joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b100
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b29b
sub esp, 0x3c
mov eax, dword [esp + 0x40]
cmp eax, 0x7000000
jle 0x40b12b
mov eax, 0x7000000
jmp 0x40b133
test eax, eax
je 0x40b28f
mov dword [esp + 0x18], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.0045f620
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
add eax, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
lea esi, [0x9edc40]
movsd xmm0, qword [esi + ebp*8]
movsd qword [esp + 0x1c], xmm0
movsd xmm1, qword [esi + ecx*8]
movsd qword [esp + 0x24], xmm1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004589f0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x34], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
shl eax, 5
mov ecx, dword [esp + 0x10]
shr ecx, 0x1b
or ecx, eax
and ecx, 0xfffff
mov dword [esp], ecx
call fcn.00458ac0
movsd xmm0, qword [esp + 0x34]
movsd xmm1, qword [esp + 0x1c]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x24]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x894b98]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x894c68]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b26a
xorps xmm0, xmm0
mov eax, dword [esp + 0x18]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x894cc8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x44], eax
add esp, 0x3c
ret
mov dword [esp + 0x44], 0
add esp, 0x3c
ret
call fcn.0045e260
jmp fcn.0040b100
Function at 0x45f520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xa43fa0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45dceb
je 0x45dd3e
cmp ebx, 0x20
jbe 0x45dd44
cmp ebx, 0x40
jbe 0x45dd8a
jmp 0x45de2b
test ebx, ebx
je 0x45dd34
add eax, 0x10
test ax, 0xff0
je 0x45dd20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x897400]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x897600]
jmp 0x45dd08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45dd08
pxor xmm1, xmmword [0xa43fb0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45de8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xa43999], 0
je 0x45f53a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45dcb0
jmp fcn.004079e0
Function at 0x47b7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b95d
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x47b801
xor edx, edx
jmp 0x47b82c
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x6bf901]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x47b837
mov edx, 1
jmp 0x47b86b
cmp ecx, 0x23
je 0x47b840
xor edx, edx
jmp 0x47b86b
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x6c4a14]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x47b8c5
lea edi, [esp + 0x3c]
call fcn.0045f76b
mov ecx, dword [0xa16f10]
lea edx, [0x895e40]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.00486540
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.0045fc4e
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x47b93c
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.0045f76b
mov ecx, dword [0xa16f14]
mov edx, dword [0xa16f10]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.0047b970
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.0045fc4e
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.0045e260
jmp fcn.0047b7d0
Function at 0x500af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x20]
cmp eax, dword [ecx + 8]
jbe 0x500ce6
sub esp, 0xa0
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0xa8]
cmp ecx, edx
jne 0x500ccd
cmp edx, 0x48
jg 0x500cb5
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f75e
lea edi, [esp + 0x10]
call fcn.0045f75e
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xb0]
mov ebp, dword [esp + 0xa4]
xor eax, eax
jmp 0x500b88
sub edx, eax
movzx edi, byte [ebp + edx - 1]
mov edx, ecx
sub ecx, eax
movzx esi, byte [ebx + ecx - 1]
xchg edi, ebx
mov byte [esp + eax + 0x58], bl
xchg edi, ebx
xchg esi, ebx
mov byte [esp + eax + 0x10], bl
xchg esi, ebx
inc eax
mov esi, dword [esp + 0xa8]
mov ecx, edx
mov edx, esi
cmp edx, eax
jg 0x500b5c
xor eax, eax
xor ecx, ecx
jmp 0x500c95
lea edx, [eax - 0x48]
neg edx
neg edx
sar edx, 0x1f
and edx, eax
movzx ebx, byte [esp + edx + 0x58]
movzx ebp, byte [esp + edx + 0x59]
mov esi, ebp
shl ebp, 8
or ebp, ebx
shr esi, 0x18
movzx ebx, byte [esp + edx + 0x5a]
mov edi, ebx
shl ebx, 0x10
or ebx, ebp
shr edi, 0x10
or edi, esi
movzx ebp, byte [esp + edx + 0x5b]
mov esi, ebp
shl ebp, 0x18
or ebp, ebx
shr esi, 8
or esi, edi
movzx ebx, byte [esp + edx + 0x5c]
or ebx, esi
movzx esi, byte [esp + edx + 0x5d]
shl esi, 8
or esi, ebx
movzx ebx, byte [esp + edx + 0x5e]
shl ebx, 0x10
or ebx, esi
movzx esi, byte [esp + edx + 0x5f]
shl esi, 0x18
or esi, ebx
mov dword [esp + 0xc], esi
movzx ebx, byte [esp + edx + 0x10]
movzx edi, byte [esp + edx + 0x11]
mov dword [esp + 8], edi
shl edi, 8
or edi, ebx
mov ebx, dword [esp + 8]
shr ebx, 0x18
movzx esi, byte [esp + edx + 0x12]
mov dword [esp + 8], esi
shr esi, 0x10
or esi, ebx
mov ebx, dword [esp + 8]
shl ebx, 0x10
or ebx, edi
movzx edi, byte [esp + edx + 0x13]
mov dword [esp + 8], edi
shr edi, 8
or edi, esi
mov esi, dword [esp + 8]
shl esi, 0x18
or esi, ebx
movzx ebx, byte [esp + edx + 0x14]
or ebx, edi
movzx edi, byte [esp + edx + 0x15]
shl edi, 8
or edi, ebx
movzx ebx, byte [esp + edx + 0x16]
shl ebx, 0x10
or ebx, edi
movzx edx, byte [esp + edx + 0x17]
shl edx, 0x18
or edx, ebx
sub ebp, esi
mov ebx, dword [esp + 0xc]
mov esi, ebx
sbb ebx, edx
sub ebp, ecx
sbb ebx, 0
add eax, 8
nop
mov ecx, esi
not ecx
and ecx, edx
xor esi, edx
xchg esi, ebx
not ebx
xchg esi, ebx
and ebx, esi
or ecx, ebx
shr ecx, 0x1f
cmp eax, 0x48
jl 0x500b95
cmp ecx, 1
sete al
and eax, 1
mov byte [esp + 0xbc], al
add esp, 0xa0
ret
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x894da8]
mov dword [esp + 4], eax
call fcn.00433690
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x894dc8]
mov dword [esp + 4], eax
call fcn.00433690
nop
call fcn.0045e260
jmp fcn.00500af0
Function at 0x58bc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58bd72
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00544870
movzx eax, byte [esp + 0xc]
test al, al
jne 0x58bc8a
lea eax, [0x687ca0]
mov dword [esp], eax
call fcn.0040af90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x6c69bb]
mov dword [eax], ecx
lea ecx, [0x8955a4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x58bd5e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00544f50
movzx eax, byte [esp + 0x10]
test al, al
je 0x58bd2b
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x58bc8a
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x687ca0]
mov dword [esp], eax
call fcn.0040af90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x6c6467]
mov dword [eax], ecx
lea ecx, [0x8955a4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045e260
jmp fcn.0058bc20
Function at 0x596cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x596eff
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0045f765
lea ecx, [0x596f10]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005891e0
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x596df5
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x596dcc
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005891e0
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x596e52
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x596e27
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x596e77
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x596efb
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x596efb
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x69c420]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00408750
mov eax, dword [esp + 8]
lea ecx, [0x895a7c]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.0045e260
jmp fcn.00596cd0
Function at 0x5caa50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cabfa
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x5caa7e
movzx ecx, byte [esp + 0x80]
jmp 0x5caa8b
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x5caac3
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x5cabe1
cmp cl, 0xe4
je 0x5caaa2
cmp ax, 0x303
jmp 0x5caac7
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x5cab55
cmp cl, 0xe3
jne 0x5cab1f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045fbfe
call fcn.005ca730
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.0049bcd0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x894ea0]
mov dword [esp + 4], eax
call fcn.00433690
nop
call fcn.0045e260
jmp fcn.005caa50
Function at 0x608ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x609073
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
test ecx, ecx
jne 0x608f14
nop
mov eax, dword [0xa1c3bc]
lea ecx, [0x8967e8]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
lea eax, [0x682040]
mov dword [esp + 4], eax
lea eax, [0xa43ac4]
mov dword [esp + 8], eax
call ecx
mov eax, dword [esp + 0x10]
lea ecx, [0x68ba20]
cmp dword [esp + 0xc], ecx
je 0x608f42
xor eax, eax
test eax, eax
je 0x60906f
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x60906f
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x44], dl
lea ebx, [ecx + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call fcn.00466530
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x64]
test edx, edx
je 0x608f9d
mov eax, dword [edx]
jmp 0x608f9f
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x45], dl
test dl, dl
je 0x609048
lea esi, [ecx + 0x7c]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x28]
call fcn.0045fc4e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
test ecx, 0x80000000
je 0x608ffb
shl ecx, 1
mov edx, eax
shr eax, 0x1f
or ecx, eax
mov eax, edx
shl edx, 1
mov ebx, ecx
shl ecx, 1
shr edx, 0x1f
or ecx, edx
shr ebx, 0x1f
add ecx, 0xd7b17f80
adc ebx, 0xd
jmp 0x609003
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
test ecx, ecx
sete cl
test ebx, ebx
sete dl
and edx, ecx
test dl, dl
je 0x60901a
test eax, 0x3fffffff
je 0x609048
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x20]
call fcn.0045fc4e
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.0045fc4e
call fcn.00480880
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.004668b0
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call fcn.0045e260
jmp fcn.00608ee0
Function at 0x405b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x524ee0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x529fc4]
push edi
push 0xf0
push eax
push esi
mov dword [ebp - 0x10c], ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x405cee
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405cee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405cee
mov edx, 0x1234
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405cd9
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
mov dword [ebp - 0x110], ecx
mov ecx, 0x403
add esi, 8
cmp cx, ax
jne 0x405c4e
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.00406de0
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x108]
cmove edi, ecx
lea ecx, [ebp - 0x104]
cmp eax, ecx
je 0x405cc6
push eax
call fcn.004a976a
add esp, 4
jmp 0x405cc6
cmp dx, ax
jne 0x405ccb
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x108], eax
call fcn.00406de0
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x12c], eax
cmp eax, ecx
je 0x405ca0
push eax
call fcn.004a976a
add esp, 4
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
mov edx, 0x1234
add esi, dword [ebp - 0x110]
test edi, edi
jne 0x405bc6
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b24
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004a8b24
mov esp, ebp
pop ebp
ret 4

Function at 0x409ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409cf5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409d34
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x409d30
lea ebx, [ebx]
cmp esi, edx
jae 0x409d34
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x409d20
cmp esi, edx
jb 0x409d39
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x418910
Capabilities:
Get disk size

Disassembly:
mov ecx, dword [0x526340]
push ebx
lea eax, [ecx + 1]
imul eax, ecx
push esi
cdq
mov esi, 0xf
idiv esi
mov bl, 1
cmp edx, 0xd
jne 0x418968
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
cdq
mov ecx, 7
idiv ecx
cmp edx, 4
je 0x418963
mov eax, esi
cdq
mov ecx, 5
idiv ecx
cmp edx, 2
jne 0x418963
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
pop esi
xor al, al
pop ebx
ret
pop esi
mov al, bl
pop ebx
ret

Function at 0x418a50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x526340]
push ebx
push esi
lea esi, [ecx + 1]
lea eax, [ecx + 2]
imul eax, esi
imul eax, ecx
push edi
cdq
mov edi, 0xc
idiv edi
mov bl, 1
cmp edx, 4
jne 0x418b19
imul esi, ecx
mov eax, esi
cdq
mov esi, 0xa
idiv esi
cmp edx, 8
jne 0x418b13
xor esi, esi
mov edx, esi
and edx, 1
dec edx
not edx
and edx, ecx
mov eax, esi
sar eax, 1
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
inc esi
add ecx, eax
cmp esi, 0x100
jl 0x418a90
mov dword [0x526340], ecx
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, bl
pop ebx
ret