joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415920
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64fa20
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
mov esi, ecx
push edi
mov ebx, esi
call fcn.004130d0
mov edi, dword [esi + 0x8c]
cmp dword [edi + 0x768], 0
je 0x41597c
mov eax, dword [edi + 0x7f8]
cmp eax, 0x2f
je 0x415af0
test eax, eax
jne 0x41597c
mov eax, dword [edi + 0x82c]
cmp dword [eax + 0x24], 0x28
je 0x415af0
cmp dword [edi + 0x7f8], 0x15
je 0x415af0
cmp dword [esi + 0x554c], 3
jne 0x415af0
mov edx, dword [esi + 0x5d4]
test edx, edx
jle 0x415af0
mov ecx, esi
call fcn.0041c1c0
cmp dword [edi + 0x7fc], 2
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x679820]
fsubr qword [0x679fb8]
fstp dword [esp + 0x10]
jne 0x415a67
add edx, 0xffffff38
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fdiv qword [0x67a360]
fstp dword [esp + 0x14]
fldz
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
test ah, 0x41
jp 0x415a12
fstp st(1)
fstp st(0)
fld dword [esp + 0x10]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [esi + 0x5d0]
jmp 0x415af0
fld1
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x415a32
fstp st(0)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [esi + 0x5d0]
jmp 0x415af0
fstp st(1)
fld st(0)
fxch st(1)
fadd st(0), st(0)
fld st(1)
fmulp st(2)
fsubrp st(1)
fstp dword [esp + 0x14]
fld dword [esp + 0x10]
fld st(0)
fldz
fsubrp st(1)
fmul dword [esp + 0x14]
faddp st(1)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [esi + 0x5d0]
jmp 0x415af0
cmp edx, 0x7d0
jge 0x415a9a
fldz
push 3
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x1c]
mov eax, edx
xor ecx, ecx
fstp dword [esp]
mov edx, 0x7d0
call fcn.00511bf0
fstp dword [esi + 0x5d0]
add esp, 0xc
jmp 0x415af0
fld dword [esi + 0x5d0]
fld dword [esp + 0x10]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x415aee
push 1
sub esp, 8
fst dword [esp + 4]
fldz
fstp dword [esp]
fld dword [esi + 0x5d0]
fmul qword [0x67a358]
call fcn.006397d0
mov ebx, eax
call fcn.006397d0
mov ecx, eax
mov eax, ebx
mov edx, 0xfffffffb
call fcn.00511bf0
fstp dword [esi + 0x5d0]
add esp, 0xc
jmp 0x415af0
fstp st(0)
cmp dword [edi + 0x7fc], 3
je 0x415b24
mov eax, dword [esi + 0x15c]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x7f8]
cmp ecx, 0x47
je 0x415b15
cmp ecx, 0x48
jne 0x415d2a
cmp byte [eax + 0x40], 0
sete al
test al, al
je 0x415d2a
mov edi, 1
jmp 0x7c1680
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bee0
Capabilities:
Packed with generic packer
Parse credit card information

Disassembly:
push esi
mov esi, dword [edi + 0x8c]
mov eax, dword [esi + 0x7f8]
cmp eax, 0x33
jl 0x41bef7
cmp eax, 0x3c
jle 0x41bf07
test eax, eax
jne 0x41bf0e
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x24], 0x23
jne 0x41bf0e
mov eax, 1
pop esi
ret
cmp dword [esi + 0x768], 0
je 0x41bf39
mov eax, dword [esi + 0x7f8]
cmp eax, 0x1e
je 0x41bf32
test eax, eax
jne 0x41bf39
mov ecx, dword [esi + 0x82c]
cmp dword [ecx + 0x24], 0xf
jne 0x41bf39
mov eax, 3
pop esi
ret
mov ecx, esi
call fcn.00453a00
test al, al
jne 0x41c000
mov eax, edi
call fcn.0041be50
test al, al
je 0x41bf5a
mov eax, 0xa
pop esi
ret
jmp 0x7af9a1
xor eax, eax
pop esi
ret
Function at 0x41f6e0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64f64a
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [eax + 0x768], 0
push esi
push edi
je 0x41f759
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x1e
je 0x41f72d
test ecx, ecx
jne 0x41f759
mov eax, dword [eax + 0x82c]
cmp dword [eax + 0x24], 0xf
jne 0x41f759
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 0x138]
mov dword [edx + 0x30], 7
mov eax, dword [ebx + 4]
mov dword [eax + 0x559c], 0xf0a
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x559c]
mov dword [eax + 0x55a0], ecx
mov eax, dword [ebx]
cmp dword [eax + 0x768], 0
mov edi, 0x190
je 0x41f78e
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x2f
je 0x41f784
test ecx, ecx
jne 0x41f78e
mov edx, dword [eax + 0x82c]
cmp dword [edx + 0x24], 0x28
jne 0x41f78e
mov dword [ebx + 0x54], 5
mov dword [ebx + 0x58], edi
jmp 0x7b1b10
Function at 0x425300
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
cmp dword [eax + 0x768], 0
je 0x42532c
mov eax, dword [eax + 0x7f8]
cmp eax, 0x24
je 0x425325
cmp eax, 0x28
je 0x425325
cmp eax, 0x16
jne 0x42532c
push edi
push esi
call fcn.00424de0
mov eax, dword [esi]
cmp dword [eax + 0x7f8], 0x32
jne 0x42533f
push edi
mov ecx, esi
call fcn.0042ca30
mov ecx, dword [esi]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x14
je 0x425351
cmp eax, 0x18
jne 0x425358
push edi
push esi
call fcn.00424fb0
mov eax, dword [esi]
cmp dword [eax + 0x768], 0
je 0x42539d
jmp 0x835915
mov eax, dword [esi]
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x4253be
cmp eax, 0x3e
je 0x4253be
cmp eax, 0x3f
je 0x4253be
cmp eax, 0x40
je 0x4253be
cmp eax, 0x41
jne 0x4253d2
mov ebx, dword [0x6a7410]
push 0x49
push 0x160
mov eax, edi
call fcn.00587150
mov ecx, dword [esi]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x42
je 0x4253ee
cmp eax, 0x43
je 0x4253ee
cmp eax, 0x44
je 0x4253ee
cmp eax, 0x46
jne 0x425402
mov ebx, dword [0x6a7410]
push 0x49
push 0x1b0
mov eax, edi
call fcn.00587150
mov edx, dword [esi]
cmp dword [edx + 0x7f8], 0x45
jne 0x425421
mov ebx, dword [0x6a7410]
push 0x49
push 0x200
mov eax, edi
call fcn.00587150
mov eax, dword [esi]
cmp dword [eax + 0x768], 0
je 0x42543e
cmp dword [eax + 0x7f8], 0x12
jne 0x42543e
mov ecx, edi
mov edx, esi
call fcn.004251e0
mov esi, dword [esi]
cmp dword [esi + 0x7f8], 0x2b
jne 0x425456
mov eax, dword [esi + 0x81c]
push edi
push eax
call fcn.00521530
pop esi
pop ebx
pop ecx
ret

Function at 0x425550
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [ecx]
cmp dword [esi + 0x768], 0
je 0x425594
mov eax, dword [esi + 0x7f8]
cmp eax, 0x11
je 0x425581
cmp eax, 0x21
je 0x425581
test eax, eax
jne 0x425594
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x24], 5
jne 0x425594
cmp ebx, 2
jle 0x425683
pop esi
mov eax, 7
pop ebp
ret 4
mov eax, esi
call fcn.004537d0
test al, al
je 0x42560d
mov esi, dword [esi + 0x7f8]
cmp esi, 0x3d
mov ecx, 6
je 0x4255c3
cmp esi, 0x3e
je 0x4255c3
cmp esi, 0x3f
je 0x4255c3
cmp esi, 0x40
je 0x4255c3
cmp esi, 0x41
jne 0x4255c8
mov ecx, 4
cmp esi, 0x42
je 0x4255dc
cmp esi, 0x43
je 0x4255dc
cmp esi, 0x44
je 0x4255dc
cmp esi, 0x46
jne 0x4255e1
mov ecx, 5
cmp ebp, 0x42
jne 0x4255f2
xor eax, eax
cmp ebx, ecx
pop esi
setge al
pop ebp
ret 4
mov eax, ebp
call fcn.0042b530
test al, al
je 0x425683
xor eax, eax
cmp ebx, ecx
pop esi
setl al
pop ebp
ret 4
cmp dword [esi + 0x768], 0
je 0x425673
mov eax, dword [esi + 0x7f8]
cmp eax, 0x24
je 0x42562b
cmp eax, 0x28
je 0x42562b
cmp eax, 0x16
jne 0x425673
mov eax, edi
mov edx, ebx
call fcn.004249f0
cmp eax, 0xffffffff
je 0x425651
cmp eax, ebp
je 0x425651
cmp ebp, 0x10
je 0x425651
cmp ebp, 0x1e
je 0x425651
pop esi
mov eax, 6
pop ebp
ret 4
cmp dword [esi + 0x7f8], 0x24
jne 0x425683
cmp ebx, 4
je 0x425664
cmp ebx, 6
jne 0x425683
cmp edi, 1
jne 0x425683
pop esi
mov eax, 1
pop ebp
ret 4
mov ecx, esi
call fcn.004539d0
test al, al
je 0x425683
cmp ebx, 8
jge 0x425669
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x425ff0
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x557c]
xor ebx, ebx
cmp ecx, dword [eax + 0x5564]
jne 0x426021
cmp dword [eax + 0x559c], ebx
je 0x426576
or esi, 0xffffffff
add dword [eax + 0x559c], esi
mov edx, dword [edi + 4]
cmp dword [edx + 0x559c], 0x64
jne 0x42605b
cmp dword [edx + 0x557c], ebx
jle 0x42605b
call fcn.00412850
mov ecx, 3
sub ecx, eax
cmp ecx, 1
jge 0x426054
mov ecx, 3
push ecx
push edi
call fcn.00425da0
mov eax, dword [edi + 4]
cmp dword [eax + 0x559c], 5
jne 0x42606c
call fcn.00413c00
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x559c]
cmp ecx, ebx
jne 0x4260c0
mov dword [eax + 0x559c], 0x7d0
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x559c]
mov dword [eax + 0x55a0], edx
mov eax, dword [edi + 4]
add dword [eax + 0x557c], 1
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x557c]
sub ecx, dword [eax + 0x5564]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffed5
add ecx, 0x12c
mov dword [edi + 0x58], ecx
jmp 0x4260cc
cmp ecx, 0x12c
jl 0x426576
add dword [edi + 0x58], esi
jne 0x426576
mov eax, dword [eax + 0x557c]
mov ecx, 0x1e
mov edx, 0xa
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
lea ecx, [eax + eax*2]
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x7c], edx
lea ecx, [ecx + ecx - 6]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
mov esi, 0xf
add eax, edx
cmp eax, ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 0x12
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], 0xd
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
jg 0x426179
mov dword [esp + 0x10], ebx
jmp 0x42618a
cmp eax, 5
mov dword [esp + 0x10], 5
jge 0x42618a
mov dword [esp + 0x10], eax
mov eax, 0x64
jmp 0x7af200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42a040
Capabilities:
Parse credit card information

Disassembly:
cmp eax, 0x3c
jne 0x42a048
xor eax, eax
ret
cmp eax, 0x3d
jne 0x42a053
mov eax, 2
ret
cmp eax, 0x3e
jne 0x42a05e
mov eax, 3
ret
cmp eax, 0x3f
jne 0x42a069
mov eax, 4
ret
cmp eax, 0x40
jne 0x42a074
mov eax, 0x15
ret
cmp eax, 0x41
jne 0x42a07f
mov eax, 0x11
ret
cmp eax, 0x42
jne 0x42a08a
mov eax, 0x14
ret
cmp eax, 0x43
jne 0x42a095
mov eax, 7
ret
cmp eax, 0x44
jne 0x42a0a0
mov eax, 0x10
ret
cmp eax, 0x45
jne 0x42a0ab
mov eax, 6
ret
cmp eax, 0x46
jne 0x42a0b6
mov eax, 0xc
ret
cmp eax, 0x47
jne 0x42a0c1
mov eax, 5
ret
cmp eax, 0x48
jne 0x42a0cc
mov eax, 8
ret
cmp eax, 0x49
jne 0x42a0d7
mov eax, 0x17
ret
cmp eax, 0x4a
jne 0x42a0e1
mov eax, 0x18
ret
Function at 0x44f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
push 0x57b0
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f635
push eax
mov ecx, edi
call fcn.00407b50
jmp 0x44f637
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x768], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x768]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret

Function at 0x44f8e0
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x64f1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
mov eax, dword [edi + 0x770]
test eax, eax
je 0x44f929
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
push 0x130
mov dword [edi + 0x7fc], 1
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f959
push edi
push eax
call fcn.00448cb0
jmp 0x44f95b
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x770], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
jmp 0x79f250
Function at 0x45a8a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6498f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push 0x14
mov esi, ecx
xor ebx, ebx
push str.soundsmainmusic.mo3
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404330
lea eax, [esp + 0xc]
push eax
push 1
push esi
mov dword [esp + 0x40], ebx
jmp loc.007b2c94
Function at 0x462b80
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x24]
cmp eax, 0x11
push esi
push edi
jmp loc.007ae853

Function at 0x463150
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x144], 0
je 0x463410
mov ecx, dword [edi]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x2b
je 0x463410
cmp eax, 0x32
je 0x463410
cmp dword [edi + 0x3c], 2
je 0x46318b
cmp byte [edi + 0x142], 0
je 0x46319b
add dword [edi + 0x4c], 0xffffffff
jns 0x46319b
push edi
call fcn.004679b0
pop edi
pop esi
pop ecx
ret
mov eax, dword [edi + 0x130]
test eax, eax
jle 0x463217
add eax, 0xffffffff
cmp eax, 0x3c
mov dword [edi + 0x130], eax
jne 0x463205
cmp byte [ecx + 0x8c5], 0
jne 0x463205
fldz
mov esi, dword [ecx + 0x784]
mov ecx, dword [0x6a9f00]
fst dword [esp + 8]
fcomp dword [ecx + 0x10e0]
fnstsw ax
test ah, 0x44
jnp 0x4631f1
fld dword [ecx + 0x10e0]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0xc]
add esp, 4
fld dword [esp + 8]
push ecx
mov eax, 0x53
fstp dword [esp]
mov ecx, esi
call fcn.00515020
cmp dword [edi + 0x130], 0
jne 0x463217
push 0
mov eax, edi
call fcn.0045e860
cmp byte [edi + 0x143], 0
jne 0x463410
cmp byte [edi + 0x142], 0
jne 0x463410
cmp dword [edi + 0x134], 0
jne 0x463410
mov eax, edi
call fcn.00464820
mov eax, dword [edi + 0x54]
test eax, eax
jle 0x463252
add eax, 0xffffffff
mov dword [edi + 0x54], eax
mov ecx, dword [edi]
call fcn.00453840
test al, al
je 0x463266
call fcn.00462ce0
pop edi
pop esi
pop ecx
ret
mov ecx, dword [edi + 0x24]
cmp ecx, 0x11
jne 0x463279
push edi
call fcn.004609d0
jmp 0x4633ee
cmp ecx, 0xf
jne 0x46328a
mov eax, edi
call fcn.00460dd0
jmp 0x4633ee
jmp 0x7c2551
cmp dword [edi + 0x48], 1
jne 0x4633fb
mov eax, edi
call fcn.0045f8a0
mov eax, dword [edi + 0x50]
test eax, eax
jle 0x463410
add eax, 0xffffffff
mov dword [edi + 0x50], eax
jne 0x463410
push edi
call fcn.004666a0
pop edi
pop esi
pop ecx
ret

Function at 0x4679b0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp byte [ebp + 0x144], 0
push esi
push edi
je 0x4679fc
cmp dword [ebp + 0x24], 0x13
jne 0x4679fc
mov ecx, dword [ebp + 4]
mov edx, dword [ebp + 0x12c]
add ecx, 0x90
test edx, edx
je 0x4679fc
movzx eax, dx
cmp eax, dword [ecx + 8]
jae 0x4679fc
imul eax, eax, 0x15c
add eax, dword [ecx]
cmp dword [eax + 0x158], edx
jne 0x4679fc
mov ecx, eax
call fcn.005302f0
mov esi, ebp
jmp fcn.007b54b0
Function at 0x46dc70
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esi + 0x54]
sub esp, 8
test ecx, ecx
push edi
jle 0x46dc95
mov edi, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
imul edi, ecx
add eax, 1
cdq
idiv edi
mov eax, edx
mov dword [esi + 0x2c], eax
cdq
idiv ecx
mov dword [esi + 0x24], eax
mov edi, dword [esi + 0x1c]
fld dword [esi + 0x30]
mov eax, dword [esi + 4]
push ecx
mov ecx, edi
fstp dword [esp]
call fcn.0041c6c0
fstp dword [esp + 8]
cmp dword [esi + 0x58], 1
push esi
jne 0x46dcbb
call fcn.0046d490
jmp 0x46dcc0
call fcn.0046d890
fld dword [esi + 0x30]
mov eax, dword [esi + 4]
push ecx
mov ecx, edi
fstp dword [esp]
call fcn.0041c6c0
fsub dword [esp + 8]
mov eax, dword [esi + 0x58]
cmp eax, 8
fstp dword [esp + 8]
fld dword [esp + 8]
jne 0x46dced
fld dword [esi + 0x34]
fadd st(1)
fstp dword [esi + 0x34]
cmp eax, 1
jne 0x46dd02
fld dword [esi + 0x34]
fadd st(1)
fstp dword [esi + 0x34]
fld dword [esi + 0x38]
fsub st(1)
fstp dword [esi + 0x38]
fadd dword [esi + 0x4c]
fstp dword [esi + 0x4c]
fld dword [esi + 0x30]
call fcn.006397d0
fld dword [esi + 0x38]
fadd dword [esi + 0x34]
jmp 0x7bdf00
Function at 0x522580
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
add eax, 0x400
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push esi
mov eax, edi
fstp dword [edi + 0x2c]
call fcn.00531880
mov ecx, dword [ebp + 0xc]
fstp dword [edi + 0x30]
fldz
mov dl, byte [ebp + 0x10]
xor ebx, ebx
fst dword [edi + 0x34]
mov eax, 0x78
fst dword [edi + 0x120]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x65]
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x24], ecx
mov byte [edi + 0x50], dl
mov byte [edi + 0x51], bl
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb0], ebx
mov byte [edi + 0xb8], bl
mov byte [edi + 0xb9], bl
mov byte [edi + 0xba], 1
mov byte [edi + 0xbb], 1
mov byte [edi + 0xbc], bl
mov byte [edi + 0xbd], bl
mov byte [edi + 0xbe], bl
mov dword [edi + 0xc4], ebx
mov dword [edi + 0xd8], ebx
mov byte [edi + 0xbf], bl
mov dword [edi + 0xc0], ebx
mov dword [edi + 0x38], ebx
call fcn.005af400
add eax, 0x190
mov dword [edi + 0x3c], eax
mov eax, 0xc
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, 0x24
mov dword [edi + 0x8c], eax
mov eax, 0x2a
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], eax
mov eax, 0x32
mov dword [edi + 0x9c], eax
or esi, 0xffffffff
lea ecx, [ebx + 0x73]
mov dword [edi + 0xa0], ebx
mov eax, 0x14
mov dword [edi + 0xa4], eax
mov dword [edi + 0x60], ebx
mov dword [edi + 0x80], esi
mov dword [edi + 0x28], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x88], bl
mov byte [edi + 0x70], bl
mov dword [edi + 0xf0], ebx
mov dword [edi + 0x98], ecx
mov dword [edi + 0xa8], ecx
mov byte [edi + 0x104], bl
mov dword [edi + 0x74], esi
fld1
mov byte [edi + 0x78], bl
fstp dword [edi + 0x11c]
mov dword [edi + 0x7c], esi
mov dword [edi + 0xdc], ebx
mov dword [edi + 0xd0], ebx
fst dword [edi + 0x84]
mov dword [edi + 0xe4], ebx
fstp dword [edi + 0x124]
mov dword [edi + 0x110], ebx
mov dword [edi + 0x114], ebx
mov dword [edi + 0x138], esi
mov dword [edi + 0x134], esi
mov dword [edi + 0x13c], esi
mov dword [edi + 0x118], ebx
mov dword [edi + 0x128], ebx
mov dword [edi + 0x12c], ebx
mov dword [edi + 0x140], ebx
mov dword [edi + 0x144], ebx
mov dword [edi + 0x130], esi
mov dword [edi + 0x148], esi
mov byte [edi + 0x14c], bl
mov dword [edi + 0x150], ebx
mov dword [edi + 0x154], esi
mov dword [edi + 0xf4], ebx
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], ebx
mov dword [edi + 0x100], ebx
mov edx, dword [edi + 4]
cmp edx, ebx
je 0x52279b
mov eax, dword [edi + 0x6c]
push eax
call fcn.00409080
test al, al
je 0x52279b
fld dword [edi + 0x2c]
fadd qword [0x6794c8]
fstp dword [edi + 0x2c]
mov eax, edi
call fcn.00524a70
mov eax, dword [edi + 0x24]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx*4 + 0x7b872e]
jmp loc.007af431
Function at 0x5259d0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x28]
test eax, eax
jne 0x525a35
fld dword [0x6799a4]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 1
jne 0x525b53
push edi
call fcn.00525890
jmp loc.007ab551
cmp eax, 0x43
jne 0x525af6
mov eax, dword [edi]
fld dword [0x6799a0]
mov ecx, dword [eax + 0x820]
mov eax, dword [edi + 0x118]
mov edx, dword [ecx + 8]
and eax, 0xffff
lea esi, [eax + eax*4]
shl esi, 5
add esi, dword [edx]
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.00473b70
test al, al
je 0x525a7e
push edi
call fcn.00525890
mov ecx, edi
call fcn.00525730
cmp dword [esi + 0x5c], 0
jle 0x525b53
add dword [edi + 0x114], 0xffffffff
mov eax, dword [edi + 0x114]
cmp eax, 4
jne 0x525aa1
push str.Zombie_catapult_basketball
jmp 0x525ac3
cmp eax, 3
jne 0x525aad
push str.Zombie_catapult_basketball2
jmp 0x525ac3
cmp eax, 2
jne 0x525ab9
push str.Zombie_catapult_basketball3
jmp 0x525ac3
cmp eax, 1
jne 0x525aca
push str.Zombie_catapult_basketball4
mov ecx, edi
call fcn.00533200
cmp dword [edi + 0x114], 0
push ecx
je 0x525b35
fld dword [0x679388]
fstp dword [esp]
push 0x14
push 0
push str.anim_idle
call fcn.00528b00
mov dword [edi + 0x28], 0x44
pop edi
pop esi
pop ecx
ret
cmp eax, 0x44
jne 0x525b53
cmp dword [edi + 0x68], 0
jne 0x525b53
push edi
call fcn.00525890
test eax, eax
push ecx
je 0x525b35
jmp loc.007ab573
fld dword [0x679320]
fstp dword [esp]
push 0x14
push 0
push str.anim_walk
call fcn.00528b00
mov dword [edi + 0x28], 0
pop edi
pop esi
pop ecx
ret

Function at 0x525be0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [edi]
sub esp, 8
cmp dword [eax + 0x7f8], 0x2c
push esi
jne 0x525c2f
fld dword [0x67a130]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 0x41
jne 0x525c2f
fld dword [edi + 0x84]
fsub qword [0x679a68]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x84]
fcomp dword [0x679f64]
fnstsw ax
test ah, 5
jp 0x525c2f
push 0
mov eax, edi
call fcn.00525b60
jmp fcn.007bec31
Function at 0x5272e0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x28]
cmp eax, 0x47
jne 0x52738c
fld dword [edi + 0x120]
mov eax, dword [edi + 0x1c]
fsub qword [0x6796d8]
push eax
mov eax, edi
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fst dword [edi + 0x120]
fadd dword [edi + 0x84]
fstp dword [edi + 0x84]
fld dword [edi + 0x2c]
fsub dword [edi + 0x34]
fstp dword [edi + 0x2c]
call fcn.00531880
fsub dword [edi + 0x30]
fstp dword [esp + 8]
fld dword [edi + 0x30]
fld dword [esp + 8]
fld st(0)
faddp st(2)
fxch st(1)
fstp dword [edi + 0x30]
fadd dword [edi + 0x84]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x84]
fldz
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
jne 0x5273ca
push ecx
fstp dword [edi + 0x84]
fld dword [0x679638]
mov dword [edi + 0x28], 0x48
fstp dword [esp]
push 0
push 3
push str.anim_land
call fcn.00528b00
pop edi
pop esi
pop ecx
ret
cmp eax, 0x48
jne 0x5273cc
mov ecx, dword [edi]
mov edx, dword [ecx + 0x820]
mov eax, dword [edi + 0x118]
mov ecx, dword [edx + 8]
and eax, 0xffff
lea edx, [eax + eax*4]
mov eax, dword [ecx]
shl edx, 5
cmp dword [eax + edx + 0x5c], 0
nop
nop
xor esi, esi
mov eax, edi
jmp loc.007b00b0
fstp st(0)
pop edi
pop esi
pop ecx
ret