joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9773
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x515214
call fcn.00484660
sub esp, 0x48
push ebx
push esi
lea ecx, [ebp - 0x54]
call fcn.004840b8
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4d97ec
push 0xc
lea eax, [ebp - 0x18]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push 1
pop esi
push eax
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4d97ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFileFind::Close
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFileFind::CFileFind
xor eax, eax
jmp 0x4d9872
push 1
pop esi
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [ebp - 0x38]
call fcn.004840b8
push ebx
lea ecx, [ebp - 0x38]
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x4d984c
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CFile::CFile
push ebx
push 0x1002
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x4d9836
xor esi, esi
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0048433a
jmp 0x4d9859
lea ecx, [ebp - 0x38]
call sub.MFC42.DLL_CFileFind::Close
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CFileFind::CFileFind
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x4d9882
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x515247
call fcn.00484660
sub esp, 0x10c
and dword [ebp - 0x10], 0
push ebx
push 1
lea eax, [ebp - 0x118]
pop ebx
push dword [ecx + 0x6c]
mov dword [ebp - 4], ebx
push 0x104
push eax
push 0x51a314
push 0x5783a0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_5
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_4
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4e22db
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x5164a8
call fcn.00484660
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x533c2c
mov dword [esi + 0x40], 0x533bf0
mov eax, dword [esi + 0x5c]
and dword [ebp - 4], 0
test eax, eax
je 0x4e2329
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4e231c
push 0
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x5c], 0
mov eax, dword [esi + 0x60]
test eax, eax
je 0x4e233b
push eax
call sub.MFC42.DLL_operatordelete
and dword [esi + 0x60], 0
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.MFC42.DLL_CWnd::CWnd
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4e2468
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x60], 0
je 0x4e2496
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x4e24b5
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
jg 0x4e249a
xor eax, eax
jmp 0x4e24b2
push 0xffffffffffffffff
push eax
mov dword [esi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x5c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
pop eax
pop esi
leave
ret
Function at 0x4e5bdd
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x516d10
call fcn.00484660
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_AfxGetAppModuleState
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x14]
push ecx
mov eax, dword [eax + 0xd4]
push eax
call dword [sym.imp.BasicCtrlDll.dll_void___cdecl_GetCurrentSysTempData_struct_IQQCore___struct_IQQData___]
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
je 0x4e5cda
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_5
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push 0x534034
push dword [ebp - 0x14]
call dword [sym.imp.BasicCtrlDll.dll_long_int___cdecl_GetQQDataBuf_struct_IQQData___char_const___class_CString__]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.BasicCtrlDll.dll_void___cdecl_Encode16_class_CString__]
add esp, 0x10
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_5
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0049f939
push eax
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push str.from:_d_clientUin:_ld_clientKey:_s
push eax
call sub.MFC42.DLL_CString::Format
lea eax, [ebp + 8]
push eax
call dword [sym.imp.BasicCtrlDll.dll_class_CString___cdecl_GetExeFolder_void_]
add esp, 0x18
push str.QQClubClient.exe
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
call sub.MFC42.DLL_operator_3
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
push 1
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str.open
push dword [eax + 0x20]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
pop ebx
je 0x4e5cec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4e724f
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 1
pop edi
xor esi, esi
mov dword [ebp - 0xc], ecx
push 0xfffffffffffffff5
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [ebp - 0x28]
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4e7351
or dword [ebp - 0x18], 0xffffffff
push 2
push esi
lea eax, [ebp - 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
push dword [ebp - 8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
mov ecx, dword [ebp - 0xc]
push edi
test eax, eax
lea eax, [ebp - 8]
push edi
push eax
jne 0x4e72d8
call fcn.004e77fa
mov ecx, dword [ebp - 0xc]
push edi
lea eax, [ebp - 4]
push edi
push eax
jmp 0x4e734c
call fcn.004e77fa
lea eax, [ebp - 0x28]
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
push 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4e7351
or dword [ebp - 0x1c], 0xffffffff
push 2
push 0
lea eax, [ebp - 0x1c]
push 0
push eax
call esi
push eax
push dword [ebp - 0x10]
call esi
push eax
call ebx
test eax, eax
push edi
push edi
jne 0x4e7355
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.004e77fa
push edi
lea eax, [ebp - 4]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
push edi
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
push edi
lea eax, [ebp - 0x10]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
xor eax, eax
jmp 0x4e73c1
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004e77fa
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.004e73c6
test eax, eax
jne 0x4e737a
xor ebx, ebx
jmp 0x4e738b
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004e7459
mov ebx, eax
push edi
lea eax, [ebp - 0x18]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
push edi
lea eax, [ebp - 4]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
push edi
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
mov ecx, esi
call fcn.004e77fa
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e73c6
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax], 0xffffffff
je 0x4e7450
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], 0xffffffff
je 0x4e7450
xor esi, esi
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0x18
or word [ebp - 0x28], 0x101
mov dword [ebp - 0x54], edi
mov eax, dword [eax]
mov word [ebp - 0x24], si
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push str.ipconfig__all
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
je 0x4e7450
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
jmp 0x4e7452
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4e85b4
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 1
pop edi
xor esi, esi
mov dword [ebp - 0xc], ecx
push 0xfffffffffffffff5
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [ebp - 0x28]
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4e86b6
or dword [ebp - 0x18], 0xffffffff
push 2
push esi
lea eax, [ebp - 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
push dword [ebp - 8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
mov ecx, dword [ebp - 0xc]
push edi
test eax, eax
lea eax, [ebp - 8]
push edi
push eax
jne 0x4e863d
call fcn.004e888b
mov ecx, dword [ebp - 0xc]
push edi
lea eax, [ebp - 4]
push edi
push eax
jmp 0x4e86b1
call fcn.004e888b
lea eax, [ebp - 0x28]
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
push 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4e86b6
or dword [ebp - 0x1c], 0xffffffff
push 2
push 0
lea eax, [ebp - 0x1c]
push 0
push eax
call esi
push eax
push dword [ebp - 0x10]
call esi
push eax
call ebx
test eax, eax
push edi
push edi
jne 0x4e86ba
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.004e888b
push edi
lea eax, [ebp - 4]
push edi
push eax
mov ecx, esi
call fcn.004e888b
push edi
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
call fcn.004e888b
push edi
lea eax, [ebp - 0x10]
push edi
push eax
mov ecx, esi
call fcn.004e888b
xor eax, eax
jmp 0x4e8726
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004e888b
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.004e872b
test eax, eax
jne 0x4e86df
xor ebx, ebx
jmp 0x4e86f0
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004e87be
mov ebx, eax
push edi
lea eax, [ebp - 0x18]
push edi
push eax
mov ecx, esi
call fcn.004e888b
push edi
lea eax, [ebp - 4]
push edi
push eax
mov ecx, esi
call fcn.004e888b
push edi
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
call fcn.004e888b
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
mov ecx, esi
call fcn.004e888b
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e872b
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax], 0xffffffff
je 0x4e87b5
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], 0xffffffff
je 0x4e87b5
xor esi, esi
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0x18
or word [ebp - 0x28], 0x101
mov dword [ebp - 0x54], edi
mov eax, dword [eax]
mov word [ebp - 0x24], si
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push str.ipconfig__all
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
je 0x4e87b5
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
jmp 0x4e87b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4f5438
Capabilities:
Terminate process

Disassembly:
push edi
call fcn.004f5432
mov edi, eax
cmp dword [edi + 0x22c], 0
je 0x4f5455
mov eax, dword [esp + 8]
mov dword [edi + 0x230], eax
pop edi
ret
push ebx
push ebp
push esi
push str._nMIRACL_error_from_routine
call fcn.004f5617
pop ecx
mov eax, dword [edi + 0x20]
mov ebp, 0x579fe0
cmp eax, 0x18
jge 0x4f547d
mov eax, dword [edi + eax*4 + 0x24]
push dword [eax*4 + 0x5794cc]
jmp 0x4f547e
push ebp
call fcn.004f5617
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
pop ecx
add eax, 0x20
push eax
push 0xa
call ebx
mov esi, dword [edi + 0x20]
pop ecx
dec esi
pop ecx
js 0x4f54dc
lea edi, [edi + esi*4 + 0x24]
push str.______________called_from
call fcn.004f5617
cmp esi, 0x18
pop ecx
jge 0x4f54be
mov eax, dword [edi]
push dword [eax*4 + 0x5794cc]
jmp 0x4f54bf
push ebp
call fcn.004f5617
mov eax, dword [sym.imp.MSVCRT.dll__iob]
pop ecx
add eax, 0x20
push eax
push 0xa
call ebx
dec esi
pop ecx
sub edi, 4
pop ecx
test esi, esi
jge 0x4f54a3
mov eax, dword [esp + 0x14]
pop esi
dec eax
pop ebp
cmp eax, 0x17
pop ebx
ja case.default.0x4f54ed
jmp dword [eax*4 + 0x4f55b7]
push str.Number_base_too_big_for_representation_n
jmp 0x4f55a9
push str.Division_by_zero_attempted_n
jmp 0x4f55a9
push str.Overflow___Number_too_big_n
jmp 0x4f55a9
push str.Internal_result_is_negative_n
jmp 0x4f55a9
push str.Input_format_error_n
jmp 0x4f55a9
push str.Illegal_number_base_n
jmp 0x4f55a9
push str.Illegal_parameter_usage_n
jmp 0x4f55a9
push str.Out_of_space_n
jmp 0x4f55a9
push str.Even_root_of_a_negative_number_n
jmp 0x4f55a9
push str.Raising_integer_to_negative_power_n
jmp 0x4f55a9
push str.Attempt_to_take_illegal_root_n
jmp 0x4f55a9
push str.Integer_operation_attempted_on_Flash_number_n
jmp 0x4f55a9
push str.Flash_overflow_n
jmp 0x4f55a9
push str.Numbers_too_big_n
jmp 0x4f55a9
push str.Log_of_a_non_positive_number_n
jmp 0x4f55a9
push str.Flash_to_double_conversation_failure_n
jmp 0x4f55a9
push str.I_O_buffer_overflow_n
jmp 0x4f55a9
push str.MIRACL_not_initialised___no_call_to_mirsys___n
jmp 0x4f55a9
push str.Illegal_modulus__n
jmp 0x4f55a9
push str.No_modulus_defined_n
jmp 0x4f55a9
push str.Exponent_too_big_n
jmp 0x4f55a9
push str.Number_Base_must_be_power_of_2_n
jmp 0x4f55a9
push str.Specified_double_length_type_isnt_double_length_n
jmp 0x4f55a9
push str.Specified_basis_is_NOT_irreducible_n
call fcn.004f5617
pop ecx
push 0
call dword [sym.imp.MSVCRT.dll_exit]
hlt

Function at 0x4f571f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop esi
call fcn.004f5432
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
and dword [ecx + 0x134], 0
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
cmp dword [ebp + 8], 0x206
lea eax, [ecx + edx*4 + 0x9c]
mov eax, esi
mov esi, edi
mov edi, eax
jl 0x4f574d
mov esi, 0x3e8
call fcn.004f569d
dec esi
jne 0x4f577e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100059ba
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
and dword [eax], eax
shl dword [ebx], 0xf3
sbb eax, ebx
and ecx, dword [ebx]
and ah, al
and edx, dword [ebx]
and al, 0xf2
mov cs, word [ebx]
sbb eax, 0x9ab6d5f0
insd dword es:[edi], dx
test al, 0x96
invalid
stc
adc edx, 3
jmp 0x100059df
sub dword [edx], 0x986d1396
jmp 0x1000582c
stc
adc esi, 7
jmp 0x10005aa9
jne 0x10005849
jae 0x100058a1
fiadd word [ebx + 0x68]
test eax, 0x9e3ff548
cmp eax, 0xf5f56dc
cmp dword [esi], 0
add byte [eax], al
invalid
pop ecx
pop ebx
pop edx
pop edi
pop esi
pop eax
jmp 0x10005b49
call 0x10005b74
jmp 0x10005943
push dword [esi + 4]
pop eax
jmp 0x10005849
call 0x1000586f
invalid
push eax
stc
push esi
push edi
push edx
push ebx
push ecx
jb 0x100059a1
mov dh, 0x20
xchg dword [esi + 0x69], ebx
xor dword [eax + ebx - 0x7e70854d], 0xffffffc6
cwde
jne 0x10005a2c
call dword [edx]
rcr dword [0xf7356950], 1
dec eax
clc
jae 0x100058c8
invalid
dec ecx
stosb byte es:[edi], al
cdq
dec eax
mov dl, 0x44
xchg esp, eax
inc eax
push ebp
stc
salc
xchg ebp, eax
inc ecx
mov dl, 0x73
mov al, byte [0x41a5a3be]
jns 0x100059d5
adc dword [eax], ebx
loop 0x10005a12
dec ebx
clc
rol dword [ebx + 0xff8003e], cl
sub esp, 0xfffffffe
invalid
add al, 0x8c
pop eax
clc
jl 0x10005a8c
jo 0x10005a98
je 0x10005a45
je 0x100059e5
in al, 0x3d
inc esi
pop ecx
dec eax
imul dword [ecx - 0x54007d39]
lodsd eax, dword [esi]
inc esi
mov al, dl
jg 0x100059ff
cmp dword [edx], ebx
test al, dl
and ch, byte cs:[esi - 0x13a3693f]
sbb byte [edi], 0x81
mov byte [edx - 2], 0xff
invalid
mov ebx, 0xdaffffff
movsd dword es:[edi], dword [esi]
out 0xbf, eax
and dword [edi - 0xf2a73d], esp
movsd dword es:[edi], dword [esi]
xor dword [esi + 0x4b], eax
and bl, al
xor ah, byte [0x229068f8]
cld
lodsd eax, dword [esi]
or al, 0xf
push esp
mov byte [eax], dl
jp 0x10005a4e
invalid
cmpsd dword [esi], dword es:[edi]
ret
xchg ebp, eax
fidiv word [ebp + 0x10]
or al, 0xdc
xchg esi, eax
lcall 0x8a40, 0xe9422ee5
sub esi, dword [ebp + 3]
dec eax
jne 0x10005b1b
jmp 0x10005ac4
jmp 0x10005a48
jmp 0x10005ab8
dec dword [edi]
stc
jmp 0x10005a7a
and dword [edi + 0x320a0194], esp
jp 0x10005ae7
invalid
push esi
pop ebx
jb 0x1000596e
xor eax, dword [edi + 7]
je 0x10005ae4
mov al, 0xd7
sbb al, 0x13
or dword [edx], eax
aaa
sub eax, esi
cli
add esi, esi
sub ebx, ecx
out 0x83, al
adc ah, byte [eax - 0x76e7050e]
cli
sbb byte [ecx + 0x7bd88389], cl
pop eax
arpl word [ebp - 0x29fc7467], cx
mov dword [ebx + 0x63587bd8], eax
lea ebx, [ecx - 0x1629fc75]
lcall 0xe2b0, 0x7afffffe
mov cl, 0x40
mov byte [edx + ecx], al
cmp al, 0xc5
cli
pop ebp
fst qword [ecx + edi + 0x21]
push eax
std
jae 0x10005b16
add edx, esi
jmp 0x10005991
add al, 0xc5
mov cl, 0xd6
pop edi
retf
push ebp
arpl word [edx + 0x168bef5c], di
mov edx, dword [esi]
jmp 0x10005af0
jmp 0x10002ef7
Function at 0x410e10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.fHUBmpzJ
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x410e32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410e28
mov eax, 1
add ebx, ebx
jne 0x410e4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410e40
jne 0x410e5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410e40
xor ecx, ecx
sub eax, 3
jb 0x410e70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410ee2
mov ebp, eax
add ebx, ebx
jne 0x410e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410e88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x410eac
inc ecx
add ebx, ebx
jne 0x410e98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x410e8d
jne 0x410ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410e8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x410ecc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x410ebd
jmp 0x410e2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x410ecc
add edi, ecx
jmp 0x410e2e
pop esi
mov edi, esi
mov ecx, 0x1fd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x410eea
cmp byte [edi], 1
jne 0x410eea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x410eef
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x410f5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x100b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410f1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10110]
or eax, eax
je 0x410f58
mov dword [ebx], eax
add ebx, 4
jmp 0x410f39
call dword [esi + 0x1010c]
mov ebp, dword [esi + 0x10114]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410f92
sub esp, 0xffffff80
jmp 0x405884