joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57a89b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5aef9f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005aec50

Function at 0x5aefaa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005aedda

Function at 0x5b8d3e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b8891

Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, ecx
push ebp
push edi
push esi
push eax
call fcn.004015ec
pop edi
lea eax, [edi - 0x160]
push 0
push 0
xchg dword [eax + 0x6afffffe], esp
add byte [edx], ch
push eax
call sub.KERNEL32.dll_LoadLibraryExA
test eax, eax
jne 0x40100d
call sub.KERNEL32.dll_GetCommandLineA
pop ebp
ret 8

Function at 0x401050
Capabilities:
Get common file path

Disassembly:
push edi
sub esp, 0x7c
push esp
pop edi
push 0x100
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0
push edi
add edi, eax
mov eax, 0x69636d5c
stosd dword es:[edi], eax
mov eax, 0x65766177
stosd dword es:[edi], eax
mov eax, 0x6c6c642e
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
call sub.KERNEL32.dll_GetCompressedFileSizeA
add esp, 0x7c
pop edi
cmp eax, 2
jg 0x40108a
int3
pushal
jmp 0x401274
mov ecx, ecx
push ebp
mov ebp, esp
mov edi, 0x403160
push edi
push ecx
push ebx
call fcn.004011ec
pop edi
push 0
call sub.KERNEL32.dll_FlushFileBuffers
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push edx
mov ebx, dword [edi + 0x90]
call ebx
pop ebp
ret
Function at 0x40e142
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0041a660
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40e35d
push esi
call fcn.0041a323
pop ecx
cmp eax, 0x7f6
jae 0x40e35d
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0041a390
movzx ecx, word [esi]
add esp, 0xc
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0x1c0
cmp cx, 0x22
jne 0x40e19d
lea eax, [esi + 2]
mov dword [ebp - 0x38], eax
jmp 0x40e1a0
mov dword [ebp - 0x38], esi
xor eax, eax
cmp cx, bx
je 0x40e1f6
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40e1c8
jmp 0x40e1b8
cmp word [esi + eax*2], 0x22
je 0x40e1c1
inc eax
cmp word [esi + eax*2], bx
jne 0x40e1b1
jmp 0x40e1c8
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40e1e2
cmp word [esi + eax*2 + 2], 0x2f
je 0x40e1e2
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40e1a9
jmp 0x40e1f6
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40e1f0
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x40e202
cmp word [eax], bx
jne 0x40e217
cmp byte [ebp + 0xc], bl
jne 0x40e217
cmp word [0x44187a], bx
je 0x40e217
mov dword [ebp - 0x34], 0x44187a
push dword [ebp - 0x38]
mov dword [ebp - 0x2c], 1
call fcn.0040a267
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40e243
push str..inf
push eax
call fcn.004119d2
test eax, eax
jne 0x40e243
mov dword [ebp - 0x3c], str.Install
push dword [ebp - 0x38]
call fcn.00408ffc
test al, al
je 0x40e26c
push 0x800
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x38]
call fcn.0040a739
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e35c
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
mov edi, 0x3e8
cmp byte [0x440870], bl
jne 0x40e2a1
cmp byte [ebp + 0xc], bl
jne 0x40e2a1
cmp byte [0x44085d], bl
je 0x40e2fe
cmp dword [ebp + 8], ebx
je 0x40e2bd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e2bd
push ebx
push dword [ebp + 8]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
call fcn.0040d534
cmp byte [0x44085d], bl
je 0x40e2fe
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e2fe
mov eax, dword [ebp - 0xc]
add eax, edi
cmp eax, dword [0x440860]
jbe 0x40e2fe
mov dword [0x440860], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40e31d
push 0x42a8ec
push dword [ebp - 8]
call fcn.004119d2
test eax, eax
je 0x40e34b
cmp byte [0x440870], bl
je 0x40e336
cmp byte [ebp + 0xc], bl
jne 0x40e336
mov dword [0x440864], 0x1b58
jmp 0x40e34b
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, edi
mov dword [0x440864], eax
cmp byte [ebp - 1], bl
je 0x40e35c
cmp byte [ebp + 0xc], bl
je 0x40e35c
push 1
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x61cc1820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov dword [esp], 0x61ccb060
call sym.libintl_8.dll_libintl_recursive_lock_lock
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x61cc1c6a
mov dword [eax + 4], 0xffffffff
mov dword [eax + 8], 0
mov eax, dword [eax]
test eax, eax
je 0x61cc1c60
mov dword [esp], eax
mov edx, 0x8000
mov dword [esp + 4], edx
call sym._open
cmp eax, 0xffffffff
mov edi, eax
je 0x61cc1c60
mov dword [esp], edi
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
call sym._fstat
test eax, eax
jne 0x61cc1c44
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x2f
mov dword [ebp - 0x58], ecx
jbe 0x61cc1c44
mov dword [esp], ecx
call sym._malloc
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x61cc1c44
mov ebx, dword [ebp - 0x58]
mov esi, eax
nop
lea esi, [esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._read
test eax, eax
jle 0x61cc1c33
add esi, eax
sub ebx, eax
test ebx, ebx
jne 0x61cc18c0
mov dword [esp], edi
call sym._close
mov ebx, dword [ebp - 0x5c]
mov eax, dword [ebx]
cmp eax, 0x950412de
setne dl
cmp eax, 0xde120495
setne al
movzx eax, al
test edx, eax
jne 0x61cc26c5
mov dword [esp], 0x8c
call sym._malloc
test eax, eax
mov edi, eax
je 0x61cc1c60
mov dword [edi + 4], 0
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x58]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [edi + 8], edx
mov dword [edi + 0x10], 0
cmp dword [eax], 0x950412de
mov dword [edi], eax
setne al
movzx eax, al
mov dword [ebp - 0x60], eax
test eax, eax
mov dword [edi + 0xc], eax
jne 0x61cc1c7e
mov ebx, dword [ebp - 0x5c]
mov esi, dword [ebx + 4]
mov eax, esi
sar eax, 0x10
cmp eax, 1
ja 0x61cc1d38
push es
cmp ax, bx
jbe 0x61cc1c54
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x61cc1c4e
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x61cc1c3f
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
stosd dword es:[edi], eax
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
inc ebp
scasb al, byte es:[edi]
rol esi, cl
inc ebp
scasd eax, dword es:[edi]
hlt
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.61cc19fa
invalid
add eax, 0x8d95cf11
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
invalid
Function at 0x61cc6d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
sub esp, 0x10
mov ebx, eax
mov eax, dword [eax + 4]
dec eax
test eax, eax
mov dword [ebx + 4], eax
js 0x61cc6e34
mov eax, dword [ebx]
mov byte [eax], 0x22
inc dword [ebx]
movzx ecx, byte [esi]
test cl, cl
je 0x61cc6d9c
lea esi, [esi]
cmp cl, 0xa
je 0x61cc6dc0
cmp cl, 0x22
sete al
cmp cl, 0x5c
sete dl
or eax, edx
test al, 1
je 0x61cc6d80
mov eax, dword [ebx + 4]
dec eax
test eax, eax
mov dword [ebx + 4], eax
js 0x61cc6e1f
mov eax, dword [ebx]
mov byte [eax], 0x5c
inc dword [ebx]
movzx ecx, byte [esi]
mov eax, dword [ebx + 4]
movsx edx, cl
dec eax
mov dword [ebx + 4], eax
test eax, eax
js 0x61cc6e0d
mov eax, dword [ebx]
inc esi
mov byte [eax], dl
inc dword [ebx]
movzx ecx, byte [esi]
test cl, cl
jne 0x61cc6d50
mov eax, dword [ebx + 4]
dec eax
test eax, eax
mov dword [ebx + 4], eax
js 0x61cc6e49
mov eax, dword [ebx]
mov byte [eax], 0x22
inc dword [ebx]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], ebx
mov eax, 3
mov ecx, 1
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x61ccd060
call sym._fwrite
cmp byte [esi + 1], 0
je 0x61cc6db2
mov dword [esp + 0xc], ebx
mov edx, 2
mov eax, 1
mov dword [esp + 8], edx
inc esi
mov dword [esp + 4], eax
mov dword [esp], 0x61ccd064
call sym._fwrite
jmp 0x61cc6d95
mov dword [esp + 4], ebx
inc esi
mov dword [esp], edx
call sym.__flsbuf
jmp 0x61cc6d95
mov dword [esp + 4], ebx
mov dword [esp], 0x5c
call sym.__flsbuf
jmp 0x61cc6d7d
mov dword [esp + 4], ebx
mov dword [esp], 0x22
call sym.__flsbuf
jmp 0x61cc6d42
mov dword [esp + 4], ebx
mov dword [esp], 0x22
call sym.__flsbuf
jmp 0x61cc6db2
Function at 0x61cc6e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov dword [esp], 0x61ccb1c0
call sym.libintl_8.dll_libintl_lock_lock
mov ebx, dword [0x61cce2a0]
test ebx, ebx
je 0x61cc6fac
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._strcmp
test eax, eax
jne 0x61cc6f90
mov dword [esp], str.domain
mov ebx, dword [0x61cce290]
mov eax, 7
mov dword [esp + 8], eax
mov eax, 1
mov esi, 1
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
call sym._fwrite
mov edx, edi
mov eax, ebx
mov edi, 7
call sym._print_escaped
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str._nmsgid
call sym._fwrite
mov edx, dword [ebp - 0x10]
mov eax, ebx
call sym._print_escaped
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x61cc6ff1
mov dword [esp + 0xc], ebx
mov edx, 0xe
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._nmsgid_plural
call sym._fwrite
mov edx, dword [ebp - 0x14]
mov eax, ebx
call sym._print_escaped
mov dword [esp + 0xc], ebx
mov eax, 0xe
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], str._nmsgstr_0_____n
call sym._fwrite
mov eax, dword [ebx + 4]
dec eax
test eax, eax
mov dword [ebx + 4], eax
js 0x61cc7013
mov eax, dword [ebx]
mov byte [eax], 0xa
inc dword [ebx]
mov dword [ebp + 8], 0x61ccb1c0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sym.libintl_8.dll_libintl_lock_unlock
mov eax, dword [0x61cce290]
test eax, eax
jne 0x61cc7028
mov dword [esp], ebx
call sym._free
xor eax, eax
mov dword [0x61cce2a0], eax
mov dword [esp], esi
call sym._strlen
inc eax
mov dword [esp], eax
call sym._malloc
mov dword [0x61cce2a0], eax
test eax, eax
je 0x61cc6f7b
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._strcpy
mov dword [esp], esi
mov eax, 0x61ccd095
mov dword [esp + 4], eax
call sym._fopen
mov dword [0x61cce290], eax
test eax, eax
je 0x61cc6f7b
jmp 0x61cc6eaf
mov dword [esp + 0xc], ebx
mov eax, 0xb
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], str._nmsgstr____n
jmp 0x61cc6f60
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call sym.__flsbuf
jmp 0x61cc6f7b
mov dword [esp], eax
call sym._fclose
mov ebx, dword [0x61cce2a0]
xor eax, eax
mov dword [0x61cce290], eax
jmp 0x61cc6f9d
Function at 0x61cc8990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x24
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._strchr
test eax, eax
je 0x61cc8a28
mov dword [esp + 8], ebx
lea eax, [ebp - 0x10]
mov edi, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libintl_8.dll_libintl_vasnprintf
test eax, eax
mov ebx, eax
je 0x61cc8a0e
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fwrite
mov dword [esp], ebx
mov esi, eax
call sym._free
cmp esi, dword [ebp - 0x10]
je 0x61cc8a20
mov eax, edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x61cc8a48
mov edi, esi
jmp 0x61cc8a0e
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._vfprintf
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.__errno
mov dword [eax], 7
jmp 0x61cc8a0e
Function at 0xd6d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d6d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd6d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6d06a
add dl, dl
jne 0xd6d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6d0dc
xor eax, eax
add dl, dl
jne 0xd6d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6d17d
add dl, dl
jne 0xd6d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd6d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd6d075
mov eax, 1
add dl, dl
jne 0xd6d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd6d0e1
sub eax, ebx
mov ebx, 1
jne 0xd6d128
mov ecx, 1
add dl, dl
jne 0xd6d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd6d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd6d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd6d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd6d136
cmp eax, 0x7d00
jae 0xd6d16d
cmp eax, 0x500
jb 0xd6d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd6d075
cmp eax, 0x7f
ja 0xd6d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd6d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd6d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd6d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4123d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push edi
mov edi, ecx
xor ebp, ebp
cmp eax, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xf
mov dword [esp + 8], ebp
jne 0x41249d
push esi
push ebx
lea esi, [edi + 0x1e8]
mov eax, dword [esi]
test eax, eax
jle 0x412441
xor ebx, ebx
test eax, eax
jle 0x412441
mov eax, dword [esp + 0x10]
lea edi, [edi + eax*4 + 0x100]
mov ecx, dword [edi]
push ebp
push 1
call fcn.0040ff90
mov ecx, dword [edi]
push ecx
mov ecx, dword [esi - 0x70]
call fcn.00410260
mov eax, dword [esp + 0x10]
add edi, 4
inc eax
inc ebx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
cmp ebx, eax
jl 0x412415
mov edi, dword [esp + 0x18]
mov eax, dword [esi]
test eax, eax
jge 0x41248e
cdq
xor eax, edx
xor ebx, ebx
sub eax, edx
test eax, eax
jle 0x41248e
mov edx, dword [esp + 0x14]
lea edi, [edi + edx*4 + 0x100]
mov ecx, dword [edi]
push ebp
push 0
call fcn.0040ff90
mov eax, dword [edi]
mov ecx, dword [esi - 0x70]
push eax
call fcn.00410260
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
cdq
xor eax, edx
inc ecx
add edi, 4
inc ebx
sub eax, edx
mov dword [esp + 0x14], ecx
cmp ebx, eax
jl 0x41245d
mov edi, dword [esp + 0x18]
inc ebp
add esi, 4
cmp ebp, 0x1c
jl 0x4123fe
pop ebx
pop esi
mov dword [edi + 0x300], 0
pop edi
pop ebp
add esp, 0xc
ret 4
Function at 0x43aa90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov eax, 0x1f
push esi
push edi
mov dword [esp + 0x10], 0xfa
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x20], 0xe1
mov dword [esp + 0x24], 0x1c
mov dword [esp + 0x28], 0x113
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x30], 0x12c
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x145
mov dword [esp + 0x3c], 0
lea ebx, [esp + 0x10]
lea esi, [ecx + 0x38]
mov ebp, 6
mov eax, dword [0x5a32d4]
mov ecx, dword [esi]
neg eax
sbb eax, eax
and eax, 0x60
add eax, 4
mov dword [ecx + 0x6c], eax
mov edx, dword [0x5a32d4]
mov eax, dword [esi]
neg edx
sbb edx, edx
and edx, 0x60
add edx, 4
mov dword [eax + 0x78], edx
mov ecx, dword [esi]
mov eax, dword [ebx + 4]
mov dword [ecx + 0x7c], 0xa
mov ecx, dword [esi]
push eax
mov eax, dword [ebx]
mov edx, dword [ecx]
push eax
call dword [edx + 0x28]
mov ecx, dword [esi]
push 0
call fcn.0044a180
push 0x20
call fcn.004d8630
add esp, 4
test eax, eax
je 0x43ab62
push 0
mov ecx, eax
call fcn.005298a0
jmp 0x43ab64
xor eax, eax
mov ecx, dword [esi]
push eax
call fcn.0044a180
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [esi]
push 0
call fcn.00485230
push 0x30
call fcn.004d8630
mov edi, eax
add esp, 4
test edi, edi
je 0x43abd1
push 0
push 0
push 0
mov ecx, edi
call fcn.004f2b30
push 0x82
mov dword [edi], vtable.BallBounceMotion.0
call fcn.004efcc0
mov ecx, dword [edi + 0x18]
add esp, 4
add eax, 0xcc
cmp ecx, 0x1f
jne 0x43abc5
push 0xffffffffffffffde
push eax
mov ecx, edi
call fcn.004f2a30
jmp 0x43abd3
push 0x1f
push eax
mov ecx, edi
call fcn.004f2a30
jmp 0x43abd3
xor edi, edi
mov ecx, dword [esi]
push edi
call fcn.00485230
add esi, 4
add ebx, 8
dec ebp
jne 0x43ab00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x43d330
Capabilities:
Parse credit card information

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x18]
call fcn.004b9280
mov esi, eax
cmp esi, 0xa
jle 0x43d3a3
cmp esi, 0x15
jl 0x43d34d
cmp esi, 0x1e
jle 0x43d3a3
cmp esi, 0x29
jl 0x43d357
cmp esi, 0x32
jle 0x43d3a3
cmp esi, 0x3d
jl 0x43d361
cmp esi, 0x46
jle 0x43d3a3
cmp esi, 0x51
jl 0x43d36b
cmp esi, 0x5a
jle 0x43d3a3
mov eax, esi
mov ecx, 0xa
cdq
idiv ecx
mov ecx, dword [edi + 0x18]
cmp edx, 6
jle 0x43d38e
call fcn.004b9250
cmp eax, 3
ja case.default.0x43d3bf
jmp dword [eax*4 + 0x43d488]
call fcn.004b9250
cmp eax, 3
ja case.default.0x43d411
jmp dword [eax*4 + 0x43d498]
mov eax, esi
mov ecx, 0xa
cdq
idiv ecx
mov ecx, dword [edi + 0x18]
cmp edx, 6
jle 0x43d407
call fcn.004b9250
cmp eax, 3
ja case.default.0x43d3bf
jmp dword [eax*4 + 0x43d4a8]
mov edx, dword [edi + 0x18]
mov eax, 0x12
mov ecx, dword [edx + 0xc]
jmp 0x43d43f
mov edx, dword [edi + 0x18]
mov eax, 0x13
mov ecx, dword [edx + 0xc]
jmp 0x43d43f
mov edx, dword [edi + 0x18]
mov eax, 0x14
mov ecx, dword [edx + 0xc]
jmp 0x43d43f
mov edx, dword [edi + 0x18]
mov eax, 0x15
mov ecx, dword [edx + 0xc]
jmp 0x43d43f
mov edx, dword [edi + 0x18]
mov eax, 0x11
mov ecx, dword [edx + 0xc]
jmp 0x43d43f
call fcn.004b9250
cmp eax, 3
ja case.default.0x43d411
jmp dword [eax*4 + 0x43d4b8]
mov eax, 0xd
jmp 0x43d439
mov eax, 0xe
jmp 0x43d439
mov eax, 0xf
jmp 0x43d439
mov eax, 0x10
jmp 0x43d439
mov eax, 0xc
mov ecx, dword [edi + 0x18]
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
cmp esi, 4
jl 0x43d44f
cmp esi, 6
jle 0x43d477
cmp esi, 0x1a
jl 0x43d459
cmp esi, 0x1c
jle 0x43d477
cmp esi, 0x25
jl 0x43d463
cmp esi, 0x27
jle 0x43d477
cmp esi, 0x44
jl 0x43d46d
cmp esi, 0x46
jle 0x43d477
cmp esi, 0x59
jl 0x43d484
cmp esi, 0x5a
jg 0x43d484
mov eax, dword [edi + 0x18]
push 0x70
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
call dword [edx + 0x10]
pop edi
pop esi
ret
Function at 0x444c40
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x88
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, 0x79
push edi
mov dword [esp + 0x94], ebp
mov word [esp + 0x1c], 1
mov word [esp + 0x1e], 2
mov word [esp + 0x20], 3
mov word [esp + 0x22], 4
mov word [esp + 0x24], 5
mov word [esp + 0x26], 6
mov word [esp + 0x28], 7
mov word [esp + 0x2a], 8
mov word [esp + 0x2c], 9
mov word [esp + 0x2e], 0xa
mov word [esp + 0x30], 0x70
mov word [esp + 0x32], 0x71
mov word [esp + 0x34], 0x72
mov word [esp + 0x36], 0x73
mov word [esp + 0x38], 0x74
mov word [esp + 0x3a], 0x75
mov word [esp + 0x3c], 0x76
mov word [esp + 0x3e], 0x77
mov word [esp + 0x40], 0x78
mov word [esp + 0x42], cx
mov word [esp + 0x44], 0xb
mov word [esp + 0x46], 0xc
mov word [esp + 0x48], 0xd
mov word [esp + 0x4a], 0xe
mov word [esp + 0x4c], 0x18
mov word [esp + 0x4e], 0x19
mov word [esp + 0x50], 0x1a
mov word [esp + 0x52], 0x24
mov word [esp + 0x54], 0x25
mov word [esp + 0x56], 0x2f
mov word [esp + 0x58], 0x6c
mov word [esp + 0x5a], 0x6d
mov word [esp + 0x5c], 0x6e
mov word [esp + 0x5e], 0x6f
mov word [esp + 0x60], 0x60
mov word [esp + 0x62], 0x61
mov word [esp + 0x64], 0x62
mov word [esp + 0x66], 0x4b
mov word [esp + 0x68], 0x55
mov word [esp + 0x6a], 0x56
mov word [esp + 0x6c], 0x63
mov word [esp + 0x6e], 0x64
mov word [esp + 0x70], 0x65
mov word [esp + 0x72], 0x66
mov word [esp + 0x74], 0x57
mov word [esp + 0x76], 0x58
mov word [esp + 0x78], 0x59
mov word [esp + 0x7a], 0x42
mov word [esp + 0x7c], 0x4c
mov word [esp + 0x7e], 0x4d
mov word [esp + 0x80], 0x14
mov word [esp + 0x82], 0x15
mov word [esp + 0x84], 0x16
mov word [esp + 0x86], 0x17
mov word [esp + 0x88], 0x21
mov word [esp + 0x8a], 0x22
mov word [esp + 0x8c], 0x23
mov word [esp + 0x8e], 0x2d
mov word [esp + 0x90], 0x2e
mov word [esp + 0x92], 0x38
lea eax, [ebp + 0x364]
mov dword [eax], 0xffffffff
add eax, 0xc
dec ecx
jne 0x444e1e
mov eax, 0x12c
lea ecx, [ebp + 0x84]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov edx, dword [0x5a0008]
mov ecx, dword [edx + 0x910]
mov ecx, dword [ecx + eax]
mov edx, dword [ecx + 0x28]
test edx, edx
je 0x444ed1
call fcn.0040da50
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], 0xa
movsx ebx, ax
mov eax, esi
lea edi, [ebx + ebx*4]
shl edi, 2
add eax, 0x28
mov dword [esp + 0x10], eax
movsx eax, word [esp + edi + 8]
lea edx, [eax + eax*2]
mov dword [ebp + edx*4 + 0x358], ebx
mov ecx, dword [esi]
test ecx, ecx
je 0x444ebc
mov dword [ecx + 0xac], eax
mov ebp, dword [eax*4 + 0x544b5c]
mov ecx, dword [esi]
mov eax, dword [eax*4 + 0x54492c]
mov ebp, dword [ebp*4 + 0x544b14]
sub eax, 0xf
mov edx, dword [ecx]
sub ebp, 8
push ebp
push eax
call dword [edx + 0x28]
mov ebp, dword [esp + 0x94]
mov eax, dword [esp + 0x18]
add esi, 4
add edi, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x444e76
mov eax, dword [esp + 0x14]
add eax, 4
cmp eax, 0x144
mov dword [esp + 0x14], eax
jl 0x444e3d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x470aa0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004ca730
pop esi
ret