joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b14b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lea ecx, [eax + ecx - 1]
cmp eax, ecx
jae 0x4b14cf
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x4b14b8
ret

Function at 0x4b4c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x57d878
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4b4cb5
mov eax, 0x80004003
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
push 1
push 0
lea eax, [esp + 0x24]
push eax
call fcn.004b31f0
mov esi, dword [esp + 0x1c]
test esi, esi
mov dword [esp + 0x14], 0
jne 0x4b4d00
push esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0044ff63
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
mov eax, dword [esi + 0xc]
cmp eax, 0x7ba9
ja 0x4b4d82
je 0x4b4d7a
cmp eax, 0x5741
ja 0x4b4d5f
je 0x4b4d57
sub eax, 0x4461
je 0x4b4d47
sub eax, 0x28
je 0x4b4d37
sub eax, 0x8f7
jne 0x4b4dd8
lea ecx, [edi + 0x94]
jmp 0x4b4dd2
mov edx, dword [edi + 0x60]
mov eax, dword [edx]
lea ecx, [edi + 0x60]
push esi
call eax
jmp 0x4b4dd8
mov edx, dword [edi + 0x78]
mov eax, dword [edx]
lea ecx, [edi + 0x78]
push esi
call eax
jmp 0x4b4dd8
lea ecx, [edi + 0x98]
jmp 0x4b4dd2
sub eax, 0x7384
je 0x4b4d75
sub eax, 0x20
jne 0x4b4dd8
push esi
mov ecx, edi
call fcn.004b1e00
jmp 0x4b4dd8
lea ecx, [edi + 0x3c]
jmp 0x4b4dd2
lea ecx, [edi + 0x90]
jmp 0x4b4dd2
cmp eax, 0x3cb923
ja 0x4b4db6
je 0x4b4dab
cmp eax, 0x2ad7b1
je 0x4b4d9e
cmp eax, 0x3c83ab
jne 0x4b4dd8
lea ecx, [edi + 0x40]
jmp 0x4b4dd2
mov edx, dword [edi + 0x48]
mov eax, dword [edx]
lea ecx, [edi + 0x48]
push esi
call eax
jmp 0x4b4dd8
push esi
lea ecx, [edi + 0x14]
call fcn.004b1e00
jmp 0x4b4dd8
cmp eax, 0x3e83bb
je 0x4b4dcf
cmp eax, 0x3eb923
jne 0x4b4dd8
push esi
lea ecx, [edi + 0x28]
call fcn.004b1e00
jmp 0x4b4dd8
lea ecx, [edi + 0x44]
push esi
call fcn.004b4880
push 0
mov ecx, esi
call fcn.004b2d80
test al, al
jne 0x4b4d00
push esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0044ff63
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x4b83b0
Capabilities:
Encode data using add xor sub operations

Disassembly:
lea ecx, [eax + 1]
cmp eax, ecx
jae 0x4b83ce
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x4b83b7
ret

Function at 0x4b8450
Capabilities:
Encode data using add xor sub operations

Disassembly:
lea ecx, [eax + 3]
cmp eax, ecx
jae 0x4b846e
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x4b8457
ret
Function at 0x4b8580
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, esi
call fcn.004b8450
lea eax, [esi + 0xc]
call fcn.004b83b0
lea eax, [esi + 0xe]
call fcn.004b83b0
lea eax, [esi + 0x10]
call fcn.004b83b0
lea eax, [esi + 0x12]
call fcn.004b8450
lea eax, [esi + 0x16]
call fcn.004b8450
lea eax, [esi + 0x1a]
call fcn.004b8450
lea eax, [esi + 0x1e]
pop esi
jmp fcn.004b8450

Function at 0x4b85d0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
call fcn.004b83b0
lea eax, [esi + 0x10]
call fcn.004b83b0
lea eax, [esi + 0x12]
call fcn.004b8450
lea eax, [esi + 0x16]
call fcn.004b83b0
lea eax, [esi + 0x18]
call fcn.004b8450
lea eax, [esi + 0x28]
call fcn.004b83b0
lea eax, [esi + 0x2a]
call fcn.004b83b0
lea eax, [esi + 0x2c]
pop esi
jmp fcn.004b83b0

Function at 0x4b8620
Capabilities:
Encode data using add xor sub operations

Disassembly:
push esi
mov esi, ecx
call fcn.004b85d0
lea eax, [esi + 0x30]
call fcn.004b83b0
lea eax, [esi + 0x34]
call fcn.004b83b0
lea eax, [esi + 0x36]
pop esi
jmp fcn.004b83b0

Function at 0x4b8650
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call fcn.004b85d0
lea eax, [esi + 0x36]
call fcn.004b83b0
lea eax, [esi + 0x3a]
call fcn.004b83b0
lea eax, [esi + 0x3c]
pop esi
jmp fcn.004b83b0
Function at 0x4dec20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x57ff4a
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x61c948]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
call fcn.00557c40
mov ecx, dword [0x59dbc4]
mov esi, dword [esp + 0xa4]
cmp esi, 3
mov edx, dword [0x59dbc8]
mov eax, dword [0x59dbcc]
mov dword [esp + 0x44], ecx
mov ecx, dword [0x59dbd0]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x98], 1
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov ecx, 0x59dd84
je 0x4decb9
mov ecx, 0x59dd54
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov di, word [esp + 0xac]
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x60], eax
mov eax, dword [0x59ded4]
mov dword [esp + 0x70], eax
mov eax, dword [0x59ded8]
mov dword [esp + 0x74], eax
mov eax, dword [0x59dedc]
mov dword [esp + 0x78], eax
mov eax, dword [0x59dee0]
mov dword [esp + 0x7c], eax
xor eax, eax
cmp esi, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x54], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x1c], dx
mov word [esp + 0x1e], di
mov dword [esp + 0x20], ebp
je 0x4ded57
jle 0x4ded51
cmp esi, 3
jg 0x4ded51
mov bx, 0x20
jmp 0x4ded5b
mov bx, 0x10
jmp 0x4ded5b
mov bx, 0x18
movzx edx, di
movzx eax, bx
imul eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov word [esp + 0x28], ax
movzx eax, ax
imul eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb0]
test eax, eax
mov word [esp + 0x2a], bx
jne 0x4deda4
cmp esi, 1
je 0x4ded96
cmp esi, 2
jne 0x4dedd6
xor eax, eax
cmp di, 2
setne al
add eax, 3
je 0x4dedd6
mov edx, dword [ecx]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x34], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x38], eax
mov eax, dword [ecx + 0xc]
mov word [esp + 0x1c], 0xfffe
mov word [esp + 0x2c], 0x16
mov word [esp + 0x2e], bx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
movzx ecx, word [esp + 0x2c]
add ecx, 0x12
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x4c]
call fcn.00557de0
mov esi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.00557c50
lea ecx, [esp + 0x44]
mov dword [esp + 0x14], 1
mov byte [esp + 0x98], 0
call fcn.00557c30
mov eax, esi
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004721e8
add esp, 0x88
ret 0x14
Function at 0x4e1b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x580378
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x5978]
mov ecx, dword [esi + 0x5974]
push eax
lea edx, [esi + 0xc8]
push ecx
push edx
call fcn.004e2160
add esp, 0xc
jmp 0x4e1b80
lea eax, [esi + 0xc8]
push eax
lea edi, [esi + 0x108]
push edi
call fcn.004e2800
add esp, 8
cmp eax, 0xffffffff
jne 0x4e1bca
mov eax, dword [esi + 0x104]
cmp eax, 1
je 0x4e1d23
test eax, 0xff00
jne 0x4e1b80
mov eax, 0x80004005
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
lea eax, [esi + 0x253c]
push edi
push eax
call fcn.004eb1b0
mov ecx, dword [esi + 0x8c]
movzx edi, word [esi + 0x3544]
mov eax, dword [ecx + 0x78]
add esp, 8
cmp word [eax + 2], di
jne 0x4e1b80
mov edx, dword [eax + 4]
cmp edx, dword [esi + 0x3540]
jne 0x4e1b80
lea ecx, [esp + 0x18]
lea ebx, [esi + 0x3548]
lea ebp, [esi + 0x4748]
call fcn.004df590
movzx eax, word [esi + 0x3546]
movzx ecx, di
imul eax, ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0
call fcn.004c8620
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp word [esi + 0x3546], dx
jbe 0x4e1cd5
fld qword [0x5a3778]
mov ecx, dword [ebx]
cmp ecx, 0x10000000
mov dword [esp + 0x14], ecx
jl 0x4e1c62
mov dword [esp + 0x14], 0xfffffff
jmp 0x4e1c72
cmp ecx, 0xf0000000
jge 0x4e1c72
mov dword [esp + 0x14], 0xf0000000
fild dword [esp + 0x14]
add eax, 4
add ebx, 4
fmul st(1)
fstp dword [eax - 4]
cmp word [esi + 0x3544], 2
jne 0x4e1cc3
mov ecx, dword [ebp]
cmp ecx, 0x10000000
mov dword [esp + 0x14], ecx
jl 0x4e1ca4
mov dword [esp + 0x14], 0xfffffff
jmp 0x4e1cb4
cmp ecx, 0xf0000000
jge 0x4e1cb4
mov dword [esp + 0x14], 0xf0000000
fild dword [esp + 0x14]
add eax, 4
add ebp, 4
fmul st(1)
fstp dword [eax - 4]
add edx, 1
cmp dx, word [esi + 0x3546]
jb 0x4e1c4a
fstp st(0)
movzx edx, word [esi + 0x3544]
mov eax, dword [esi + 0x3540]
push 0
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.004dff30
lea ecx, [esp + 0x18]
mov edi, eax
mov dword [esp + 0x34], 0xffffffff
call fcn.004df5b0
test edi, edi
je 0x4e1b80
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [esi + 0xdc]
mov edx, dword [esi + 0xcc]
sub edx, eax
push edx
push eax
mov eax, dword [esi + 0x5974]
push eax
call fcn.0047dcb0
mov ecx, dword [esi + 0xcc]
sub ecx, dword [esi + 0xdc]
add esp, 0xc
push 0xffffffffffffffff
push ecx
lea ecx, [esi + 0x5970]
call fcn.00514000
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4eb3e0
Capabilities:
Encode data using xor

Disassembly:
push esi
movzx esi, word [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 0x20
jb 0x4eb46a
push ebp
mov ebp, edi
shr ebp, 5
lea eax, [esp + 0x10]
push 0x20
push eax
call fcn.004eb320
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
movzx edx, ch
movzx ecx, word [edx*2 + 0x5a61c0]
shl esi, 8
xor ecx, esi
mov edx, eax
shr edx, 8
xor edx, ecx
movzx edx, dh
movzx edx, word [edx*2 + 0x5a61c0]
shl ecx, 8
xor edx, ecx
mov ecx, eax
xor ecx, edx
movzx ecx, ch
movzx ecx, word [ecx*2 + 0x5a61c0]
shl edx, 8
xor ecx, edx
mov edx, ecx
shr edx, 8
xor edx, eax
and edx, 0xff
movzx esi, word [edx*2 + 0x5a61c0]
shl ecx, 8
add esp, 8
xor esi, ecx
sub edi, 0x20
sub ebp, 1
jne 0x4eb3f6
pop ebp
mov eax, edi
shr eax, 3
sub eax, 1
je 0x4eb4ce
sub eax, 1
je 0x4eb4a6
sub eax, 1
jne 0x4eb4f9
lea eax, [esp + 0xc]
push 8
push eax
call fcn.004eb320
mov ecx, esi
shr ecx, 8
xor eax, ecx
and eax, 0xff
movzx edx, word [eax*2 + 0x5a61c0]
shl esi, 8
add esp, 8
xor esi, edx
lea eax, [esp + 0xc]
push 8
push eax
call fcn.004eb320
mov ecx, esi
shr ecx, 8
xor eax, ecx
and eax, 0xff
movzx edx, word [eax*2 + 0x5a61c0]
shl esi, 8
add esp, 8
xor esi, edx
lea eax, [esp + 0xc]
push 8
push eax
call fcn.004eb320
mov ecx, esi
shr ecx, 8
xor eax, ecx
and eax, 0xff
movzx edx, word [eax*2 + 0x5a61c0]
shl esi, 8
add esp, 8
xor esi, edx
and edi, 7
test edi, edi
je 0x4eb529
lea ecx, [ecx]
lea eax, [esp + 0xc]
push 1
push eax
sub edi, 1
call fcn.004eb320
mov ecx, esi
shr ecx, 0xf
xor eax, ecx
add esp, 8
add esi, esi
test al, 1
je 0x4eb525
xor esi, 0x8005
test edi, edi
jne 0x4eb500
pop edi
mov ax, si
pop esi
ret
Function at 0x514a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x580608
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00514640
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004a9ff0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x523440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x581668
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00522eb0
push 0x12d000
mov dword [esp + 0x18], 0
mov dword [esi], vtable.dirac::InputStreamBuffer.0
call fcn.0044ff68
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x3c], eax
mov dword [ecx], eax
mov edx, dword [esi + 0x20]
mov dword [edx], eax
mov edx, dword [esi + 0x30]
mov ecx, eax
add esp, 4
sub ecx, eax
mov dword [edx], ecx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x529d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5820fb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x48
call fcn.0044ff38
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x28], 0
je 0x529d6f
push edi
mov ecx, eax
call fcn.0052c790
jmp 0x529d71
xor eax, eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.00529c10
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x529d94
xor eax, eax
jmp 0x529d9c
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
mov ecx, dword [edi + 0x28]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
add eax, 0xffffffff
push edx
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], eax
call fcn.005290e0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x52a170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x582128
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
push ecx
push eax
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x1c]
call fcn.0052bd50
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea esi, [edi + 0x10]
mov dword [esi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], edx
lea edx, [esp + 0x20]
mov dword [esi + 0xc], ecx
push edx
lea ecx, [esi + 0x10]
mov dword [esp + 0x48], 0
mov dword [esi + 8], eax
call fcn.00529820
mov cl, byte [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov byte [esi + 0x24], cl
push esi
mov ecx, edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], edx
call fcn.00529fc0
mov bl, al
mov eax, dword [esp + 0x24]
test eax, eax
mov byte [edi + 0x3c], bl
je 0x52a217
push eax
call fcn.0044ff63
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 4
Function at 0x52c790
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x58243b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov dword [esi], vtable.dirac::Frame.0
mov eax, dword [edi]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
mov dword [esi + 8], ecx
mov edx, dword [edi + 8]
lea ecx, [edi + 0x10]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0xc]
push ecx
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], eax
call fcn.0052c6f0
mov edx, dword [edi + 0x20]
mov dword [esi + 0x24], edx
mov al, byte [edi + 0x24]
mov byte [esi + 0x28], al
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x2c], ecx
xor eax, eax
mov ecx, esi
mov dword [esp + 0x18], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
call fcn.0052c0f0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x52f2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebp
push esi
mov esi, ecx
movzx ecx, word [esi + 0x16]
push edi
movzx edi, word [esi + 0x14]
movzx eax, di
sub ecx, eax
movzx eax, word [edx]
add ecx, 1
test ax, ax
jne 0x52f30a
movzx eax, word [edx + 2]
imul eax, ecx
movzx ecx, word [edx + 4]
xor edx, edx
div ecx
lea edx, [eax + edi - 1]
mov word [esi + 0x16], dx
jmp 0x52f31e
movzx eax, ax
imul eax, ecx
movzx ecx, word [edx + 4]
xor edx, edx
div ecx
add eax, edi
mov word [esi + 0x14], ax
or ebp, 0xffffffff
movzx ecx, word [esi + 0x14]
movzx eax, word [esi + 0x16]
mov edx, ecx
xor edx, eax
test edx, 0x8000
jne 0x52f37e
mov ecx, dword [esi + 0x1c]
shr eax, 0xf
and al, 1
mov byte [esp + 0x10], al
lea edi, [esi + 4]
push edi
lea eax, [esp + 0x14]
push eax
call fcn.0052ae40
cmp dword [esi + 0xc], 0
jle 0x52f3a4
movzx ecx, word [esi + 0x16]
not ecx
shr ecx, 0xf
and cl, 1
push edi
lea edx, [esp + 0x14]
mov byte [esp + 0x14], cl
mov ecx, dword [esi + 0x1c]
push edx
call fcn.0052ae40
add dword [esi + 0xc], ebp
cmp dword [esi + 0xc], 0
jg 0x52f355
jmp 0x52f3a4
test ecx, 0x4000
je 0x52f3bc
test eax, 0x4000
jne 0x52f3bc
add dword [esi + 0xc], 1
and ecx, 0x3fff
or eax, 0x4000
mov word [esi + 0x14], cx
mov word [esi + 0x16], ax
mov ax, word [esi + 0x16]
shl word [esi + 0x14], 1
add ax, ax
or ax, 1
mov word [esi + 0x16], ax
jmp 0x52f321
pop edi
pop esi
pop ebp
ret 4

Function at 0x52f2d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebp
push esi
mov esi, ecx
movzx ecx, word [esi + 0x16]
push edi
movzx edi, word [esi + 0x14]
movzx eax, di
sub ecx, eax
movzx eax, word [edx]
add ecx, 1
test ax, ax
jne 0x52f30a
movzx eax, word [edx + 2]
imul eax, ecx
movzx ecx, word [edx + 4]
xor edx, edx
div ecx
lea edx, [eax + edi - 1]
mov word [esi + 0x16], dx
jmp 0x52f31e
movzx eax, ax
imul eax, ecx
movzx ecx, word [edx + 4]
xor edx, edx
div ecx
add eax, edi
mov word [esi + 0x14], ax
or ebp, 0xffffffff
movzx ecx, word [esi + 0x14]
movzx eax, word [esi + 0x16]
mov edx, ecx
xor edx, eax
test edx, 0x8000
jne 0x52f37e
mov ecx, dword [esi + 0x1c]
shr eax, 0xf
and al, 1
mov byte [esp + 0x10], al
lea edi, [esi + 4]
push edi
lea eax, [esp + 0x14]
push eax
call fcn.0052ae40
cmp dword [esi + 0xc], 0
jle 0x52f3a4
movzx ecx, word [esi + 0x16]
not ecx
shr ecx, 0xf
and cl, 1
push edi
lea edx, [esp + 0x14]
mov byte [esp + 0x14], cl
mov ecx, dword [esi + 0x1c]
push edx
call fcn.0052ae40
add dword [esi + 0xc], ebp
cmp dword [esi + 0xc], 0
jg 0x52f355
jmp 0x52f3a4
test ecx, 0x4000
je 0x52f3bc
test eax, 0x4000
jne 0x52f3bc
add dword [esi + 0xc], 1
and ecx, 0x3fff
or eax, 0x4000
mov word [esi + 0x14], cx
mov word [esi + 0x16], ax
mov ax, word [esi + 0x16]
shl word [esi + 0x14], 1
add ax, ax
or ax, 1
mov word [esi + 0x16], ax
jmp 0x52f321
pop edi
pop esi
pop ebp
ret 4
Function at 0x533d80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x58297b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
fld qword [edi + 0x10]
fstp qword [esi + 0x10]
mov ecx, dword [edi + 0x18]
lea edx, [edi + 0x1c]
mov dword [esi + 0x18], ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.005333c0
mov eax, dword [edi + 0x2c]
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x2c], eax
call fcn.0052c6f0
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x533fd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5829db
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x2c]
fld1
mov edx, dword [esp + 0x30]
fstp qword [esi + 0x10]
mov eax, dword [esp + 0x28]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 8], edx
mov dword [esi], eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x10]
mov dword [esi + 0x18], ecx
xor edi, edi
lea ecx, [esi + 0x1c]
push edx
mov dword [esi + 0xc], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 7
call fcn.0052c9c0
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x14
Function at 0x5443c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x583a98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
xor edi, edi
push edi
push edx
push 0x7472616b
mov ecx, esi
call fcn.00547de0
push edi
lea ecx, [esi + 0x1c]
push str.tkhd
mov dword [esp + 0x20], edi
mov dword [esi], vtable.AP4_TrakAtom.1.0
mov dword [ecx], vtable.AP4_TrakAtom.0
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.005474f0
cmp eax, edi
je 0x544449
push edi
push 0x642564
push 0x64237c
push edi
push eax
call fcn.004740f9
add esp, 0x14
mov dword [esi + 0x34], eax
jmp 0x54444c
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x548d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x584273
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x61c948]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61c948]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
push esi
push 1
push ebp
mov edi, ecx
push 0x68646c72
mov dword [esp + 0x24], edi
call fcn.00547180
xor ebx, ebx
mov dword [edi], vtable.AP4_HdlrAtom.0
mov dword [edi + 0x38], 0xf
mov dword [edi + 0x34], ebx
mov dword [esp + 0x30], ebx
mov byte [edi + 0x24], bl
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push ebx
push 4
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov byte [esp + 0x3c], 1
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [edi + 0x1c]
push ecx
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push ebx
push 0xc
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
add ebp, 0xffffffe0
cmp ebp, ebx
jle 0x548e64
lea eax, [ebp + 1]
push eax
call fcn.0044ff68
mov edx, dword [esi]
add esp, 4
push 0
mov ebx, eax
mov eax, dword [edx + 0xc]
push ebp
push ebx
mov ecx, esi
call eax
mov eax, ebx
mov byte [ebx + ebp], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x548e46
sub eax, edx
push eax
push ebx
lea ecx, [edi + 0x20]
call fcn.004ac660
push ebx
call fcn.0044ff63
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004721e8
add esp, 0x20
ret 8