joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1501cba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x150fed8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebx], sym.Core.dll_const_FArchive::vftable
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x38], eax
mov dword [ebp - 4], 0
lea esi, [ebx + 0x3c]
mov dword [ebx], sym.Core.dll_const_FBitWriter::vftable
mov ecx, esi
mov dword [ebp + 8], esi
mov eax, dword [edi + 0x40]
push 1
mov dword [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call sym.Core.dll_protected:_void___thiscall_FArray::Realloc_int_
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [edi + 0x3c]
push dword [esi]
call fcn.1504c860
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [ebx + 0x4c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1501cfc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x150fedeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebx], sym.Core.dll_const_FArchive::vftable
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x38], eax
mov dword [ebp - 4], 0
lea esi, [ebx + 0x3c]
mov dword [ebx], sym.Core.dll_const_FBitReader::vftable
mov ecx, esi
mov dword [ebp + 8], esi
mov eax, dword [edi + 0x40]
push 1
mov dword [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call sym.Core.dll_protected:_void___thiscall_FArray::Realloc_int_
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [edi + 0x3c]
push dword [esi]
call fcn.1504c860
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [ebx + 0x4c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1501d0b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x150fee1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebx], sym.Core.dll_const_FArchive::vftable
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x38], eax
mov dword [ebp - 4], 0
lea esi, [ebx + 0x3c]
mov dword [ebx], sym.Core.dll_const_FBitReader::vftable
mov ecx, esi
mov dword [ebp + 8], esi
mov eax, dword [edi + 0x40]
push 1
mov dword [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call sym.Core.dll_protected:_void___thiscall_FArray::Realloc_int_
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [edi + 0x3c]
push dword [esi]
call fcn.1504c860
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [ebx + 0x4c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x150204c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x150ff01e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], sym.Core.dll_const_FSingletonBase::vftable
mov dword [ebp - 4], 0
mov dword [esi], sym.Core.dll_const_TSingleton_class_L2Configuration_::vftable
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov dword [esi], sym.Core.dll_const_L2Configuration::vftable
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ecx + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ecx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ecx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [ecx + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [ecx + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [ecx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ecx + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [ecx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ecx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ecx + 0x68]
mov dword [esi + 0x68], eax
mov eax, dword [ecx + 0x6c]
mov dword [esi + 0x6c], eax
mov eax, dword [ecx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ecx + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [ecx + 0x78]
mov dword [esi + 0x78], eax
mov eax, dword [ecx + 0x7c]
mov dword [esi + 0x7c], eax
mov eax, dword [ecx + 0x80]
mov dword [esi + 0x80], eax
lea eax, [ecx + 0x84]
push eax
lea ecx, [esi + 0x84]
call fcn.150240d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x150306c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
je 0x150306e9
push ecx
mov dword [esp], 0
call sym.Core.dll_void___cdecl_appSleep_float_
add esp, 4
cmp dword [edi + 0x54], 0
jne 0x150306d3
mov ecx, dword [edi + 0x48]
mov edx, 0x400
mov esi, dword [edi + 0x44]
mov eax, ecx
inc dword [edi + 0x54]
and eax, 0x3ff
sub edx, eax
mov dword [edi + 0x4c], ecx
sub esi, ecx
mov dword [esp + 0xc], 0
cmp dword [ebp + 8], edx
lea eax, [esp + 0xc]
push 0
cmovle edx, dword [ebp + 8]
cmp edx, esi
push eax
cmovle esi, edx
lea eax, [edi + 0x58]
push esi
push eax
push dword [edi + 0x3c]
mov dword [edi + 0x50], esi
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
mov esi, eax
cmp ecx, dword [edi + 0x50]
je 0x15030766
push 0
mov dword [edi + 0x2c], 1
call sym.Core.dll_wchar_t_const____cdecl_appGetSystemErrorMessage_int_
add esp, 4
push eax
push dword [edi + 0x50]
push dword [esp + 0x14]
push esi
push 0x15118b88
push dword [edi + 0x40]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0x18
dec dword [edi + 0x54]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x15030930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
jle 0x15030a20
mov eax, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x50]
sub edi, dword [esi + 0x48]
add edi, dword [esi + 0x4c]
cmp ebx, edi
cmovle edi, ebx
test edi, edi
jne 0x150309a2
cmp ebx, 0x400
jae 0x150309d6
push 0x7fffffff
mov ecx, esi
call fcn.150306c0
mov edi, dword [esi + 0x50]
mov eax, dword [esi + 0x48]
sub edi, eax
add edi, dword [esi + 0x4c]
cmp ebx, edi
cmovle edi, ebx
test edi, edi
jg 0x1503099c
push dword [esi + 0x44]
mov dword [esi + 0x2c], 1
push ebx
push eax
push 0x15118cec
push dword [esi + 0x40]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0x14
cmp dword [esi + 0x2c], 0
jne 0x15030a1f
mov eax, dword [esi + 0x48]
sub eax, dword [esi + 0x4c]
add eax, 0x58
push edi
add eax, esi
push eax
push dword [ebp + 8]
call fcn.1504c860
mov eax, dword [ebp + 8]
sub ebx, edi
add dword [esi + 0x48], edi
add eax, edi
add esp, 0xc
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x15030946
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push ebx
push eax
push dword [esi + 0x3c]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x15030a19
push 0
mov dword [esi + 0x2c], 1
call sym.Core.dll_wchar_t_const____cdecl_appGetSystemErrorMessage_int_
push eax
push ebx
push dword [ebp + 8]
push edi
push 0x15118c68
push dword [esi + 0x40]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0x1c
add dword [esi + 0x48], ebx
add dword [esi + 0x4c], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x15030a80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x151011e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
call sym.Core.dll_public:_void___thiscall_FArchive::constructor_void_
mov dword [ebp - 4], 0
mov dword [edi], 0x15119488
mov byte [ebp - 4], 1
mov dword [edi + 0x1c], 1
mov dword [edi + 0x10], 1
mov dword [edi + 0x40], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], 0xac
mov edx, 0x15118d28
mov ecx, 0x458
call fcn.15031720
mov ebx, eax
test ebx, ebx
je 0x15030b12
push 0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push dword [ebp + 0xc]
push esi
mov ecx, ebx
call fcn.15030510
jmp 0x15030b14
xor eax, eax
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x15030b23
mov byte [ebp - 4], al
jmp 0x15030bd9
mov ebx, 1
cmp dword [ebp + 0x10], 0x18
jbe 0x15030bc8
xor esi, esi
mov dword [ebp - 0x14], esi
cmp esi, 0xb
jae 0x15030b5b
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
push 2
lea edx, [ebp + 8]
push edx
call dword [eax + 4]
mov ax, word [ebp + 8]
cmp ax, word [esi*2 + 0x15113eb0]
jne 0x15030bc8
inc esi
jmp 0x15030b34
test ebx, ebx
je 0x15030bc8
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
push 2
lea edx, [ebp - 0x28]
push edx
call dword [eax + 4]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
push 2
lea edx, [ebp - 0x26]
push edx
call dword [eax + 4]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
push 2
lea edx, [ebp - 0x24]
push edx
call dword [eax + 4]
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x28]
push eax
call fcn.15056002
add esp, 4
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 0x1c
cmp eax, 0x6f
jne 0x15030bb0
mov byte [edi + 0x48], 0xac
jmp 0x15030bd2
cmp eax, 0x79
jne 0x15030bc2
mov ecx, dword [ebp + 0x14]
call fcn.1509fc00
mov byte [edi + 0x48], al
jmp 0x15030bd2
mov byte [edi + 0x48], 0
jmp 0x15030bd2
push 0
mov ecx, dword [edi + 0x3c]
call fcn.15030780
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x150315f0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov edx, dword [esi + 0x4c]
test edx, edx
je 0x150316a8
mov eax, dword [esi + 0x3c]
push edi
cmp eax, 0x6f
je 0x1503162e
cmp eax, 0x79
je 0x1503162e
cmp eax, 0x137
jne 0x15031654
mov ecx, dword [sym.Core.dll_class_FCodec__GL2DESCodec]
mov eax, dword [ecx]
mov edi, dword [eax]
cmp edi, 0x1500e500
je 0x15031654
jmp 0x150316b4
test edx, edx
jle 0x15031654
mov edx, 0xffffffb0
lea ecx, [esi + 0x50]
sub edx, esi
nop dword [eax]
mov al, byte [esi + 0x450]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
lea eax, [edx + ecx]
cmp eax, dword [esi + 0x4c]
jl 0x15031640
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [esi + 0x4c]
lea eax, [esi + 0x50]
push eax
push dword [esi + 0x40]
call dword [sym.imp.kernel32.dll_WriteFile]
pop edi
test eax, eax
jne 0x150316a8
push eax
push 0x15118d4c
mov dword [esi + 0x2c], 1
call sym.Core.dll_wchar_t_const____cdecl_appFromAnsi_char_const___wchar_t__
push 0
push 0
push 0x151138c0
push eax
push 0x1511fb74
call sym.Core.dll_wchar_t_const____cdecl_Localize_wchar_t_const___wchar_t_const___wchar_t_const___wchar_t_const___int_
push eax
push dword [esi + 0x44]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0x24
mov dword [esi + 0x4c], 0
pop esi
mov esp, ebp
pop ebp
ret
push edx
lea eax, [esi + 0x50]
push eax
call edi
jmp 0x15031654

Function at 0x15031a60
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x15031a9d
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [sym.Core.dll_class_FMalloc__GMalloc]
mov eax, dword [ecx]
cmp eax, 0x15116d68
jne 0x15031b32
push 0x15113720
push 0x1511368c
push dword [sym.Core.dll_class_FOutputDeviceError__GError]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0xc
cmp dword [esi + 4], 0
je 0x15031ae0
cmp dword [esi + 8], 0
je 0x15031ae0
mov ecx, 1
lea eax, [esi + 0xb8]
xchg dword [eax], ecx
push 0xc
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
lea eax, [esi + 0x14]
push eax
push 0x15119edc
call sym.Core.dll_void___cdecl_debugf_wchar_t_const__
add esp, 8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov edi, dword [esi + 0x94]
test edi, edi
je 0x15031b25
mov ecx, edi
call sym.Core.dll_public:_void___thiscall_FCriticalSection::destructor_void_
mov ecx, dword [sym.Core.dll_class_FMalloc__GMalloc]
mov eax, dword [ecx]
cmp eax, 0x15116d68
jne 0x15031b40
push 0x15113720
push 0x1511368c
push dword [sym.Core.dll_class_FOutputDeviceError__GError]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0xc
mov dword [esi + 0x94], 0
pop edi
pop esi
ret
pop edi
mov dword [esi + 0x94], 0
pop esi
ret
push dword [esi + 0xbc]
call dword [eax + 8]
jmp 0x15031a9d
push edi
call dword [eax + 8]
jmp 0x15031b25
Function at 0x150323b0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x150323ed
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [sym.Core.dll_class_FMalloc__GMalloc]
mov eax, dword [ecx]
cmp eax, 0x15116d68
jne 0x15032482
push 0x15113720
push 0x1511368c
push dword [sym.Core.dll_class_FOutputDeviceError__GError]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0xc
cmp dword [esi + 4], 0
je 0x15032430
cmp dword [esi + 8], 0
je 0x15032430
mov ecx, 1
lea eax, [esi + 0xb8]
xchg dword [eax], ecx
push 0xc
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
lea eax, [esi + 0x14]
push eax
push 0x15119edc
call sym.Core.dll_void___cdecl_debugf_wchar_t_const__
add esp, 8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov edi, dword [esi + 0x94]
test edi, edi
je 0x15032475
mov ecx, edi
call sym.Core.dll_public:_void___thiscall_FCriticalSection::destructor_void_
mov ecx, dword [sym.Core.dll_class_FMalloc__GMalloc]
mov eax, dword [ecx]
cmp eax, 0x15116d68
jne 0x15032490
push 0x15113720
push 0x1511368c
push dword [sym.Core.dll_class_FOutputDeviceError__GError]
call sym.Core.dll_public:_void___cdecl_FOutputDevice::Logf_wchar_t_const__
add esp, 0xc
mov dword [esi + 0x94], 0
pop edi
pop esi
ret
pop edi
mov dword [esi + 0x94], 0
pop esi
ret
push dword [esi + 0xbc]
call dword [eax + 8]
jmp 0x150323ed
push edi
call dword [eax + 8]
jmp 0x15032475

Function at 0x150435a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x15103374
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 2
lea eax, [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 5
lea eax, [ecx + 0x18]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
lea eax, [ecx + 0x24]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0xb
lea eax, [ecx + 0x30]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x15046b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
nop dword [eax]
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x64]
sub edx, ecx
mov eax, dword [edi + 0x6c]
sub edx, eax
mov dword [ebp + 8], edx
jne 0x15046b81
test ecx, ecx
jne 0x15046b8d
test eax, eax
jne 0x15046b8d
mov edx, esi
jmp 0x15046bff
cmp edx, 0xffffffff
jne 0x15046b8d
mov edx, 0xfffffffe
jmp 0x15046bff
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, esi
cmp ecx, eax
jb 0x15046bff
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.1504c860
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x15046bcf
sub eax, esi
jmp 0x15046bd1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x15046bc0
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x15046bf0
sub eax, esi
jmp 0x15046bf2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x15046be1
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x15046ca0
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x15046c2c
xor eax, eax
jmp 0x15046c64
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x15046c4e
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.15046f40
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.1504c860
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x6c], eax
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x15046c8c
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x15046ca0
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x15046b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x15046f40
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x15046f5c
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x15047061
nop dword [eax + eax]
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x15047024
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x15046f96
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x15047035
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x15047028
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x15046f70
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret