joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4224f3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x43501c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x43501c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00416560
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x4166b2
push str.floatadr
lea ecx, [esp + 0x14]
call dword [0x427478]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
jmp 0x4166bf
push 0x427764
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00420f36
add esp, 0x34
ret
Function at 0x416870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42244c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x43501c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x54], ebx
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
call fcn.00416920
mov dword [esp + 0x54], ebx
push str.K8BugReport.exe
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push edi
push ecx
mov dword [esp + 0x60], 1
call sub.K8Common.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_GameMgr::GMFileName::JoinFileName_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 0xc
push eax
mov ecx, edi
mov byte [esp + 0x58], 2
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret
Function at 0x416920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x422633
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x43501c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x43501c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 8], 0
cmp byte [0x4358b0], 0
mov dword [esp + 0xc], edi
jne 0x41696d
mov esi, edi
call fcn.00416190
jmp 0x4169a0
lea esi, [esp + 0x10]
call fcn.00416190
lea eax, [esp + 0x10]
push eax
mov esi, 1
push edi
mov dword [esp + 0x40], esi
call sub.K8Common.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_GameMgr::GMFileName::GetParentDirectory_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00420f36
add esp, 0x34
ret
Function at 0x41b180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4223ab
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x43501c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebp
mov eax, dword [0x43501c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], esp
call fcn.004163b0
lea ecx, [esp + 0x4c]
call sub.K8Common.dll_public:_void___thiscall_GameMgr::GMIniFile::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___
push str.Config
lea ecx, [esp + 0x18]
mov dword [esp + 0x5c], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push ebp
mov byte [esp + 0x78], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push edi
lea eax, [esp + 0x34]
push eax
push esi
lea ecx, [esp + 0x58]
call sub.K8Common.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_GameMgr::GMIniFile::GetStringValue_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
mov byte [esp + 0x58], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 0
call sub.K8Common.dll_public:_void___thiscall_GameMgr::GMIniFile::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop ebp
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00420f36
add esp, 0x54
ret 4
Function at 0x420f36
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43501c]
jne 0x420f40
repz ret
jmp fcn.0042142d

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x417e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
invalid
invalid
inc esp
invalid

Function at 0x417e11
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
invalid
invalid
inc esp
invalid

Function at 0x417e21
Capabilities:
Query or enumerate registry value

Disassembly:
dec esp
add byte [eax + ecx*4], cl
sub esp, 8
mov byte [0x4c3044], al
inc esp
xor byte [eax + eax - 0x5f], cl
cmp al, 0x30
dec esp
add byte [ebx - 0x1e3ea938], cl
add al, 0x23
sal dword [ebx], 1
leave
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
adc eax, 0x4c3034

Function at 0x417e29
Capabilities:
Query or enumerate registry value

Disassembly:
dec esp
add byte [eax + ecx*4], cl
sub esp, 8
mov byte [0x4c3044], al
inc esp
xor byte [eax + eax - 0x5f], cl
cmp al, 0x30
dec esp
add byte [ebx - 0x1e3ea938], cl
add al, 0x23
sal dword [ebx], 1
leave
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
adc eax, 0x4c3034

Function at 0x417e59
Capabilities:
Query or enumerate registry value

Disassembly:
loop 0x417e5b
imul edx, ecx
or eax, edx
lea edx, [esp + 4]
push esp
and al, 4
add al, 0x52
push edx
push 0x20019
push esi
push str.CLSIDA80DB8A6_D8FF_11CF_9377_A00103B70AA1InprocServer32
push SysReAllocStringLen
mov dword [0x4c303c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417e85
xor eax, eax
pop esi
add esp, 8
ret 4
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
and al, 4
mov dword [0x4c6abc], eax
lea eax, [esp + 8]
push eax
push ecx
push 0
push 0
add byte [edx], ch
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417ebc
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi

Function at 0x417e91
Capabilities:
Query or enumerate registry value

Disassembly:
loop 0x417e5b
imul edx, ecx
or eax, edx
lea edx, [esp + 4]
push esp
and al, 4
add al, 0x52
push edx
push 0x20019
push esi
push str.CLSIDA80DB8A6_D8FF_11CF_9377_A00103B70AA1InprocServer32
push SysReAllocStringLen
mov dword [0x4c303c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417e85
xor eax, eax
pop esi
add esp, 8
ret 4
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
and al, 4
mov dword [0x4c6abc], eax
lea eax, [esp + 8]
push eax
push ecx
push 0
push 0
add byte [edx], ch
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417ebc
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
Function at 0x417ea1
Capabilities:
Query or enumerate registry value

Disassembly:
loop 0x417e5b
imul edx, ecx
or eax, edx
lea edx, [esp + 4]
push esp
and al, 4
add al, 0x52
push edx
push 0x20019
push esi
push str.CLSIDA80DB8A6_D8FF_11CF_9377_A00103B70AA1InprocServer32
push SysReAllocStringLen
mov dword [0x4c303c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417e85
xor eax, eax
pop esi
add esp, 8
ret 4
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
and al, 4
mov dword [0x4c6abc], eax
lea eax, [esp + 8]
push eax
push ecx
push 0
push 0
add byte [edx], ch
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417ebc
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi

Function at 0x420dc1
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax], 0x24
dec esi
and al, 0x4e
add esp, dword [eax]
add dword [eax - 0x1852514d], eax
push ecx
insd dword es:[edi], dx
mov dword es:[0x9c0553c4], eax
cmp eax, 0x43481501
mov al, byte [0xd4818e3a]
inc ebx
inc eax
push esp
in al, 0x66
xor byte [ebx], al
dec esp
xor dh, byte [edi + 0xd]
xor dword [esi + 0x66383c8], 0x54
add dword [ecx], ebp
dec ecx
add byte [esi], al
cmp dword [ebx], 0xf303fd98
call 0x7309bfbe
imul esi, edx, 0x47700575
xor eax, 0x8bc8fe25
inc esp
and dl, dl
and eax, 0x47cce500
inc ebx
or dh, bh
sub al, 0x3f
mov edi, 0x8bd06bab
cld
mov cl, 0x40
inc ebp
sbb byte gs:[ebp - 0x4f], 0xc0
push ss
les esp, [edx + 0x70]
movsd dword es:[edi], dword [esi]
adc al, 0x73
scasd eax, dword es:[edi]
push ebx
js 0x420dbf
jle 0x420ea8
sub eax, 0x1723084
enter 0xffffffffffffc160, 0xffffffffffffff88
jbe 0x420e64
adc edi, edi
pop es
mov al, byte [0x2f1d31c9]
retf
hlt
inc ebx
int 0x62
cld
or dword [ebx - 0x7cac94a0], eax
and bh, byte [0x363ec283]
int1
inc esi
push ss
mov ebp, 0xeb08f2d0
jne 0x420f10
inc edx
lock add ah, byte [eax + esi*4]
pop edi
lodsb al, byte [esi]
pop esp
out dx, al
mov dword [0x7b79fd44], eax
cmp byte [ecx - 0x3d], cl
add ah, byte [eax - 0x5f43ffa9]
stc
rcr esi, 1
int 0xce
jno 0x420f46
add dh, byte [esi - 0x28add457]
nop
clc
movsb byte es:[edi], byte [esi]
pushfd
lodsb al, byte [esi]
inc esp
adc dh, byte [ecx + 2]
push 0x5525906c
invalid
sbb dword [ecx + edi + 0x18145000], edi
inc ebx
cdq
inc ebp
cmpsd dword [esi], dword es:[edi]
sti
cwde
in al, 7
mov ebx, 0x17906313
dec edi
ror dword [ebp + ecx + 0x78], cl
push edi
hlt
mov al, byte [0xa10e9552]
imul edx, edi, 0xffffffb0
imul dword [edx]
leave
xlatb
mov al, 0xf7
sub cl, cl
mov byte [0x4f0c21d4], al
jno 0x420f4c
sbb bh, 0x1c
sbb al, 0xa1
xchg ebx, eax
mov bh, 0xb3
pushal
pop edi
cmpsd dword [esi], dword es:[edi]
xor dword [bx + di], 0x21
cmpsd dword [esi], dword es:[edi]
ficomp word [edi - 0x3f]
adc eax, 0x538a9254
ret 0xdc13

Function at 0x422bf9
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xdde6bd83
stosb byte es:[edi], al
aam 0x81
das
invalid
Function at 0x42f22d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xde27073d
pushal
popal
pop ecx
fadd st(6)
pop ecx
jl 0x42f226
dec edi
salc
xchg edi, eax
rol al, cl
jno 0x42f2aa
add eax, dword [ebx]
mov eax, dword [0xa61a297c]
sub eax, 0x7a226869
sbb eax, dword [edx + edx*2 - 0x3b693805]
cmp byte [edx], dl
inc esi
jl 0x42f28e
cmp al, 0x78
std
js 0x42f251
neg byte [ecx + 0x1f273deb]
movsd dword es:[edi], dword [esi]
in eax, dx
scasd eax, dword es:[edi]
enter 0xffffffffffff8dbd, 0x58
mov dl, 0x4b
retf
outsb dx, byte [esi]
invalid
ret 0x7960

Function at 0x43b721
Capabilities:
Encode data using xor

Disassembly:
dec edx
imul esi, dword [ecx + 0x559355d9], 0x1f2a2781
sbb al, 0x1a
sbb dword [edi - 0x6f9aaeb1], edx
cdq
jo 0x43b78e
sbb dword [esi - 0x1f], 0xba882e89
mov ecx, 0x1944d92d
dec ebx
mov al, byte [0xdac7bc70]
xor byte [esi + 0x39c6c835], 0xf6
test dword [eax - 0x14744f63], esp
test esp, esp
inc ebp
lock add dword [edx + ecx*8 - 0x769b0620], ebx
xchg ecx, eax
cmp ebp, esp
dec esi
mov edi, 0x204c1084
push esp
mov ah, 0x8d
mul dh
mov ah, 0x9b
movsb byte es:[edi], byte [esi]
pop ss
dec esi
or al, byte [ecx - 0x153a76ba]
xor al, 0x36
adc ah, bh
or byte ss:[ebp - 0x3f62ca4b], 0xad
popal
xchg ebx, eax
dec ecx
xor dl, al
sbb eax, 0xa0a9e219
jbe 0x43b741
sbb dword [ebx - 0x60], ecx
jo 0x43b702
invalid
mov al, byte [0xbd6eb076]
les ebp, [ecx + ebp*8]
sbb byte [esi + 0x3514e53e], 0xf0
cmp al, 0x73
pop ecx

Function at 0x48bb0d
Capabilities:
Encode data using xor

Disassembly:
cmp edx, dword [edi]
sub eax, 0xeed37a01
out dx, al
mov edi, dword [edx + 0x6461e16f]
outsb dx, byte [esi]
in eax, 0xbd
mov dword [ebp + edi*8 - 0x154554f1], edx
pushal
jnp 0x48bb13
pop edi
pop ss
push edi
loop 0x48bb6f
rep insd dword es:[edi], dx
invalid
shr cl, 1
adc ebx, ecx
jno 0x48bbcd
test dword [ebp + 0x67c72692], ecx
cwde
or byte [ebp + edx*2 - 0x5591d355], cl
mov word [ebp - 0x55], ss
sub al, 0x6e
outsb dx, byte [esi]
stosb byte es:[edi], al
and bh, byte [edx + 0x50bc7db1]
out 0xe4, eax
cmp ebp, dword [ebx - 0x76]
fcomp qword [ebx]
imul esi, dword [edi - 0x6f4e3980], 0xed9865e6
wait
int 0xfb
xchg dword [edx + 0x34], ecx
xchg edi, eax
stosb byte es:[edi], al
cmc
fistp word [ebp + 0x5f]
cdq
and dword [edx - 0x7a], esi
xor eax, 0x8eacf2f0
jns 0x48bbb6
daa
add byte [ecx], cl
xor al, 0xf5
mov ecx, 0x2fcec9a
pushal
xor al, 0x9c
lahf
dec ebp
dec edi
insb byte es:[edi], dx
int 0x3c
mov cl, 0x2d
inc ebp
push 0x710d0af8
scasb al, byte es:[edi]
jno 0x48bb7d
xor dword [0x3d70b12b], eax
jo 0x48bc12
add byte [edx], dl
push eax
aam 0x1c
je 0x48bb81
jmp 0x48bbd3
mov al, byte [0xb86c7bbe]
inc eax
add edx, dword [edi + edx*4 - 0x4e]
and al, 0xac
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
retf
xchg dword [ebx + ebx*8], ebp
mov eax, dword [0x5f86ad63]
outsd dx, dword [esi]
jnp 0x48bbef
push ecx
invalid
Function at 0x4bb521
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3378
cmp edx, dword [eax]
je 0x4bb543
add eax, 8
inc ecx
cmp eax, 0x4c3408
jl 0x4bb534
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3378]
jne 0x4bb671
mov eax, dword [0x4c7cfc]
cmp eax, 1
je 0x4bb64b
test eax, eax
jne 0x4bb574
cmp dword [0x4c32a0], 1
je 0x4bb64b
cmp edx, 0xfc
je 0x4bb671
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb5ab
lea eax, [ebp - 0x1a4]
push 0x4c0978
push eax
call fcn.004bbf00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc390
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb5ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc390
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0974
push edi
call fcn.004be260
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0958
push eax
call fcn.004bbf00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbf10
lea eax, [ebp - 0xa0]
push 0x4c0954
push eax
call fcn.004bbf10
push dword [esi + 0x4c337c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbf10
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c092c
push eax
call fcn.004be1d4
add esp, 0x2c
pop edi
jmp 0x4bb671
lea eax, [ebp + 8]
lea esi, [esi + 0x4c337c]
push 0
push eax
push dword [esi]
call fcn.004bc390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40f8a0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x40fa64
pushal
mov esi, section.DATA
lea edi, [esi - 0xc000]
push edi
jmp 0x40f8ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f8d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f8c0
mov eax, 1
add ebx, ebx
jne 0x40f8e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f8d8
jne 0x40f8f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f8d8
xor ecx, ecx
sub eax, 3
jb 0x40f908
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f97a
mov ebp, eax
add ebx, ebx
jne 0x40f913
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f920
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f944
inc ecx
add ebx, ebx
jne 0x40f930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f925
jne 0x40f941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f925
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f964
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f955
jmp 0x40f8c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f964
add edi, ecx
jmp 0x40f8c6
pop esi
mov edi, esi
mov ecx, 0x131
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f982
cmp byte [edi], 6
jne 0x40f982
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40f987
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f9f6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf408]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf460]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f9b4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf464]
or eax, eax
je 0x40f9f0
mov dword [ebx], eax
add ebx, 4
jmp 0x40f9d1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40fa27
cmp al, 0xef
ja 0x40fa1a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40f9fc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40fa09
mov ebp, dword [esi + 0xf468]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40fa5b
sub esp, 0xffffff80
jmp 0x4050d4