joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c814
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x463b10
call fcn.0044cdcc
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x44c854
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44c854
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x44c86c
cmp eax, 0x20b
je 0x44c859
mov dword [ebp - 0x1c], edi
jmp 0x44c880
cmp dword [ecx + 0x84], 0xe
jbe 0x44c854
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x44c87a
cmp dword [ecx + 0x74], 0xe
jbe 0x44c854
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x47a618], 0xffffffff
or dword [0x47a61c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x47a5a0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x47a59c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x47a614], eax
call fcn.0044ce24
call fcn.0044cec4
cmp dword [0x4733b0], edi
jne 0x44c8e0
push fcn.0044cec4
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0044ceb2
push 0x4730c4
push 0x4730c0
call sub.MSVCR71.dll__initterm
push 0x44ce68
call fcn.0044ca96
mov eax, dword [0x47a598]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x47a594]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x44c934
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4730bc
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x44c95e
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x44ca18
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x44c9cd
cmp ax, di
je 0x44c974
cmp dword [ebp - 0x20], edi
jne 0x44c9cd
mov ax, word [esi]
cmp ax, di
je 0x44c989
cmp ax, 0x20
ja 0x44c989
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x44c974
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x44c9a5
movzx eax, word [ebp - 0x54]
jmp 0x44c9a8
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0044d6ba
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x44c9c5
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x44ca12
cmp ax, 0x22
jne 0x44c9de
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x44c95e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0044ce07
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x51eb679b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x76c918b8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402ad8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4cb008], 0x8088405
inc edx
mov dword [ebx + 0x4cb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404284
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x4042e9
test ecx, ecx
je fcn.00403fbc
cmp edx, dword [eax]
je 0x4042f0
cmp ecx, dword [eax]
je 0x4042a6
push eax
push ecx
call fcn.00403fbc
pop edx
pop eax
jmp fcn.00404240
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
call fcn.0040402c
mov edi, eax
mov edx, eax
mov eax, ebx
mov ecx, dword [ebx - 4]
call fcn.004028dc
mov edx, edi
mov eax, esi
mov ecx, dword [esi - 4]
add edx, dword [ebx - 4]
call fcn.004028dc
pop eax
mov edx, edi
test edi, edi
je 0x4042e0
dec dword [edi - 8]
call fcn.00403fbc
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.00403fbc
mov edx, ecx
jmp fcn.00404240

Function at 0x4228b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x4228e5
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x4228d6
and ecx, 3
je 0x4228fd
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x4228ea
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x422908
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x422941
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x422929
pop esi
and esi, 3
je 0x422966
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x422947
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x422970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42299c
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42298d
and ecx, 3
je 0x4229b4
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x4229a1
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4229bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x4229c8
pop edi
pop ebx
ret

Function at 0x4232e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00422f3c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x453423
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x423392
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.004028dc
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004229bc
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.004028dc
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004229bc
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x42333f
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x4233e0
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.004028dc
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004229bc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.004028dc
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x42340a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x42340a
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x4233fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45342a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004230d8
ret
Function at 0x431bec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x431c40
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x4cb704]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x4cbb04]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x4cbf04]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x4cc304]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x431bfb
pop edi
pop esi
pop ebx
ret

Function at 0x455b88
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x455c48
xor ebx, ebx
lea esi, [ebp - 0x114]
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
call fcn.004050a8
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x455bb2
xor edx, edx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x455c48
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc edx
and dl, 0xff
mov esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x114]
mov cl, byte [ebp - 0xd]
add cl, al
and cl, 0xff
mov byte [ebp - 0xd], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov cl, byte [ebp + ecx - 0x114]
mov byte [ebp + esi - 0x114], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x114], al
add al, byte [ebp + esi - 0x114]
and al, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x114]
mov eax, dword [ebp - 8]
mov byte [eax + ebx], cl
inc ebx
dec dword [ebp - 0x14]
jne 0x455be4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x455c54
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x455d0c
xor esi, esi
lea ecx, [ebp - 0x110]
mov eax, esi
cdq
idiv edi
mov al, byte [ebx + edx]
mov byte [ecx], al
inc esi
inc ecx
cmp esi, 0x100
jne 0x455c81
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x455d0c
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc edx
and dl, 0xff
xor eax, eax
mov al, dl
mov al, byte [ebp + eax - 0x110]
lea ecx, [eax + ecx]
and cl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [ebp + ebx - 0x110]
mov edi, edx
and edi, 0xff
mov byte [ebp + edi - 0x110], bl
xor ebx, ebx
mov bl, cl
mov byte [ebp + ebx - 0x110], al
xor ebx, ebx
mov bl, dl
add al, byte [ebp + ebx - 0x110]
and al, 0xff
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + esi]
and eax, 0xff
xor bl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], bl
inc esi
dec dword [ebp - 0x10]
jne 0x455ca7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x455d18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, ecx
mov ecx, edx
mov ebp, eax
test cl, cl
jbe 0x455d7f
xor ebx, ebx
mov esi, esp
mov byte [edi + ebx], bl
xor eax, eax
mov al, cl
push eax
mov eax, ebx
pop edx
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
mov al, byte [ebp + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x455d30
xor eax, eax
xor ebx, ebx
mov esi, esp
mov dl, byte [edi + ebx]
xor ecx, ecx
mov cl, dl
add eax, ecx
xor ecx, ecx
mov cl, byte [esi]
add eax, ecx
and eax, 0xff
mov cl, byte [edi + eax]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
inc ebx
inc esi
cmp ebx, 0x100
jne 0x455d58
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x456f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0x456f74
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0x456f62
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x457304
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x457329
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.004572c4
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.004572c4
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.004572c4
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.004572c4
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x457345
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.004572c4
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.004572c4
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x457494
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4574b9
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.004572c4
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.004572c4
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.004572c4
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.004572c4
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4574d5
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.004572c4
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.004572c4
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x466558
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x466589
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x466571
add dl, dl
jne 0x466594
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4665e5
xor eax, eax
add dl, dl
jne 0x4665a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x466682
add dl, dl
jne 0x4665b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4665bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4665c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4665d1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4665db
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x466580
mov eax, 1
add dl, dl
jne 0x4665f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4665fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4665ea
sub eax, ebx
mov ebx, 1
jne 0x466631
mov ecx, 1
add dl, dl
jne 0x466617
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x466622
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x46660e
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x466580
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x466648
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x466653
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x46663f
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x466580
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4666a3
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x466580
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x467d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x497e3f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x467e31
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x467e1a
test esi, esi
jbe 0x467e31
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00408cd4
test eax, eax
jne 0x467e0c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x467e31
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x467de9
jmp 0x467e31
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x467e31
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e46
ret
Function at 0x468860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x498a0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.0040462c
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x46889b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4688b4
lea eax, [ebp - 0x10]
mov edx, dword [0x4dc26c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.0040468c
jmp 0x4688c7
lea eax, [ebp - 0x10]
mov edx, dword [0x4dc26c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.0040468c
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4688d3
adc edx, 0
mov edx, dword [edx*4 + 0x4da9d8]
call fcn.0040488c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404870
push eax
call fcn.00406590
mov esi, eax
cmp esi, 0xffffffff
je 0x4689e1
mov eax, 0x40
call fcn.004026e4
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406998
test eax, eax
je 0x4689d4
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4689d4
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406a10
mov eax, edi
call fcn.00402704
mov eax, 0x18
call fcn.004026e4
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406998
test eax, eax
je 0x4689d4
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4689d4
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4689d4
cmp dx, 0x150
ja 0x4689d4
mov eax, edi
call fcn.00402704
mov eax, 0xe0
call fcn.004026e4
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406998
test eax, eax
je 0x4689d4
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4689d4
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404668
mov eax, edi
call fcn.00402704
push esi
call fcn.00406548
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404998
jne 0x4689f9
inc ebx
cmp ebx, 0x19
jne 0x46888d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498a16
lea eax, [ebp - 0x10]
call fcn.0040462c
ret