joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106a203
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x106a14c
add ebx, 0
push ecx
call 0x106a161
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x711e1324
sub ebx, dword [0x71200b63]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x71200b53
call fcn.01065c2b
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.01065139
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x106a2bf
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x106a2bf
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x106a276
mov eax, 1
lock xchg dword [0x71200b5f], eax
push 0x3dd1fc71
call 0x106a203
push esi
add esp, 8
cmp eax, 0
jne 0x106a1ec
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x106a212
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x106a227
cmp ecx, edx
cmp eax, 0
je 0x106a24c
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x106a236
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.0106a265
dec eax
loope 0x106a268
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x71200b5f], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x106a29c
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x106a2b1
jmp 0x106a2bc
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x106a1aa

Function at 0x1071324
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x10715fa
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x711ed7d7
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x711e479d
push 0xffffffffffffffff
call fcn.01068524
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x107138e
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.010713a6
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x10715ee
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x10715c2
Function at 0x1080df4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1080e16
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1080e16
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1080e16
ret
cmp word [ebx + 4], 0x14c
jne 0x1080e16
test word [ebx + 0x16], 2
je 0x1080e16
test word [ebx + 0x16], 0x100
je 0x1080e16
cmp word [ebx + 0x18], 0x10b
jne 0x1080e16
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1080e16
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1080ea2
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1080e36
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.01067d81
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1080e16
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1080ea2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1080e16
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1080e16
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1080e16
ret
cmp word [ebx + 4], 0x14c
jne 0x1080e16
test word [ebx + 0x16], 2
je 0x1080e16
test word [ebx + 0x16], 0x100
je 0x1080e16
cmp word [ebx + 0x18], 0x10b
jne 0x1080e16
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1080e16
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1080ea2
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1080e36
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.01067d81
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1080e16
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1080f59
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1080fb2
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1080f59
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1080f68
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1486c0b
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1080fb9
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.01067e2f
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1081058
add edi, 4
add eax, 2
dec ecx
jne 0x1080f9e
call 0x1081005
loope 0x1080ffb
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1081055
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1081066
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1081019
cmp eax, ecx
ja 0x1081019
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10810a3
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1081099
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0106830e
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1080f68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1080fb2
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1080f59
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1080f68
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1486c0b
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1080fb9
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.01067e2f
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1081058
add edi, 4
add eax, 2
dec ecx
jne 0x1080f9e
call 0x1081005
loope 0x1080ffb
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1081055
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1081066
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1081019
cmp eax, ecx
ja 0x1081019
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10810a3
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1081099
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0106830e
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401c66
pop dword [ebp - 0x14]
mov eax, 0x401c66
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa66b8ad1
add dword [ebp - 0x24], 0xa7e6ba7a
mov dword [ebp - 0x20], 0xd457bbad
add dword [ebp - 0x20], 0x5ddb9098
mov dword [ebp - 0x1c], 0x3aa0cc99
sub dword [ebp - 0x1c], 0xee54886b
mov dword [ebp - 0x18], 0x95d26d40
add dword [ebp - 0x18], 0x6a2d92c0
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf80e67b3
add dword [ebp - 0x24], 0x7c6401a3
mov dword [ebp - 0x20], 0xbff7f68a
add dword [ebp - 0x20], 0x81746aeb
mov dword [ebp - 0x1c], 0x29760a53
sub dword [ebp - 0x1c], 0xc6069de7
mov dword [ebp - 0x18], 0x7576f34
sub dword [ebp - 0x18], 0x7576f34
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf9d63243
add eax, 0x669fde9
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34c2e
push 0
call eax
mov ecx, 0x411f
xor edi, edi
add edi, eax
mov edx, 0x893e1720
sub edx, 0x88fda720
add edx, dword [ebp - 0x14]
mov esi, 0x5efd65e9
add esi, 0xc50f05b2
add dword [ebp - 8], ecx
mov ebx, dword [edx]
sub dword [ebp - 8], 0x6b7aac92
add ebx, esi
add dword [ebp - 0xc], 0xc9d0cca3
mov dword [edi], ebx
xor dword [ebp - 8], ecx
add edi, 0x5a25ca39
add edi, 0xa5da35cb
add edx, 4
loop 0x401d7a
add eax, 0x236b8268
add eax, 0xdc9574e7
mov ebx, eax
add eax, 0x64ac727b
add eax, 0x9b538d8a
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x103b9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x103b91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x103b907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103b906a
add dl, dl
jne 0x103b9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103b90dc
xor eax, eax
add dl, dl
jne 0x103b9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103b917d
add dl, dl
jne 0x103b90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x103b90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x103b9075
mov eax, 1
add dl, dl
jne 0x103b90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103b90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103b90e1
sub eax, ebx
mov ebx, 1
jne 0x103b9128
mov ecx, 1
add dl, dl
jne 0x103b910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103b9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103b9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103b9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x103b913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x103b914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103b9136
cmp eax, 0x7d00
jae 0x103b916d
cmp eax, 0x500
jb 0x103b9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103b9075
cmp eax, 0x7f
ja 0x103b9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x103b9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x103b919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x103b9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4014d4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push str.SoftwaregameAutoShot_
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x401501
cmp eax, 2
je 0x401522
jmp 0x401543
add esp, 0xfffffff8
push 4
push 0x404120
push 4
push 0
push str.ShotSpeed
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
jmp 0x401543
add esp, 0xfffffff8
push 4
push section..bss
push 4
push 0
push str.Swap
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
jmp 0x401543
add esp, 0xfffffff4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
leave
ret

Function at 0x401d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x404150], 1
add esp, 0xfffffff8
push 0x404150
push 0
mov eax, dword [ebp + 8]
push eax
push 0x401854
push 0
push 0
call sub.KERNEL32.dll_CreateThread
add esp, 8
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateEventA
mov eax, eax
mov dword [0x404080], eax
add esp, 0xfffffff4
push 0x401d56
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
mov dword [0x404170], eax
add esp, 0xfffffff4
add esp, 0xfffffff8
push 0x401d60
mov eax, dword [0x404170]
push eax
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov eax, eax
push 1
push 0
push 0x401a24
push 1
push 0x11
call eax
add esp, 0xc
mov dword [0x404040], eax
leave
ret
Function at 0x401e6c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push str.SoftwaregameAutoShot_
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 4
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.ShotSpeed
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov eax, eax
test eax, eax
jne 0x401ee2
cmp dword [ebp - 0x10], 0
je 0x401ed7
cmp dword [ebp - 0x10], 9
ja 0x401ed7
mov eax, dword [ebp - 0x10]
mov dword [0x404120], eax
jmp 0x401ee0
jmp 0x401ee2
jmp 0x401f0b
mov dword [0x404120], 8
add esp, 0xfffffff8
push 4
push 0x404120
push 4
push 0
push str.ShotSpeed
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.Swap
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov eax, eax
test eax, eax
jne 0x401f55
cmp dword [ebp - 0x10], 1
ja 0x401f51
mov eax, dword [ebp - 0x10]
mov dword [section..bss], eax
jmp 0x401f53
jmp 0x401f55
jmp 0x401f7e
mov dword [section..bss], 1
add esp, 0xfffffff8
push 4
push section..bss
push 4
push 0
push str.Swap
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
add esp, 0xfffffff4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov eax, dword [0x404120]
mov dword [0x404090], eax
mov eax, dword [section..bss]
mov dword [0x4041b0], eax
leave
ret

Function at 0x4022c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
call fcn.004023e0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
add esp, 0xc
test ebx, ebx
je 0x40232c
jmp 0x4022e9
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x4022e8
cmp al, 9
je 0x4022e8
mov al, byte [ebx]
cmp al, 0x22
jne 0x402313
lea esi, [esi]
inc ebx
mov al, byte [ebx]
cmp al, 0x22
je 0x402321
test al, al
jne 0x402300
jmp 0x402322
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x402321
cmp al, 9
je 0x402322
test al, al
jne 0x402310
jmp 0x402322
inc ebx
mov al, byte [ebx]
cmp al, 0x20
je 0x402321
cmp al, 9
je 0x402321
mov eax, 0xa
test byte [ebp - 0x24], 1
je 0x40233b
movzx eax, word [ebp - 0x20]
push eax
push ebx
push 0
add esp, 0xfffffff4
push 0
call sub.KERNEL32.dll_GetModuleHandleA
add esp, 0xc
push eax
call fcn.00402288
mov ebx, dword [ebp - 0x68]
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x484ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x59000]
push edi
jmp 0x484aca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x484ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484ac0
mov eax, 1
add ebx, ebx
jne 0x484ae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x484af4
jne 0x484b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484b13
dec eax
add ebx, ebx
jne 0x484b00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x484ad8
add ebx, ebx
jne 0x484b0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x484b65
xor ecx, ecx
sub eax, 3
jb 0x484b2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x484b9a
sar eax, 1
mov ebp, eax
jmp 0x484b36
add ebx, ebx
jne 0x484b36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484b04
inc ecx
add ebx, ebx
jne 0x484b44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484b04
add ebx, ebx
jne 0x484b51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x484b46
jne 0x484b62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x484b46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x484b84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x484b76
jmp 0x484ac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x484b84
add edi, ecx
jmp 0x484ac6
pop esi
mov edi, esi
mov ecx, 0x2bcc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x484ba2
cmp byte [edi], 0xe
jne 0x484ba2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x484ba7
lea edi, [esi + 0x7f000]
mov eax, dword [edi]
or eax, eax
je 0x484c1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x845ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x84700]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x484bd4
mov ecx, edi
jns 0x484c03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x84704]
or eax, eax
je 0x484c19
mov dword [ebx], eax
add ebx, 4
jmp 0x484bf1
call dword [esi + 0x84714]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x484c50
cmp al, 0xef
ja 0x484c43
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x484c25
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x484c32
mov ebp, dword [esi + 0x84708]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x484c84
sub esp, 0xffffff80
jmp 0x43eb60