joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525730
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x14
test eax, eax
push ebx
push ebp
push esi
mov esi, ecx
fld dword [esi + 0x2c]
push edi
fadd qword [0x679980]
fstp dword [esp + 0x14]
fld dword [esi + 0x30]
fsub qword [0x679580]
fstp dword [esp + 0x20]
je 0x525767
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x525781
fld dword [esi + 0x2c]
fsub qword [0x679768]
call fcn.006397d0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov eax, dword [esi]
fldz
cmp byte [eax + 0x8c5], 0
jne 0x5257d7
mov ecx, dword [0x6a9f00]
fst dword [esp + 0x10]
fcomp dword [ecx + 0x788]
mov edi, dword [eax + 0x784]
fnstsw ax
test ah, 0x44
jnp 0x5257c1
fld dword [ecx + 0x788]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x14]
add esp, 4
fld dword [esp + 0x10]
push ecx
mov eax, 0x25
fstp dword [esp]
mov ecx, edi
call fcn.00515020
jmp 0x5257d9
fstp st(0)
mov ebx, dword [esi + 0x1c]
mov ebp, dword [esi + 0x20]
mov esi, dword [esi + 4]
lea edi, [esi + 0xc8]
call fcn.0041df60
fld dword [esp + 0x20]
push 9
push ebp
mov esi, eax
call fcn.006397d0
fld dword [esp + 0x1c]
push eax
call fcn.006397d0
push eax
push esi
mov eax, ebx
call fcn.0046c730
fld dword [esp + 0x14]
fisub dword [esp + 0x18]
fsub qword [0x679338]
fstp dword [esp + 0x10]
fild dword [esp + 0x1c]
fsub dword [esp + 0x20]
fstp dword [esp + 0x20]
fld dword [0x67959c]
fcom dword [esp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x525843
fstp dword [esp + 0x10]
jmp 0x525845
fstp st(0)
fld dword [esp + 0x10]
pop edi
fchs
jmp 0x7a2b32

Function at 0x525be0
Capabilities:
Packed with generic packer
Parse credit card information

Disassembly:
mov eax, dword [edi]
sub esp, 8
jmp fcn.007c7045
Function at 0x527750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, eax
cmp byte [edi + 0xba], 0
je 0x527a98
mov eax, dword [edi + 0x68]
cmp eax, 0x64
jne 0x5277d9
mov eax, dword [edi]
mov edi, dword [edi + 0x144]
mov ecx, dword [eax + 0x820]
mov edx, dword [ecx + 8]
and edi, 0xffff
lea esi, [edi + edi*4]
shl esi, 5
add esi, dword [edx]
push 0x14
push esi
call fcn.00473310
fld dword [0x6797f0]
fstp dword [esi + 8]
lea eax, [esi + 0x1c]
fldz
push eax
fstp dword [esi + 4]
lea ecx, [esi + 0x18]
fld dword [0x679378]
push ecx
mov edx, str.anim_shooting
fstp dword [esi + 0x94]
mov eax, esi
mov dword [esi + 0x10], 3
mov dword [esi + 0x5c], 0
call fcn.004731d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
cmp eax, 0x12
je 0x52783d
cmp eax, 0x23
je 0x52783d
cmp eax, 0x33
je 0x52783d
jmp loc.00795f34
jmp fcn.00797879
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x52ad30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push esi
mov esi, eax
mov eax, dword [esi + 0x24]
cmp eax, 0x14
je 0x52ae37
cmp eax, 0x19
je 0x52ae37
cmp dword [esi + 0x28], 0xe
je 0x52ae37
cmp dword [esi + 0x64], 0xa
je 0x52ae37
call fcn.0052aa40
mov eax, dword [esi + 0x24]
jmp loc.0079be47
pop esi
add esp, 8
ret

Function at 0x52ae60
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
jmp fcn.007a9dff

Function at 0x52b340
Capabilities:
Check http status code

Disassembly:
mov eax, dword [edi + 4]
sub esp, 8
add dword [edi + 0x3c], 0xffffffff
mov eax, dword [eax + 0xa0]
push esi
jne 0x52b415
call fcn.005af400
test eax, eax
jne 0x52b415
cmp byte [edi + 0xba], al
je 0x52b415
cmp dword [edi + 0x24], 0x19
je 0x52b415
mov eax, dword [edi + 4]
call fcn.00413a40
test al, al
jne 0x52b415
fldz
mov ecx, dword [edi]
fstp dword [esp + 8]
call fcn.004538c0
test al, al
je 0x52b3bd
fld dword [0x679800]
sub esp, 8
fstp dword [esp + 4]
fld dword [0x67959c]
fstp dword [esp]
call fcn.00511cb0
fstp dword [esp + 0x10]
add esp, 8
cmp dword [edi + 0x24], 0x17
jne 0x52b3d1
mov eax, dword [edi]
mov esi, 0x46
call fcn.00453630
jmp 0x52b403
cmp byte [edi + 0x50], 0
je 0x52b3e1
push ecx
mov ecx, dword [edi]
mov eax, 0xc
jmp 0x52b3f7
mov ecx, dword [edi]
cmp byte [ecx + 0x8be], 0
push ecx
mov eax, 0xd
jne 0x52b3f7
mov eax, 0xb
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.00453650
mov eax, 0x3e8
call fcn.005af400
add eax, 0x1f4
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 0xb4]
test eax, eax
jle 0x52b43e
add eax, 0xffffffff
mov dword [edi + 0xb4], eax
jne 0x52b43e
mov eax, edi
call fcn.00532350
push 0x3a
push 0x6a
push 0x4b
mov eax, edi
call fcn.005321f0
mov eax, dword [edi + 0xac]
test eax, eax
jle 0x52b45a
add eax, 0xffffffff
mov dword [edi + 0xac], eax
jne 0x52b45a
mov esi, edi
call fcn.0052f050
mov eax, dword [edi + 0xb0]
test eax, eax
jle 0x52b476
add eax, 0xffffffff
mov dword [edi + 0xb0], eax
jne 0x52b476
mov eax, edi
call fcn.00532570
cmp dword [edi + 0x28], 0xe
jne 0x52b488
mov esi, edi
call fcn.00528ec0
pop esi
add esp, 8
ret
cmp dword [edi + 0xb4], 0
jg 0x52b4c3
cmp dword [edi + 0xb0], 0
jg 0x52b4c3
mov eax, edi
call fcn.0052b110
mov eax, edi
call fcn.0052ad30
mov eax, edi
call fcn.0052f4c0
push edi
call fcn.0052f870
mov esi, edi
call fcn.0052fa20
mov eax, edi
call fcn.0052b280
cmp dword [edi + 0x24], 0x19
jne 0x52b4d0
mov eax, edi
call fcn.00536080
cmp byte [edi + 0xec], 0
jne 0x52b551
mov eax, dword [edi + 0x28]
cmp eax, 1
je 0x52b551
cmp eax, 2
je 0x52b551
cmp eax, 3
je 0x52b551
cmp dword [edi + 0x6c], 0xfffffffc
je 0x52b551
cmp byte [edi + 0xba], 0
mov eax, dword [edi + 0x24]
sete cl
cmp eax, 0xc
je 0x52b508
cmp eax, 0x16
jne 0x52b514
cmp dword [edi + 0xc8], 0xc8
jl 0x52b518
test cl, cl
je 0x52b551
cmp eax, 0x13
mov esi, 1
jne 0x52b525
lea esi, [eax - 9]
cmp dword [edi + 0xcc], 0x1f4
jl 0x52b536
mov esi, 3
mov eax, 5
call fcn.005af400
test eax, eax
jne 0x52b551
push esi
mov eax, 9
mov esi, edi
call fcn.005317c0
pop esi
add esp, 8
ret
Function at 0x52f870
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x24]
test eax, eax
push esi
push edi
je 0x52f8ba
jmp loc.00797fe2
mov ecx, dword [ebp + 0x28]
cmp ecx, 0x49
je 0x52f9aa
cmp ecx, 0x4a
je 0x52f9aa
cmp eax, 0xe
je 0x52f9aa
cmp eax, 0xb
je 0x52f9aa
mov eax, dword [ebp + 0x64]
cmp eax, 1
je 0x52f9aa
cmp eax, 2
je 0x52f9aa
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 4]
mov edi, dword [ebp + 0xc]
lea eax, [ebx + 0x4b]
mov ecx, esi
mov byte [esp + 0x14], 0
call fcn.0041c4c0
mov ecx, dword [ebp + 0x1c]
mov edx, esi
call fcn.0040ce00
test al, al
je 0x52f93e
lea eax, [ebx + 0x2d]
mov ecx, esi
call fcn.0041c4c0
mov ecx, dword [ebp + 0x1c]
mov edx, esi
call fcn.0040ce00
test al, al
je 0x52f93e
cmp ebx, 0x2a8
mov cl, 1
jl 0x52f942
mov cl, byte [esp + 0x14]
mov al, byte [ebp + 0xbd]
test al, al
jne 0x52f98e
test cl, cl
je 0x52f98a
mov esi, dword [esi + 0x5618]
test esi, esi
push 1
mov eax, ebp
jle 0x52f970
mov dword [ebp + 0xb4], esi
call fcn.00530950
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov dword [ebp + 0x64], 1
jmp loc.0079b679
test al, al
je 0x52f9aa
test cl, cl
jne 0x52f9aa
xor esi, esi
mov eax, ebp
mov dword [ebp + 0x64], 2
call fcn.0052f2e0
push esi
mov eax, ebp
call fcn.0052f6d0
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x52fa60
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [0x6a7aac]
mov eax, dword [eax + 0xd8]
push ebx
push edx
call eax
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, 8
jmp loc.00796614

Function at 0x5312d0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
and esi, 8
push edi
mov dword [esp + 0x10], esi
jne 0x5312f1
mov dword [ebp + 0x54], 0x19
test al, 4
je 0x5312fe
push 0
mov eax, ebp
call fcn.00530950
mov edi, dword [ebp + 0xc8]
mov eax, ebp
mov dword [esp + 0x14], edi
call fcn.0052d710
sub edi, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, ebp
jmp 0x7953b7

Function at 0x534dc0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x60]
cmp eax, 0xdac
push ebx
jge 0x534dcf
xor eax, eax
jmp 0x534e0a
cmp eax, 0x1f40
jge 0x534ddd
mov eax, 2
jmp 0x534e0a
cmp eax, 0x30d4
jge 0x534deb
jmp 0x7a3d38
cmp dword [esi + 0x130], 0
mov eax, 0xc
jne 0x534dfe
mov eax, 0xb
call fcn.005af400
mov eax, dword [eax*4 + 0x69de1c]
mov ecx, dword [esi + 0x130]
push ecx
push eax
mov eax, dword [esi + 4]
xor ebx, ebx
call fcn.0040ddc0
jmp 0x7b6bf1
Function at 0x537f60
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x640888
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [esi + 0x44]
mov ecx, dword [edi + 4]
or edx, eax
mov ebx, eax
mov eax, dword [esi + 0x48]
not eax
and edx, eax
mov dword [edi], edx
mov edx, dword [esi + 0x48]
mov dword [esp + 0x20], ecx
or ecx, dword [esi + 0x44]
not edx
and ecx, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [edi + 4], ecx
mov dword [esp + 0x30], 0
cmp byte [edi + 8], 0
je 0x537fd1
mov eax, dword [edi]
jmp 0x537fd3
mov eax, ecx
test al, 2
je 0x537fe0
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
mov ecx, dword [esi + 0x10]
test ecx, ecx
mov dword [esp + 0x14], ecx
jne 0x538009
mov eax, dword [esp + 0x20]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 8], 0
je 0x538013
mov eax, dword [edi]
jmp 0x538016
mov eax, dword [edi + 4]
test al, 1
je 0x53802e
mov eax, dword [ecx + 0x28]
cmp dword [esi + 0x24], eax
je 0x53802e
mov edx, dword [esi]
mov dword [esi + 0x24], eax
mov eax, dword [edx + 0x58]
mov ecx, esi
call eax
mov ecx, dword [esi + 8]
mov ecx, dword [ecx]
lea eax, [esi + 4]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
lea esp, [esp]
mov eax, dword [esi + 0x1c]
test eax, eax
mov ebx, dword [esi + 8]
lea ecx, [esi + 4]
je 0x538051
cmp eax, ecx
je 0x538056
call fcn.0061c63f
cmp dword [esi + 0x20], ebx
je 0x5380c6
mov byte [esi + 0x18], 0
cmp dword [esi + 0x1c], 0
jne 0x53806a
call fcn.0061c63f
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x20]
cmp eax, dword [edx + 4]
jne 0x53807a
call fcn.0061c63f
mov ecx, dword [esi + 0x20]
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x14]
cmp ecx, dword [edx + 0x94]
jne 0x538090
mov byte [edi + 8], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
push edi
call edx
cmp byte [esi + 0x18], 0
jne 0x538040
cmp dword [esi + 0x1c], 0
jne 0x5380a9
call fcn.0061c63f
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp ecx, dword [eax + 4]
jne 0x5380b9
call fcn.0061c63f
mov edx, dword [esi + 0x20]
mov eax, dword [edx]
mov dword [esi + 0x20], eax
jmp 0x538040
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [esi + 0x18], 1
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
jmp 0x7a8e4e
Function at 0x539390
Capabilities:
Delete file
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ecx
test ebx, ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi + 0x28]
mov dword [edi + 0xf0], eax
jge 0x5393b2
or dword [edi + 0xec], 2
jmp 0x5393c7
cmp ebx, 3
jne 0x5393c0
or dword [edi + 0xec], 4
jmp 0x5393c7
or dword [edi + 0xec], 1
push esi
push ebp
call fcn.005391c0
mov ecx, dword [edi + 0x6c]
test ecx, ecx
je 0x5393ec
mov edx, dword [ecx]
mov eax, dword [edx + 0x110]
push esi
push ebp
call eax
test al, al
jne 0x5393ec
mov ecx, edi
call fcn.005391a0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
mov eax, esi
mov ecx, ebp
mov edx, edi
call fcn.00538730
mov esi, eax
mov eax, dword [edi + 0x8c]
test eax, eax
je 0x53940f
mov esi, eax
test ebx, ebx
jge 0x539426
or dword [edi + 0xe8], 2
jmp 0x7a36cd
cmp ebx, 3
jne 0x53943e
jmp 0x7a8da1
jmp 0x797cfb
Function at 0x7a2a80
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
movzx ecx, byte [esi + 0x19c]
sub ecx, 1
imul ecx, ecx, 5
mov ebx, dword [esi + 0x194]
imul ebx, ecx
cmp ebx, 0
jne 0x7a2ab7
push eax
mov eax, dword [esi + 0x194]
mov ecx, 4
push 0
call fcn.007a0334
mov ebx, eax
pop eax
pushal
push ebx
mov eax, 0x12
call fcn.005317c0
popal
mov dword [esi + 0x194], 0
mov byte [esi + 0x19c], 0
pop ecx
pop ebx
ret

Function at 0x7a60fd
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebx, dword [0x6a9ec0]
mov ebx, dword [ebx + 0x768]
test ebx, ebx
je 0x7a6218
push ebx
lea esi, [ebx + 0xac]
call fcn.0041de80
push eax
mov ebx, dword [esp + 0x38]
push ebx
mov ebx, dword [esp + 0x38]
push ebx
push eax
mov byte [eax + 0x144], 1
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
call fcn.0045db60
pop eax
pop ebx
mov dword [eax + 0x134], 2
push eax
lea esi, [ebx + 0x90]
mov ebx, dword [ebx + 0x557c]
call fcn.0041dda0
push eax
push ebx
push 0
xor ecx, ecx
mov ebx, dword [esp + 0x38]
test ebx, ebx
jne 0x7a6170
mov cl, 1
push ecx
push 0x14
push eax
mov eax, ebx
call fcn.00522580
pop eax
push eax
mov esi, dword [esp + 0x30]
push esi
call fcn.00531880
pop eax
fstp dword [eax + 0x30]
mov ebx, eax
push ebx
push ecx
fld dword [0x679558]
mov edi, ebx
fstp dword [esp]
push 0
push 3
push str.anim_raise
call fcn.00528b00
pop ebx
pop eax
mov byte [ebx + 0xb8], 1
mov ecx, dword [esp + 0x28]
imul ecx, ecx, 0x2710
add ecx, 0x49f9c
mov dword [ebx + 0x20], ecx
mov dword [eax + 0x20], ecx
fild dword [eax + 8]
fstp dword [ebx + 0x2c]
mov ecx, dword [eax + 0x148]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0x1b0], 1
mov dword [eax + 0x134], 2
mov byte [eax + 0x18], 0
push 0
push 0x7a6218
sub esp, 0xc
push ebx
mov bl, byte [esp + 0x14]
push esi
mov esi, eax
cmp byte [esi + 0x143], bl
push edi
je 0x45eafe
mov ecx, dword [esi + 0x24]
jmp 0x45e8c5
popal
ret 0x10

Function at 0x7ad406
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebx, esi
push 0
mov esi, esp
mov edx, dword [0x6a9ec0]
mov edx, dword [edx + 0x768]
call fcn.0041c9b0
test al, al
je 0x7ad477
mov esi, dword [esi]
jmp 0x7b7d17
mov dword [esi + 0x58], 7
mov dword [esi + 0x3c], 0xc1000000
mov byte [esi + 0x74], 0
jmp 0x7ad40b
add esp, 4
popal
ret
mov ecx, dword [ebx + 0x16c]
add ecx, dword [ebx + 0xc]
add ecx, 0x3c
push 0xa0
push ecx
mov ecx, dword [ebx + 0x160]
add ecx, dword [ebx + 8]
add ecx, 0x41
push ecx
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.007b7d4e
test al, al
je 0x7ad40b
jmp 0x7ad463
Function at 0x7b60f5
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x200
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov esi, dword [esp + 0x230]
mov dword [esp + 0x158], esi
mov esi, dword [esp + 0x158]
mov dword [esp + 0x230], esi
mov esi, dword [esp + 0x158]
cmp byte [esi], 0
jne 0x7b6147
mov dword [esp + 0x150], 1
jmp 0x7b6163
cmp byte [esi], 0x40
jne 0x7b6159
mov byte [esi], 0
add dword [esp + 0x158], 1
jmp 0x7b6163
add dword [esp + 0x158], 1
jmp 0x7b612e
push dword [esp + 0x230]
push dword [esp + 0x234]
lea esi, [esp + 0x108]
call fcn.005b0ca0
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [0x820000]
call fcn.00403e20
mov ecx, dword [esp + 0x244]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
lea eax, [0x820000]
push eax
call edx
mov ecx, dword [esp + 0x244]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x224]
mov dword [ecx + 0x40], eax
lea eax, [esp + 0x234]
call fcn.00586cc0
lea eax, [esp + 0x100]
mov edi, dword [esp + 0x154]
mov ecx, dword [esp + 0x248]
imul edi, ecx
add edi, dword [esp + 0x22c]
push edi
push dword [esp + 0x22c]
push eax
mov eax, dword [esp + 0x230]
call fcn.00587120
lea ecx, [esp + 0x100]
call fcn.00404420
add dword [esp + 0x154], 1
cmp dword [esp + 0x150], 1
jne 0x7b6120
add esp, 0x200
popal
ret 0x24

Function at 0x7c2b5b
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x200
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov esi, dword [esp + 0x230]
mov dword [esp + 0x158], esi
mov esi, dword [esp + 0x158]
mov dword [esp + 0x230], esi
mov esi, dword [esp + 0x158]
cmp byte [esi], 0
jne 0x7c2bb4
mov dword [esp + 0x150], 1
jmp 0x7c2bd7
cmp byte [esi], 0xa
jne 0x7c2bcd
mov byte [esi], 0
add dword [esp + 0x158], 1
jmp 0x7c2bd7
add dword [esp + 0x158], 1
jmp 0x7c2b94
push dword [esp + 0x230]
push dword [esp + 0x234]
lea esi, [esp + 0x108]
call fcn.005b0ca0
add esp, 8
mov ecx, dword [esp + 0x230]
mov esi, eax
call fcn.005195d0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [0x700600]
call fcn.00403e20
mov ecx, dword [esp + 0x244]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
lea eax, [0x700600]
push eax
call edx
mov ecx, dword [esp + 0x244]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x224]
mov dword [ecx + 0x40], eax
lea eax, [esp + 0x234]
call fcn.00586cc0
lea eax, [esp + 0x100]
mov edi, dword [esp + 0x154]
mov ecx, dword [esp + 0x248]
imul edi, ecx
add edi, dword [esp + 0x22c]
push edi
push dword [esp + 0x22c]
push eax
mov eax, dword [esp + 0x230]
call fcn.00587120
lea ecx, [esp + 0x100]
call fcn.00404420
add dword [esp + 0x154], 1
cmp dword [esp + 0x150], 1
jne 0x7c2b86
add esp, 0x200
popal
ret 0x24
Function at 0x7c45f4
Capabilities:
Write file on windows

Disassembly:
pushal
push 0
push 0
push 1
push 0
push 3
push 0x40000000
push 0x7f0013
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push 0x7f0013
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x820000], eax
push 0
mov dword [0x821100], 0x23
push 0x821100
push 0x880500
call fcn.007c46c1
push eax
mov eax, dword [esp + 4]
mov dword [0x8804fc], eax
pop eax
add dword [esp], 0x500
push 0x880000
push dword [0x820000]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x820000]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
popal
mov dword [0x800000], 0xa3b1d1d2
mov dword [0x800004], 0xe6b4
mov byte [0x871000], 1
pushal
push 3
push 0x65123c
push 0x651256
push 0x800000
push 0x65123c
push 0x30
push dword [0x6a9ec0]
call fcn.004504b0
mov byte [0x871000], 0
popal
ret

Function at 0x7c645c
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [edx + 0x880058], 2
jne 0x7c64a7
pushal
push 0xc
push 0xe
push 0x91
imul eax, eax, 0x19
add dword [esp], eax
push 0x196
imul ecx, ecx, 0x82
add dword [esp], ecx
mov eax, esi
mov dword [eax + 0x30], 0x40
mov dword [eax + 0x34], 0xb0
mov dword [eax + 0x38], 0x40
mov dword [eax + 0x3c], 0xff
call fcn.00586d50
popal
ret

Function at 0x7c7505
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov eax, 6
call fcn.005af400
test eax, eax
jne 0x7c751d
popal
mov dword [eax + 0x5c], 3
ret
cmp eax, 1
jne 0x7c752e
popal
mov dword [eax + 0x80], 2
ret
cmp eax, 2
jne 0x7c753f
popal
mov dword [eax + 0x80], 5
ret
cmp eax, 3
jne 0x7c7550
popal
mov dword [eax + 0x80], 6
ret
cmp eax, 4
jne 0x7c7561
popal
mov dword [eax + 0x80], 1
ret
popal
ret
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0xe4c380], 1
mov dword [0xe4c384], 1
mov dword [0xe4c388], 1
mov dword [0xe4c374], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401415
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401438
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40145a
cmp eax, 0x20b
je 0x40147f
jmp 0x4014aa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146c
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401497
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, 0
leave
ret

Function at 0x403149
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.msvcrt.dll_fread
cmp ebx, eax
je 0x403180
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
call fcn.00402feb
mov eax, dword [ebp - 0xc]
add esp, 0x24
pop ebx
pop ebp
ret 4

Function at 0x40391f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [ebp - 0x10], ecx
call sub.msvcrt.dll_fwrite
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
call fcn.00402feb
mov eax, dword [ebp - 0xc]
leave
ret 4

Function at 0x403ec4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x10
test edx, edx
je 0x403ede
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fflush
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x40715c
Capabilities:
Write file on windows

Disassembly:
cmp dword [0xe4c0ac], 0
jne 0x407167
jmp fcn.00407118
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
call fcn.004070cd
mov dword [esp + 4], edx
mov ebx, edx
mov dword [esp], eax
call dword [0xe4c0ac]
push edx
push edx
test ebx, ebx
je 0x407196
bt dword [ebx], 0x1e
jb 0x407196
mov dword [esp], ebx
call fcn.00404e04
mov dword [esp], 0xe391e8
call fcn.004250f0
cmp byte [eax], 0
je 0x4071ca
mov byte [eax], 0
mov dword [esp], 0xe39168
call fcn.004250f0
mov ecx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov dword [esp], 0
call fcn.00405477
push eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4089f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
xor ebx, ebx
sub esp, 0x2c
mov dword [esp], 0xe4c090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edx
cmp ebx, esi
jl 0x408a69
mov dword [esp], 1
mov ebx, dword [fcn.0042e42c]
call ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0xe3a4db
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0xe4c090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push eax
jmp 0x408ae2
test ebx, ebx
jns 0x408a7c
dec esi
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00406bbc
jmp 0x408ae2
mov dword [esp], 1
call dword [0xe394f4]
mov dword [esp + 8], 0
mov ecx, eax
lea eax, [edi + ebx*8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004088fa
sub esp, 0xc
mov dword [esp], 0xe391e8
call fcn.004250f0
cmp byte [eax], 0
jne 0x408ae2
lea ecx, [ebp - 0x1c]
mov edx, 1
mov eax, ebx
call fcn.00403ddf
test al, al
je 0x408ada
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00404f18
mov ebx, dword [ebp - 0x1c]
jmp 0x408a15
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret