joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e920
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x4e9bb4]
xor eax, esp
mov dword [esp + 0x400], eax
lea eax, [esp + 0x40c]
push eax
push 0
push dword [esp + 0x410]
lea eax, [esp + 0xc]
push 0x400
push eax
call fcn.0042e8e0
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004955a0
add esp, 0x404
ret
Function at 0x432610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x43263b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x43265d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x43265f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x4326e3
jg 0x432674
test esi, esi
je 0x4326e3
test ecx, ecx
jl 0x4326bd
jg 0x43267e
test eax, eax
je 0x4326bd
cmp edi, ecx
jg 0x432692
jl 0x432688
cmp esi, eax
jae 0x432692
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00498370
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4326c0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4326e3
jg 0x4326ca
test esi, esi
je 0x4326e3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4326e3
push eax
push esi
push 1
push edx
call fcn.004a427a
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x43272b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x43274d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x43274f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4327ee
jg 0x43276c
test esi, esi
je 0x4327ee
test ecx, ecx
jl 0x4327b9
jg 0x432776
test eax, eax
je 0x4327b9
cmp ebx, ecx
jg 0x43278a
jl 0x432780
cmp esi, eax
jae 0x43278a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00498370
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4327c0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4327ee
jg 0x4327ca
test esi, esi
je 0x4327ee
cmp dword [edi + 0x4c], 0
je 0x4327ee
mov ecx, edi
call fcn.00433690
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004a4854
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432bf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x4e9bb4]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x432c20
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004955a0
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x432c5d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x432c5d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004955a0
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x432d3b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x432c85
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x432cb9
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004a3bd2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004955a0
add esp, 0x30
ret 4
mov al, bl
mov byte [esp + 0xf], al
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x432d52
lea ecx, [esp + 0xf]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ecx
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.004a3bd2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004955a0
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x432d29
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a427a
add esp, 0x10
cmp edi, eax
jne 0x432d3b
lea eax, [esp + 0xf]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
jne 0x432c47
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004955a0
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x432d3b
cmp eax, 1
jle 0x432d0a
cmp eax, 3
jne 0x432d3b
mov al, byte [esp + 0xf]
jmp 0x432cdd
Function at 0x4336c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e9bb4]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x43375e
cmp byte [esi + 0x3d], 0
je 0x43375e
push 0xffffffffffffffff
call fcn.00432bf0
cmp eax, 0xffffffff
je 0x433714
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x433771
lea edi, [esp + 0xc]
xor eax, eax
mov dword [esp + 8], edi
sub eax, 0
je 0x433727
sub eax, 1
je 0x43372b
sub eax, 2
je 0x43375e
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004955a0
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
lea eax, [esp + 0xc]
sub edi, eax
je 0x433746
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a427a
add esp, 0x10
cmp edi, eax
jne 0x433714
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004955a0
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.004955a0
add esp, 0x28
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [esp + 8]
jmp 0x433705
Function at 0x4347e0
Capabilities:
Get mac address on windows
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba708
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4e9bb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push 0x100
mov ecx, eax
call fcn.004349e0
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x10]
push eax
push 0
mov dword [ebp - 0x10], 0
call esi
push dword [ebp - 0x10]
call fcn.004957ef
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
call esi
mov esi, ebx
test ebx, ebx
je 0x4348c5
cmp dword [esi + 0x1a0], 6
jne 0x4348bf
cmp dword [esi + 0x190], 6
jne 0x4348bf
movzx eax, byte [esi + 0x199]
mov ecx, dword [ebp - 0x24]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
mov eax, dword [ebp - 0x20]
push str._02X__02X__02X__02X__02X__02X
sub eax, ecx
push eax
push ecx
call fcn.0042e9c0
add esp, 0x24
mov esi, dword [esi]
test esi, esi
jne 0x434866
mov edi, dword [ebp - 0x24]
or ebx, 0xffffffff
mov ecx, edi
xor edx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4348d2
sub ecx, esi
je 0x43490d
nop dword [eax]
movzx ecx, byte [edi + edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
mov eax, edi
xor ebx, dword [ecx*4 + 0x4d0c60]
inc edx
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434900
sub eax, esi
cmp edx, eax
jb 0x4348e0
push dword [ebp - 0x14]
call fcn.004957ac
mov ecx, dword [ebp - 0x24]
add esp, 4
test ecx, ecx
je 0x434948
mov edx, dword [ebp - 0x1c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x43493e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43495c
push edx
push ecx
call fcn.004957e1
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a37c0
int3
Function at 0x438590
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
xor edx, edx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
setne dl
mov edi, ecx
xor eax, eax
lea edx, [edx*2 - 1]
add edx, dword [0x500260]
mov dword [0x500260], edx
sete al
test esi, esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 0x2a38c], eax
je 0x4386be
cmp edx, 1
jne 0x4386be
cmp dword [edi + 0x2a390], 0
je 0x4386be
cmp dword [0x500290], 0
jne 0x438625
lea eax, [esp + 8]
mov dword [0x500290], edx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x5002a0], edx
test edx, edx
je 0x43867a
mov ecx, dword [esp + 8]
mov dword [0x500268], ecx
mov ecx, dword [esp + 0xc]
mov dword [0x50026c], ecx
jmp 0x43862b
mov edx, dword [0x5002a0]
test edx, edx
je 0x43867a
mov ecx, dword [0x500280]
mov eax, ecx
mov esi, dword [0x500284]
or eax, esi
jne 0x43865a
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [0x5002a0]
mov dword [0x500284], esi
mov dword [0x50029c], esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x500280], ecx
mov dword [0x500298], ecx
jmp 0x4386c4
movsd xmm0, qword [0x5002a8]
ucomisd xmm0, qword [0x4ded50]
lahf
test ah, 0x44
jp 0x4386b4
call esi
mov edx, dword [0x5002a0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df1b0]
mulsd xmm0, qword [0x4dee28]
movsd qword [0x5002a8], xmm0
jmp 0x4386c4
mov edx, dword [0x5002a0]
cmp dword [0x500260], 0
jne 0x4387b8
cmp dword [edi + 0x2a390], 0
je 0x4387b8
cmp dword [0x500290], 0
jne 0x43871a
lea eax, [esp + 8]
mov dword [0x500290], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x5002a0], edx
test edx, edx
je 0x43876c
mov eax, dword [esp + 8]
mov dword [0x500268], eax
mov eax, dword [esp + 0xc]
mov dword [0x50026c], eax
test edx, edx
je 0x43876c
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 8]
xorps xmm0, xmm0
mov edx, dword [esp + 0xc]
mov ecx, esi
sub ecx, dword [0x500280]
mov eax, edx
mov dword [0x500298], esi
sbb eax, dword [0x500284]
add dword [0x500278], ecx
movlpd qword [0x500280], xmm0
adc dword [0x50027c], eax
mov dword [0x50029c], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call esi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x4df1b0]
mulsd xmm1, qword [0x4dee28]
movaps xmm0, xmm1
movsd qword [0x500270], xmm1
subsd xmm0, qword [0x5002a8]
addsd xmm0, qword [0x500288]
movsd qword [0x500288], xmm0
xorps xmm0, xmm0
movsd qword [0x5002a8], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46b670
Capabilities:
Read file on windows

Disassembly:
cmp dword [0x4fec98], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x46b6aa
push 0x4d0c24
push 0x4d0c28
call fcn.004a38dc
mov edi, eax
add esp, 8
test edi, edi
je 0x46b6aa
push str.GroundObjectTiles::Generate
push edi
call fcn.00430d20
push edi
call fcn.004a39b0
add esp, 0xc
call fcn.004a561a
push 0x1c0000
mov dword [esi + 0x108], 0x100
mov dword [esi + 0x10c], 0x100
call fcn.004957ef
mov ecx, dword [esi + 0x10c]
add esp, 4
xor ebx, ebx
mov dword [esi + 0x120], eax
test ecx, ecx
jle 0x46b7b5
mov eax, dword [esi + 0x108]
xor edx, edx
test eax, eax
jle 0x46b7a4
nop word [eax + eax]
xor edi, edi
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 1], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 2], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 3], 0
add edi, 4
cmp edi, 0x1c
jl 0x46b702
mov eax, dword [esi + 0x108]
inc edx
cmp edx, eax
jl 0x46b700
mov ecx, dword [esi + 0x10c]
inc ebx
cmp ebx, ecx
jl 0x46b6e6
jmp 0x46b7bb
mov eax, dword [esi + 0x108]
imul eax, ecx
push eax
call fcn.004957ef
mov dword [esi + 0x194], eax
add esp, 4
mov eax, dword [esi + 0x110]
test eax, eax
jne 0x46b7e3
push 0x4d5b5c
push str.dat_roads_256.raw
jmp 0x46b7f2
cmp eax, 1
jne 0x46b81e
push 0x4d5b74
push str.dat_roads2_256.raw
call fcn.004a38dc
mov ecx, dword [esi + 0x108]
mov edi, eax
imul ecx, dword [esi + 0x10c]
push edi
push ecx
push 1
push dword [esi + 0x194]
call fcn.004a4854
push edi
call fcn.004a39b0
add esp, 0x1c
cmp dword [0x4fec98], 0
je 0x46b853
push 0x4d0c24
push 0x4d0c28
call fcn.004a38dc
mov esi, eax
add esp, 8
test esi, esi
je 0x46b853
push 0x4d5b9c
push esi
call fcn.00430d20
push esi
call fcn.004a39b0
add esp, 0xc
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x47eec0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x4ffbb0]
push edi
call fcn.00443ba0
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp edi, 0xc8
mov byte [esp + 0x1c], 0x13
setne bl
lea ebx, [ebx*2 + 1]
cmp edi, 0xc9
jne 0x47eefe
mov ebx, 2
jmp 0x47ef0c
cmp edi, 0xcb
mov eax, 4
cmove ebx, eax
mov ecx, dword [esi + 0x2b8]
push 0x19
add ecx, 0x140
call fcn.00434d00
test eax, eax
jne 0x47eff0
cmp edi, 0xc8
jne 0x47ef80
mov ecx, dword [esi + 0x2c0]
push 0x87
add ecx, 0x140
call fcn.00434d00
test eax, eax
jne 0x47ef80
mov ecx, dword [0x4fecb8]
lea edx, [esp + 0x14]
push 0
push 0
push edx
mov eax, dword [ecx]
push 5
mov byte [esp + 0x24], 0x40
call dword [eax + 4]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ebp, dword [esi + 0x2b8]
mov ecx, dword [esi + 0x2c0]
mov dword [esp + 0x2c], ecx
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
cmp eax, method.UIRectArtTextButton.virtual_20
jne 0x47f135
cmp dword [ebp + 0x14c], 0
je 0x47efbc
mov eax, dword [ebp + 0x144]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0
sete al
jmp 0x47efbe
mov al, 1
mov byte [ecx + 0x139], al
push ecx
lea ecx, [ebp + 0x140]
call fcn.00434c40
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x13c], ebp
mov ecx, dword [esi + 0x2b8]
jmp 0x47f08e
mov ecx, dword [esi + 0x2b8]
jmp 0x47f08e
mov ecx, dword [esi + 0x2c0]
add ecx, 0x140
cmp edi, dword [esi + 0x23bc]
je 0x47f0c7
push 0x87
call fcn.00434d00
cmp edi, 0xc8
je 0x47f073
test eax, eax
je 0x47f093
mov ecx, dword [esi + 0x2b8]
push 0x86
add ecx, 0x140
call fcn.00434d00
test eax, eax
je 0x47f05a
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.00434d50
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
add ecx, 0x140
call fcn.00434d50
jmp 0x47f088
test eax, eax
jne 0x47f093
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [0x4fecb8]
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0x23a4]
push 0
push 0
mov byte [esp + 0x29], bl
mov dword [esp + 0x25], eax
mov eax, dword [ecx]
push edx
push 0xa
call dword [eax + 4]
mov dword [esi + 0x23bc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push dword [esi + 0x2fc]
call fcn.00434d50
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c0]
add ecx, 0x140
call fcn.00434d50
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.00434d50
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
pop edi
mov dword [esi + 0x23bc], 0
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push ecx
mov ecx, ebp
call eax
jmp 0x47efe5
Function at 0x4acfc3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ace42

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x473ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x473f11
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00473c23
loopne 0x473f44
pop esi
pop edx
lea eax, [ebp - 0x40]
push eax
call fcn.00473c33
push eax
push esi
push dword [ebp + 8]
call fcn.00473be8
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00473c23
adc esp, dword [ecx]
sal ecx, 1
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00473c33
push eax
push esi
push dword [ebp + 8]

Function at 0x473fd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00473be8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35

Function at 0x474026
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5a], 0x41
call fcn.00473c33
push eax
push esi
push dword [ebp + 8]
call fcn.00473be8
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
aam 0x88
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00473c33
push eax
push esi
push dword [ebp + 8]
call fcn.00473be8
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00473c23
jno 0x474041
imul cx, word [eax - 0x8363], 0x88ff
popfd
jge 0x4740ae
invalid
invalid