joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410b20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402d30
push 0x410d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x4174b4], 0xffffffff
mov dword [0x4174b8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4174a8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x4174a4]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x4174b0], ecx
call fcn.00406c70
mov eax, dword [0x4173c0]
test eax, eax
jne 0x410bb1
push 0x410d10
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00410cf0
push 0x417014
push 0x417010
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4174a0]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x41749c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x41700c
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x410cbf
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x410c25
cmp al, 0x22
jne 0x410c17
cmp byte [esi], 0x22
jne 0x410c2e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x410c3e
cmp al, 0x20
ja 0x410c3e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x410c2e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x410c5f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x410c64
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x410ca4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x410c2e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x410cbf

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x41420d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450f4f
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x47162c]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x47162c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x4142b1
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0x45fbe0
call 0x4353cd
mov dword [esp + 0x20], 0x4575f8
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0x45fb80
mov dword [esp + 0x1c], 0x45fb6c
mov dword [esp + 0x20], 0x1b
call fcn.00414e05
lea eax, [esp + 0x4c]
mov dword [esp], 0x466c20
push eax
call 0x43c341
push 0xf
pop esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x80], 1
mov eax, dword [esp + 0x3c]
add eax, 0x100
lea ecx, [esp + 0x2c]
call fcn.00412690
inc dword [ebx + 0x1040247c]
mov eax, dword [esp + 0x2c]
jae 0x4142ec
lea eax, [esp + 0x2c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esp + 0x48]
push eax
call 0x43ab8e
add esp, 0x14
cmp eax, 0xffffffff
je 0x4142cb
lea ecx, [esp + 0x2c]
call fcn.00412690
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
lea esi, [esp + 0x2c]
mov byte [edi], bl
call fcn.00405ca7
push ebx
push 1
mov ecx, esi
call fcn.00405e00
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call 0x434c4e
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4a7779
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
jmp 0x527dd0
jmp fcn.005073c0
push esi
mov esi, ecx
mov ecx, 0x65cbd1
call fcn.004a73a0
mov ecx, esi
pop esi
jmp method.LevelScene.virtual_132

Function at 0x4a77a1
Capabilities:
Encode data using base64
Execute command
Terminate process

Disassembly:
jmp 0x52c700
push esi
mov esi, ecx
mov ecx, 0x65cce0
call fcn.004a73a0
mov ecx, esi
pop esi
jmp fcn.004a7887

Function at 0x4a7daa
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
jmp 0x52ea50
push esi
mov esi, ecx
mov ecx, 0x65cd92
call fcn.004a73a0
mov ecx, esi
pop esi
jmp method.LevelScene.virtual_132

Function at 0x4a8467
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
jmp 0x527dd0
jmp fcn.005073c0
push esi
mov esi, ecx
mov ecx, 0x65cbd1
call fcn.004a73a0
mov ecx, esi
pop esi
jmp method.LevelScene.virtual_132
Function at 0x4ac520
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
jmp 0x4ac55c
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
movzx eax, word [edx]
test eax, eax
je 0x4ac587
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x20
je 0x4ac57c
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax]
cmp ecx, 9
jne 0x4ac585
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x4ac553
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4ac645
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x20], eax
push 4
push 0x3000
mov ecx, dword [ebp - 0x20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ac645
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x24], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x24]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 4]
je 0x4ac641
push 0x97
push 0x6492c0
push 0x6492ec
push 0x6492a4
call fcn.004a7e5e
add esp, 0x10
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4ac636
jmp 0x4ac605
cmp dword [ebp - 0x2c], 1
jne 0x4ac63d
int3
jmp 0x4ac641
xor eax, eax
jne 0x4ac605
cmp dword [ebp - 0x24], 0
jne 0x4ac655
call fcn.004ac900
jmp 0x4ac6f2
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004ac700
add esp, 8
cmp eax, dword [ebp - 0x10]
jle 0x4ac69c
push 0xa9
push str....._srcmainwindowsSDL_windows_main.c
push str.main_getcmdline
push 0x649334
call fcn.004a7e5e
add esp, 0x10
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4ac691
jmp 0x4ac655
cmp dword [ebp - 0x30], 1
jne 0x4ac698
int3
jmp 0x4ac69c
xor edx, edx
jne 0x4ac655
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004ac700
add esp, 8
mov dword [ebp - 0xc], eax
call fcn.004a6a72
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a7a62
add esp, 8
mov dword [ebp - 0x14], eax
push 0x4000
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4d45c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, 0x65c1e2
push edi
mov dword [ebp - 4], esi
call fcn.004a73a0
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.ucrtbased.dll_calloc]
mov dword [esi + 8], eax
mov dword [esi], vtable.IGraphics.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x10
mov dword [esi + 0x18], 9
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 0
mov byte [esi + 0x32], 0
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], 0x190
mov dword [esi + 0x1d3c], 0xffff
mov dword [esi + 0x1d50], 0
mov dword [esi + 0x1d54], 0
mov byte [esi + 0x1d58], 0
mov dword [esi + 0x1d5c], 0xff
mov dword [esi + 0x1d60], 0
mov dword [esi + 0x2d68], 0
mov dword [0x64b6b8], 0x4a586b
mov dword [0x64b6bc], 0x4a704e
mov dword [0x64b6c0], 0x4a704e
mov dword [0x64b6c4], 0x4a704e
mov dword [0x64b6c8], 0x4a704e
mov eax, dword [esi + 8]
push 1
push dword [eax + 0x2c]
call edi
mov dword [esi + 0x1d50], eax
mov eax, dword [esi + 8]
push 1
push dword [eax + 0x28]
call edi
mov dword [esi + 0x1d54], eax
lea edi, [esi + 0x193c]
mov dword [esi + 0x1d40], 0
add esp, 0x10
mov dword [esi + 0x1d44], 0
xor ecx, ecx
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x28]
mov dword [esi + 0x1d48], eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x2c]
mov dword [esi + 0x1d4c], eax
nop dword [eax]
mov eax, 0xaaaaaaab
lea edi, [edi + 4]
mul ecx
inc ecx
shr edx, 1
mov dword [edi - 4], edx
cmp ecx, 0x100
jl 0x4d4710
lea eax, [esi + 0x1d68]
xor edi, edi
mov esi, eax
nop dword [eax]
nop word [eax + eax]
movd xmm0, edi
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x6031d0]
mulsd xmm0, qword [0x603170]
movsd qword [ebp - 0xc], xmm0
call fcn.004a8453
xorps xmm0, xmmword [0x603210]
movsd qword [esi + 0x800], xmm0
movsd xmm0, qword [ebp - 0xc]
call fcn.004a730a
inc edi
movsd qword [esi], xmm0
lea esi, [esi + 8]
cmp edi, 0x100
jl 0x4d4740
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.ucrtbased.dll_calloc]
push 4
mov ecx, dword [esi + 8]
mov dword [esi + 0x34], 1
mov eax, dword [ecx + 0x2c]
imul eax, dword [ecx + 0x28]
push eax
call edi
mov ecx, dword [esi + 8]
mov dword [esi + 0x10], eax
push 4
mov eax, dword [ecx + 0x2c]
imul eax, dword [ecx + 0x28]
push eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 8]
push str.Classic_Sprites_UI_DevFont.bin
mov eax, dword [eax + 0x28]
mov dword [esi + 0x38], eax
call fcn.004a7125
add esp, 0x14
test eax, eax
je 0x4d47ea
push 0x400
push 0x64b2b8
mov ecx, eax
call fcn.004a6bd5
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x428c44
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, eax
imul esi, eax
and eax, edx
xor word [0x429c04], 0x50
je 0x428c99
xor edi, edx
inc esi
shrd eax, edx, 0x11
mov ebx, 0x429b50
stc
sub dword [0x429716], eax
imul esi, edx
mov al, dl
neg dword [0x429ba2]
shl cl, 7
or dword [ebx], 0x2cde60a5
dec eax
shld esi, eax, 9
and eax, dword [0x429a20]
imul esi, dword [ebx]
imul edi, eax
nop
adc esi, edx
btc edi, 0xc
shr edi, 1
movzx ecx, word [0x4298d1]
lea edx, [ebp - 4]
and dword [0x4297f7], edx
push edx
or ecx, edx
inc dword [0x429b67]
push dword [ebp + 0x14]
btc si, 2
bts di, 0xc
or eax, edx
mov edx, dword [ebp + 0x10]
sbb ecx, dword [0x4294be]
or esi, 0x24ec081f
shl edx, 2
xor esi, edx
mov eax, 0x429768
mov esi, edx
sets byte [eax]
sbb dword [0x429b68], 0x662c98bd
imul esi, dword [eax]
inc esi
push edx
sub dword [0x4297d8], eax
inc dword [eax]
rcr bh, 6
inc dword [eax]
movsx ebx, byte [0x42997e]
mov ebx, dword [eax]
sete byte [0x429510]
add ecx, edx
and dword [0x429926], 0xffffffff
mov dword [0x429842], eax
add byte [0x429509], 4
or edx, eax
and bl, dl
push dword [eax]
pop dword [eax]
add word [eax], 0xff84
mov esi, edx
seta dl
push eax
call fcn.0045b5bc
mov ebx, edx
or eax, edx
mov edx, 0x2ad25948
shld ax, dx, 6
movzx edx, dx
shrd dword [0x429926], eax, 9
shl eax, 1
sub ah, al
or ebx, edx
dec edx
add byte [0x429921], 0x4a
xor dword [0x42983b], 0xffffff9e
pop eax
pop edx
xchg edx, eax
setb dl
mov esi, dword [ebp + 8]
sbb edi, eax
xor esi, 0x72e579ee
btc edi, edx
mov edx, 0xd
or dword [0x42961f], 0x71da1b08
shrd dword [0x429a2d], eax, 0x17
rol byte [0x4294f7], 1
mov dword [edx*4 + 0x4296d0], 0x57bec62e
sub dword [0x429a0f], 0xffffffdd
or ecx, 0x61876aed
add eax, esi
inc dword [0x4296eb]
or dword [0x4293e7], edx
push eax
neg dword [0x4293dd]
call fcn.0045b9ca
mov ebx, eax
mov edx, 0x18ec44b5
mov ebx, dword [ebp + 0x10]
mov esi, 0x78c8a381
shl ebx, 2
imul edi, edx, 0x2983dec3
btc ecx, eax
dec ecx
add ebx, dword [ebp + 0xc]
imul eax
or esi, 0xffffffab
push dword [ebp - 4]
or dword [0x429bf3], eax
pop dword [ebx]
inc di
dec dword [ebp + 0x10]
js 0x428eca
shl dword [0x429763], 6
bt esi, edx
push dword [ebp + 0x14]
dec dword [0x4299f9]
imul eax
push dword [ebp + 0x10]
imul ecx, dword [0x429a5c], 0x13f3fdb0
imul esi, edx, 0x36e6a8e5
test dword [0x429a04], eax
jne 0x428ea5
imul ecx, edx
movzx edi, word [0x429a21]
cmp esi, dword [0x429c00]
je 0x428ea5
adc eax, dword [0x42996a]
mov edi, edx
imul edx
neg edi
or eax, edx
add dword [0x4297b5], eax
inc edi
mov edi, dword [0x429c2f]
movzx edi, dl
dec esi
dec di
sub ecx, 0x66330dc2
inc ecx
seta byte [0x429a13]
add dword [0x429934], 0xffffffcc
push dword [0x429819]
pop dword [0x429ae0]
mov dx, 0x2905
sub edx, 0x47a80994
sbb dh, 0x7b
mov dword [0x4296b1], edx
mov ax, 0xa245
push dword [ebp + 0xc]
shl dword [0x429b60], 1
push dword [ebp + 8]
imul eax, dword [0x42976f]
bt ecx, 0x1c
call fcn.0045c9ad
mov edx, 0x4004f604
dec byte [0x429a6d]
jns 0x428ede
or dword [0x42964c], 0x45014a3d
mov esi, eax
movzx edx, word [0x4298ee]
or esi, dword [0x429503]
movsx esi, ax
popal
mov esp, ebp
pop ebp
ret 0x10
Function at 0x428ef5
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
push edx
push dword [0x429628]
btr dword [0x429401], 1
push dword [0x429a6e]
push eax
push dword [0x4295ab]
push dword [ebp + 0xc]
mov dword [0x429c47], eax
call fcn.004570e8
add esp, 0x18
and dword [ebp + 0x14], eax
not dword [0x429964]
push 0x6e04938c
pop dword [ebp + 0x24]
sub ebx, eax
mov bh, byte [ebp + 0x24]
sub dword [ebp + 0x28], 0xffffffdd
dec eax
movsx ecx, word [0x4298fa]
mov edi, 0x429671
add eax, dword [0x429b3b]
push dword [0x4296b2]
pop dword [ebp + 0x28]
inc eax
dec word [edi]
and cl, dl
mov ecx, edx
movzx eax, word [ebp + 8]
or bl, dl
shl ecx, 0
sete ch
adc ecx, 0x6f82db1f
neg al
mov eax, 0x429763
dec edx
movsx esi, byte [0x429925]
mov dword [0x4296fd], edx
movsx edx, word [eax]
mov ebx, 0x38470119
bts esi, 0x10
mov dword [eax], 0xb38d818
shrd edx, eax, 5
sbb ecx, edx
push edx
mov cl, byte [0x429a53]
movsx ecx, word [ebp + 0x10]
sbb bx, word [0x4296a6]
shrd ecx, eax, 9
shr ebx, 1
mov bl, byte [0x4294f9]
pop edx
seta dh
popal
mov esp, ebp
pop ebp
ret

Function at 0x455ef4
Capabilities:
Encode data using xor

Disassembly:
inc ecx
adc dword [ecx], ecx
xor eax, 0xe8606c05
add byte [eax], al
add byte [eax], al
pop edx
mov ecx, 0x13b
xor dword [edx + ecx*4 + 0xf], 0x68c97d64
loop 0x455f00
call fcn.00455f23
call fcn.00455f17

Function at 0x455f23
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
mov esi, dword [esp + 0x2c]
mov edi, edx
lea eax, [esi + 0x517]
mov ecx, 0x7145
mov dl, 0x39
xor byte [eax], dl
inc edx
inc eax
loop 0x455f44
call fcn.004560fc
mov ebp, ebx
push 0x1adfda1e
call fcn.00456243
test eax, eax
je 0x456039
mov dword [edi + 0x3d9], eax
push 0x2bc20d80
call fcn.00456243
test eax, eax
je 0x455f79
call eax
mov dword [edi + 0x139], eax
push 0xb3b0e220
call fcn.00456243
test eax, eax
je 0x456039
push 0x40
push 0x1000
push 0x129c0
push 0
call eax
test eax, eax
je 0x456039
xchg ebx, eax
mov esi, dword [esp + 0x2c]
cld
pushal
mov edi, ebx
lea esi, [esi + 0x517]
call fcn.004562f9
popal
mov eax, ebx
mov ecx, 0xad23
xor byte [eax], 0xa1
inc eax
loop 0x455fc5
mov edx, esi
lea edi, [ebx + 0xb1f6]
lea esi, [edx + 0x7550]
mov ecx, 0x10c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx + 0xb364]
mov esi, edx
mov ecx, 0x765c
rep movsb byte es:[edi], byte [esi]
call 0x455ff4
pop esi
lea esi, [esi - 0xe7]
lea edi, [ebx + 0xb383]
mov ecx, 0x4ee
rep movsb byte es:[edi], byte [esi]
push ebx
call ebx
pop edi
push 0x58474545
call fcn.00456243
test eax, eax
je 0x456039
push 0x8000
push 0
push edi
call eax
push 0xd0259555
call fcn.00456243
test eax, eax
je 0x456039
push 0
call eax
xor ecx, ecx
pop dword fs:[ecx]
pop ecx
popal
mov eax, dword [esp + 4]
cmp dword [eax + 0x7572], 0
jne 0x456050
ret 4
add esp, 0x7664
call 0x45605b
pop edi
add edi, 0x15
lea esi, [eax + 0x7561]
cld
push 0xd
pop ecx
rep movsb byte es:[edi], byte [esi]
popal
leave
pop ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45625a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
mov edi, ebp
add edi, dword [edi + 0x3c]
mov ebx, dword [edi + 0x78]
add ebx, ebp
mov esi, ebx
mov ecx, dword [ebx + 0x18]
mov ebx, dword [ebx + 0x20]
add ebx, ebp
mov eax, dword [ebx + ecx*4 - 4]
add eax, ebp
call fcn.004561f7
cmp eax, dword [esp + 0x2c]
jne 0x4562e6
mov eax, dword [esi + 0x24]
add eax, ebp
movzx eax, word [eax + ecx*2 - 2]
mov ecx, dword [esi + 0x1c]
add ecx, ebp
mov eax, dword [ecx + eax*4]
add eax, ebp
mov ebx, dword [edi + 0x78]
add ebx, ebp
cmp eax, ebx
jl 0x4562eb
add ebx, dword [edi + 0x7c]
cmp eax, ebx
jg 0x4562eb
sub esp, 0x7f
mov edi, esp
xchg esi, eax
push 0x7f
pop ecx
rep movsb byte es:[edi], byte [esi]
mov edi, esp
mov al, 0x2e
push 0x7f
pop ecx
repne scasb al, byte es:[edi]
dec edi
xor eax, eax
stosb byte es:[edi], al
mov eax, edi
call fcn.004561f7
xchg ebx, eax
push esp
mov eax, 0x7713a920
call eax
mov ebp, eax
add esp, 0x7f
push ebx
call fcn.00456243
jmp 0x4562eb
dec ecx
jne 0x45627c
xor eax, eax
mov dword [esp + 0x24], eax
xor ecx, ecx
pop dword fs:[ecx]
pop ecx
popal
ret 4