joyce8/EMBER2024-capa huggingface dataset:
Function at 0x549280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585926
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
mov eax, 0xa
push edi
mov dword [esp + 0x18], esi
mov dword [esi + 8], 0x5a4744
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esi + 0x24], 0x5a4730
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0x11
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], eax
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x14
mov byte [esp + 0x28], 1
mov byte [esi + 0x40], al
mov byte [esi + 0x41], cl
mov byte [esi + 0x48], bl
call fcn.00462ec0
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x10], 1
call dword [0x5882e4]
cmp dword [0x5d3398], ebx
jne 0x549336
mov dword [0x5d3398], edi
mov dword [edi], ebx
mov edx, dword [0x5d3398]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x5d3394]
inc ecx
mov dword [0x5d3394], ecx
lea ecx, [esp + 0x14]
call dword [0x5882e8]
cmp ebp, ebx
je 0x54935a
push ebp
call fcn.00462eb4
add esp, 4
mov edi, dword [0x5d3398]
push 0x14
call fcn.00462ec0
mov dword [eax + 4], edi
mov dword [eax + 0x10], ebx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x44]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x5a472c
mov dword [esi + 4], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x54d070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585d38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [0x588488]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x54d0b3
mov eax, dword [esi]
jmp 0x54d0b5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
push edi
call dword [ecx + 0x6c]
test eax, eax
jge 0x54d0d1
push 0x5cdb00
push edi
push eax
call fcn.00464032
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x54d131
lea eax, [esi + 8]
push eax
call dword [0x58724c]
test eax, eax
jne 0x54d131
mov eax, dword [esi]
test eax, eax
je 0x54d118
push eax
call dword [0x588484]
mov eax, dword [esi + 4]
test eax, eax
je 0x54d128
push eax
call fcn.00462eb4
add esp, 4
push esi
call fcn.00462eb4
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x54d500
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x585e39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [esp + 0x1c], 1
mov ecx, edi
call fcn.00462ea8
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call fcn.00462ea8
lea ebx, [esi + 0x10]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call fcn.00462ea8
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 4
call fcn.00462ea8
push 0x5cf4fc
mov ecx, ebx
mov byte [esp + 0x20], 5
call fcn.00462f32
lea eax, [esp + 0x28]
lea ecx, [esi + 0x14]
push eax
call fcn.00462ed8
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1c], ecx
xor ebx, ebx
push 0x5c9a58
lea ecx, [esp + 0x28]
mov dword [esi], edx
mov dword [esi + 0x18], ebx
call fcn.005615d4
push 0x5c
lea ecx, [esp + 0x28]
call fcn.00463058
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call fcn.004630a0
push eax
mov ecx, ebp
mov byte [esp + 0x20], 6
call fcn.00462ed8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 5
call fcn.00462da6
push 0x5c9a58
mov ecx, ebp
call fcn.00463442
mov ecx, dword [esp + 0x24]
push 0x5c
mov ebp, dword [ecx - 8]
lea ecx, [esp + 0x28]
call fcn.00463058
sub ebp, eax
lea edx, [esp + 0x2c]
push ebp
push edx
lea ecx, [esp + 0x2c]
call fcn.00463034
push eax
mov ecx, edi
mov byte [esp + 0x20], 7
call fcn.00462ed8
mov byte [esp + 0x1c], 5
lea ecx, [esp + 0x2c]
call fcn.00462da6
push 0x5c9a58
mov ecx, edi
call fcn.005615d4
push 0x5c9a58
mov ecx, edi
call fcn.00463442
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.0054d6f0
lea ecx, [esp + 0x2c]
call fcn.00462da6
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.00462da6
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00462da6
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x54f8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5861f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005615f2
xor edi, edi
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esi], 0x5a4a88
call fcn.005615ec
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x556050
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
mov ebx, dword [esp + 0x5c]
mov ecx, dword [eax]
cmp ebx, 1
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], edx
jae 0x55609f
lea eax, [esp + 0x60]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0x64], str.Incorrect_key_length
call fcn.00463e5c
lea ecx, [esp + 0x10]
push 0x5c44b8
push ecx
call fcn.00463e62
cmp ebx, 0x38
jbe 0x5560a9
mov ebx, 0x38
mov ecx, ebx
push esi
mov esi, dword [esp + 0x5c]
mov edx, ecx
push edi
lea edi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp + 0x10]
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x5a5670
mov edi, edx
mov dword [esp + 0x64], 0x12
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x58]
mov ecx, 0x400
mov esi, 0x5a56b8
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
mov esi, edx
xor edx, edx
mov dword [esp + 0x68], 4
mov edi, edx
xor edx, edx
mov dl, byte [ecx]
shl edi, 8
or edx, edi
inc ecx
inc eax
cmp eax, ebx
jne 0x556114
xor eax, eax
lea ecx, [esp + 0x24]
mov edi, dword [esp + 0x68]
dec edi
mov dword [esp + 0x68], edi
jne 0x5560fd
mov edi, dword [esi]
add esi, 4
xor edi, edx
mov edx, dword [esp + 0x64]
mov dword [esi - 4], edi
dec edx
mov dword [esp + 0x64], edx
jne 0x5560f3
xor edi, edi
lea esi, [ebp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.005561c0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x12
jb 0x556141
lea eax, [ebp + 0x58]
mov dword [esp + 0x68], 4
mov ebx, eax
xor edi, edi
mov esi, ebx
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.005561c0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x100
jl 0x556177
mov eax, dword [esp + 0x68]
add ebx, 0x400
dec eax
mov dword [esp + 0x68], eax
jne 0x556173
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x558ab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x558acb
cmp ebx, 8
jg 0x558acb
mov eax, 1
jmp 0x558acd
xor eax, eax
mov esi, dword [esp + 0x14]
push str.bad_pack_level
push eax
push esi
call fcn.00557330
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x558b04
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x5a791a]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x5a7918]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x5a791c]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x5a791e]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x558b65
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x558b71
cmp ebx, 8
jl 0x558b71
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x558bea
cmp eax, 0xffffffff
je 0x558bea
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x558bb5
push esi
call fcn.00558e00
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x558bbd
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x559e80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x559e8b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x559f8e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5a7968]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5a7968]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5a7968]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5a7968]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5a7968]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5a7968]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5a7968]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5a7968]
xor eax, edx
inc ecx
dec edi
jne 0x559ea6
pop edi
test esi, esi
je 0x559fb0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5a7968]
xor eax, edx
inc ecx
dec esi
jne 0x559f92
pop esi
pop ebx
not eax
ret

Function at 0x559fc0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x5a7968]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x5a7968]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x55a1f0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x4c]
push eax
push esi
call dword [0x5871a0]
test eax, eax
jne 0x55a212
mov eax, 0x200
pop esi
add esp, 0x44
ret
mov eax, dword [esp + 0x14]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x55a225
mov ebp, 1
test al, 2
je 0x55a22c
or ebp, 2
test al, 4
je 0x55a233
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x55a23d
or ebp, 0x10
test al, 0x20
je 0x55a244
or ebp, 0x20
test ecx, ecx
je 0x55a250
or ebp, 0x40000000
jmp 0x55a256
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x55a266
or ebp, 0x800000
push ebx
push edi
push 0
push esi
call dword [0x587204]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x55a315
mov edi, dword [0x5871e8]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x587200]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x60]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x58], 0x54ad
jne 0x55a315
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x55a315
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x55a30f
cmp eax, 0x454e
je 0x55a30f
cmp eax, 0x454c
je 0x55a30f
cmp eax, 0x4550
jne 0x55a315
or ebp, 0x400000
mov eax, dword [esp + 0x5c]
pop edi
test eax, eax
pop ebx
je 0x55a321
mov dword [eax], ebp
mov eax, dword [esp + 0x58]
pop ebp
test eax, eax
je 0x55a330
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x58]
test esi, esi
je 0x55a379
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0055a150
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x34]
push edx
push eax
call fcn.0055a150
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.0055a150
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x55a3b8
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
call fcn.0055a180
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x55d590
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x55d59b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x55d69e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5a7968]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5a7968]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5a7968]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5a7968]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5a7968]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5a7968]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5a7968]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5a7968]
xor eax, edx
inc ecx
dec edi
jne 0x55d5b6
pop edi
test esi, esi
je 0x55d6c0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5a7968]
xor eax, edx
inc ecx
dec esi
jne 0x55d6a2
pop esi
pop ebx
not eax
ret

Function at 0x55d6d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x5a7968]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x5a7968]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x55ede0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jne 0x55edfc
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x55ee0d
pop edi
pop esi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x55ee1b
push edi
call fcn.0055f200
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call fcn.0055ebe0
add esp, 0x10
test eax, eax
je 0x55ee43
pop edi
pop esi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push 0x84
call fcn.00462ec0
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x55ee62
pop edi
pop esi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call fcn.00462ec0
mov dword [esi], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x55ee9b
push esi
call fcn.00462eb4
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x55eee9
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0055d960
add esp, 4
test eax, eax
jne 0x55eee9
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x55ef16
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x55ef22
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
neg cl
sbb ecx, ecx
mov dword [ebx], 0x12345678
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x78], 0x34567890
je 0x55ef63
mov al, byte [ebp]
test al, al
je 0x55ef63
push eax
push ebx
call fcn.0055d6d0
add esp, 8
inc ebp
jne 0x55ef4f
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
pop ebp
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x56be90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x57afd2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [0x5d1700]
push ebx
push esi
push edi
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.004e4400
add esp, 0xc
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
xor edi, edi
call fcn.00462ea8
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x2c]
push eax
push str._sBCGToolbarParameters
push ecx
mov byte [esp + 0x30], 1
call fcn.00463094
add esp, 0xc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
push ebx
push ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.004e4350
mov esi, eax
mov eax, dword [esp + 0x2c]
push eax
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x20]
test eax, eax
je 0x56c06a
mov eax, dword [0x5cbbe4]
mov edx, dword [esi]
push eax
push str.Tooltips
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5cbbe8]
mov edx, dword [esi]
push eax
push str.ShortcutKeys
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5d1e40]
mov edx, dword [esi]
push eax
push str.LargeIcons
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5d21b4]
mov edx, dword [esi]
push eax
push str.MenuAnimation
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5cccb8]
mov edx, dword [esi]
push eax
push str.RecentlyUsedMenus
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5cccc0]
mov edx, dword [esi]
push eax
push str.MenuShadows
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5cccbc]
mov edx, dword [esi]
push eax
push str.ShowAllMenusAfterDelay
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [0x5d1f54]
cmp eax, ebx
jne 0x56c038
mov ecx, dword [0x5d1f58]
cmp ecx, ebx
jne 0x56c017
push 0x60
call fcn.00462ec0
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x24], 3
je 0x56c00e
push ebx
mov ecx, eax
call fcn.004a07e0
mov byte [esp + 0x24], 2
jmp 0x56c01c
xor eax, eax
mov byte [esp + 0x24], 2
jmp 0x56c01c
call fcn.00463754
mov dword [0x5d1f54], eax
mov dword [eax + 0x5c], 1
mov ecx, dword [0x5d1f54]
mov edx, dword [ecx]
call dword [edx + 0x18]
mov eax, dword [0x5d1f54]
mov eax, dword [eax + 4]
mov edx, dword [esi]
push eax
push str.Look2000
mov ecx, esi
call dword [edx + 0x68]
test eax, eax
je 0x56c068
mov eax, dword [esi]
push 0x5d1708
push str.CommandsUsage
mov ecx, esi
call dword [eax + 0x38]
test eax, eax
je 0x56c068
mov edi, 1
jmp 0x56c06a
xor edi, edi
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x24], 1
cmp ecx, ebx
je 0x56c07e
mov edx, dword [ecx]
push 1
call dword [edx + 4]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], bl
call fcn.00462da6
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.00462da6
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret