joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3274350
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x32e206c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, edx
mov ecx, dword [esi + 4]
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, 0xfffffff7
mov byte [ebp - 0xc], dl
shr edx, 3
sub eax, edx
mov byte [ebp - 8], cl
shr ecx, 0x18
and eax, 0x3f
inc eax
mov byte [ebp - 5], cl
push eax
mov edx, 0x32d9618
mov ecx, esi
call fcn.03275130
push 8
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.03275130
add esp, 8
xor eax, eax
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
sar edx, 2
and ecx, 3
shl ecx, 3
mov edx, dword [esi + edx*4 + 8]
shr edx, cl
mov byte [edi + eax + 4], dl
inc eax
cmp eax, 0x10
jl 0x32743d0
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop esi
call fcn.032a2376
mov esp, ebp
pop ebp
ret
Function at 0x3274430
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x32c9069
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x32e206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0
push 0x58
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], 0
call fcn.032a238c
mov ecx, eax
add esp, 4
mov dword [ebp - 0x74], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
lea edx, [esi + 4]
mov dword [ebp - 4], 1
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x32744bf
mov edx, dword [edx]
add eax, eax
push eax
call fcn.03275130
add esp, 4
lea ecx, [ebp - 0x74]
call fcn.03274350
inc dword [0x32e4754]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [edi], 0x32d9c14
xor ecx, ecx
movups xmm0, xmmword [ebp - 0x70]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 7
mov byte [ebp - 0x14], 0
movups xmmword [ebp - 0x24], xmm0
mov word [edi + 4], cx
mov dword [ebp - 0x78], 1
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0x24]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x44]
movq qword [ebp - 0x34], xmm0
push 0x32d95f8
push eax
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x28], 0
call fcn.03274320
add esp, 0xc
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x60]
push eax
call fcn.0327f3f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
lea ecx, [edi + 4]
push dword [ebp - 0x4c]
cmovae eax, dword [ebp - 0x5c]
push eax
call fcn.03281c30
mov byte [ebp - 4], 1
dec dword [0x32e4754]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x60], 0x32d9c14
cmp edx, 8
jb 0x32745ae
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x32745a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x32745e2
push edx
push ecx
call fcn.032a23bc
add esp, 8
inc esi
cmp esi, 0x10
jl 0x3274510
push 0x58
push dword [ebp - 0x74]
call fcn.032a23bc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
call fcn.032a81a6
int3
Function at 0x3274690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x32c90f0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x32e206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
push 0x58
mov dword [ebp - 0x5c], eax
call fcn.032a238c
mov dword [ebp - 0x40], eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
push esi
mov edx, edi
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.03275130
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.03274350
movups xmm0, xmmword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x58]
movups xmmword [ebp - 0x20], xmm0
call fcn.032745f0
xor ecx, ecx
mov dword [ebp - 0x2c], 0x32d9c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
inc dword [0x32e4754]
mov ecx, eax
call fcn.0327fab0
add esp, 4
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x28]
add ecx, 4
mov byte [ebp - 4], 3
cmp ecx, eax
je 0x327477b
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.03281f70
dec dword [0x32e4754]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x32747b7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x32747ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x327480f
push edx
push ecx
call fcn.032a23bc
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x32747e7
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x32747dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x327480f
push edx
push ecx
call fcn.032a23bc
add esp, 8
push 0x58
push dword [ebp - 0x40]
call fcn.032a23bc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
call fcn.032a81a6
int3
Function at 0x3279cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x32c9a71
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x32e206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x48], 0
test ebx, ebx
je 0x3279dcd
cmp dword [ebp + 8], 0
jle 0x3279dcd
lea eax, [ebp - 0x44]
push eax
call fcn.0327ffa0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x48], 1
call fcn.0327f9e0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x32d9954
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.032abb6f
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov esi, eax
cmp edx, 0x10
jb 0x3279d85
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3279d7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3279ded
push edx
push ecx
call fcn.032a23bc
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
jne 0x3279daa
lea ecx, [ebp - 0x44]
or esi, 0xffffffff
call fcn.0327f970
mov eax, esi
jmp 0x3279dd2
push esi
push 1
push dword [ebp + 8]
push ebx
call fcn.032ac6a2
push esi
call fcn.032abde3
add esp, 0x14
lea ecx, [ebp - 0x44]
xor esi, esi
call fcn.0327f970
mov eax, esi
jmp 0x3279dd2
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
call fcn.032a81a6
int3
Function at 0x327b1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x32c9b78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x32e206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x327b329
cmp byte [ebx + 0x3d], 0
je 0x327b329
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x327b244
xor al, al
jmp 0x327b32b
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.03279e20
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x327b29f
sub eax, 1
je 0x327b2a3
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x327b2f9
xor bl, bl
jmp 0x327b2fb
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x327b2db
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.032ac6a2
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x327b29b
cmp byte [ebx + 0x3d], 0
je 0x327b2f9
test esi, esi
jne 0x327b260
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.03274000
jmp 0x327b257
mov bl, 1
cmp edx, 0x10
jb 0x327b325
inc edx
mov ecx, eax
cmp edx, 0x1000
jb 0x327b31b
mov eax, dword [eax - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x327b347
push edx
push eax
call fcn.032a23bc
add esp, 8
mov al, bl
jmp 0x327b32b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
call fcn.032a81a6
int3
Function at 0x327b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x32c9bd0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x32e206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], 0x32d9974
call fcn.032a238c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.032a01b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], 0x32d99b4
call fcn.0327b350
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x32844f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x32e206c]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 8]
push edi
mov edx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [eax], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [edi], 0
cmp ecx, 5
jae 0x328455f
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov al, byte [edx]
mov dword [esp + 0x2c], ecx
cmp al, 0xe1
jae 0x32846a2
xor edx, edx
movzx eax, al
mov ecx, 9
div ecx
mov ecx, 5
mov dword [esp + 0x20], edx
xor edx, edx
movzx eax, al
div ecx
push ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.03284490
add esp, 4
test eax, eax
jne 0x32846a7
mov ecx, dword [esp + 0x10]
mov edx, ecx
movups xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edi
push ecx
push esi
push dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x48]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x98], 1
mov dword [esi], eax
call fcn.032841f0
mov ecx, dword [esp + 0x6c]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [eax], ecx
test esi, esi
jne 0x328467a
cmp dword [edi], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x48]
push 0x32e2acc
call dword [str.GetUserNameW]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.032a2376
mov esp, ebp
pop ebp
ret
Function at 0x3284fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x32c9910
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x32e206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x32ce104
call fcn.032a238c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.032a01b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x32965f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x158
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], edx
push esi
push edi
test ecx, ecx
je 0x32967bb
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x32967bb
cmp esi, 0x40
jb 0x32967bb
movups xmm0, xmmword [ecx + 0x10]
mov edx, 0x5a4d
movups xmm1, xmmword [ecx]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [ecx + 0x20]
movd eax, xmm1
movups xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm1
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [esp + 0x50], xmm0
cmp ax, dx
jne 0x32967bb
mov edx, dword [esp + 0x5c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x32967bb
lea eax, [edx + ecx]
mov ecx, 0x3e
mov esi, eax
mov dword [esp + 0x18], eax
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x68], 0x4550
jne 0x32967bb
mov eax, 0xe0
cmp word [esp + 0x7c], ax
jne 0x32967bb
mov eax, dword [esp + 0x6c]
shr eax, 0x10
lea ecx, [eax + eax*4]
shl ecx, 3
lea eax, [edx + 0xf8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x32967bb
push ecx
call fcn.032b4309
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x32967bb
movzx edi, word [esp + 0x6e]
mov dword [esp + 0x14], edi
lea esi, [edi + edi*4]
shl esi, 3
push esi
push 0
push eax
call fcn.032a48b0
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, 0xf8
push esi
push eax
push dword [esp + 0x18]
call fcn.032a3db0
mov esi, dword [esp + 0xc8]
xor edx, edx
mov ecx, dword [esp + 0xac]
mov eax, esi
div ecx
add esp, 0xc
test edx, edx
je 0x329671d
lea esi, [eax + 1]
imul esi, ecx
test edi, edi
je 0x3296752
mov edi, dword [esp + 0x10]
add edi, 8
mov ecx, dword [edi]
test ecx, ecx
je 0x3296748
xor edx, edx
mov eax, ecx
div dword [esp + 0xa0]
test edx, edx
je 0x3296746
sub ecx, edx
add ecx, dword [esp + 0xa0]
add esi, ecx
add edi, 0x28
sub dword [esp + 0x14], 1
jne 0x3296728
push 0x40
push 0x1000
push esi
push 0
call dword [0x32cd110]
mov edi, eax
test edi, edi
jne 0x3296771
lea eax, [edi + 0xb]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x68]
push edi
push dword [esp + 0x14]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.03296080
add esp, 0x10
test eax, eax
jne 0x3296799
mov eax, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
push esi
push edi
push ecx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.03296240
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x329d450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov ebx, ecx
xor cl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], cl
test eax, eax
je 0x329d62c
test ebx, ebx
je 0x329d62c
push esi
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x329d480
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
call fcn.032a23ca
mov edi, eax
add esp, 4
test edi, edi
je 0x329d622
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.032a48b0
add esp, 0xc
lea eax, [esi*2 + 1]
push 0
push 0
push eax
push edi
push esi
push ebx
push 0
push 0
call dword [0x32cd098]
mov ebx, edi
lea ecx, [ebx + 1]
nop dword [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x329d4e0
sub ebx, ecx
mov ecx, 0
je 0x329d55f
cmp ebx, 0x40
jb 0x329d553
movsx eax, bl
mov edx, ebx
and edx, 0xffffffc0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [edi + ecx]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + ecx], xmm1
movups xmm0, xmmword [edi + ecx + 0x10]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x10], xmm0
movups xmm0, xmmword [edi + ecx + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x20], xmm0
movups xmm0, xmmword [edi + ecx + 0x30]
pxor xmm1, xmm0
movups xmmword [edi + ecx + 0x30], xmm1
add ecx, 0x40
cmp ecx, edx
jb 0x329d510
cmp ecx, ebx
jae 0x329d55f
xor byte [ecx + edi], bl
inc ecx
cmp ecx, ebx
jb 0x329d557
lea eax, [ebx + ebx]
mov dword [ebp - 0x10], eax
inc eax
push eax
mov dword [ebp - 0xc], eax
call fcn.032a23ca
mov esi, eax
add esp, 4
test esi, esi
je 0x329d60e
push dword [ebp - 0xc]
push 0
push esi
call fcn.032a48b0
lea eax, [ebx + ebx]
push eax
push 0
push esi
call fcn.032a48b0
xor ecx, ecx
add esp, 0x18
mov dword [ebp - 0xc], ecx
test ebx, ebx
je 0x329d5f2
nop
movzx ecx, byte [ecx + edi]
xor eax, eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
mov eax, ecx
and eax, 0xf
shr ecx, 4
movsx eax, byte [eax + 0x32d971c]
push eax
movsx eax, byte [ecx + 0x32d971c]
push eax
push 0x32da2c4
lea eax, [ebp - 8]
push 3
push eax
call fcn.0327ec50
mov ecx, dword [ebp - 0xc]
add esp, 0x14
movzx eax, byte [ebp - 8]
mov byte [esi + ecx*2], al
movzx eax, byte [ebp - 7]
mov byte [esi + ecx*2 + 1], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
jb 0x329d5a0
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push eax
push esi
push 0
push 0
call dword [0x32cd08c]
push esi
call fcn.032a2387
add esp, 4
push edi
mov bl, 1
call fcn.032a2387
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x32a0c35
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x32cc6ce
call fcn.032a2c50
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x32a0d6a
cmp byte [edi + 0x3e], bl
je 0x32a0d6a
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x32cd2d4]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x32a0c82
xor al, al
jmp 0x32a0d6c
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0327b090
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x32a0cb7
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x32a0cc1
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x32cd2d4]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x32a0cf1
sub eax, 1
jne 0x32a0d4f
mov edi, dword [ebp - 0x30]
jmp 0x32a0cf7
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x32a0d07
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x32a0d31
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x32a0d18
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.032ac6a2
add esp, 0x10
cmp esi, eax
jne 0x32a0d5a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x32a0d58
test esi, esi
jne 0x32a0ca9
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.03274000
jmp 0x32a0ca3
dec eax
sub eax, 1
jne 0x32a0d5e
inc eax
jmp 0x32a0d5c
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.03273bc0
mov al, bl
jmp 0x32a0d6c
mov al, 1
call fcn.032a2c0b
ret

Function at 0x32bc850
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.032bc513

Function at 0x32bc85b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.032bc694
Function at 0x1352058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x13521a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x135207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x135206a
add dl, dl
jne 0x1352089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13520dc
xor eax, eax
add dl, dl
jne 0x1352096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x135217d
add dl, dl
jne 0x13520a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13520b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13520bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13520c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13520d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1352075
mov eax, 1
add dl, dl
jne 0x13520ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13520f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13520e1
sub eax, ebx
mov ebx, 1
jne 0x1352128
mov ecx, 1
add dl, dl
jne 0x135210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1352119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1352105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1352075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x135213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x135214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1352136
cmp eax, 0x7d00
jae 0x135216d
cmp eax, 0x500
jb 0x1352168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1352075
cmp eax, 0x7f
ja 0x1352170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1352075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x135219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1352075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10