joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041d50
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 4]
call fcn.1003b8f0
mov edi, eax
mov ebx, edx
add edi, 0xea60
adc ebx, 0
cmp dword [esi], 0
jne 0x10041d9a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, eax
test edx, edx
je 0x10041daa
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x10041d9a
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x10041db0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp]
mov esi, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
mov eax, 0x300
mov word [esp + 0x14], ax
test esi, esi
jle 0x10041e02
mov ecx, dword [ebp + 8]
nop
mov eax, dword [ecx]
test eax, eax
je 0x10041dfa
mov eax, dword [eax + 0xad18]
test eax, eax
je 0x10041dfa
cmp byte [eax + 0x10], 0
jne 0x10041dfa
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
cmp ebx, eax
jl 0x10041dfa
jg 0x10041df6
cmp edi, edx
jbe 0x10041dfa
mov edi, edx
mov ebx, eax
add ecx, 4
sub esi, 1
jne 0x10041dd0
push dword [ebp + 4]
mov esi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
jle 0x10041ee6
call fcn.1003b8f0
sub edi, eax
sbb ebx, edx
test ebx, ebx
jg 0x10041e36
jl 0x10041e29
test edi, edi
jae 0x10041e36
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov edi, dword [esp + 0x18]
push edi
push str.Entering_poll_for__d_ms
push 0x1a4
push str.C:UsersJesse_source_reposSNPJuiceout_buildx86_release_depsjuice_src_srcconn_mux.c
push 0
call fcn.10034290
add esp, 0x14
lea eax, [esp + 0x10]
push edi
push 1
push eax
call dword [sym.imp.WS2_32.dll_WSAPoll]
push str.Leaving_poll
push 0x1a6
push str.C:UsersJesse_source_reposSNPJuiceout_buildx86_release_depsjuice_src_srcconn_mux.c
push 0
mov esi, eax
call fcn.10034290
add esp, 0x10
test esi, esi
jns 0x10041eb3
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2714
je 0x10041e95
call ebx
cmp eax, 0x2733
jne 0x10041eca
push str.poll_interrupted
push 0x1a9
push str.C:UsersJesse_source_reposSNPJuiceout_buildx86_release_depsjuice_src_srcconn_mux.c
push 0
call fcn.10034290
add esp, 0x10
jmp 0x10041d5b
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.10041870
add esp, 8
test eax, eax
js 0x10041ee6
jmp 0x10041d5b
call ebx
push eax
push str.poll_failed__errno_d
push 0x1ac
push str.C:UsersJesse_source_reposSNPJuiceout_buildx86_release_depsjuice_src_srcconn_mux.c
push 5
call fcn.10034290
add esp, 0x14
push str.Leaving_connections_thread
push 0x1b5
push str.C:UsersJesse_source_reposSNPJuiceout_buildx86_release_depsjuice_src_srcconn_mux.c
push 1
call fcn.10034290
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10042830
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.1003b8f0
mov ebp, dword [esp + 0x1c]
add eax, 0xea60
mov esi, dword [esp + 0x14]
adc edx, 0
lea ebx, [esi + 4]
mov dword [ebp], eax
mov dword [ebp + 4], edx
cmp dword [ebx], 0
jne 0x1004287c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, eax
test edx, edx
je 0x1004288c
mov ecx, edx
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x1004287c
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x10042892
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x18]
mov esi, dword [esi + 0xc]
inc esi
cmp dword [edi + 4], esi
je 0x100428e4
lea eax, [esi*8]
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
test eax, eax
jne 0x100428df
push str.Memory_allocation_for_poll_file_descriptors_failed
push 0x89
push str.C:UsersJesse_source_reposSNPJuiceout_buildx86_release_depsjuice_src_srcconn_poll.c
push 5
call fcn.10034290
add esp, 0x10
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov dword [edi], eax
mov dword [edi + 4], esi
mov ebx, dword [esp + 0x14]
mov edx, 1
mov ecx, dword [edi]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov eax, 0x300
mov word [ecx + 4], ax
cmp dword [edi + 4], edx
jbe 0x1004293b
mov eax, dword [edi]
lea ecx, [eax + edx*8]
mov eax, dword [ebx + 8]
mov eax, dword [eax + edx*4 - 4]
test eax, eax
je 0x1004292a
mov eax, dword [eax + 0xad18]
test eax, eax
je 0x1004292a
mov esi, dword [eax + 4]
test esi, esi
je 0x1004294e
cmp esi, 1
je 0x10042955
xor eax, eax
mov word [ecx + 4], ax
or eax, 0xffffffff
inc edx
mov dword [ecx], eax
cmp edx, dword [edi + 4]
jb 0x10042904
push dword [ebx + 4]
mov esi, dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
mov dword [eax + 4], 1
mov ebx, dword [eax + 0x1c]
mov esi, dword [eax + 0x18]
cmp dword [ebp + 4], ebx
jl 0x1004296d
jg 0x10042967
cmp dword [ebp], esi
jbe 0x1004296d
mov dword [ebp], esi
mov dword [ebp + 4], ebx
mov eax, dword [eax + 8]
mov ebx, 0x300
mov word [ecx + 4], bx
mov ebx, dword [esp + 0x14]
jmp 0x10042933
Function at 0x10044650
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov al, byte [edi]
test al, al
je 0x10044758
cmp al, 0x3d
je 0x10044758
xor esi, esi
mov dword [esp + 0x14], 0
test al, al
je 0x1004474e
cmp esi, 4
jae 0x100446f5
mov bl, byte [edi]
inc edi
movzx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
jne 0x100446f0
cmp bl, 0x3d
je 0x100446f5
lea eax, [ebx - 0x41]
cmp al, 0x19
ja 0x100446ab
mov byte [esp + esi + 0x14], al
jmp 0x100446ef
lea eax, [ebx - 0x61]
cmp al, 0x19
ja 0x100446bb
sub bl, 0x47
mov byte [esp + esi + 0x14], bl
jmp 0x100446ef
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x100446cb
add bl, 4
mov byte [esp + esi + 0x14], bl
jmp 0x100446ef
cmp bl, 0x2b
je 0x100446ea
cmp bl, 0x2d
je 0x100446ea
cmp bl, 0x2f
je 0x100446e3
cmp bl, 0x5f
jne 0x10044763
mov byte [esp + esi + 0x14], 0x3f
jmp 0x100446ef
mov byte [esp + esi + 0x14], 0x3e
inc esi
cmp byte [edi], 0
jne 0x10044680
test esi, esi
je 0x1004474e
mov ecx, dword [esp + 0x1c]
lea eax, [esi - 1]
cmp ecx, eax
jb 0x10044763
mov dl, byte [esp + 0x15]
mov eax, 1
sub eax, esi
add ecx, eax
mov al, byte [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov cl, dl
shr cl, 4
shl al, 2
or cl, al
mov byte [ebp], cl
inc ebp
cmp esi, 1
jbe 0x1004474e
mov cl, byte [esp + 0x16]
mov al, cl
shl dl, 4
shr al, 2
or al, dl
mov byte [ebp], al
inc ebp
cmp esi, 2
jbe 0x1004474e
shl cl, 6
or cl, byte [esp + 0x17]
mov byte [ebp], cl
inc ebp
mov al, byte [edi]
test al, al
jne 0x10044666
sub ebp, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x10044770
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x10081578], 0
push esi
push edi
jne 0x10044825
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x10081578], eax
inc esi
cmp esi, 0x100
jb 0x10044781
mov esi, dword [esp + 0x10]
or eax, 0xffffffff
mov edi, dword [esp + 0xc]
test esi, esi
je 0x1004484e
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10081578]
sub esi, 1
jne 0x10044834
pop edi
not eax
pop esi
ret
Function at 0x10044963
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1004498a
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1004498d
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1004493f
pop esi
leave
ret 8
Function at 0x1000b5b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [0x1019cb00], 0x8cd
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x1019cb00], 0x246e
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000b62e
xor eax, eax
mov dword [0x1019cb00], 0x94
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
je 0x1000b6d3
jmp 0x1000b703
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jge 0x1000b644
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x1000b617
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [0x1019cb00], 0x37d
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x1000b703
xor eax, eax
mov dword [0x1019cb04], 0x741
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
jne 0x1000b703
xor eax, eax
mov dword [0x1019cb00], 0x1e09
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
jne 0x1000b703
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
jne 0x1000b703
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
je 0x1000b5f0
jmp 0x1000b703
xor eax, eax
mov dword [0x1019cb04], 0x1211
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1000b703
mov eax, 1
mov dword [0x1019cb00], 0xffffff04
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
Function at 0x1000b8b0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dl, 0x6b
xor esi, esi
lea edi, [ebp - 0x6c]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x8c], 0x56
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x75
mov byte [ebp - 0x87], 0x61
mov byte [ebp - 0x86], 0x6c
mov byte [ebp - 0x85], 0x41
mov byte [ebp - 0x84], 0x6c
mov byte [ebp - 0x83], 0x6c
mov byte [ebp - 0x82], 0x6f
mov byte [ebp - 0x81], 0x63
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0xb
mov dword [0x1019cb04], 0x103d
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xb
mov dword [0x1019cb00], 0x196b
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], esi
mov eax, dword [ebp - 0xa8]
mov cl, byte [ebp - 0x9d]
movsx edx, cl
mov si, dx
mov edx, eax
add edx, 1
mov word [ebp + eax*2 - 0x6c], si
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x9d], cl
mov dword [ebp - 0xa8], edx
jne 0x1000b9a4
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [0x1019cb00], 0x18f0
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0xac], eax
call fcn.1000c0d0
mov dword [esp], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
call fcn.1000b2d0
xor ecx, ecx
mov dword [0x1019cb00], 0x8fa
cmp eax, 0
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], ecx
je 0x1000baf9
mov dword [0x1019cb00], 0x1868
mov eax, dword [ebp - 0xb0]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1019cb00], 0xcb6
mov dword [esp], eax
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [ebp - 0xb8], eax
call fcn.1000b710
xor eax, eax
mov ecx, dword [ebp - 0xb8]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x98]
mov dword [edx + 0x14], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [edx + 0x50], ecx
mov dword [0x1019cb00], 0x1ebc
mov dword [0x1019cb04], 0x21a7
cmp ecx, 0
mov dword [ebp - 0xb4], eax
je 0x1000baf9
mov eax, dword [ebp - 0xb8]
add eax, 0x1ceb
mov dword [0x1019cb04], 0x1401
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000bbe0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1019cb0c], 0
mov byte [0x1019cb10], 0
mov dword [0x1019cb04], 0x1e8d
mov dword [0x1019cb08], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x1019cb00], 0x1186
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1019cb04], 0x2167
mov eax, dword [0x1019cb08]
add eax, 1
mov dword [0x1019cb08], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000bc25
xor eax, eax
mov dword [0x1019cb00], 0x1002
mov dword [0x1019cb08], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1019cb14], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x1019cb00], 0x1768
mov edi, dword [0x1019cb0c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1019cb14], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x1019cb0c], edx
mov dword [0x1019cb00], 0x1c29
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x1019cb10], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x1019cb00], 0x194b
mov cl, byte [0x1019cb10]
mov esi, dword [0x1019cb0c]
mov byte [ebx + esi], cl
mov esi, dword [0x1019cb08]
add esi, 1
mov dword [0x1019cb08], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1000bc78
mov eax, dword [0x1019cb00]
add eax, 0xd50
mov dword [0x1019cb04], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000cbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1019cb08], 0
mov dword [0x1019cb0c], 0
mov dword [0x1019cb18], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1000cc21
jmp 0x1000cc29
mov eax, dword [0x1019cb08]
mov ecx, dword [0x1019cb0c]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jmp 0x1000cc3a
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000cc3a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
add eax, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1019cb08], edx
mov dword [0x1019cb00], 0x25ec
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1019cb0c], edx
mov dword [0x1019cb00], 0x227d
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1019cb10], cl
mov dword [0x1019cb00], 0x1d00
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1019cb10]
mov edx, dword [0x1019cb0c]
mov byte [ebx + edx], cl
mov edx, dword [0x1019cb08]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1019cb0c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov edx, dword [0x1019cb04]
and ecx, 0xff
mov dword [0x1019cb18], ecx
mov esi, edx
add esi, 0xffffec0a
mov dword [0x1019cb00], esi
mov cl, byte [ebx + ecx]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
mov ch, byte [esi + ebx]
mov dword [0x1019cb04], 0x1fea
add edx, 0xffffc8e1
mov dword [0x1019cb00], edx
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x20], edi
jne 0x1000cc08
jmp 0x1000cc21
Function at 0x1000cd30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [0x1019cb00], 0x2313
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.1000c510
mov ecx, 0x3ec
lea edx, [0x1000c400]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x58], 0x122a00
mov esi, dword [0x1019caec]
mov dword [esp + 0x70], esi
mov esi, dword [0x1019caf0]
mov dword [esp + 0x48], esi
mov esi, dword [0x1019caf4]
mov dword [esp + 0x98], esi
mov esi, dword [0x1019caf8]
mov dword [esp + 0x40], esi
mov esi, dword [0x1019cafc]
mov dword [esp + 0x74], esi
mov dword [0x1019cb00], 0xd17
mov dword [0x1019cb04], 0xf21
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
je 0x1000ce1d
jmp 0x1000ce3d
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000b8b0
mov dword [0x1019cb04], 0x104e
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x14], eax
jmp 0x1000cea0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
je 0x1000ce69
mov eax, 0xfffffb4e
mov dword [0x1019cb00], 0x479
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x1000cdcb
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x44], edx
mov dword [0x1019cb04], ecx
mov eax, dword [edx + eax + 0x50]
mov dword [esp + 0x80], eax
call fcn.1000b5b0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
je 0x1000cde4
mov eax, dword [esp + 0x14]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x35c3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.035c378f
jae 0x35c370e
xor ecx, ecx
call fcn.035c378f
jae 0x35c373d
xor eax, eax
call fcn.035c378f
jae 0x35c374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.035c378f
adc al, al
jae 0x35c372f
jne 0x35c3779
stosb byte es:[edi], al
jmp 0x35c3711
call fcn.035c379b
sub ecx, ebx
jne 0x35c3756
call fcn.035c3799
jmp 0x35c3775
lodsb al, byte [esi]
shr eax, 1
je 0x35c3783
adc ecx, ecx
jmp 0x35c3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.035c3799
cmp eax, 0x7d00
jae 0x35c3772
cmp ah, 5
jae 0x35c3773
cmp eax, 0x7f
ja 0x35c3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x35c3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x3633700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0363378f
jae 0x363370e
xor ecx, ecx
call fcn.0363378f
jae 0x363373d
xor eax, eax
call fcn.0363378f
jae 0x363374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0363378f
adc al, al
jae 0x363372f
jne 0x3633779
stosb byte es:[edi], al
jmp 0x3633711
call fcn.0363379b
sub ecx, ebx
jne 0x3633756
call fcn.03633799
jmp 0x3633775
lodsb al, byte [esi]
shr eax, 1
je 0x3633783
adc ecx, ecx
jmp 0x3633772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03633799
cmp eax, 0x7d00
jae 0x3633772
cmp ah, 5
jae 0x3633773
cmp eax, 0x7f
ja 0x3633774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3633711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x3113700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0311378f
jae 0x311370e
xor ecx, ecx
call fcn.0311378f
jae 0x311373d
xor eax, eax
call fcn.0311378f
jae 0x311374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0311378f
adc al, al
jae 0x311372f
jne 0x3113779
stosb byte es:[edi], al
jmp 0x3113711
call fcn.0311379b
sub ecx, ebx
jne 0x3113756
call fcn.03113799
jmp 0x3113775
lodsb al, byte [esi]
shr eax, 1
je 0x3113783
adc ecx, ecx
jmp 0x3113772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03113799
cmp eax, 0x7d00
jae 0x3113772
cmp ah, 5
jae 0x3113773
cmp eax, 0x7f
ja 0x3113774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3113711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8