joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e9c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b60f3
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4e72c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00404c5a
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.004035cb
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
push 2
call fcn.0040135c
add esp, 8
lea eax, [ebp - 0xa0]
lea ecx, [ebp - 0x40]
push eax
call fcn.00404cf0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.00404cf0
sub esp, 8
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ecx], str.Shell
mov dword [ecx + 4], 5
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.004031b1
lea ecx, [ebp - 0x88]
call fcn.00401ec9
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 5
call fcn.00401ec9
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x70]
call fcn.00401910
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
push 0
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x40ead0
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40eac6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40eac6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040182a
add esp, 8
call fcn.00403fa8
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], str.action
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa4], 6
push ecx
mov ecx, eax
call fcn.0040427d
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push str.register
push eax
call fcn.00403094
add esp, 8
test al, al
je 0x40eb44
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00401b54
call fcn.00401c71
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004037e7
add esp, 0x10
mov esi, eax
call fcn.00401c71
call fcn.00402d74
jmp 0x40eb7c
lea eax, [ebp - 0x28]
push str.unregister
push eax
call fcn.00403094
add esp, 8
test al, al
je 0x40eb77
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00401b54
add esp, 8
mov esi, eax
call fcn.00401c71
call fcn.00402d74
jmp 0x40eb7c
mov esi, 1
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40ebb2
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eba8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40eba8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040182a
add esp, 8
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00401ec9
lea ecx, [ebp - 0x40]
call fcn.00401ec9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040282e
mov esp, ebp
pop ebp
ret
Function at 0x41e150
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7b3d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e72c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
sub esp, 8
mov edx, esp
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x41e18d
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00404494
add esp, 0xc
mov esi, eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x41e1b2
mov esi, dword [esi]
mov ecx, dword [ebp + 8]
sub esp, 8
mov edx, esp
mov dword [edx], ecx
test ecx, ecx
je 0x41e1cc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e1c3
sub ecx, edi
lea eax, [ebp - 0x28]
mov dword [edx + 4], ecx
push eax
call fcn.00404494
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41e1e3
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [ebp - 0x14]
test eax, eax
setne bl
cmp edx, 8
jb 0x41e226
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e21c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e266
push edx
push ecx
call fcn.0040182a
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x41e276
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e26c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41e26c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040182a
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040282e
mov esp, ebp
pop ebp
ret 8

Function at 0x41e2f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4e72c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
sub esp, 8
mov edx, esp
mov dword [edx], ecx
test ecx, ecx
je 0x41e31c
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e313
sub ecx, esi
lea eax, [ebp - 0x1c]
mov dword [edx + 4], ecx
push eax
call fcn.00404494
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41e333
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [ebp - 8]
test eax, eax
setne bl
cmp edx, 8
jb 0x41e37d
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e373
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41e373
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040182a
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0040282e
mov esp, ebp
pop ebp
ret 4
Function at 0x432af0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x528
mov eax, dword [0x4e72c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x534]
mov eax, dword [ebp + 8]
push esi
push 3
push 0
push eax
call fcn.004028b0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x534]
call fcn.0040216c
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
je 0x432c43
mov bl, byte [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x534]
call fcn.00401f6e
mov ecx, dword [ebp - 0x290]
mov byte [ebp - 4], 3
test cl, 1
je 0x432bb2
test bl, bl
jne 0x432b9c
lea ecx, [ebp - 0x290]
call fcn.00403896
test al, al
jne 0x432bb2
mov ecx, dword [ebp - 0x290]
and ecx, 0xfffffffe
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x290]
call fcn.00403896
test al, al
je 0x432bec
test bl, bl
je 0x432c02
push 1
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00432af0
add esp, 0xc
test al, al
je 0x432c76
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
jmp 0x432bfe
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x432c76
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 1
call fcn.00404b92
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x534]
call fcn.0040216c
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004049bc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401ec9
cmp dword [ebp - 0x18], 0
jne 0x432b62
lea ecx, [ebp - 0x28]
call fcn.00401ec9
mov bl, 1
lea ecx, [ebp - 0x534]
call fcn.004011a9
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040282e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x290]
call fcn.00404b92
lea ecx, [ebp - 0x28]
call fcn.00401ec9
xor bl, bl
jmp 0x432c4d
Function at 0x43dee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0x43df08
call fcn.0040252c
cmp eax, 1
jl 0x43df08
mov dword [ebp - 4], 0x10000
jmp 0x43df0a
xor esi, esi
push 0xc
call fcn.00401feb
mov ecx, dword [ebp + 0xc]
add esp, 4
mov ebx, dword [ebp + 0x10]
mov edi, eax
test ebx, ebx
push 0
push dword [ebp - 4]
mov dword [edi], ecx
setne cl
push edi
push 0x43e360
push esi
mov byte [edi + 4], cl
mov ecx, dword [ebp + 0x14]
push 0
mov dword [edi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x43df58
push 0xc
push edi
call fcn.0040182a
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x43df67
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb93d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4e72c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x443b8d
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x14]
call fcn.00404863
mov dword [ebp - 4], 2
call fcn.004023c4
test al, al
je 0x443bb8
mov eax, esi
lea ecx, [ebp - 0x14]
cdq
push edx
push eax
push edi
push str.File::Read
call fcn.00401cfd
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x14]
movlpd qword [ebp - 0x28], xmm0
push eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x18], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x443bf0
mov esi, dword [ebp + 0x14]
jmp 0x443c02
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x443bff
xor esi, esi
jmp 0x443c02
or esi, 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402590
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4578a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdd2d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4e72c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.0040337d
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
push eax
call fcn.0040337d
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x34]
mov dword [ebp - 4], 1
lea ecx, [edi + 0x34]
push eax
call fcn.0040337d
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x68]
push dword [ebp + 0x10]
mov dword [ebp - 4], 2
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x4c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x5c], xmm0
mov eax, dword [eax + 0x18]
mov dword [edi + 0x64], eax
call fcn.0040337d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4af250
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4e72c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x3c]
push 0x38
push eax
call fcn.004af560
add esp, 8
test eax, eax
jne 0x4af28a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040282e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
shr eax, 0xa
call fcn.0040282e
mov esp, ebp
pop ebp
ret
Function at 0x502d91
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.00503151
movzx eax, al
test eax, eax
jne 0x502db7
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [0x2111407c]
push eax
call fcn.00503201
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [0x2111407c]
test eax, eax
je 0x502dda
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [0x2111407c]
mov dword [ebp - 0x24], eax
jmp 0x502dea
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [0x21114100]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x502dfd
xor al, al
jmp 0x502e81
mov eax, dword [ebp - 4]
push eax
call fcn.00502ce1
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov edx, dword fs:[0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 0xc
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
je 0x502e7f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00502ce1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00503201
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 4]
je 0x502e70
jmp 0x502e34
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00502e91
jmp 0x502e34
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x5035d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
push ecx
push 0x21115fe0
mov edx, dword [ebp + 0xc]
push edx
call fcn.005056ec
add esp, 0xc
cmp eax, 1
jne 0x503650
cmp dword [ebp - 4], 0
jle 0x50364c
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x5036a9
mov dword [ebp - 0x20], 0
jmp 0x503662
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx + 0x18]
jae 0x5036a5
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.00508673
add esp, 8
test eax, eax
je 0x503692
jmp 0x503659
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 4], edx
jmp 0x5036a9
jmp 0x5036cb
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x5036c1
jmp 0x5036cb
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x5036cd
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x503df1
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21117a70
push 0x21109a60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
test eax, eax
jne 0x503e49
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
jmp 0x504001
mov dword [ebp - 4], 0xffffffff
jmp 0x503e78
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x503e8e
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x503e98
mov eax, 2
jmp 0x504001
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
test eax, eax
jne 0x503ed3
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
jmp 0x504001
mov dword [ebp - 4], 0xffffffff
jmp 0x503f02
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x503f28
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x503f28
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x503f32
mov eax, 2
jmp 0x504001
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.0050529b
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x503f76
mov eax, 3
jmp 0x504001
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
test eax, eax
jne 0x503fd3
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
jmp 0x504001
mov dword [ebp - 4], 0xffffffff
jmp 0x503fff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x58b6e6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0058b765
jae 0x58b6f2
xor ecx, ecx
call fcn.0058b765
jae 0x58b71c
xor eax, eax
call fcn.0058b765
jae 0x58b72d
mov al, 0x10
call fcn.0058b765
adc al, al
jae 0x58b70e
jne 0x58b75a
stosb byte es:[edi], al
jmp 0x58b6f3
call fcn.0058b771
dec ecx
loop 0x58b739
mov eax, ebp
call fcn.0058b76f
jmp 0x58b75b
lodsb al, byte [esi]
shr eax, 1
je 0x58b781
adc ecx, 2
mov ebp, eax
jmp 0x58b75b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0058b76f
cmp eax, 0x7d00
jae 0x58b759
cmp eax, 0x500
jae 0x58b75a
cmp eax, 0x7f
ja 0x58b75b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x58b6f3
pop ebp
ret 8

Function at 0x596d1b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00596d9a
jae 0x596d27
xor ecx, ecx
call fcn.00596d9a
jae 0x596d51
xor eax, eax
call fcn.00596d9a
jae 0x596d62
mov al, 0x10
call fcn.00596d9a
adc al, al
jae 0x596d43
jne 0x596d8f
stosb byte es:[edi], al
jmp 0x596d28
call fcn.00596da6
dec ecx
loop 0x596d6e
mov eax, ebp
call fcn.00596da4
jmp 0x596d90
lodsb al, byte [esi]
shr eax, 1
je 0x596db6
adc ecx, 2
mov ebp, eax
jmp 0x596d90
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00596da4
cmp eax, 0x7d00
jae 0x596d8e
cmp eax, 0x500
jae 0x596d8f
cmp eax, 0x7f
ja 0x596d90
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x596d28
pop ebp
ret 8

Function at 0x5ee62b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005ee6aa
jae 0x5ee637
xor ecx, ecx
call fcn.005ee6aa
jae 0x5ee661
xor eax, eax
call fcn.005ee6aa
jae 0x5ee672
mov al, 0x10
call fcn.005ee6aa
adc al, al
jae 0x5ee653
jne 0x5ee69f
stosb byte es:[edi], al
jmp 0x5ee638
call fcn.005ee6b6
dec ecx
loop 0x5ee67e
mov eax, ebp
call fcn.005ee6b4
jmp 0x5ee6a0
lodsb al, byte [esi]
shr eax, 1
je 0x5ee6c6
adc ecx, 2
mov ebp, eax
jmp 0x5ee6a0
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005ee6b4
cmp eax, 0x7d00
jae 0x5ee69e
cmp eax, 0x500
jae 0x5ee69f
cmp eax, 0x7f
ja 0x5ee6a0
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5ee638
pop ebp
ret 8
Function at 0x6624d6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00662555
jae 0x6624e2
xor ecx, ecx
call fcn.00662555
jae 0x66250c
xor eax, eax
call fcn.00662555
jae 0x66251d
mov al, 0x10
call fcn.00662555
adc al, al
jae 0x6624fe
jne 0x66254a
stosb byte es:[edi], al
jmp 0x6624e3
call fcn.00662561
dec ecx
loop 0x662529
mov eax, ebp
call fcn.0066255f
jmp 0x66254b
lodsb al, byte [esi]
shr eax, 1
je 0x662571
adc ecx, 2
mov ebp, eax
jmp 0x66254b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0066255f
cmp eax, 0x7d00
jae 0x662549
cmp eax, 0x500
jae 0x66254a
cmp eax, 0x7f
ja 0x66254b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6624e3
pop ebp
ret 8