joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b5840
Capabilities:
Packed with generic packer

Disassembly:
add dword [edi + 0x164], 1
cmp dword [edi + 0x164], 0x226
jne 0x7b58d4
pushal
mov eax, 0x32
call fcn.005af400
mov dword [edi + 0x164], eax
sub esp, 8
mov dword [esp], 0
lea esi, [esp]
mov edx, dword [edi + 4]
call fcn.0041c8f0
test al, al
je 0x7b58d0
mov esi, dword [esi]
push 0x7f
call fcn.00531a80
test al, al
je 0x7b5872
cmp dword [esi + 0xc8], 0
je 0x7b5872
push 4
push dword [edi + 0x1c]
push 0
push dword [edi + 0xc]
add dword [esp], 0x14
push dword [edi + 8]
add dword [esp], 0x14
mov eax, dword [esi + 4]
call fcn.0040d620
mov dword [eax + 0xa0], 2
mov dword [eax + 0x74], 0x7f
mov dword [eax + 0x58], 7
add esp, 8
popal
ret

Function at 0x7bb3de
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x100
push eax
lea ecx, [esp + 0x50]
call fcn.00404450
mov edi, dword [0x6a9ec0]
mov edi, dword [edi + 0x768]
mov esi, dword [edi + 0x140]
mov ecx, 6
lea edx, [esp + 0x4c]
call fcn.00459010
mov dword [esi + 0x88], 0xfa
add esp, 0x100
popal
ret

Function at 0x7bb4ea
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebp, edi
add ebp, 0x5a20
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub eax, 0x14
add ebx, 0x1e
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a30
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
add ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a40
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a50
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub eax, 0x14
sub ebx, 0x1e
call fcn.007bb421
cmp dword [edi + 0x5a08], 0x4b0
jg 0x7bb5e9
sub esp, 0x40
mov edi, esi
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, 0x1e
mov dword [esp + 0x30], eax
mov eax, 0x320
mov dword [esp + 0x34], eax
mov esi, esp
mov edx, dword [edi + 4]
call fcn.0041c950
test al, al
je 0x7bb5e6
mov esi, dword [esi]
mov eax, esi
call fcn.007b513c
test al, al
je 0x7bb57f
mov eax, dword [esi + 0x1c]
cmp eax, dword [edi + 0x1c]
jne 0x7bb57f
lea eax, [esp + 0x20]
mov ecx, esi
call fcn.00467ef0
mov ebx, dword [esp + 0x30]
sub ebx, dword [eax]
sub ebx, dword [eax + 8]
cmp ebx, 0
jg 0x7bb57f
add ebx, dword [eax + 8]
add ebx, dword [esp + 0x34]
cmp ebx, 0
jl 0x7bb57f
mov dword [esp + 4], 1
push 0x28
call fcn.007a0000
mov dword [esi + 0xb8], 0x19
jmp 0x7bb57f
add esp, 0x40
popal
ret

Function at 0x7bb671
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebp, edi
add ebp, 0x5a20
mov eax, 0x2f8
mov ebx, 0x226
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a30
mov eax, 0x2f8
mov ebx, 0x230
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a40
mov eax, 0x2f8
mov ebx, 0x23a
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a50
mov eax, 0x2f8
mov ebx, 0x244
call fcn.007bb421
cmp dword [edi + 0x5a08], 1
jne 0x7bb70d
push 5
push 0xb
mov eax, dword [0x6a9ec0]
mov eax, dword [eax + 0x768]
call fcn.0040ddc0
mov dword [eax + 0xc8], 0x320
mov dword [eax + 0xcc], 0x320
mov dword [eax + 0x11c], 0x3e99999a
popal
ret
Function at 0x7bb70f
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebp, edi
add ebp, 0x5a20
mov eax, dword [edi + 0x5a14]
imul eax, eax, 0x50
add eax, 0x28
mov ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a30
mov eax, dword [edi + 0x5a14]
imul eax, eax, 0x50
add eax, 0x28
mov ebx, 0x226
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a40
mov eax, dword [edi + 0x5a18]
imul eax, eax, 0x50
add eax, 0x28
mov ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a50
mov eax, dword [edi + 0x5a18]
imul eax, eax, 0x50
add eax, 0x28
mov ebx, 0x226
call fcn.007bb421
cmp dword [edi + 0x5a08], 0x12c
jg 0x7bb801
sub esp, 0x40
mov dword [esp], 0
mov dword [esp + 4], 0
mov edx, edi
mov esi, esp
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
call fcn.0041c950
test al, al
je 0x7bb7fe
mov esi, dword [esi]
mov eax, esi
call fcn.007b513c
test al, al
je 0x7bb7ac
mov eax, dword [esi + 0x28]
cmp eax, dword [edx + 0x5a18]
je 0x7bb7eb
cmp eax, dword [edx + 0x5a14]
jne 0x7bb7ac
push 0xc
call fcn.007a0000
mov dword [esi + 0xb8], 0x19
jmp 0x7bb7ac
add esp, 0x40
popal
ret

Function at 0x7bb803
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebp, edi
add ebp, 0x5a20
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub eax, 0x14
add ebx, 0x1e
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a30
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
add ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a40
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a50
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub eax, 0x14
sub ebx, 0x1e
call fcn.007bb421
cmp dword [edi + 0x5a08], 0x190
jne 0x7bb8d6
push 0
push 0xc
mov eax, dword [0x6a9ec0]
mov eax, dword [eax + 0x768]
call fcn.0040ddc0
push 1
push 0xc
mov eax, dword [0x6a9ec0]
mov eax, dword [eax + 0x768]
call fcn.0040ddc0
push 2
push 0xc
mov eax, dword [0x6a9ec0]
mov eax, dword [eax + 0x768]
call fcn.0040ddc0
push 3
push 0xc
mov eax, dword [0x6a9ec0]
mov eax, dword [eax + 0x768]
call fcn.0040ddc0
push 4
push 0xc
mov eax, dword [0x6a9ec0]
mov eax, dword [eax + 0x768]
call fcn.0040ddc0
popal
ret
Function at 0x7bb8d8
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebp, edi
add ebp, 0x5a20
mov eax, 0x14
mov ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a30
mov eax, 0x14
mov ebx, 0x226
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a40
mov eax, 0x2f8
mov ebx, 0xa
call fcn.007bb421
mov ebp, edi
add ebp, 0x5a50
mov eax, 0x2f8
mov ebx, 0x226
call fcn.007bb421
cmp dword [edi + 0x5a08], 1
jne 0x7bba05
sub esp, 0xa
mov dword [esp], 0
mov esi, esp
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
call fcn.0041c950
test al, al
je 0x7bba02
mov esi, dword [esi]
cmp dword [esi + 0x24], 5
je 0x7bb9c9
cmp dword [esi + 0x24], 0xe
je 0x7bb9c9
cmp dword [esi + 0x24], 0x2c
je 0x7bb9c9
cmp dword [esi + 0x184], 0
jne 0x7bb99b
mov byte [esi + 0x188], 1
cmp dword [esi + 0x184], 0x190
jg 0x7bb94c
add dword [esi + 0x184], 0x190
cmp dword [esi + 0x184], 0x190
jl 0x7bb94c
mov dword [esi + 0x184], 0x190
jmp 0x7bb94c
cmp dword [esi + 0x180], 0x190
jg 0x7bb94c
add dword [esi + 0x180], 0x190
cmp dword [esi + 0x180], 0x190
jl 0x7bb94c
mov dword [esi + 0x180], 0x190
jmp 0x7bb94c
add esp, 0xa
popal
ret
Function at 0x7ca3e5
Capabilities:
Read file on windows

Disassembly:
pushal
push 0
push 0
push 3
push 0
push 3
push connect
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x7ca3e1], eax
push 0
push 0x7caa2f
push 0x1d00
push 0x7c5000
push dword [0x7ca3e1]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x7ca3e1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7caa24], 0x46
popal
pushal
mov ebx, dword [0x7c50f0]
mov eax, dword [eax]
mov dword [eax + 0x154], ebx
popal
ret

Function at 0x7cd000
Capabilities:
Packed with generic packer

Disassembly:
mov dword [0x7aa008], 0x78
mov dword [0x7aa00c], 0x6e
mov dword [0x7aa014], 0x6a7498
mov dword [0x7aa010], 0x7cde00
call fcn.007aa130
mov dword [0x7aa008], 0x24e
mov dword [0x7aa00c], 0x1ea
mov dword [0x7aa014], 0x6a7498
mov dword [0x7aa010], 0x7cde0b
call fcn.007aa130
mov edi, 0
pushal
mov ecx, dword [0x7aa004]
mov dword [ecx + 0x30], 0xff
mov dword [ecx + 0x34], 0xff
mov dword [ecx + 0x38], 0xff
mov dword [ecx + 0x3c], 0xff
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
cmp dword [esp], 0x30
jl 0x7cd098
add dword [esp], 0x48
mov esi, dword [esp]
mov ebx, edi
xor eax, eax
mov edx, 0x10
cmp ebx, edx
jl 0x7cd0b3
sub ebx, edx
add eax, 1
jmp 0x7cd0a4
imul eax, eax, 0x46
imul ebx, ebx, 0x30
add eax, 0x78
add ebx, 0xd
push eax
fild dword [esp]
fstp dword [esp]
push ebx
fild dword [esp]
fstp dword [esp]
push ecx
cmp dword [0x7c4fe8], 1
jne 0x7cd124
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x320]
cmp dword [ecx + 0xe0], ebx
jl 0x7cd124
add ebx, 0x2f
cmp dword [ecx + 0xe0], ebx
jg 0x7cd124
cmp dword [ecx + 0xe4], eax
jl 0x7cd124
add eax, 0x46
cmp dword [ecx + 0xe4], eax
jg 0x7cd124
xor byte [esi + 0x7c5300], 1
mov ecx, 0xff
cmp byte [esi + 0x7c5300], 1
jne 0x7cd137
mov ecx, 0x60
call fcn.004876f0
add esp, 0x20
popal
add edi, 1
cmp edi, 0x38
jne 0x7cd05f
ret
Function at 0x7d0a68
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
sub esp, 0x10
mov dword [esp], 0
mov dword [esp + 4], 0
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
mov esi, esp
call fcn.0041c950
test al, al
je 0x7d0ca9
mov esi, dword [esi]
cmp dword [esi + 0x1c], edi
jne 0x7d0a83
cmp dword [esi + 0x28], ebp
jne 0x7d0a83
mov eax, dword [esi + 0x24]
cmp eax, 0x10
je 0x7d0a83
cmp eax, 0x21
je 0x7d0a83
cmp eax, 0x23
je 0x7d0a83
cmp eax, 1
jne 0x7d0ad3
cmp dword [esi + 0x160], 0x64
jg 0x7d0c8b
jmp 0x7d0c6d
cmp eax, 9
je 0x7d0c6d
cmp eax, 0x29
je 0x7d0c6d
cmp eax, 0
je 0x7d0c81
cmp eax, 2
je 0x7d0c8b
cmp eax, 3
je 0x7d0c77
cmp eax, 4
je 0x7d0c8b
cmp eax, 5
je 0x7d0c81
cmp eax, 6
je 0x7d0c81
cmp eax, 7
je 0x7d0c81
cmp eax, 8
je 0x7d0c81
cmp eax, 0xa
je 0x7d0c81
cmp eax, 0xb
je 0x7d0c95
cmp eax, 0xc
je 0x7d0c8b
cmp eax, 0xd
je 0x7d0c81
cmp eax, 0xe
je 0x7d0c8b
cmp eax, 0xf
je 0x7d0c8b
cmp eax, 0x11
je 0x7d0c8b
cmp eax, 0x12
je 0x7d0c81
cmp eax, 0x13
je 0x7d0c8b
cmp eax, 0x14
je 0x7d0c8b
cmp eax, 0x15
je 0x7d0c81
cmp eax, 0x16
je 0x7d0c95
cmp eax, 0x17
je 0x7d0c77
cmp eax, 0x18
je 0x7d0c81
cmp eax, 0x19
je 0x7d0c95
cmp eax, 0x1a
je 0x7d0c81
cmp eax, 0x1b
je 0x7d0c8b
cmp eax, 0x1c
je 0x7d0c81
cmp eax, 0x1d
je 0x7d0c81
cmp eax, 0x1e
je 0x7d0c9f
cmp eax, 0x1f
je 0x7d0c95
cmp eax, 0x20
je 0x7d0c81
cmp eax, 0x22
je 0x7d0c81
cmp eax, 0x24
je 0x7d0c95
cmp eax, 0x25
je 0x7d0c95
cmp eax, 0x26
je 0x7d0c6d
cmp eax, 0x27
je 0x7d0c81
cmp eax, 0x28
je 0x7d0c81
cmp eax, 0x2a
je 0x7d0c81
cmp eax, 0x2b
je 0x7d0c81
cmp eax, 0x2c
je 0x7d0c81
cmp eax, 0x2d
je 0x7d0c95
cmp eax, 0x2e
je 0x7d0c81
cmp eax, 0x2f
je 0x7d0c81
cmp eax, 0x30
je 0x7d0c95
jmp 0x7d0a83
mov byte [esp + 4], 1
jmp 0x7d0a83
mov byte [esp + 4], 2
jmp 0x7d0a83
mov byte [esp + 4], 3
jmp 0x7d0a83
mov byte [esp + 4], 4
jmp 0x7d0a83
mov byte [esp + 4], 5
jmp 0x7d0a83
mov byte [esp + 5], 2
jmp 0x7d0a83
add esp, 0x10
popal
mov eax, dword [esp - 0x2c]
ret 8
Function at 0x7d62ac
Capabilities:
Packed with generic packer

Disassembly:
pushal
cmp eax, 0
jl 0x7d63b8
cmp ebx, 0
jl 0x7d63b8
cmp ebx, 8
jg 0x7d63b8
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
cmp dword [edx + eax*4 + 0x5d8], 0
je 0x7d63b8
mov edi, eax
mov ebp, ebx
sub esp, 0xa
lea esi, [esp]
mov dword [esi], 0
xor ebx, ebx
call fcn.0041c950
test al, al
je 0x7d6318
mov eax, dword [esi]
call fcn.007b513c
test al, al
je 0x7d62f4
mov eax, dword [esi]
cmp dword [eax + 0x28], ebp
jne 0x7d62f4
cmp dword [eax + 0x1c], edi
jne 0x7d62f4
push eax
add ebx, 1
mov ecx, 0
cmp ebx, 0
je 0x7d633e
add ecx, 1
sub ebx, 1
pop esi
push 0x190
call fcn.007a0000
cmp dword [esi + 0x40], 0
jg 0x7d631d
sub ecx, 1
jmp 0x7d631d
add esp, 0xa
cmp ecx, 0
jne 0x7d63b8
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
mov esi, dword [edx + 0x11c]
mov ecx, dword [edx + 0x120]
xor eax, eax
cmp ecx, 0
je 0x7d6396
cmp word [esi + 0xea], 0
je 0x7d638b
cmp dword [esi + 0x14], edi
jne 0x7d638b
cmp dword [esi + 0x10], ebp
jne 0x7d638b
mov al, 1
sub ecx, 1
add esi, 0xec
jmp 0x7d6364
test al, al
jne 0x7d63b8
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
mov edx, dword [edx + 0x160]
push edx
mov ebx, ebp
call fcn.00426620
popal
ret

Function at 0x7d6cea
Capabilities:
Packed with generic packer

Disassembly:
pushal
add dword [esi + 0x160], 1
cmp dword [esi + 0x160], 0x96
jl 0x7d6d51
mov dword [esi + 0x160], 0
mov eax, 6
call fcn.005af400
cmp eax, dword [esi + 0x1c]
je 0x7d6d0c
mov edi, dword [esi + 4]
cmp dword [edi + eax*4 + 0x5d8], 0
je 0x7d6d0c
cmp dword [edi + eax*4 + 0x5d8], 2
je 0x7d6d0c
mov dword [esi + 0x1c], eax
push dword [esi + 0x2c]
mov ecx, dword [esi + 0x1c]
mov eax, edi
call fcn.0041c6c0
mov dword [esp - 4], 0x1e
fisub dword [esp - 4]
fstp dword [esi + 0x30]
popal
ret

Function at 0x7d6d53
Capabilities:
Packed with generic packer

Disassembly:
pushal
cmp dword [esi + 0x28], 0x35
jne 0x7d6e13
mov edi, esi
mov ebp, dword [edi + 0x160]
cmp ebp, 0
jne 0x7d6db6
push 0
lea esi, [esp]
mov edx, dword [edi + 4]
call fcn.0041c8f0
test al, al
je 0x7d6db3
mov esi, dword [esi]
cmp dword [esi + 0x24], 0xe
je 0x7d6d71
mov eax, dword [edi + 0x1c]
cmp eax, dword [esi + 0x1c]
jne 0x7d6d71
mov eax, dword [edi + 8]
sub eax, 0x50
cmp eax, dword [esi + 8]
jg 0x7d6d71
add eax, 0x50
cmp eax, dword [esi + 8]
jl 0x7d6d71
mov ebp, dword [esi + 0x158]
mov dword [edi + 0x160], ebp
add esp, 4
cmp ebp, 0
je 0x7d6e13
mov eax, dword [edi + 4]
mov ebx, ebp
and ebx, 0xffff
imul ebx, ebx, 0x19c
add ebx, dword [eax + 0x90]
cmp dword [ebx + 0x158], 0
je 0x7d6e09
mov eax, dword [edi + 8]
sub eax, 0x50
cmp eax, dword [ebx + 8]
jg 0x7d6e13
mov dword [esp - 4], 0xc0400000
fld dword [ebx + 0x2c]
fadd dword [esp - 4]
fstp dword [ebx + 0x2c]
jmp 0x7d6e13
mov dword [edi + 0x160], 0
popal
ret
Function at 0x7d775f
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x100
mov edi, 0
mov ebp, edi
mov ecx, 0x46
mov ebx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
call fcn.0046f280
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
mov dword [esp + 0x1c], eax
call fcn.00586a30
lea eax, [esp + 0x1c]
mov dword [esp + 0xa4], 0
call fcn.00586d40
push 0
push 0x3f800000
push 0x3f800000
mov ecx, dword [esp + 0x134]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x13c]
call fcn.0046f100
lea ecx, [esp + 0x1c]
call fcn.00586b10
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x124]
mov dword [ebx], eax
add esp, 0x100
popal
ret 0xc

Function at 0x7d7a0a
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esi + 0x160], 1
pushal
mov edi, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov esi, esp
mov edx, dword [edi + 4]
call fcn.0041cad0
test al, al
je 0x7d7a5a
mov esi, dword [esi]
cmp dword [esi + 8], 3
jne 0x7d7a2b
mov eax, dword [esi + 0x14]
cmp eax, dword [edi + 0x1c]
jne 0x7d7a2b
mov eax, dword [esi + 0x10]
mov dword [esp + eax*4 + 4], 1
jmp 0x7d7a2b
mov dword [esp], 0
mov ebp, 0
mov esi, esp
mov edx, dword [edi + 4]
call fcn.0041c950
test al, al
je 0x7d7a9e
mov esi, dword [esi]
mov eax, dword [esi + 0x1c]
cmp eax, dword [edi + 0x1c]
jne 0x7d7a66
mov eax, dword [esi + 0x28]
cmp dword [esp + eax*4 + 4], 1
je 0x7d7a66
cmp ebp, 0
je 0x7d7a9a
cmp eax, dword [ebp + 0x28]
jl 0x7d7a66
mov ebp, esi
jmp 0x7d7a66
xor eax, eax
test ebp, ebp
je 0x7d7aab
mov eax, dword [ebp + 0x28]
add eax, 1
imul eax, eax, 0x50
mov dword [edi + 8], eax
fild dword [edi + 8]
fstp dword [edi + 0x2c]
push 0x58
push 0x61a80
push ecx
push eax
fild dword [edi + 0xc]
fstp dword [esp + 4]
fild dword [edi + 8]
fstp dword [esp]
mov esi, dword [0x6a9ec0]
mov esi, dword [esi + 0x820]
mov esi, dword [esi]
call fcn.00518a70
add esp, 0x28
popal
ret

Function at 0x7d7b21
Capabilities:
Packed with generic packer

Disassembly:
add dword [esi + 0x160], 1
cmp dword [esi + 0x160], 0x12c
jl 0x7d7bed
mov dword [esi + 0x160], 0
pushal
push 0
mov edi, esi
xor ebp, ebp
mov esi, esp
mov edx, dword [edi + 4]
call fcn.0041c8f0
test al, al
je 0x7d7bae
mov esi, dword [esi]
cmp esi, edi
je 0x7d7b49
mov eax, dword [esi + 0x1c]
cmp eax, dword [edi + 0x1c]
jne 0x7d7b49
cmp dword [esi + 0x24], 0x19
je 0x7d7b49
cmp dword [esi + 0x24], 0x25
je 0x7d7b49
cmp dword [esi + 0x28], 0x47
je 0x7d7b49
cmp dword [esi + 0x28], 0x48
je 0x7d7b49
push 1
call fcn.00531a80
test al, al
je 0x7d7b49
mov eax, dword [esi + 8]
sub eax, dword [edi + 8]
cmp eax, 0x50
jl 0x7d7b49
cmp ebp, 0
je 0x7d7baa
mov ebx, dword [esi + 8]
sub ebx, dword [edi + 8]
cmp eax, ebp
jg 0x7d7b49
mov ebp, esi
jmp 0x7d7b49
add esp, 4
test ebp, ebp
je 0x7d7bec
fild dword [ebp + 8]
fisub dword [edi + 8]
mov dword [esp - 4], 0x42f00000
fdiv dword [esp - 4]
mov esi, ebp
mov byte [esi + 0x50], 0
mov dword [esi + 0x28], 0x47
fstp dword [esi + 0x34]
mov dword [esi + 0x120], 0x40400000
mov eax, esi
call fcn.0052c310
popal
ret
Function at 0x7d9000
Capabilities:
Packed with generic packer

Disassembly:
pushal
cmp dword [edi + 0x164], 0
jne 0x7d901d
mov eax, 0x14
call fcn.005af400
add eax, 1
mov dword [edi + 0x164], eax
add dword [edi + 0x164], 1
cmp dword [edi + 0x164], 0x1d6
jne 0x7d90aa
mov dword [edi + 0x164], 0
push 0
mov esi, esp
mov edx, dword [edi + 4]
call fcn.0041c8f0
test al, al
je 0x7d9070
mov esi, dword [esi]
push 1
call fcn.00531a80
test al, al
je 0x7d903c
mov eax, dword [edi + 0x1c]
cmp eax, dword [esi + 0x1c]
jne 0x7d903c
mov eax, dword [edi + 8]
cmp eax, dword [esi + 8]
jg 0x7d903c
mov eax, 1
pop ebx
test al, al
je 0x7d90aa
push 2
push dword [edi + 0x1c]
push 0
push dword [edi + 0xc]
sub dword [esp], 0x28
push dword [edi + 8]
sub dword [esp], 0x14
mov eax, dword [edi + 4]
call fcn.0040d620
mov dword [eax + 0xa0], 4
mov byte [eax + 0xa5], 1
mov dword [eax + 0x74], 1
popal
ret

Function at 0x7e02ed
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0x10
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xca
mov dword [eax + 0x34], 0xca
mov dword [eax + 0x38], 0xca
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0xe
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0x8f
mov dword [eax + 0x34], 0x8f
mov dword [eax + 0x38], 0x8f
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0xd
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xbf
mov dword [eax + 0x34], 0xbf
mov dword [eax + 0x38], 0xbf
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0xc
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xb3
mov dword [eax + 0x34], 0xb3
mov dword [eax + 0x38], 0xb3
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
sub eax, 7
sub ebx, 1
push 2
push 0xe
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x34], 0xf
mov dword [eax + 0x38], 0xf
mov dword [eax + 0x3c], 0xff
call fcn.00586d50
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
sub eax, 1
sub ebx, 7
push 0xe
push 2
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x34], 0xf
mov dword [eax + 0x38], 0xf
mov dword [eax + 0x3c], 0xff
call fcn.00586d50
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xff
mov dword [eax + 0x34], 0xff
mov dword [eax + 0x38], 0xff
mov dword [eax + 0x3c], 0xff
popal
ret 8
Function at 0x7e05b1
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0x10
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xca
mov dword [eax + 0x34], 0xca
mov dword [eax + 0x38], 0xca
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0xe
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0x8f
mov dword [eax + 0x34], 0x8f
mov dword [eax + 0x38], 0x8f
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0xd
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xbf
mov dword [eax + 0x34], 0xbf
mov dword [eax + 0x38], 0xbf
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
push 0xc
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xb3
mov dword [eax + 0x34], 0xb3
mov dword [eax + 0x38], 0xb3
mov dword [eax + 0x3c], 0xff
call fcn.007e0801
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
sub eax, 7
sub ebx, 1
push 2
push 0xe
push ebx
push eax
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x34], 0xf
mov dword [eax + 0x38], 0xf
mov dword [eax + 0x3c], 0xff
call fcn.00586d50
mov eax, dword [0x7aa004]
mov dword [eax + 0x30], 0xff
mov dword [eax + 0x34], 0xff
mov dword [eax + 0x38], 0xff
mov dword [eax + 0x3c], 0xff
popal
ret 8
Function at 0x403ee7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], edi
je 0x403f16
cmp dword [esi + 4], edi
jbe 0x403f0f
mov eax, dword [esi]
mov eax, dword [eax + edi*8]
test eax, eax
je 0x403f09
push eax
call fcn.004301e8
inc edi
cmp edi, dword [esi + 4]
jb 0x403efa
push dword [esi]
call fcn.004324f6
push ebx
xor ebx, ebx
mov edi, 0xe0
cmp dword [esi + 8], ebx
je 0x403f48
cmp dword [esi + 0xc], ebx
jbe 0x403f40
mov dword [ebp + 8], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x403f2b
push dword [esi + 8]
call fcn.004324f6
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x403f74
cmp dword [esi + 0x14], ebx
jbe 0x403f6c
and dword [ebp + 8], ebx
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x403f57
push dword [esi + 0x10]
call fcn.004324f6
xor edi, edi
pop ebx
cmp dword [esi + 0x18], edi
je 0x403f9f
cmp dword [esi + 0x1c], edi
jbe 0x403f97
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*8]
test dword [edi + 0x65], eax
je 0x403fb9
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654b7972
imul esi, dword [bp + di + 0x74], 0x654b7972
jns 0x403fcf
jo 0x404016
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx + 0x40], al
add byte [eax], al
add byte [esi + 0x2e000011], dh
adc dword [eax], eax
add byte [esi], ch
adc al, 0
add byte [0x516aede9], bl
cmp edi, dword [eax]
pop esp
add dword [edi - 0x7e818284], 0x383b8177
dec esi
dec esi
dec esi
cmp dword [ebx], 0x4e4e4e38
dec esi
adc byte [ebx - 0x6c685f5e], 0xa4
xchg ebx, eax
dec esi
mov al, byte [0xa1979593]
mov byte [0x994ea7a0], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
push esi
mov eax, dword [0x9d944e57]
mov al, byte [0xa1a7a14e]
mov byte [0x975b9b93], al
pushfd
mov eax, dword [0x9a9a8fa2]
xchg ebx, eax
xchg edx, eax
dec esi
invalid
invalid

Function at 0x411efd
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax + esi + 0x308c3055], ah
mov dword [0xa330a930], eax
xor byte [eax + esi + 0x309d3095], ah
arpl word [eax], si
bound esi, qword [eax]
invalid
Function at 0x100eefde
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx