joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push 0xa
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CObList::CObList
mov dword [esp + 0xc], 0x4a0274
lea eax, [ebp + 0x10]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CObList::AddTail
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
test ebx, ebx
mov byte [esp + 0x30], 1
je 0x450dc1
push esi
mov esi, dword [esp + 0x44]
push edi
mov eax, ebx
mov ebx, dword [ebx]
mov edi, dword [eax + 8]
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x450db7
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx + 0x2c]
test edx, edx
jne 0x450db7
cmp dword [ecx + 0x30], eax
jne 0x450db7
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.004513f0
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x10]
push esi
push edx
push eax
mov ecx, ebp
call fcn.00450e10
cmp dword [esp + 0x48], 1
jne 0x450db0
mov ecx, dword [esi]
push esi
inc ecx
mov dword [esi], ecx
mov ecx, dword [esp + 0x48]
push ecx
push edi
mov ecx, ebp
call fcn.00450cc0
mov edx, dword [edi + 4]
lea eax, [esp + 0x10]
push edx
push 0x4f0598
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esi]
mov edx, dword [esp + 0x50]
add esp, 0xc
dec ecx
mov dword [esi], ecx
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
mov ecx, ebp
call fcn.00450e10
mov dword [edi + 0x2c], 1
test ebx, ebx
jne 0x450d24
pop edi
pop esi
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048c966
mov ecx, dword [esp + 0x28]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc

Function at 0x450e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4942ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 4]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 8]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_4
lea ebp, [esi + 0x10]
push 0xa
mov ecx, ebp
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CObList::CObList
mov dword [ebp], 0x4a0274
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [esi], eax
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 1
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4511c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49436c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov esi, dword [edi + 0x14]
mov dword [esp + 0x14], 3
test esi, esi
je 0x451203
mov eax, esi
mov esi, dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4511ff
mov eax, dword [ecx]
push 1
call dword [eax + 4]
test esi, esi
jne 0x4511ed
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x10]
mov byte [esp + 0x14], 1
call fcn.0048c966
lea ecx, [edi + 8]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x451250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4943a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x497f84
lea edi, [esi + 4]
mov dword [esp + 0x18], 0
mov ecx, edi
call sub.MFC42.DLL_CString::CString_4
lea ebx, [esi + 0xc]
push 0xa
mov ecx, ebx
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CObList::CObList
mov dword [ebx], 0x4a029c
lea ebx, [esi + 0x34]
mov byte [esp + 0x18], 2
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_4
push 0x4f11f4
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [esi], 0x4a0288
call sub.MFC42.DLL_CString::operator_2
push 0x4f11f4
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 8], eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4526c0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x104
test edx, edx
push edi
je 0x452757
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452757
mov ecx, 0x3f
lea edi, [esp + 9]
mov byte [esp + 8], al
push esi
rep stosd dword es:[edi], eax
push 0
push 0
push 3
push 0
stosw word es:[edi], ax
push 1
push SysReAllocString
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x452730
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x14]
push 0x100
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
add esp, 0x104
ret 8
Function at 0x452770
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x104
test edx, edx
push ebx
push esi
push edi
je 0x45284c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45284c
mov esi, dword [esp + 0x118]
test esi, esi
je 0x45284c
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45284c
mov ecx, 0x3f
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0
rep stosd dword es:[edi], eax
push 0
push 3
stosw word es:[edi], ax
push 0
push 3
push 0xc0000000
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45284c
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x18]
push 0x100
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x18]
push 0x100
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x104
ret 8
Function at 0x452b80
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
mov esi, ecx
test edi, edi
mov dword [esp + 0xc], esi
je 0x452d1c
mov ecx, dword [esi + 0x10]
test ecx, ecx
jle 0x452d1c
mov eax, dword [esi + 0x14]
test eax, eax
jle 0x452d1c
mov dl, byte [esp + 0x7c]
test dl, dl
mov edx, dword [esp + 0x78]
jne 0x452bc3
cmp edx, 4
je 0x452d1c
mov dword [esp + 0x10], 0x9999999a
mov dword [esp + 0x14], 0x3fb99999
mov dword [esp + 0x18], 0x33333333
mov dword [esp + 0x1c], 0x3fd33333
mov dword [esp + 0x20], 0x33333333
mov dword [esp + 0x24], 0x3fe33333
mov dword [esp + 0x28], 0xcccccccd
mov dword [esp + 0x2c], 0x3feccccc
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3ff00000
mov dword [esp + 0x38], 0x33333333
mov dword [esp + 0x3c], 0x3ff33333
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3ff80000
mov dword [esp + 0x48], 0xcccccccd
mov dword [esp + 0x4c], 0x3ffccccc
mov dword [esp + 0x50], 0xcccccccd
mov dword [esp + 0x54], 0x4000cccc
mov dword [esp + 0x58], 0x33333333
mov dword [esp + 0x5c], 0x40033333
mov dword [esp + 0x60], 0x9999999a
mov dword [esp + 0x64], 0x40059999
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0x40080000
fld qword [esp + edx*8 + 0x10]
xor ebp, ebp
fstp dword [esp + 0x74]
test ecx, ecx
jle 0x452d1c
push ebx
xor ebx, ebx
test eax, eax
jle 0x452d0f
imul eax, ebp
add eax, ebx
mov esi, eax
movsx eax, word [edi + esi*2]
sub eax, 0x80
mov dword [esp + 0x80], eax
fild dword [esp + 0x80]
fmul dword [esp + 0x78]
fadd dword [0x4a02b8]
call sub.MSVCRT.dll__ftol
cmp eax, 0xff
jg 0x452cdf
test eax, eax
jge 0x452cd8
xor eax, eax
jmp 0x452ce4
cmp eax, 0xff
jle 0x452ce4
mov eax, 0xff
cmp ax, 0xff
mov word [edi + esi*2], ax
jle 0x452cf4
mov word [edi + esi*2], 0xff
cmp word [edi + esi*2], 0
jge 0x452d01
mov word [edi + esi*2], 0
mov ecx, dword [esp + 0x10]
inc ebx
mov eax, dword [ecx + 0x14]
cmp ebx, eax
jl 0x452c9c
mov esi, ecx
mov ecx, dword [esi + 0x10]
inc ebp
cmp ebp, ecx
jl 0x452c96
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x64
ret 0xc
Function at 0x452d30
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov dword [esp + 0x10], ecx
je 0x452fe6
mov ebx, dword [ecx + 0x10]
test ebx, ebx
jle 0x452fe6
mov esi, dword [ecx + 0x14]
test esi, esi
jle 0x452fe6
mov eax, dword [ebp + 0xc]
cmp eax, 7
je 0x452fe6
mov dword [esp + 0x20], 0x33333333
mov dword [esp + 0x24], 0x3fd33333
mov dword [esp + 0x28], 0x9999999a
mov dword [esp + 0x2c], 0x3fd99999
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3fe00000
mov dword [esp + 0x38], 0x33333333
mov dword [esp + 0x3c], 0x3fe33333
mov dword [esp + 0x40], 0x66666666
mov dword [esp + 0x44], 0x3fe66666
mov dword [esp + 0x48], 0x9999999a
mov dword [esp + 0x4c], 0x3fe99999
mov dword [esp + 0x50], 0xcccccccd
mov dword [esp + 0x54], 0x3feccccc
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0x3ff00000
mov dword [esp + 0x60], 0x9999999a
mov dword [esp + 0x64], 0x3ff19999
mov dword [esp + 0x68], 0x33333333
mov dword [esp + 0x6c], 0x3ff33333
mov dword [esp + 0x70], 0xcccccccd
mov dword [esp + 0x74], 0x3ff4cccc
mov dword [esp + 0x78], 0x66666666
mov dword [esp + 0x7c], 0x3ff66666
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0x3ff80000
mov dword [esp + 0x88], 0x9999999a
mov dword [esp + 0x8c], 0x3ff99999
mov dword [esp + 0x90], 0x33333333
mov dword [esp + 0x94], 0x3ffb3333
mov dword [esp + 0x98], 0xcccccccd
mov dword [esp + 0x9c], 0x3ffccccc
mov dword [esp + 0xa0], 0x66666666
mov dword [esp + 0xa4], 0x3ffe6666
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0x40000000
mov dword [esp + 0xb0], 0xcccccccd
mov dword [esp + 0xb4], 0x4000cccc
mov dword [esp + 0xb8], 0x9999999a
mov dword [esp + 0xbc], 0x40019999
mov dword [esp + 0xc0], 0x66666666
mov dword [esp + 0xc4], 0x40026666
mov dword [esp + 0xc8], 0x33333333
mov dword [esp + 0xcc], 0x40033333
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 0x40040000
fld qword [esp + eax*8 + 0x20]
fdivr qword [0x4a02c8]
fstp qword [esp + 0x18]
fld qword [0x49df08]
fld qword [esp + 0x18]
call sub.MSVCRT.dll__CIpow
fmul qword [0x4a02c0]
test ebx, ebx
mov dword [esp + 0xc], 0
fstp qword [esp + 0xd8]
jle 0x452fe6
xor ebx, ebx
test esi, esi
jle 0x452fce
imul esi, dword [esp + 0xc]
add esi, ebx
movsx eax, word [edi + esi*2]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fld qword [esp + 0x18]
call sub.MSVCRT.dll__CIpow
fdiv qword [esp + 0xd8]
call sub.MSVCRT.dll__ftol
cmp eax, 0xff
jg 0x452fa0
test eax, eax
jge 0x452f99
xor eax, eax
jmp 0x452fa5
cmp eax, 0xff
jle 0x452fa5
mov eax, 0xff
cmp ax, 0xff
mov word [edi + esi*2], ax
jle 0x452fb5
mov word [edi + esi*2], 0xff
cmp word [edi + esi*2], 0
jge 0x452fc2
mov word [edi + esi*2], 0
mov ecx, dword [esp + 0x10]
inc ebx
mov esi, dword [ecx + 0x14]
cmp ebx, esi
jl 0x452f62
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc eax
mov ecx, dword [edx + 0x10]
mov dword [esp + 0xc], eax
cmp eax, ecx
jl 0x452f5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4617e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494cd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
xor esi, esi
mov eax, 3
mov dword [esp + 8], 0x4a0388
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x4c], esi
mov ecx, dword [esp + 0x6c]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x6c], esi
call fcn.00461be0
mov ebx, eax
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, esi
mov dword [esp + 8], 0x4a0388
je 0x46188e
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x50]
cmp eax, esi
je 0x4618a3
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esp + 0x50], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4618b8
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4618c9
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x5c]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x471700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4952f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x64]
push ebp
push esi
mov eax, dword [ebx + 0x18]
mov ebp, dword [ebx + 0x1c]
xor esi, esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0x3ff00000
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x6c], esi
call fcn.004667e0
mov ecx, dword [esp + 0x78]
push ecx
lea ecx, [esp + 0x24]
call fcn.00467120
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
mov ecx, eax
mov edx, dword [eax]
mov dword [esp + 0x1c], ecx
mov dword [eax + 8], edx
call fcn.004664c0
cmp eax, esi
je 0x471825
mov ecx, dword [eax + 0x24]
mov edx, dword [esp + 0x74]
cmp ecx, edx
jg 0x471814
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
mov ebp, dword [eax + 0x1c]
mov ebx, dword [eax + 0x20]
cmp edx, ecx
mov dword [esp + 0x18], ebp
jg 0x471810
sub ecx, edx
lea esi, [edx*4]
inc ecx
mov dword [esp + 0x78], ecx
cmp ebp, ebx
mov ecx, ebp
jg 0x471800
mov edx, dword [edi + 8]
add edx, esi
mov ebp, dword [edx]
mov ebp, dword [ebp + ecx*4]
cmp ebp, dword [eax]
jne 0x4717f7
mov edx, dword [edx]
mov dword [edx + ecx*4], 0
inc ecx
cmp ecx, ebx
jle 0x4717df
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x78]
add esi, 4
dec ecx
mov dword [esp + 0x78], ecx
jne 0x4717d9
xor esi, esi
mov ebx, dword [esp + 0x70]
mov ecx, dword [esp + 0x1c]
call fcn.004664c0
cmp eax, esi
jne 0x4717ac
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, esi
jle 0x47185c
xor eax, eax
cmp ebp, esi
jle 0x471853
mov edx, dword [edi + 8]
mov ebp, dword [ebx + 8]
inc eax
mov edx, dword [edx + ecx*4]
mov ebp, dword [ebp + ecx*4]
mov edx, dword [edx + eax*4 - 4]
mov dword [ebp + eax*4 - 4], edx
mov ebp, dword [esp + 0x10]
cmp eax, ebp
jl 0x471835
mov eax, dword [esp + 0x14]
inc ecx
cmp ecx, eax
jl 0x47182f
lea ecx, [esp + 0x20]
mov dword [esp + 0x68], 0xffffffff
call fcn.00466780
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret
Function at 0x4773d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
xor eax, eax
lea edx, [esp]
push ebx
mov ebx, ecx
push ebp
push esi
mov word [ecx], ax
lea ebp, [ebx + 3]
push edi
mov edi, ebp
mov byte [ecx + 2], al
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x107]
mov ecx, 0x40
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x207]
mov ecx, 0x40
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x307]
mov ecx, 0xc1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x400
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, str._tmpFile.txt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0x207]
lea esi, [ebx + 0x107]
push edi
push esi
push ebp
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
push edi
push esi
push ebp
lea eax, [ebx + 0x307]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x28
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
Function at 0x47b500
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x495713
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov eax, 3
mov dword [esp + 0x24], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esi + 0x78], edi
mov dword [esi], 0x4a057c
mov dword [esi + 0x7c], 0x3ff00000
mov dword [esi + 0x68], eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x30], edi
lea ecx, [eax*4]
push ecx
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi + 0x68]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov eax, 1
shl eax, cl
add esp, 4
mov dword [esp + 0x20], edi
dec eax
mov dword [esp + 0x1c], eax
fild qword [esp + 0x1c]
fdivr qword [0x49df08]
fstp qword [esi + 0x70]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
cmp eax, edi
mov dword [esp + 0x1c], ecx
jle 0x47b628
lea edx, [eax*4 - 4]
mov dword [esp + 0x10], eax
xor eax, eax
cmp ecx, edi
jle 0x47b61a
mov ecx, dword [ebx + 8]
inc eax
mov ecx, dword [edx + ecx]
movsx ecx, word [ecx + eax*2 - 2]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0xc]
fild dword [esp + 0x18]
add ecx, 4
mov dword [esp + 0xc], ecx
fmul qword [esi + 0x78]
fstp dword [ecx - 4]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x47b5ed
mov eax, dword [esp + 0x10]
sub edx, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x47b5e7
push 0x68
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, edi
mov byte [esp + 0x30], 1
je 0x47b657
mov edx, dword [ebx + 0x18]
mov ebx, dword [ebx + 0x1c]
push 0x20
push edx
mov edx, dword [esp + 0x1c]
push ebx
push edx
mov ecx, eax
call fcn.00457060
jmp 0x47b659
xor eax, eax
fld qword [esi + 0x70]
mov dword [esi + 0x64], eax
fstp dword [eax + 0x24]
mov eax, dword [esp + 0x14]
push eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x484d90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x495bc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], 0
mov dword [esp + 0x30], 0
mov dword [esp], eax
fild dword [esp + 0x4c]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x58]
fidiv dword [esp + 0x54]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x50]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 4], edx
fstp qword [esp + 0x20]
imul eax, ecx
fild dword [esp + 0x50]
fidiv dword [esp + 0x58]
shl eax, 2
push eax
fstp qword [esp + 0x2c]
call sub.MFC42.DLL_operatornew
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
add esp, 4
dec eax
lea ecx, [esp]
je 0x484e2d
call fcn.0048a650
jmp 0x484e32
call fcn.0048a9e0
mov eax, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0xc]
test eax, eax
je 0x484e4c
test esi, esi
je 0x484e4c
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0xae4160
Capabilities:
Decompress data using aplib

Disassembly:
call 0xae42b0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xae4186
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xae4172
add dl, dl
jne 0xae4191
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xae41e4
xor eax, eax
add dl, dl
jne 0xae419e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xae4285
add dl, dl
jne 0xae41ad
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae41b8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae41c3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae41ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xae41da
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xae417d
mov eax, 1
add dl, dl
jne 0xae41f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xae41fd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xae41e9
sub eax, ebx
mov ebx, 1
jne 0xae4230
mov ecx, 1
add dl, dl
jne 0xae4216
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xae4221
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xae420d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xae417d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xae4247
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xae4252
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xae423e
cmp eax, 0x7d00
jae 0xae4275
cmp eax, 0x500
jb 0xae4270
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xae417d
cmp eax, 0x7f
ja 0xae4278
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xae417d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xae42a6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xae417d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10