joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ebc0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x46ec88
cmp eax, 1
je 0x46ec88
cmp eax, 0xd
je 0x46ec88
cmp eax, 0xb
jne 0x46ec13
mov eax, dword [esi + 0x10]
cdq
sub eax, edx
mov edx, dword [esi + 8]
sar eax, 1
lea eax, [eax + edx - 0x73]
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
cdq
sub eax, edx
mov edx, dword [esi + 0xc]
sar eax, 1
lea eax, [eax + edx - 0x73]
mov dword [ecx + 4], eax
mov eax, 0xe6
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
mov eax, ecx
ret
cmp eax, 3
je 0x46ec6a
cmp eax, 5
je 0x46ec6a
cmp eax, 6
jmp fcn.0079bc00
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add edx, 0x14
mov dword [ecx], edx
mov edx, dword [esi + 0x14]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0x3c
mov dword [ecx + 0xc], edx
mov eax, ecx
ret
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub eax, 0xf
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
add eax, 0xf
mov dword [ecx + 4], edx
mov edx, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov eax, ecx
ret
Function at 0x5259d0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x28]
test eax, eax
jne 0x525a35
fld dword [0x6799a4]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 1
jne 0x525b53
push edi
call fcn.00525890
test eax, eax
je 0x525b53
cmp dword [edi + 0x114], 0
jle 0x525b53
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0
push 3
push str.anim_shoot
mov dword [edi + 0x28], 0x43
mov dword [edi + 0x68], 0x12c
call fcn.00528b00
pop edi
pop esi
pop ecx
ret
cmp eax, 0x43
jne 0x525af6
mov eax, dword [edi]
fld dword [0x6799a0]
mov ecx, dword [eax + 0x820]
mov eax, dword [edi + 0x118]
mov edx, dword [ecx + 8]
and eax, 0xffff
lea esi, [eax + eax*4]
shl esi, 5
add esi, dword [edx]
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.00473b70
test al, al
je 0x525a7e
push edi
call fcn.00525890
mov ecx, edi
call fcn.00525730
cmp dword [esi + 0x5c], 0
jle 0x525b53
add dword [edi + 0x114], 0xffffffff
mov eax, dword [edi + 0x114]
cmp eax, 4
jne 0x525aa1
push str.Zombie_catapult_basketball
jmp 0x525ac3
cmp eax, 3
jne 0x525aad
push str.Zombie_catapult_basketball2
jmp 0x525ac3
cmp eax, 2
jne 0x525ab9
push str.Zombie_catapult_basketball3
jmp 0x525ac3
cmp eax, 1
jne 0x525aca
push str.Zombie_catapult_basketball4
mov ecx, edi
call fcn.00533200
cmp dword [edi + 0x114], 0
push ecx
je 0x525b35
fld dword [0x679388]
fstp dword [esp]
push 0x14
push 0
push str.anim_idle
call fcn.00528b00
jmp loc.00795ecf
cmp eax, 0x44
jne 0x525b53
cmp dword [edi + 0x68], 0
jne 0x525b53
push edi
call fcn.00525890
test eax, eax
push ecx
je 0x525b35
fld dword [0x679638]
mov dword [edi + 0x28], 0x43
fstp dword [esp]
push 0x14
push 3
push str.anim_shoot
mov dword [edi + 0x68], 0x12c
call fcn.00528b00
pop edi
pop esi
pop ecx
ret
fld dword [0x679320]
fstp dword [esp]
push 0x14
push 0
push str.anim_walk
call fcn.00528b00
mov dword [edi + 0x28], 0
pop edi
pop esi
pop ecx
ret
Function at 0x525be0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [edi]
sub esp, 8
cmp dword [eax + 0x7f8], 0x2c
push esi
jne 0x525c2f
fld dword [0x67a130]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 0x41
jne 0x525c2f
fld dword [edi + 0x84]
fsub qword [0x679a68]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x84]
fcomp dword [0x679f64]
fnstsw ax
test ah, 5
jp 0x525c2f
push 0
mov eax, edi
call fcn.00525b60
cmp dword [edi + 0x28], 0x4a
jne 0x525c6a
mov ecx, dword [edi]
mov edx, dword [ecx + 0x820]
mov eax, dword [edi + 0x118]
mov ecx, dword [edx + 8]
and eax, 0xffff
lea edx, [eax + eax*4]
mov eax, dword [ecx]
shl edx, 5
cmp dword [eax + edx + 0x5c], 0
jle 0x525c6a
xor esi, esi
mov eax, edi
mov dword [edi + 0x28], 0x4b
call fcn.0052f2e0
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x525cd1
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x525cad
cmp eax, 0x3e
je 0x525cad
cmp eax, 0x3f
je 0x525cad
cmp eax, 0x40
je 0x525cad
cmp eax, 0x41
je 0x525cad
cmp eax, 0x42
je 0x525cad
cmp eax, 0x43
je 0x525cad
cmp eax, 0x44
je 0x525cad
cmp eax, 0x45
je 0x525cad
cmp eax, 0x46
jne 0x525cd1
cmp dword [edi + 0x28], 0x49
jne 0x525cd1
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x160]
push edx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x525cd1
push 0
mov eax, edi
call fcn.00525b60
pop esi
add esp, 8
ret
Function at 0x526ae0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
cmp eax, 0xf
push edi
jne 0x526b58
cmp dword [esi + 0x68], 0
jg 0x526d02
cmp byte [esi + 0xba], 0
je 0x526d02
push esi
mov dword [esi + 0x68], 0x6e
jmp fcn.00795b1d
cmp eax, 0x10
jne 0x526d02
cmp dword [esi + 0x68], 0x50
fldz
jne 0x526bbd
mov eax, dword [esi]
cmp byte [eax + 0x8c5], 0
jne 0x526bbd
mov ecx, dword [0x6a9f00]
fst dword [esp + 0x10]
fcomp dword [ecx + 0x6ec]
mov edi, dword [eax + 0x784]
fnstsw ax
test ah, 0x44
jnp 0x526ba7
fld dword [ecx + 0x6ec]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x14]
add esp, 4
fld dword [esp + 0x10]
push ecx
mov eax, 0x22
fstp dword [esp]
mov ecx, edi
call fcn.00515020
fldz
cmp dword [esi + 0x68], 0
jg 0x526d00
mov eax, dword [esi]
cmp byte [eax + 0x8c5], 0
jne 0x526c1b
mov ecx, dword [0x6a9f00]
fst dword [esp + 0x10]
fcomp dword [ecx + 0x4b0]
mov edi, dword [eax + 0x784]
fnstsw ax
test ah, 0x44
jnp 0x526c05
fld dword [ecx + 0x4b0]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x14]
add esp, 4
fld dword [esp + 0x10]
push ecx
mov eax, 0x17
fstp dword [esp]
mov ecx, edi
call fcn.00515020
jmp 0x526c1d
fstp st(0)
mov eax, dword [esi + 0x10]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x14]
cdq
sub eax, edx
mov ebx, eax
sar edi, 1
add edi, dword [esi + 8]
sar ebx, 1
add ebx, dword [esi + 0xc]
cmp byte [esi + 0xb8], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
je 0x526c61
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 4]
push 0x7f
push 1
push 1
push 0x73
push ebx
push edi
push ecx
push edx
call fcn.0041d8a0
jmp 0x526c84
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 4]
push 0xff
push 1
push 1
push 0x73
push ebx
push edi
push eax
push ecx
call fcn.0041d8a0
push edi
mov edi, dword [esi + 4]
call fcn.0041cbf0
fild dword [esp + 0x14]
mov edx, dword [esi]
mov eax, dword [edx + 0x820]
mov esi, dword [eax]
push 5
push 0x61a80
sub esp, 8
fstp dword [esp + 4]
fild dword [esp + 0x20]
fstp dword [esp]
call fcn.00518a70
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ecx, esi
mov dword [eax + 0x5540], 0xc
mov dword [eax + 0x5544], 4
mov dword [eax + 0x5548], 0xfffffffa
call fcn.00530510
mov ecx, dword [esi]
call fcn.004538f0
test al, al
je 0x526d02
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x160]
mov ecx, dword [esp + 0x10]
push edx
mov eax, ebx
call fcn.00429db0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
fstp st(0)
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5272e0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x28]
cmp eax, 0x47
jne 0x52738c
fld dword [edi + 0x120]
mov eax, dword [edi + 0x1c]
fsub qword [0x6796d8]
push eax
mov eax, edi
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fst dword [edi + 0x120]
fadd dword [edi + 0x84]
fstp dword [edi + 0x84]
fld dword [edi + 0x2c]
fsub dword [edi + 0x34]
fstp dword [edi + 0x2c]
call fcn.00531880
fsub dword [edi + 0x30]
fstp dword [esp + 8]
fld dword [edi + 0x30]
fld dword [esp + 8]
fld st(0)
faddp st(2)
fxch st(1)
fstp dword [edi + 0x30]
fadd dword [edi + 0x84]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x84]
fldz
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
jne 0x5273ca
push ecx
fstp dword [edi + 0x84]
fld dword [0x679638]
mov dword [edi + 0x28], 0x48
fstp dword [esp]
push 0
push 3
push str.anim_land
call fcn.00528b00
pop edi
pop esi
pop ecx
ret
cmp eax, 0x48
jne 0x5273cc
mov ecx, dword [edi]
mov edx, dword [ecx + 0x820]
mov eax, dword [edi + 0x118]
mov ecx, dword [edx + 8]
and eax, 0xffff
lea edx, [eax + eax*4]
mov eax, dword [ecx]
shl edx, 5
cmp dword [eax + edx + 0x5c], 0
jle 0x5273cc
xor esi, esi
mov eax, edi
jmp loc.007b0701
fstp st(0)
pop edi
pop esi
pop ecx
ret
Function at 0x528ca0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x51], 0
jne 0x528ebb
mov eax, dword [edi + 0x114]
test eax, eax
jle 0x528d14
add eax, 0xffffffff
mov dword [edi + 0x114], eax
jne 0x528d14
mov eax, edi
call fcn.0052df90
cmp eax, 0xc
jne 0x528d0a
cmp byte [edi + 0xba], 0
je 0x528d0a
fld dword [0x679b54]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 0x41
jne 0x528d0a
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0x14
push 3
push str.anim_point
mov dword [edi + 0x28], 0x2a
call fcn.00528b00
jmp 0x528d14
mov dword [edi + 0x114], 1
mov ecx, dword [edi + 0x28]
cmp ecx, 0x28
jne 0x528d5c
cmp byte [edi + 0xba], 0
je 0x528ebb
cmp dword [edi + 0x68], 0
jne 0x528ebb
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0x14
push 3
push str.anim_point
mov dword [edi + 0x28], 0x29
call fcn.00528b00
mov eax, edi
pop edi
pop esi
pop ebx
jmp fcn.00524a70
cmp ecx, 0x29
je 0x528e63
cmp ecx, 0x2a
je 0x528e63
cmp ecx, 0x2b
mov esi, 0x2c
jne 0x528d99
cmp dword [edi + 0x68], 0
jne 0x528ebb
fldz
push ecx
fstp dword [esp]
mov dword [edi + 0x28], esi
push 0x14
push 0
push str.anim_walk
call fcn.00528b00
mov eax, edi
call fcn.0052dfe0
cmp eax, dword [edi + 0x28]
je 0x528e3a
cmp eax, esi
jne 0x528dc1
fldz
push ecx
fstp dword [esp]
mov dword [edi + 0x28], esi
push 0xa
push 0
push str.anim_walk
jmp 0x528e35
cmp eax, 0x2d
jne 0x528e0b
fld dword [0x6795c4]
push ecx
fstp dword [esp]
push 0xa
push 0
push str.anim_armraise
mov dword [edi + 0x28], eax
call fcn.00528b00
fld dword [0x679610]
mov eax, dword [edi]
mov ecx, dword [eax + 0x820]
mov eax, dword [edi + 0x118]
mov edx, dword [ecx + 8]
mov ecx, dword [edx]
and eax, 0xffff
lea eax, [eax + eax*4]
shl eax, 5
fstp dword [ecx + eax + 4]
jmp 0x528e3a
cmp eax, 0x2e
je 0x528e1f
cmp eax, 0x2f
je 0x528e1f
cmp eax, 0x30
je 0x528e1f
cmp eax, 0x31
jne 0x528e3a
fld dword [0x6795c4]
push ecx
fstp dword [esp]
push 0xa
push 0
mov dword [edi + 0x28], eax
push str.anim_armraise
call fcn.00528b00
cmp byte [edi + 0xba], 0
je 0x528ebb
cmp dword [edi + 0x114], 0
jne 0x528ebb
call fcn.00528a50
test al, al
je 0x528ebb
mov dword [edi + 0x114], 0x64
pop edi
pop esi
pop ebx
ret
mov edx, dword [edi]
mov eax, dword [edx + 0x820]
mov edx, dword [eax + 8]
mov eax, dword [edi + 0x118]
mov edx, dword [edx]
and eax, 0xffff
lea eax, [eax + eax*4]
shl eax, 5
cmp dword [edx + eax + 0x5c], 0
jle 0x528ebb
cmp ecx, 0x29
jne 0x528ea6
mov ebx, dword [edi + 4]
call fcn.00408b60
cmp eax, 0xf
jg 0x528ea6
mov eax, dword [edi]
mov esi, 0x64
call fcn.00453630
mov esi, edi
call fcn.00528970
jmp 0x7957e6
pop edi
pop esi
pop ebx
ret
Function at 0x52a930
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp byte [ebx + 0xb8], 0
push esi
push edi
jne 0x52aa35
cmp byte [ebx + 0xba], 0
je 0x52aa35
cmp byte [ebx + 0xec], 0
jne 0x52aa35
mov eax, dword [ebx + 0x28]
cmp eax, 1
je 0x52aa35
cmp eax, 2
je 0x52aa35
cmp eax, 3
je 0x52aa35
cmp eax, 0x4c
jne 0x52a9c4
cmp dword [ebx + 0x64], 0
jne 0x52a9c4
push 3
push ebx
call fcn.0052e780
test eax, eax
je 0x52aa35
mov edi, ebx
call fcn.0052f440
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0xa
push 3
push str.anim_placeladder
jmp fcn.00799180
cmp eax, 0x4d
jne 0x52aa35
mov ecx, dword [ebx + 0x118]
mov eax, dword [ebx]
call fcn.00453cb0
cmp dword [eax + 0x5c], 0
jle 0x52aa35
push 3
push ebx
call fcn.0052e780
mov esi, eax
test esi, esi
je 0x52aa25
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x1c]
push eax
mov eax, dword [ebx + 4]
call fcn.00408f40
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [0x6a727c]
mov edx, dword [edx + 0xd8]
push eax
call edx
mov dword [ebx + 0x64], 6
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x7c], eax
mov eax, ebx
nop
nop
nop
nop
nop
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, ebx
mov dword [ebx + 0x28], 0x4c
call fcn.0052f2e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52b340
Capabilities:
Check http status code

Disassembly:
mov eax, dword [edi + 4]
sub esp, 8
add dword [edi + 0x3c], 0xffffffff
mov eax, dword [eax + 0xa0]
push esi
jne 0x52b415
call fcn.005af400
test eax, eax
jne 0x52b415
cmp byte [edi + 0xba], al
je 0x52b415
cmp dword [edi + 0x24], 0x19
je 0x52b415
mov eax, dword [edi + 4]
call fcn.00413a40
test al, al
jne 0x52b415
fldz
mov ecx, dword [edi]
fstp dword [esp + 8]
call fcn.004538c0
test al, al
je 0x52b3bd
fld dword [0x679800]
sub esp, 8
fstp dword [esp + 4]
fld dword [0x67959c]
fstp dword [esp]
call fcn.00511cb0
fstp dword [esp + 0x10]
add esp, 8
cmp dword [edi + 0x24], 0x17
jne 0x52b3d1
mov eax, dword [edi]
mov esi, 0x46
call fcn.00453630
jmp 0x52b403
cmp byte [edi + 0x50], 0
je 0x52b3e1
push ecx
mov ecx, dword [edi]
mov eax, 0xc
jmp 0x52b3f7
mov ecx, dword [edi]
cmp byte [ecx + 0x8be], 0
push ecx
mov eax, 0xd
jne 0x52b3f7
mov eax, 0xb
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.00453650
mov eax, 0x3e8
call fcn.005af400
add eax, 0x1f4
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 0xb4]
test eax, eax
jle 0x52b43e
jmp 0x79b6e4
mov eax, dword [edi + 0xac]
test eax, eax
jle 0x52b45a
jmp 0x79b712
mov eax, dword [edi + 0xb0]
test eax, eax
jle 0x52b476
jmp 0x79b6b6
cmp dword [edi + 0x28], 0xe
jne 0x52b488
mov esi, edi
call fcn.00528ec0
pop esi
add esp, 8
ret
cmp dword [edi + 0xb4], 0
jg 0x52b4c3
cmp dword [edi + 0xb0], 0
jg 0x52b4c3
mov eax, edi
call fcn.0052b110
mov eax, edi
call fcn.0052ad30
mov eax, edi
call fcn.0052f4c0
push edi
call fcn.0052f870
mov esi, edi
call fcn.0052fa20
mov eax, edi
call fcn.0052b280
cmp dword [edi + 0x24], 0x19
jne 0x52b4d0
mov eax, edi
call fcn.00536080
cmp byte [edi + 0xec], 0
jne 0x52b551
mov eax, dword [edi + 0x28]
cmp eax, 1
je 0x52b551
cmp eax, 2
je 0x52b551
cmp eax, 3
je 0x52b551
cmp dword [edi + 0x6c], 0xfffffffc
je 0x52b551
cmp byte [edi + 0xba], 0
mov eax, dword [edi + 0x24]
sete cl
cmp eax, 0xc
je 0x52b508
cmp eax, 0x16
jne 0x52b514
cmp dword [edi + 0xc8], 0xc8
jl 0x52b518
test cl, cl
je 0x52b551
cmp eax, 0x13
mov esi, 1
jne 0x52b525
lea esi, [eax - 9]
cmp dword [edi + 0xcc], 0x1f4
jl 0x52b536
mov esi, 3
mov eax, 5
call fcn.005af400
test eax, eax
jne 0x52b551
push esi
mov eax, 9
mov esi, edi
call fcn.005317c0
pop esi
add esp, 8
ret
Function at 0x52edb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [esp + 0x10]
call fcn.00532140
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp 0x52ede0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
lea esi, [esp + 0xc]
call fcn.0041c950
test al, al
je 0x52ee7c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov esi, dword [esp + 0xc]
cmp edx, dword [esi + 0x1c]
jne 0x52ede0
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00467ef0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jge 0x52ee24
mov edx, dword [esp + 0x18]
lea eax, [ebx + edi]
add edx, ecx
jmp 0x52ee2f
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, edi
lea edx, [ebx + edi]
cmp eax, ecx
jg 0x52ee37
sub eax, ecx
jmp 0x52ee43
cmp eax, edx
jg 0x52ee3f
sub eax, ecx
jmp 0x52ee43
sub edx, ecx
mov eax, edx
cmp eax, 0x14
jl 0x52ede0
mov ecx, dword [ebp + 8]
push 1
push esi
call fcn.0052e4c0
test al, al
je 0x52ede0
mov eax, dword [esi + 0x24]
cmp eax, 0x15
je 0x52ede0
cmp eax, 0x2e
je 0x52ede0
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov edi, dword [ebp + 8]
push 1
push ecx
push edx
call fcn.0052e920
jmp 0x52ee7f
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x52eee6
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x52eec2
cmp eax, 0x3e
je 0x52eec2
cmp eax, 0x3f
je 0x52eec2
cmp eax, 0x40
je 0x52eec2
cmp eax, 0x41
je 0x52eec2
cmp eax, 0x42
je 0x52eec2
cmp eax, 0x43
je 0x52eec2
cmp eax, 0x44
je 0x52eec2
cmp eax, 0x45
je 0x52eec2
cmp eax, 0x46
jne 0x52eee6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52eee6
mov edx, dword [edi + 4]
mov ecx, dword [edx + 0x160]
push ecx
call fcn.0042ba30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5312d0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
and esi, 8
push edi
mov dword [esp + 0x10], esi
jne 0x5312f1
mov dword [ebp + 0x54], 0x19
test al, 4
je 0x5312fe
push 0
mov eax, ebp
call fcn.00530950
mov edi, dword [ebp + 0xc8]
mov eax, ebp
mov dword [esp + 0x14], edi
call fcn.0052d710
jmp 0x79f100

Function at 0x534dc0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x60]
cmp eax, 0xdac
push ebx
jge 0x534dcf
xor eax, eax
jmp 0x534e0a
cmp eax, 0x1f40
jge 0x534ddd
mov eax, 2
jmp 0x534e0a
cmp eax, 0x30d4
jge 0x534deb
mov eax, 4
jmp 0x534e0a
cmp dword [esi + 0x130], 0
mov eax, 0xc
jne 0x534dfe
mov eax, 0xb
call fcn.005af400
mov eax, dword [eax*4 + 0x69de1c]
mov ecx, dword [esi + 0x130]
jmp 0x79bcad
Function at 0x538240
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x645d03
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x1c], edi
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x4c]
cmp ecx, dword [eax + 0x80]
jle 0x53828d
push ecx
push eax
call fcn.00538790
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov edx, dword [edi + 0x44]
mov ecx, dword [ebx + 4]
or edx, eax
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x48]
not eax
and edx, eax
mov dword [ebx], edx
mov edx, dword [edi + 0x48]
mov dword [esp + 0x28], ecx
mov ecx, dword [edi + 0x44]
or ecx, dword [ebx + 4]
not edx
and ecx, edx
mov dword [esp + 0x20], ebx
mov dword [ebx + 4], ecx
mov dword [esp + 0xa8], 0
cmp byte [edi + 0x41], 0
je 0x5382f4
cmp byte [ebx + 8], 0
je 0x5382da
mov eax, dword [ebx]
jmp 0x5382dc
mov eax, ecx
test al, 8
je 0x5382f4
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x38]
mov esi, dword [ebp + 0xc]
push eax
push ecx
push 0
push 0
call fcn.00587840
cmp dword [edi + 0xc], 0
jne 0x53833d
cmp byte [ebx + 8], 0
je 0x538304
mov eax, dword [ebx]
jmp 0x538307
mov eax, dword [ebx + 4]
test al, 4
je 0x538318
mov edx, dword [edi]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + 0x68]
push eax
mov ecx, edi
call edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], ecx
mov dword [ebx], eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx + 8], 0
je 0x538347
mov eax, dword [ebx]
jmp 0x53834a
mov eax, dword [ebx + 4]
test al, 4
je 0x53836c
mov esi, dword [ebp + 0xc]
push esi
call fcn.00586b40
mov edx, dword [edi]
mov eax, dword [edx + 0x68]
push esi
mov ecx, edi
call eax
mov edi, esi
call fcn.00586bd0
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
lea esi, [edi + 4]
mov dword [esp + 0x18], ecx
jmp 0x538380
cmp esi, esi
mov edx, dword [esi + 4]
mov dword [esp + 0x30], edx
je 0x538390
call fcn.0061c63f
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x30]
je 0x538318
cmp eax, dword [esi + 4]
jne 0x5383a8
call fcn.0061c63f
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 8]
jmp 0x79d8d9
Function at 0x79c239
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0
mov esi, esp
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
call fcn.0041c8f0
test al, al
je 0x79c269
mov esi, dword [esi]
push ebx
mov ebx, dword [esi + 0x2c]
sub ebx, 0x4e20
mov dword [esi + 0x2c], ebx
pop ebx
jmp 0x79c23c
add esp, 4
popal
ret

Function at 0x79caa0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push edx
push eax
mov eax, 0x35
call fcn.005af400
mov edi, eax
pop eax
pop edx
pop ecx
cmp edi, 0x10
je fcn.0079caa0
cmp edi, 0x13
je fcn.0079caa0
cmp edi, 0x18
je fcn.0079caa0
cmp edi, 0x2b
je fcn.0079caa0
cmp edi, 0x2d
je fcn.0079caa0
cmp edi, 0x2e
je fcn.0079caa0
cmp edi, 0x2f
je fcn.0079caa0
cmp edi, 0x30
je fcn.0079caa0
pushal
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
push 2
push 0x10
push 0x50
push 0x50
call fcn.0040cb10
mov dword [eax + 0x68], edi
popal
ret
Function at 0x423a30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b1aeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a3f16
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x423ab2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004a1905
mov eax, dword [eax]
push 0x54a238
push eax
call fcn.004900d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a41a1
test bl, bl
je 0x423ab2
push 0x54a238
lea ecx, [esp + 0xc]
call fcn.004a457d
push 0x54ddc8
lea ecx, [esp + 0xc]
call fcn.004a457d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x423aee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a41a1
jmp 0x423bb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x423b72
lea edx, [esp + 0x7c]
push 0x54ddc4
push edx
call fcn.004900d4
add esp, 8
test eax, eax
je 0x423b72
lea eax, [esp + 0x7c]
push 0x54ddc0
push eax
call fcn.004900d4
add esp, 8
test eax, eax
je 0x423b72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x423b02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a41a1
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4243b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x424412
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc