joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6b40
Capabilities:
Encode data using xor

Disassembly:
cmp eax, edx
jne 0x4d6b68
lea ecx, [edx + edi - 1]
cmp eax, ecx
jae 0x4d6b83
lea esp, [esp]
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x4d6b50
ret
xor ecx, ecx
test edi, edi
jle 0x4d6b83
push esi
lea esi, [edx + edi - 1]
mov dl, byte [esi]
mov byte [ecx + eax], dl
add ecx, 1
sub esi, 1
cmp ecx, edi
jl 0x4d6b73
pop esi
ret

Function at 0x4d7040
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x61ea88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
xor esi, esi
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x2c]
lea eax, [edi - 1]
cmp eax, 0x7f
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
ja case.0x4d708e.3
movzx eax, byte [eax + 0x4d724c]
jmp dword [eax*4 + 0x4d7238]
push 0x24
call fcn.005b4663
mov ebx, eax
add esp, 4
mov dword [ebx], 0x24
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov ecx, dword [ebp + 8]
push esi
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], esi
mov eax, dword [ebx]
lea edx, [esp + 0x1c]
push edx
push eax
push ebx
push eax
mov eax, dword [ebp + 4]
push ebx
push 0x335004
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4d716c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esp + 0x28], 0xffffffff
call fcn.005b465e
add esp, 4
xor al, al
jmp 0x4d7220
push 0x20
call fcn.005b4663
mov ebx, eax
add esp, 4
mov dword [ebx], 0x20
jmp 0x4d70a7
push 0x818
call fcn.005b4663
mov ebx, eax
add esp, 4
mov dword [ebx], 0x818
jmp 0x4d70a7
push 0x20
call fcn.005b4663
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x34]
push esi
cdq
push 0x800
push edx
push eax
mov dword [ebx], 0x20
call fcn.005d9dc0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
jmp 0x4d70ad
push esi
mov dword [esp + 0x28], 0xffffffff
call fcn.005b465e
add esp, 4
xor al, al
jmp 0x4d7220
mov ecx, dword [esp + 0x2c]
movzx edx, byte [ecx + 0x4d72e0]
jmp dword [edx*4 + 0x4d72cc]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x4d8810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x61ecea
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x7161c0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
call fcn.00496f70
mov ecx, dword [0x63339c]
mov esi, dword [esp + 0xa4]
cmp esi, 3
mov edx, dword [0x6333a0]
mov eax, dword [0x6333a4]
mov dword [esp + 0x44], ecx
mov ecx, dword [0x6333a8]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x98], 1
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov ecx, 0x63367c
je 0x4d88a9
mov ecx, 0x63360c
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov di, word [esp + 0xac]
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x60], eax
mov eax, dword [0x63382c]
mov dword [esp + 0x70], eax
mov eax, dword [0x633830]
mov dword [esp + 0x74], eax
mov eax, dword [0x633834]
mov dword [esp + 0x78], eax
mov eax, dword [0x633838]
mov dword [esp + 0x7c], eax
xor eax, eax
cmp esi, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x54], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov word [esp + 0x1c], dx
mov word [esp + 0x1e], di
mov dword [esp + 0x20], ebp
je 0x4d8947
jle 0x4d8941
cmp esi, 3
jg 0x4d8941
mov bx, 0x20
jmp 0x4d894b
mov bx, 0x10
jmp 0x4d894b
mov bx, 0x18
movzx edx, di
movzx eax, bx
imul eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov word [esp + 0x28], ax
movzx eax, ax
imul eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb0]
test eax, eax
mov word [esp + 0x2a], bx
jne 0x4d8994
cmp esi, 1
je 0x4d8986
cmp esi, 2
jne 0x4d89c6
xor eax, eax
cmp di, 2
setne al
add eax, 3
je 0x4d89c6
mov edx, dword [ecx]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x34], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x38], eax
mov eax, dword [ecx + 0xc]
mov word [esp + 0x1c], 0xfffe
mov word [esp + 0x2c], 0x16
mov word [esp + 0x2e], bx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
movzx ecx, word [esp + 0x2c]
add ecx, 0x12
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x4c]
call fcn.00497110
mov esi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.00496f80
lea ecx, [esp + 0x44]
mov dword [esp + 0x14], 1
mov byte [esp + 0x98], 0
call fcn.00496f60
mov eax, esi
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.005d8d34
add esp, 0x88
ret 0x14
Function at 0x4d9750
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareGabestFiltersMPEG_Audio_Decoder
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esi], vtable.CMpaDecFilter.4.0
mov dword [esi + 0xc], vtable.CMpaDecFilter.3.0
mov dword [esi + 0x10], vtable.CMpaDecFilter.2.0
mov dword [esi + 0x98], vtable.CMpaDecFilter.1.0
mov dword [esi + 0x9c], vtable.CMpaDecFilter.0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4d98d6
mov edi, dword [esp + 8]
mov edx, dword [esi + 0x59b0]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.SampleFormat
push edi
mov dword [esp + 0x28], edx
call ebx
movzx ecx, byte [esi + 0x59b4]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.Normalize
push edi
mov dword [esp + 0x28], ecx
call ebx
mov eax, dword [esi + 0x59c8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.Boost
push edi
mov dword [esp + 0x28], eax
call ebx
mov edx, dword [esi + 0x59b8]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Ac3SpeakerConfig
push edi
mov dword [esp + 0x28], edx
call ebx
mov ecx, dword [esi + 0x59bc]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.DtsSpeakerConfig
push edi
mov dword [esp + 0x28], ecx
call ebx
mov eax, dword [esi + 0x59c0]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.AacSpeakerConfig
push edi
mov dword [esp + 0x28], eax
call ebx
movzx edx, byte [esi + 0x59c4]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Ac3DynamicRangeControl
push edi
mov dword [esp + 0x28], edx
call ebx
movzx ecx, byte [esi + 0x59c5]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
mov dword [esp + 0x20], ecx
push str.DtsDynamicRangeControl
push edi
call ebx
movzx eax, byte [esi + 0x59c6]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.AacDynamicRangeControl
push edi
mov dword [esp + 0x28], eax
call ebx
test edi, edi
pop ebx
je 0x4d98d6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea edx, [esi + 0x5998]
push edx
call edi
lea ecx, [esi + 0x5978]
call fcn.00598980
lea ecx, [esi + 0xc0]
call fcn.004d93e0
lea eax, [esi + 0xa0]
push eax
call edi
pop edi
mov ecx, esi
pop esi
add esp, 0xc
jmp fcn.005fef00
Function at 0x4dee70
Capabilities:
Access peb ldr_data
Get ntdll base address
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x61f3da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], vtable.CMpeg2DecFilter.4.0
mov dword [esi + 0xc], vtable.CMpeg2DecFilter.3.0
mov dword [esi + 0x10], vtable.CMpeg2DecFilter.2.0
mov dword [esi + 0xe8], vtable.CMpeg2DecFilter.1.0
mov dword [esi + 0xec], vtable.CMpeg2DecFilter.0
xor ebx, ebx
mov dword [esp + 0x24], ebx
xor edi, edi
mov dword [esp + 0x10], edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareGabestFiltersMPEG_Video_Decoder
push reloc.DSOUND.dll_DirectSoundCreate
mov byte [esp + 0x48], 4
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4defec
mov edi, dword [esp + 0xc]
mov edx, dword [esi + 0x184]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push ebx
push str.DeinterlaceMethod
push edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edx
call ebp
mov ecx, dword [esi + 0x188]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push str.Brightness
push edi
mov dword [esp + 0x28], ecx
call ebp
mov eax, dword [esi + 0x18c]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebx
push str.Contrast
push edi
mov dword [esp + 0x28], eax
call ebp
mov edx, dword [esi + 0x190]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push ebx
push 0x6492d4
push edi
mov dword [esp + 0x28], edx
call ebp
mov ecx, dword [esi + 0x194]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push str.Saturation
push edi
mov dword [esp + 0x28], ecx
call ebp
movzx eax, byte [esi + 0x20298]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebx
push str.ForcedSubtitles
push edi
mov dword [esp + 0x28], eax
call ebp
movzx edx, byte [esi + 0x20299]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push ebx
push str.PlanarYUV
push edi
mov dword [esp + 0x28], edx
call ebp
movzx ecx, byte [esi + 0x2029a]
push 4
lea edx, [esp + 0x14]
push edx
push 4
mov dword [esp + 0x1c], ecx
push ebx
push str.Interlaced
push edi
call ebp
pop ebp
mov ecx, dword [esi + 0xf0]
cmp ecx, ebx
je 0x4defff
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov ecx, dword [esi + 0xf4]
cmp ecx, ebx
je 0x4df012
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
cmp edi, ebx
je 0x4df01d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x11c]
cmp eax, ebx
je 0x4df03d
push eax
call fcn.005e16ce
add esp, 4
mov dword [esi + 0x11c], ebx
mov ecx, dword [esi + 0xf8]
cmp ecx, ebx
mov byte [esp + 0x24], bl
je 0x4df059
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, esi
mov dword [esi + 0xf8], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.00516540
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4dee89
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x61f3da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], vtable.CMpeg2DecFilter.4.0
mov dword [esi + 0xc], vtable.CMpeg2DecFilter.3.0
mov dword [esi + 0x10], vtable.CMpeg2DecFilter.2.0
mov dword [esi + 0xe8], vtable.CMpeg2DecFilter.1.0
mov dword [esi + 0xec], vtable.CMpeg2DecFilter.0
xor ebx, ebx
mov dword [esp + 0x24], ebx
xor edi, edi
mov dword [esp + 0x10], edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareGabestFiltersMPEG_Video_Decoder
push reloc.DSOUND.dll_DirectSoundCreate
mov byte [esp + 0x48], 4
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4defec
mov edi, dword [esp + 0xc]
mov edx, dword [esi + 0x184]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push ebx
push str.DeinterlaceMethod
push edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edx
call ebp
mov ecx, dword [esi + 0x188]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push str.Brightness
push edi
mov dword [esp + 0x28], ecx
call ebp
mov eax, dword [esi + 0x18c]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebx
push str.Contrast
push edi
mov dword [esp + 0x28], eax
call ebp
mov edx, dword [esi + 0x190]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push ebx
push 0x6492d4
push edi
mov dword [esp + 0x28], edx
call ebp
mov ecx, dword [esi + 0x194]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push str.Saturation
push edi
mov dword [esp + 0x28], ecx
call ebp
movzx eax, byte [esi + 0x20298]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebx
push str.ForcedSubtitles
push edi
mov dword [esp + 0x28], eax
call ebp
movzx edx, byte [esi + 0x20299]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push ebx
push str.PlanarYUV
push edi
mov dword [esp + 0x28], edx
call ebp
movzx ecx, byte [esi + 0x2029a]
push 4
lea edx, [esp + 0x14]
push edx
push 4
mov dword [esp + 0x1c], ecx
push ebx
push str.Interlaced
push edi
call ebp
pop ebp
mov ecx, dword [esi + 0xf0]
cmp ecx, ebx
je 0x4defff
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov ecx, dword [esi + 0xf4]
cmp ecx, ebx
je 0x4df012
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
cmp edi, ebx
je 0x4df01d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x11c]
cmp eax, ebx
je 0x4df03d
push eax
call fcn.005e16ce
add esp, 4
mov dword [esi + 0x11c], ebx
mov ecx, dword [esi + 0xf8]
cmp ecx, ebx
mov byte [esp + 0x24], bl
je 0x4df059
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, esi
mov dword [esi + 0xf8], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.00516540
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4ecb80
Capabilities:
Encode data using add xor sub operations

Disassembly:
lea ecx, [eax + 1]
cmp eax, ecx
jae 0x4ecb9e
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x4ecb87
ret

Function at 0x4ecba0
Capabilities:
Encode data using add xor sub operations

Disassembly:
lea ecx, [eax + 3]
cmp eax, ecx
jae 0x4ecbbe
movzx edx, byte [ecx]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
xor byte [eax], dl
add eax, 1
sub ecx, 1
cmp eax, ecx
jb 0x4ecba7
ret

Function at 0x4ece90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, esi
call fcn.004ecba0
lea eax, [esi + 0xc]
call fcn.004ecb80
lea eax, [esi + 0xe]
call fcn.004ecb80
lea eax, [esi + 0x10]
call fcn.004ecb80
lea eax, [esi + 0x12]
call fcn.004ecba0
lea eax, [esi + 0x16]
call fcn.004ecba0
lea eax, [esi + 0x1a]
call fcn.004ecba0
lea eax, [esi + 0x1e]
pop esi
jmp fcn.004ecba0

Function at 0x4ecee0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
call fcn.004ecb80
lea eax, [esi + 0x10]
call fcn.004ecb80
lea eax, [esi + 0x12]
call fcn.004ecba0
lea eax, [esi + 0x16]
call fcn.004ecb80
lea eax, [esi + 0x18]
call fcn.004ecba0
lea eax, [esi + 0x28]
call fcn.004ecb80
lea eax, [esi + 0x2a]
call fcn.004ecb80
lea eax, [esi + 0x2c]
pop esi
jmp fcn.004ecb80

Function at 0x4ecf30
Capabilities:
Encode data using add xor sub operations

Disassembly:
push esi
mov esi, ecx
call fcn.004ecee0
lea eax, [esi + 0x30]
call fcn.004ecb80
lea eax, [esi + 0x34]
call fcn.004ecb80
lea eax, [esi + 0x36]
pop esi
jmp fcn.004ecb80

Function at 0x4ecf60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call fcn.004ecee0
lea eax, [esi + 0x36]
call fcn.004ecb80
lea eax, [esi + 0x3a]
call fcn.004ecb80
lea eax, [esi + 0x3c]
pop esi
jmp fcn.004ecb80
Function at 0x4ee6a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6205f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004ee2a0
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CRealMediaSourceFilter.14.0
mov dword [esi + 0xc], vtable.CRealMediaSourceFilter.13.0
mov dword [esi + 0x10], vtable.CRealMediaSourceFilter.12.0
mov dword [esi + 0x50], vtable.CRealMediaSourceFilter.11.0
mov dword [esi + 0x54], vtable.CRealMediaSourceFilter.10.0
mov dword [esi + 0x64], vtable.CRealMediaSourceFilter.9.0
mov dword [esi + 0x78], vtable.CRealMediaSourceFilter.8.0
mov dword [esi + 0x90], vtable.CRealMediaSourceFilter.7.0
mov dword [esi + 0xd8], vtable.CRealMediaSourceFilter.6.0
mov dword [esi + 0xdc], vtable.CRealMediaSourceFilter.5.0
mov dword [esi + 0xe0], vtable.CRealMediaSourceFilter.4.0
mov dword [esi + 0xe4], vtable.CRealMediaSourceFilter.3.0
mov dword [esi + 0xe8], vtable.CRealMediaSourceFilter.2.0
mov dword [esi + 0xec], vtable.CRealMediaSourceFilter.1.0
mov dword [esi + 0xf0], vtable.CRealMediaSourceFilter.0
mov edx, dword [0x64bbc8]
mov dword [esi + 0x28], edx
mov eax, dword [0x64bbcc]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x64bbd0]
mov dword [esi + 0x30], ecx
mov edx, dword [0x64bbd4]
mov dword [esi + 0x34], edx
mov ecx, dword [esi + 0x1bc]
test ecx, ecx
je 0x4ee797
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 1
call edx
mov dword [esi + 0x1bc], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x507260
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, ecx
lea ecx, [eax + esi]
xor eax, eax
cmp esi, edx
jae 0x50728d
sub edx, esi
mov esi, edx
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x6edcb8]
add ecx, 1
sub esi, 1
jne 0x507270
pop esi
ret
Function at 0x508336
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x7161c0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
or ebx, 0xffffffff
cmp eax, ebx
push edi
mov edi, dword [esp + 0x54]
je 0x50834e
push eax
call ebp
mov dword [esi + 0x1c], ebx
push edi
lea ecx, [esp + 0x1c]
call fcn.0041fed0
mov eax, dword [eax]
xor edi, edi
push edi
push 0x8000001
push 3
push edi
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x508395
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x508463
push edi
lea ecx, [esp + 0x20]
push ecx
push 0x2c
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x50845a
cmp dword [esp + 0x20], 0x46464952
jne 0x50845a
cmp dword [esp + 0x28], 0x41584443
jne 0x50845a
mov eax, dword [esp + 0x48]
add eax, 0x24
cmp dword [esp + 0x24], eax
jne 0x50845a
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
push edi
mov dword [esp + 0x14], eax
sub eax, 0x2c
push 0x930
sbb ecx, edi
push ecx
push eax
call fcn.005da540
imul eax, eax, 0x914
cdq
mov ecx, esi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.005077b0
test al, al
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
jne 0x508440
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
push edx
jmp 0x50845e
pop edi
mov dword [esi + 0x34], ebx
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005d8d34
add esp, 0x40
ret 4
mov eax, dword [esi + 0x1c]
push eax
call ebp
mov dword [esi + 0x1c], ebx
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.005d8d34
add esp, 0x40
ret 4
Function at 0x509bc0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
movzx eax, byte [ecx]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
movzx ebp, byte [esi + 0x55]
push edi
movzx edi, byte [esi + 0x54]
xor edi, eax
movzx eax, byte [ecx + 1]
xor ebp, eax
mov eax, dword [esi + 0x56]
xor eax, dword [ecx + 2]
lea edx, [esi + 0x800]
lea ecx, [eax + eax + 8]
and eax, 7
add esi, 0x80
or edi, 0x100
sub ecx, eax
xor ebx, ebx
cmp esi, edx
mov dword [esp + 0x14], edx
je 0x509c77
lea ebx, [ebx]
movzx eax, byte [edi + 0x6ee358]
movzx edx, byte [ebp + 0x6ee258]
xor edx, eax
mov eax, edi
shr eax, 1
mov ebp, eax
mov eax, ecx
shr eax, 3
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 8
xor eax, ecx
and edi, 1
shr eax, 5
shl edi, 8
xor edi, edx
movzx edx, byte [edx + 0x6ee658]
and eax, 0xff
shl ecx, 8
or ecx, eax
movzx eax, byte [eax + 0x6ee558]
add edx, ebx
lea ebx, [edx + eax]
movzx eax, byte [esi]
mov dl, byte [eax + str.3s_ckv_6n.f]
xor dl, bl
mov byte [esi], dl
add esi, 1
shr ebx, 8
cmp esi, dword [esp + 0x14]
jne 0x509c10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x50a2e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
movzx ecx, byte [eax + 2]
xor edx, edx
mov dh, byte [eax]
add dword [esp + 8], 1
push ebx
push ebp
push esi
push edi
movzx edi, byte [eax + 3]
mov dl, byte [eax + 1]
movzx eax, byte [eax + 4]
mov esi, ecx
and esi, 0xfffffffc
shl edi, 9
shl edx, 8
or edx, esi
or edx, 4
add edx, edx
and ecx, 7
or edi, eax
or edx, ecx
or edi, 0x100
mov esi, edx
xor bl, bl
xor ebp, ebp
mov byte [esp + 0x13], 0
mov eax, esi
shr eax, 0x18
mov ecx, esi
shr ecx, 0x15
xor al, cl
mov edx, esi
shr edx, 0x14
xor al, dl
mov ecx, esi
shr ecx, 0xc
xor al, cl
and al, 1
movzx edx, al
add esi, esi
or esi, edx
mov edx, edi
shr edx, 0x10
mov ecx, edi
shr ecx, 2
xor dl, cl
and dl, 1
movzx ecx, dl
add edi, edi
or edi, ecx
test dl, dl
sete dl
test al, al
sete al
add dl, al
add dl, bl
mov cl, dl
shr cl, 1
and cl, 1
mov bl, cl
and dl, 1
mov ecx, ebp
shl dl, cl
add ebp, 1
or byte [esp + 0x13], dl
cmp ebp, 8
jl 0x50a327
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
sub eax, 1
mov dword [esp + 0x18], eax
mov byte [eax], dl
mov eax, dword [esp + 0x1c]
sub eax, 1
test eax, eax
mov dword [esp + 0x1c], eax
jg 0x50a320
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x50ad50
Capabilities:
Get file size

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
push 0
push 0x800
push ecx
push eax
mov dword [edx], 0x800
call fcn.005da540
mov edx, dword [esp + 0x10]
mov dword [edx], eax
mov al, 1
add esp, 8
ret
Function at 0x50ad90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
imul esi, ebx
push 0
push 0
push esi
push ebp
mov edi, eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, eax
jne 0x50addc
mov ecx, dword [esp + 0x18]
imul edi, ebx
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x50addc
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret