joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ecd0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x59c6b8]
xor eax, esp
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
xor edx, edx
push esi
mov esi, dword [esp + 0x7c]
cmp ecx, edx
jl 0x40ed4d
push ecx
push eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], edx
call fcn.0040eb20
lea ecx, [esp + 0x10]
push ecx
call fcn.0040eba0
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esi], edx
mov edx, dword [esp + 0x78]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
add esp, 0x10
mov dword [esi + 0xc], edx
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.00511afd
add esp, 0x6c
ret

Function at 0x411ff0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x41201c
push edi
mov edi, edi
movsx edx, dl
mov edi, eax
shl edi, 4
and edx, 0xff
add edi, eax
add edx, edi
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x412000
pop edi
mov ecx, dword [ecx + 0xc]
lea ecx, [ecx + ecx - 1]
xor edx, edx
div ecx
pop esi
mov eax, edx
ret 4

Function at 0x412080
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
add eax, eax
push 0x20
push eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
push eax
call fcn.004a3110
mov ecx, dword [esi + 0xc]
push 4
lea edx, [ecx + ecx - 1]
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
push edx
push eax
call fcn.004a3110
mov ecx, dword [esi + 0xc]
add ecx, ecx
lea edx, [ecx*4 - 4]
push edx
xor edi, edi
push edi
push eax
mov dword [esi + 8], eax
call fcn.00512510
add esp, 0x24
mov dword [esp + 8], edi
cmp dword [esi + 0x10], edi
jle 0x412134
push ebx
push ebp
mov ecx, dword [esi + 4]
mov edx, dword [edi + ecx]
lea ebx, [edi + ecx]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x412102
movsx ecx, cl
mov ebp, eax
shl ebp, 4
and ecx, 0xff
add ebp, eax
add ecx, ebp
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4120e7
mov edx, dword [esi + 0xc]
lea ecx, [edx + edx - 1]
xor edx, edx
div ecx
mov eax, dword [esi + 8]
mov ecx, dword [eax + edx*4]
mov dword [ebx + 0x18], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
add eax, edi
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x10]
inc eax
add edi, 0x20
mov dword [esp + 0x10], eax
cmp eax, dword [esi + 0x10]
jl 0x4120d6
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x422780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52dabb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi], vtable.GfxFont.0
mov dword [esi + 0x98], 0
call fcn.00511699
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x4227dc
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.004a1c90
jmp 0x4227de
xor eax, eax
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x24], eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x429be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52aa66
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
cmp dword [edi + 0xc], 4
mov dword [esp + 0x10], 0xd
je 0x429c40
push str.Bad_Separation_color_space
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.00412330
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x10]
push eax
push 1
mov ecx, edi
call fcn.00408350
cmp dword [eax], 4
je 0x429c84
push str.Bad_Separation_color_space__name_
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.00412330
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.0044ea50
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
push 8
call fcn.00511699
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x429cae
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, eax
call fcn.004a1c90
mov ebx, eax
jmp 0x429cb0
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.0044ea50
lea edx, [esp + 0x10]
push edx
push 2
mov ecx, edi
call fcn.00408350
mov eax, dword [esp + 0x34]
inc eax
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0042f5a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x429cfd
push str.Bad_Separation_color_space__alternate_color_space_
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.00412330
add esp, 0x10
jmp 0x429d33
lea ecx, [esp + 0x10]
call fcn.0044ea50
lea edx, [esp + 0x10]
push edx
push 3
mov ecx, edi
call fcn.00408350
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00415540
mov edi, eax
add esp, 8
test edi, edi
jne 0x429d65
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
test ebx, ebx
je 0x429d47
mov ecx, ebx
call fcn.004a1da0
push ebx
call fcn.0051163f
add esp, 4
lea ecx, [esp + 0x10]
call fcn.0044ea50
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea ecx, [esp + 0x10]
call fcn.0044ea50
push 0x18
call fcn.00511699
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 1
test eax, eax
je 0x429c2b
push edi
push esi
push ebx
mov ecx, eax
call fcn.004299d0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x42aa50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52ab38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi + 4], 1
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esi], vtable.GfxTilingPattern.0
mov dword [esi + 0x40], 0xd
mov dword [esi + 0x80], 0xd
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x40]
mov dword [esi + 0xc], edx
fld qword [eax]
fstp qword [esi + 0x10]
lea edi, [esi + 0x80]
fld qword [eax + 8]
push ecx
mov ecx, dword [ebp + 0x24]
fstp qword [esi + 0x18]
fld qword [eax + 0x10]
mov dword [esp + 0x24], 0
fstp qword [esi + 0x20]
fld qword [eax + 0x18]
fstp qword [esi + 0x28]
fld qword [ebp + 0x14]
fstp qword [esi + 0x30]
fld qword [ebp + 0x1c]
fstp qword [esi + 0x38]
call fcn.0044e950
mov eax, dword [ebp + 0x28]
fld qword [eax]
mov ecx, dword [ebp + 0x2c]
fstp qword [esi + 0x50]
push edi
fld qword [eax + 8]
fstp qword [esi + 0x58]
fld qword [eax + 0x10]
fstp qword [esi + 0x60]
fld qword [eax + 0x18]
fstp qword [esi + 0x68]
fld qword [eax + 0x20]
fstp qword [esi + 0x70]
fld qword [eax + 0x28]
fstp qword [esi + 0x78]
call fcn.0044e950
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x28
Function at 0x436a90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, dword [ecx]
jmp 0x44d210
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov dl, byte [ebp]
push esi
xor eax, eax
push edi
mov esi, ebp
test dl, dl
je 0x44d23e
movsx edx, dl
mov edi, eax
shl edi, 4
and edx, 0xff
add edi, eax
add edx, edi
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x44d223
mov edi, dword [ecx + 4]
xor edx, edx
div edi
mov esi, dword [ecx]
mov eax, dword [esi + edx*8]
test eax, eax
je 0x44d289
mov edi, edi
mov ecx, ebp
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x44d272
test bl, bl
je 0x44d26e
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x44d272
add eax, 2
add ecx, 2
test bl, bl
jne 0x44d252
xor eax, eax
jmp 0x44d277
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d292
inc edx
cmp edx, edi
jne 0x44d282
xor edx, edx
mov eax, dword [esi + edx*8]
test eax, eax
jne 0x44d250
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
mov eax, dword [esi + edx*8 + 4]
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x44bb40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52bb48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x40]
mov eax, 0xd
mov dword [esi], vtable.LinkLaunch.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
cmp dword [edi], 7
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
jne 0x44bc68
mov ecx, dword [edi + 8]
push 0
lea eax, [esp + 0x14]
push eax
push 0x5317f0
call fcn.00412200
cmp dword [eax], 5
lea ecx, [esp + 0x10]
je 0x44bbcf
push ecx
call fcn.0044b240
add esp, 4
mov dword [esi + 4], eax
jmp 0x44bc5f
call fcn.0044ea50
mov ecx, dword [edi + 8]
push 0
lea edx, [esp + 0x14]
push edx
push 0x545d10
call fcn.00412200
cmp dword [eax], 7
jne 0x44bc4c
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x24]
push eax
push 0x5317f0
call fcn.00412200
lea ecx, [esp + 0x20]
push ecx
call fcn.0044b240
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esi + 4], eax
call fcn.0044ea50
mov ecx, dword [esp + 0x18]
push 0
lea edx, [esp + 0x24]
push edx
push 0x532e54
call fcn.00412200
cmp dword [eax], 3
jne 0x44bc41
mov ecx, dword [esp + 0x28]
call fcn.00401000
mov dword [esi + 8], eax
lea ecx, [esp + 0x20]
call fcn.0044ea50
jmp 0x44bc5f
push str.Bad_launch_type_link_action
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call fcn.00412330
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.0044ea50
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
Function at 0x44d0a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
cmp dword [esi + 8], eax
jl 0x44d15d
mov ebp, dword [esi]
lea eax, [edi + edi + 1]
push 8
push eax
mov dword [esp + 0x18], ebp
mov dword [esi + 4], eax
call fcn.004a30a0
mov dword [esi], eax
xor eax, eax
add esp, 8
cmp dword [esi + 4], eax
jle 0x44d0ef
jmp 0x44d0e0
mov ecx, dword [esi]
mov dword [ecx + eax*8], 0
inc eax
cmp eax, dword [esi + 4]
jl 0x44d0e0
test edi, edi
jle 0x44d154
mov edx, dword [ebp]
test edx, edx
je 0x44d14a
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x44d11d
movsx ecx, cl
mov ebx, eax
shl ebx, 4
and ecx, 0xff
add ebx, eax
add ecx, ebx
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x44d102
mov ecx, dword [esi + 4]
xor edx, edx
div ecx
mov eax, dword [esi]
cmp dword [eax + edx*8], 0
je 0x44d13d
mov ebx, eax
mov edi, edi
inc edx
cmp edx, ecx
jne 0x44d137
xor edx, edx
cmp dword [ebx + edx*8], 0
jne 0x44d130
mov ecx, dword [ebp]
mov dword [eax + edx*8], ecx
mov ecx, dword [ebp + 4]
mov dword [eax + edx*8 + 4], ecx
add ebp, 8
dec edi
jne 0x44d0f3
mov ebp, dword [esp + 0x10]
push ebp
call fcn.004a2fd0
add esp, 4
mov edx, dword [esp + 0x18]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x44d18b
lea esp, [esp]
movsx ecx, cl
mov edi, eax
shl edi, 4
and ecx, 0xff
add edi, eax
add ecx, edi
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x44d170
mov ebp, dword [esi + 4]
xor edx, edx
div ebp
mov ebx, dword [esi]
mov edi, edx
cmp dword [ebx + edi*8], 0
je 0x44d1e5
lea esp, [esp]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx + edi*8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44d1c7
test dl, dl
je 0x44d1c3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44d1c7
add eax, 2
add ecx, 2
test dl, dl
jne 0x44d1a7
xor eax, eax
jmp 0x44d1cc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d1df
inc edi
cmp edi, ebp
jne 0x44d1d7
xor edi, edi
mov edx, ebx
cmp dword [edx + edi*8], 0
jne 0x44d1a0
cmp dword [ebx + edi*8], 0
jne 0x44d1f7
mov eax, dword [esp + 0x18]
push eax
call fcn.004a3170
mov ecx, dword [esi]
add esp, 4
mov dword [ecx + edi*8], eax
mov edx, dword [esi]
mov eax, dword [esp + 0x1c]
mov dword [edx + edi*8 + 4], eax
inc dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x450e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52bfd6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], 0xd
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi], eax
mov edi, dword [eax]
lea ecx, [edi + 1]
push 2
push ecx
call fcn.004a30a0
mov dword [esi + 4], eax
add esp, 8
xor eax, eax
cmp edi, ebx
jle 0x450f0e
mov edx, dword [esi]
mov ecx, dword [edx + 4]
movsx dx, byte [eax + ecx]
mov ecx, 0xff
and dx, cx
mov ecx, dword [esi + 4]
mov word [ecx + eax*2], dx
inc eax
cmp eax, edi
jl 0x450ef0
mov edx, dword [esi + 4]
xor eax, eax
mov word [edx + edi*2], ax
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x544518
push eax
call fcn.00513e32
add esp, 8
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x450fe0
mov edi, dword [esi]
push 8
call fcn.00511699
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], ebx
cmp eax, ebx
je 0x450f59
push edi
mov ecx, eax
call fcn.004a1d60
mov edi, eax
jmp 0x450f5b
xor edi, edi
mov ecx, edi
mov dword [esp + 0x28], 0xffffffff
call fcn.004a22b0
mov eax, dword [edi + 4]
push 0x544518
push eax
call fcn.00513e32
add esp, 8
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x450fd0
mov ecx, edi
call fcn.004a2260
mov eax, dword [edi + 4]
push 0x544518
push eax
call fcn.00513e32
add esp, 8
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x450fd0
mov ecx, dword [esi]
push ecx
push str.Couldnt_open_file_0:t
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
call fcn.00412330
add esp, 0x14
mov ecx, edi
call fcn.004a1da0
push edi
call fcn.0051163f
add esp, 4
mov dword [esi + 0x34], 1
jmp 0x45103d
mov ecx, edi
call fcn.004a1da0
push edi
call fcn.0051163f
add esp, 4
push 0x158
mov dword [esp + 0x14], 5
call fcn.00511699
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], 1
cmp eax, ebx
je 0x45101c
mov ecx, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov ecx, eax
call fcn.0046ae60
jmp 0x45101e
xor eax, eax
mov edx, dword [esp + 0x38]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.00450d60
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x451ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52c05b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x59c6b8]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
push 8
call fcn.00511699
add esp, 4
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x28], esi
cmp eax, esi
je 0x451f28
mov ecx, eax
call fcn.004a1c60
mov ebx, eax
jmp 0x451f2a
xor ebx, ebx
mov eax, dword [edi + 4]
mov al, byte [eax]
sub al, 0x30
mov dword [esp + 0x28], 0xffffffff
cmp al, 9
ja 0x451f46
push 0x66
mov ecx, ebx
call fcn.004a1dd0
cmp dword [edi], esi
jle 0x451fbf
lea ebx, [ebx]
mov ecx, dword [edi + 4]
mov al, byte [esi + ecx]
mov byte [esp + 0x10], al
lea edx, [eax - 0x21]
cmp dl, 0x5d
ja 0x451f98
cmp al, 0x28
je 0x451f98
cmp al, 0x29
je 0x451f98
cmp al, 0x3c
je 0x451f98
cmp al, 0x3e
je 0x451f98
cmp al, 0x5b
je 0x451f98
cmp al, 0x5d
je 0x451f98
cmp al, 0x7b
je 0x451f98
cmp al, 0x7d
je 0x451f98
cmp al, 0x2f
je 0x451f98
cmp al, 0x25
je 0x451f98
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
call fcn.004a1dd0
jmp 0x451fba
movzx ecx, al
push ecx
lea edx, [esp + 0x18]
push str._02x
push edx
call fcn.00514164
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.004a1e60
inc esi
cmp esi, dword [edi]
jl 0x451f50
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00511afd
add esp, 0x1c
ret 4
Function at 0x462900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52c85b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov ecx, dword [edi + 8]
push 0
lea eax, [esp + 0x10]
push eax
push str.Filter
mov dword [esp + 0x18], 0xd
call fcn.00412200
cmp dword [esp + 0xc], 4
jne 0x4629e0
mov esi, dword [esp + 0x14]
mov ecx, str.Standard
mov eax, esi
jmp 0x462960
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x462980
test dl, dl
je 0x46297c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x462980
add eax, 2
add ecx, 2
test dl, dl
jne 0x462960
xor eax, eax
jmp 0x462985
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4629ca
push 0x5c
call fcn.00511699
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0
test eax, eax
je 0x4629bc
mov ecx, dword [esp + 0x2c]
push edi
push ecx
mov ecx, eax
call fcn.00461e50
mov dword [esp + 0x24], 0xffffffff
mov esi, eax
jmp 0x4629f5
xor eax, eax
mov dword [esp + 0x24], 0xffffffff
mov esi, eax
jmp 0x4629f5
push esi
push str.Couldnt_find_the_0:s_security_handler
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.00412330
add esp, 0x14
jmp 0x4629f3
push str.Missing_or_invalid_Filter_entry_in_encryption_dictionary
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.00412330
add esp, 0x10
xor esi, esi
lea ecx, [esp + 0xc]
call fcn.0044ea50
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x465130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x52c96b
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push 0x20
setne al
mov dword [esp + 0x44], eax
call fcn.00511699
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x80], ebx
cmp eax, ebx
je 0x465190
mov ecx, eax
call fcn.0048c190
mov dword [esp + 0x38], eax
jmp 0x465194
mov dword [esp + 0x38], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x3c], ebx
cmp dword [eax + 0x1c], ebx
jle 0x465285
mov ecx, dword [eax + 0x18]
mov edi, dword [ecx + ebx*4]
mov edx, dword [esp + 0x40]
cmp dword [edi + 0xc], edx
jle 0x465274
mov eax, dword [edi + 4]
fld qword [eax]
mov ecx, dword [edi]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ecx]
mov ecx, dword [esp + 0x48]
fstp qword [esp]
call fcn.0048c2b0
mov esi, 1
cmp dword [edi + 0xc], esi
jle 0x465263
lea ebx, [esi + 0x17]
jmp 0x4651f0
mov edx, dword [edi + 8]
cmp dword [edx + esi*4], 0
mov eax, dword [edi + 4]
mov ecx, dword [edi]
je 0x46523d
fld qword [ebx + eax]
sub esp, 0x30
fstp qword [esp + 0x28]
fld qword [ebx + ecx]
fstp qword [esp + 0x20]
fld qword [eax + esi*8 + 8]
fstp qword [esp + 0x18]
fld qword [ecx + esi*8 + 8]
fstp qword [esp + 0x10]
fld qword [eax + esi*8]
fstp qword [esp + 8]
fld qword [ecx + esi*8]
mov ecx, dword [esp + 0x68]
fstp qword [esp]
call fcn.0048c370
add esi, 3
add ebx, 0x18
jmp 0x46525a
fld qword [eax + esi*8]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ecx + esi*8]
mov ecx, dword [esp + 0x48]
fstp qword [esp]
call fcn.0048c310
inc esi
add ebx, 8
cmp esi, dword [edi + 0xc]
jl 0x4651f0
mov ebx, dword [esp + 0x3c]
cmp dword [edi + 0x14], 0
je 0x465274
mov ecx, dword [esp + 0x38]
push 0
call fcn.0048c430
mov eax, dword [ebp + 0xc]
inc ebx
mov dword [esp + 0x3c], ebx
cmp ebx, dword [eax + 0x1c]
jl 0x4651af
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x467230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x52ca8e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.SplashOutputDev.0
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], edx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], eax
cmp eax, ebx
je 0x4672a6
mov ecx, dword [0x59da88]
call fcn.004377b0
test eax, eax
je 0x4672a6
cmp dword [esi + 0x68], ebx
je 0x4672a6
lea eax, [ebx + 1]
jmp 0x4672a8
xor eax, eax
fld qword [0x534990]
sub esp, 0x10
fst qword [esp + 8]
mov ecx, esi
fstp qword [esp]
mov dword [esi + 0x80], eax
call fcn.00463ae0
mov eax, dword [esp + 0x30]
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax]
mov byte [esi + 0x88], cl
movzx edx, byte [eax + 1]
lea edi, [esi + 0x88]
mov byte [edi + 1], dl
movzx ecx, byte [eax + 2]
mov byte [edi + 2], cl
movzx edx, byte [eax + 3]
mov byte [edi + 3], dl
push 0x18
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
call fcn.00511699
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x20], 1
cmp eax, ebx
je 0x467341
mov ebp, dword [esi + 0x68]
mov ecx, dword [esi + 0x70]
xor edx, edx
cmp ebp, ebx
push ecx
mov ecx, dword [esi + 0x6c]
setne dl
push edx
push ebp
push ecx
push 1
push 1
mov ecx, eax
call fcn.0048be50
jmp 0x467343
xor eax, eax
push 0x148
mov byte [esp + 0x24], bl
mov dword [esi + 0xc4], eax
call fcn.00511699
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x20], 2
cmp eax, ebx
je 0x467385
mov ecx, dword [esi + 0x80]
lea edx, [esi + 0x90]
push edx
mov edx, dword [esi + 0xc4]
push ecx
push edx
mov ecx, eax
call fcn.0047fff0
jmp 0x467387
xor eax, eax
mov dword [esi + 0xc8], eax
mov ecx, dword [0x59da88]
mov byte [esp + 0x20], bl
call fcn.00437960
mov eax, dword [esi + 0xc8]
fstp qword [eax + 0x120]
mov ecx, dword [0x59da88]
call fcn.00437810
mov ecx, dword [esi + 0xc8]
push eax
call fcn.00480410
mov ecx, dword [esi + 0xc8]
push ebx
push edi
call fcn.00480540
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18