00508ae0
push 0xfffffffffffffffe
push esi
call fcn.00508c60
push 0xffffffffffffffff
push esi
call fcn.005088c0
add esp, 0x28
lea ecx, [esp + 4]
push eax
call fcn.0058f868
push 0xfffffffffffffffe
push esi
call fcn.005084b0
push 0xfffffffffffffffe
push esi
call fcn.005084b0
mov esi, dword [esp + 0x2c]
add esp, 0x10
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.0058f454
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call fcn.0058f6df
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 0
call fcn.0058f6df
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x4aa6c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5b3462
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
xor ebx, ebx
push 0x4b90
mov dword [eax], 0x64
mov dword [esp + 0x2c], ebx
mov dword [ebp], 0x32
call fcn.0058f420
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov byte [esp + 0x28], 1
je 0x4aa71c
mov ecx, eax
call fcn.00495fa0
mov esi, eax
jmp 0x4aa71e
xor esi, esi
mov edi, dword [esp + 0x3c]
mov byte [esp + 0x28], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x44], edi
call fcn.005953c4
cmp eax, ebx
je 0x4aa73e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x4aa740
xor eax, eax
mov edx, dword [esi]
push ebx
push 0x270f
push eax
lea eax, [esp + 0x1c]
mov ecx, 0x64
push eax
push 0x40000000
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
push 0x604b5c
push ebx
mov ecx, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [edx + 0x54]
test eax, eax
mov ecx, esi
je 0x4aa7d8
push ebx
call fcn.00592e77
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.0058f454
mov ecx, esi
call fcn.00497d50
mov ecx, dword [esi + 0x3c]
push ebx
call fcn.00592eb9
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x10]
push eax
call fcn.0049a290
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx], ecx
mov dword [ebp], eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x58]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
cmp edi, ebx
je 0x4aa7df
add dword [ebp], 0x19
jmp 0x4aa7df
mov edx, dword [esi]
push 1
call dword [edx + 4]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.0058f6df
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x24
Function at 0x4b62a1
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push ebx
xor edx, edx
push esi
mov dword [eax], edx
xor esi, esi
mov bl, 1
mov ecx, esi
shl bl, cl
inc esi
cmp esi, 8
mov byte [eax + esi + 3], bl
jl 0x4b62ab
mov bl, dl
mov cl, dl
shl bl, 4
shr cl, 4
xor cl, bl
and cl, 0xf
xor cl, bl
mov bl, cl
shl bl, 2
shr cl, 2
xor cl, bl
and cl, 0x33
xor cl, bl
mov bl, cl
add bl, bl
shr cl, 1
xor cl, bl
and cl, 0x55
xor cl, bl
mov byte [eax + edx + 0xc], cl
inc edx
cmp edx, 0x100
jl 0x4b62bb
pop esi
pop ebx
ret
Function at 0x4f286d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
sub ebx, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x4f28f5
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00576e70
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x4f28b8
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x4f28da
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x4f2950
mov ecx, dword [esi + 0x6c]
push ebx
add ecx, dword [esi + 0x64]
add ecx, dword [esi + 0x30]
push ecx
push eax
call fcn.004f2955
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x4f293c
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x4f2950
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4f2879
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5356fa
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x535791
mov edx, dword [eax]
push ebx
push esi
push edi
mov byte [edx + 0x16], cl
mov edx, dword [eax]
mov byte [edx + 0x17], cl
mov edx, dword [eax]
mov byte [edx + 0x18], cl
mov edx, dword [eax]
mov byte [edx + 0x19], cl
mov esi, dword [eax + 4]
xor edx, edx
cmp esi, ecx
jle 0x535746
mov edi, dword [eax]
mov ebx, ecx
shr ebx, 0x18
movzx edi, byte [edi + edx]
xor edi, ebx
shl ecx, 8
mov edi, dword [edi*4 + 0x619070]
xor ecx, edi
inc edx
cmp edx, esi
jl 0x535728
xor edx, edx
cmp dword [eax + 0xc], edx
jle 0x53576d
mov esi, dword [eax + 8]
movzx edi, byte [esi + edx]
mov ebx, ecx
shr ebx, 0x18
xor edi, ebx
shl ecx, 8
mov edi, dword [edi*4 + 0x619070]
xor ecx, edi
inc edx
cmp edx, dword [eax + 0xc]
jl 0x535750
mov edx, dword [eax]
pop edi
mov byte [edx + 0x16], cl
mov esi, dword [eax]
mov edx, ecx
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [eax]
mov edx, ecx
shr edx, 0x10
mov byte [esi + 0x18], dl
mov eax, dword [eax]
shr ecx, 0x18
pop esi
mov byte [eax + 0x19], cl
pop ebx
ret
Function at 0x551d80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x678680]
push ebx
push esi
push edi
push eax
call dword [fcn.005b71ec]
mov ebx, eax
test ebx, ebx
jne 0x551d9c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [ebx + 0xc88]
push ebp
push ecx
call fcn.00557cf0
mov ebp, dword [esp + 0x18]
add esp, 4
xor edi, edi
call fcn.00557c40
xor edx, edx
mov esi, eax
mov dl, byte [edi + ebp]
xor esi, edx
push esi
call fcn.00557c70
add esp, 4
inc edi
cmp edi, 0xc
jl 0x551db2
mov al, byte [ebx + 0xafc]
pop ebp
test al, 8
je 0x551de8
xor eax, eax
mov ax, word [ebx + 0xb00]
shr eax, 8
jmp 0x551dfd
mov eax, dword [ebx + 0xc4a]
xor ecx, ecx
shr eax, 0x10
mov cl, ah
and ecx, 0xff
mov eax, ecx
and esi, 0xffff
cmp esi, eax
je 0x551e0e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [ebx + 0x8cea]
mov ecx, dword [ebx + 0xab2]
cmp eax, ecx
jbe 0x551e20
mov eax, ecx
mov esi, dword [ebx + 0x8ce6]
mov edx, eax
dec eax
test edx, edx
je 0x551e4c
lea edi, [eax + 1]
call fcn.00557c40
mov ebx, eax
xor eax, eax
mov al, byte [esi]
xor ebx, eax
push ebx
call fcn.00557c70
add esp, 4
mov byte [esi], bl
inc esi
dec edi
jne 0x551e30
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x557c70
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [0x678680]
push eax
call dword [fcn.005b71ec]
test eax, eax
je 0x557ce8
mov edx, dword [eax + 0xcca]
push esi
mov esi, dword [esp + 8]
mov ecx, edx
xor ecx, esi
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x62445c]
xor ecx, edx
mov edx, dword [eax + 0xcce]
mov dword [eax + 0xcca], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [eax + 0xcd2]
imul ecx, ecx, 0x8088405
inc ecx
mov esi, edx
mov dword [eax + 0xcce], ecx
and esi, 0xff
shr ecx, 0x18
xor ecx, esi
pop esi
shr edx, 8
mov ecx, dword [ecx*4 + 0x62445c]
xor ecx, edx
mov dword [eax + 0xcd2], ecx
ret

Function at 0x557d40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
mov edx, ecx
dec ecx
mov eax, dword [edi + 0x8cde]
test edx, edx
je 0x557d87
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x62445c]
xor eax, edx
inc ecx
dec esi
jne 0x557d5f
pop esi
mov dword [edi + 0x8cde], eax
pop ebx
pop edi
ret
mov dword [edi + 0x8cde], eax
pop edi
ret
Function at 0x55eca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
jne 0x55ecb0
or eax, 0xffffffff
pop esi
not eax
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov esi, edx
dec edx
mov eax, dword [eax + 0x3d2a]
test esi, esi
not eax
je 0x55ecea
push edi
lea esi, [edx + 1]
xor edx, edx
mov edi, eax
mov dl, byte [ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x6266c0]
xor eax, edx
inc ecx
dec esi
jne 0x55eccb
pop edi
not eax
pop esi
ret