joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100799e2
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x100799fb
or eax, 0xffffffff
jmp 0x10079a5c
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x10079a58
push 0x3d
push esi
call fcn.1006a2c9
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x10079a58
cmp esi, eax
je 0x10079a58
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x10098dc8]
sete cl
cmp eax, dword [0x10098dcc]
mov dword [ebp - 8], ecx
jne 0x10079a3e
mov edi, eax
call fcn.10079981
mov dword [0x10098dc8], eax
cmp eax, ebx
jne 0x10079a97
cmp dword [ebp + 0xc], ebx
je 0x10079a60
cmp dword [0x10098dd0], ebx
je 0x10079a60
call fcn.10078838
test eax, eax
je 0x10079a97
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x10079a69
xor eax, eax
jmp 0x10079a5b
push 4
call fcn.100688d8
cmp eax, ebx
pop ecx
mov dword [0x10098dc8], eax
je 0x10079a58
mov dword [eax], ebx
cmp dword [0x10098dd0], ebx
jne 0x10079a97
push 4
call fcn.100688d8
cmp eax, ebx
pop ecx
mov dword [0x10098dd0], eax
je 0x10079a58
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x10098dc8]
call fcn.10079934
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x10079af8
cmp dword [esi], ebx
je 0x10079af8
lea esi, [esi + edi*4]
push dword [esi]
call fcn.100688ea
cmp dword [ebp - 8], ebx
pop ecx
jne 0x10079adb
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x10079b39
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x10079ad2
mov eax, edi
shl eax, 2
push eax
push dword [0x10098dc8]
call fcn.10069634
cmp eax, ebx
pop ecx
pop ecx
je 0x10079b39
jmp 0x10079b34
cmp dword [ebp - 8], ebx
jne 0x10079ba4
cmp edi, ebx
jge 0x10079b07
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x10098dc8]
call fcn.10069634
cmp eax, ebx
pop ecx
pop ecx
je 0x10079a58
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x10098dc8], eax
cmp dword [ebp + 0xc], ebx
je 0x10079b8e
push dword [ebp - 4]
call fcn.1006be90
inc eax
inc eax
push eax
call fcn.100688d8
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x10079b8e
push dword [ebp - 4]
push esi
call fcn.10070380
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x10079b87
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.100688ea
pop ecx
cmp dword [ebp - 8], ebx
je 0x10079b9c
push dword [ebp - 4]
call fcn.100688ea
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x10079a5b
push dword [ebp - 4]
call fcn.100688ea
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x10079a65
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x20091c21
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x39d167a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404fc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
push edi
test edx, edx
mov esi, ecx
lea edi, [edx + eax]
jne 0x404fdc
mov dword [esi], edx
pop edi
xor eax, eax
pop esi
ret 8
cmp edx, edi
jae 0x405005
push ebx
mov eax, dword [esi]
xor ebx, ebx
mov bl, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x48867c]
xor ecx, eax
inc edx
cmp edx, edi
mov dword [esi], ecx
jb 0x404fe1
pop ebx
mov eax, dword [esi]
pop edi
pop esi
ret 8

Function at 0x405fb0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x8000
call fcn.00464610
mov eax, dword [ecx]
mov edx, dword [esp + 0x8010]
push eax
lea ecx, [esp + 4]
mov eax, dword [edx]
push 0x7fff
push ecx
mov ecx, dword [esp + 0x8018]
push eax
mov eax, dword [esp + 0x8018]
mov edx, dword [ecx]
mov ecx, dword [eax]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp]
test edx, edx
je 0x40604b
mov al, byte [esp]
test al, al
je 0x40604b
push ebx
push esi
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea eax, [ebx + 1]
push eax
call fcn.004640eb
mov ecx, ebx
mov edi, eax
mov eax, dword [esp + 0x8014]
mov edx, ecx
lea esi, [esp + 0x10]
add esp, 4
shr ecx, 2
mov dword [eax], edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax]
pop edi
pop esi
mov byte [ecx + ebx], 0
pop ebx
add esp, 0x8000
ret 0x10
mov eax, dword [esp + 0x8004]
mov dword [eax], 0x496630
add esp, 0x8000
ret 0x10
Function at 0x406a10
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x406a48
mov ecx, dword [esi + 0xc]
mov edx, dword [0x496644]
lea eax, [esi + 0x3c]
push eax
push ecx
push 0
push str.file_not_opened
push 5
push str.RES__s__.4s
push edx
call fcn.00407250
add esp, 0x1c
push 1
call fcn.00465bed
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.00406b50
mov edi, eax
test edi, edi
mov dword [esp + 8], edi
jne 0x406a8d
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x3c]
push ecx
mov ecx, dword [0x496644]
push edx
push eax
push str.Load
push 0xb
push str.RES__s__.4s
push ecx
call fcn.00407250
add esp, 0x1c
push 1
call fcn.00465bed
mov edx, dword [esp + 0x10]
push ebx
push ebp
push edx
mov ecx, esi
call fcn.004065a0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
cmp dword [ebp], 0
jne 0x406abc
mov eax, edi
imul eax, ebx
push eax
call fcn.004640eb
add esp, 4
mov dword [ebp], eax
jmp 0x406ae0
mov edx, dword [esi + 0xc]
mov eax, dword [0x496644]
lea ecx, [esi + 0x3c]
push ecx
push edx
push 0
push str.Already_loaded
push 5
push str.RES__s__.4s
push eax
call fcn.00407250
add esp, 0x1c
cmp dword [ebp], 0
jne 0x406b00
mov edx, dword [0x496644]
lea ecx, [esp + 0x18]
push edi
push ecx
push str.ResLoad::type_.4s_no_sub_i_Not_enough_Memory
push edx
call fcn.004071f0
add esp, 0x10
test edi, edi
jle 0x406b38
mov eax, dword [esp + 0x10]
xor edi, edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp]
mov edx, dword [esi]
add eax, edi
push ebx
push eax
mov ecx, esi
call dword [edx]
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00406710
mov eax, dword [esp + 0x1c]
add edi, ebx
dec eax
mov dword [esp + 0x1c], eax
jne 0x406b0e
mov edi, dword [esp + 0x10]
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x4071f0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x400
lea eax, [esp + 0x40c]
lea edx, [esp]
push esi
push eax
push ecx
push edx
call fcn.004645b9
mov esi, dword [esp + 0x414]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00407190
mov eax, dword [esi + 8]
add esp, 0x14
test eax, eax
je 0x407233
push eax
call fcn.004643ae
add esp, 4
push 1
mov dword [esi + 8], 0
call fcn.00465bed
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x419cc0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, ecx
mov ebp, 0x480278
mov dword [esp + 0x10], ebp
push edi
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
cmp byte [eax], 0
je 0x419cf4
push 0x488a7c
push eax
call fcn.0046449c
add esp, 8
jmp 0x419cf6
xor eax, eax
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.00419820
lea edi, [esi + 0x30]
push ebx
mov ecx, edi
call fcn.00405080
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x419d47
push eax
push 0x496618
push 7
mov ecx, esi
call fcn.00419f70
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], ebp
test eax, eax
je 0x419d38
push eax
call fcn.004643ae
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
push eax
push 4
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.004642c6
mov eax, dword [esp + 0x20]
add esp, 0x10
test eax, 0xff000000
je 0x419d8f
push edi
mov ecx, esi
call fcn.00419940
mov esi, eax
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [esp + 0x14], ebp
je 0x419d83
push eax
call fcn.004643ae
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
cmp dword [esi + 8], 0x80
jge 0x419e5f
mov edi, dword [esi + 0xc]
push 0x604
mov dword [esp + 0x24], edi
call fcn.004640eb
add esp, 4
test eax, eax
je 0x419dde
lea ebp, [eax + 4]
mov dword [eax], 0x80
mov ebx, ebp
mov edi, 0x80
mov ecx, ebx
call fcn.00419ca0
add ebx, 0xc
dec edi
jne 0x419dc4
mov edi, dword [esp + 0x20]
mov eax, ebp
mov ebp, 0x480278
jmp 0x419de0
xor eax, eax
test eax, eax
mov dword [esi + 0xc], eax
jne 0x419e00
mov edx, dword [0x496644]
push 0x80
push str.___ERROR___::LIST:_Not_enough_memory__i
push edx
call fcn.004071f0
add esp, 0xc
test edi, edi
je 0x419e54
mov eax, dword [esi + 8]
xor ebx, ebx
test eax, eax
jle 0x419e4b
mov eax, dword [esp + 0x20]
mov ebp, 0xfffffff8
add edi, 8
sub ebp, eax
mov edx, dword [esi + 0xc]
mov cl, byte [edi - 8]
lea eax, [edi + ebp]
push edi
add eax, edx
mov byte [eax], cl
mov edx, dword [edi - 4]
lea ecx, [eax + 8]
mov dword [eax + 4], edx
call fcn.00405080
mov eax, dword [esi + 8]
inc ebx
add edi, 0xc
cmp ebx, eax
jl 0x419e1b
mov edi, dword [esp + 0x20]
mov ebp, 0x480278
push 3
mov ecx, edi
call fcn.004031f0
mov eax, dword [esp + 0x10]
mov dword [esi + 8], 0x80
mov ecx, dword [esi + 8]
mov dword [esi + 4], eax
cmp eax, ecx
jle 0x419e71
push eax
mov ecx, esi
call fcn.0041f0a0
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.00419f30
mov ecx, dword [esp + 0x18]
lea edi, [esi + 0x38]
push ecx
push 4
push 1
push edi
call fcn.004642c6
mov edx, dword [edi]
push edx
call fcn.004640eb
add esp, 0x14
mov dword [esi + 0x34], eax
test eax, eax
jne 0x419eb7
push eax
push str.data2
push 2
mov ecx, esi
call fcn.00419f70
push 1
call fcn.00465bed
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push ecx
push edx
push 1
push eax
call fcn.004642c6
mov eax, dword [esp + 0x28]
add esp, 0x10
test eax, eax
mov dword [esp + 0x14], ebp
je 0x419edf
push eax
call fcn.004643ae
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
Function at 0x41a660
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1004
call fcn.00464610
push esi
push edi
mov esi, ecx
call fcn.0041a630
mov eax, dword [esi + 0x3c]
xor ecx, ecx
cmp byte [eax], 0xa
je 0x41a69d
mov eax, dword [esi + 0x3c]
mov dl, byte [eax]
cmp dl, 0xd
je 0x41a69d
cmp ecx, 0xfff
jge 0x41a6d4
inc eax
mov byte [esp + ecx + 0xc], dl
mov dword [esi + 0x3c], eax
inc ecx
cmp byte [eax], 0xa
jne 0x41a67d
mov edi, dword [esp + 0x1010]
mov byte [esp + ecx + 0xc], 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.00405100
mov al, byte [esp + 0xc]
test al, al
jne 0x41a6eb
push 0
push str.empty_line
push 0xa
mov ecx, esi
call fcn.00419f70
push 1
call fcn.00465bed
push 0
push str.Very_long_line
push 0xa
mov ecx, esi
call fcn.00419f70
push 1
call fcn.00465bed
lea edx, [esp + 8]
push 0x489c20
push edx
mov ecx, edi
call fcn.00405910
push eax
mov ecx, edi
call fcn.00405080
mov eax, dword [esp + 8]
cmp eax, 0x496630
je 0x41a718
push eax
call fcn.004640e0
add esp, 4
push 0x488c04
mov ecx, edi
call fcn.00405790
mov ecx, esi
call fcn.0041a630
pop edi
pop esi
add esp, 0x1004
ret 4

Function at 0x41a740
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1000
call fcn.00464610
push esi
push edi
mov esi, ecx
call fcn.0041a630
xor edi, edi
mov eax, dword [esi + 0x3c]
movsx ecx, byte [eax]
push ecx
call fcn.00465936
add esp, 4
test eax, eax
jne 0x41a770
mov edx, dword [esi + 0x3c]
cmp byte [edx], 0x5f
jne 0x41a788
cmp edi, 0xfff
jge 0x41a7d1
mov eax, dword [esi + 0x3c]
mov cl, byte [eax]
inc eax
mov byte [esp + edi + 8], cl
mov dword [esi + 0x3c], eax
inc edi
jmp 0x41a755
mov ecx, dword [esp + 0x100c]
lea edx, [esp + 8]
push edx
mov byte [esp + edi + 0xc], 0
call fcn.00405100
mov al, byte [esp + 8]
test al, al
jne 0x41a7bd
push 0
push str.name
push 4
mov ecx, esi
call fcn.00419f70
push 1
call fcn.00465bed
mov ecx, esi
call fcn.0041a630
mov eax, edi
pop edi
pop esi
add esp, 0x1000
ret 4
push 0
push str.Very_long_name
push 0xa
mov ecx, esi
call fcn.00419f70
push 1
call fcn.00465bed
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41a880
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call fcn.0041a7f0
test eax, eax
je 0x41a89c
pop edi
mov eax, 1
pop esi
ret 4
push 0
push edi
push 0xd
mov ecx, esi
call fcn.00419f70
push 1
call fcn.00465bed
nop
Function at 0x41a900
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x3c]
push ebp
push edi
mov edi, dword [esp + 0xc]
mov dl, byte [eax]
mov ebp, edi
cmp dl, 0x22
jne 0x41a9c9
lea edx, [eax + 1]
push ebx
mov dword [ecx + 0x3c], edx
push esi
mov bl, byte [edx]
cmp bl, 0x22
je 0x41a99e
cmp edx, dword [ecx + 0x40]
jae 0x41a99e
cmp bl, 0x5c
jne 0x41a98d
mov al, byte [edx + 1]
lea esi, [edx + 1]
cmp al, 0xd
jne 0x41a950
mov bl, byte [edx + 2]
add edx, 2
cmp bl, 0xa
jne 0x41a950
mov eax, dword [ecx + 0x48]
mov dword [ecx + 0x3c], edx
inc eax
mov dword [ecx + 0x48], eax
jmp 0x41a990
cmp al, 0xa
jne 0x41a960
mov eax, dword [ecx + 0x48]
mov dword [ecx + 0x3c], esi
inc eax
mov dword [ecx + 0x48], eax
jmp 0x41a990
mov al, byte [esi]
cmp al, 0x6e
jne 0x41a973
mov byte [edi], 0xa
mov eax, dword [ecx + 0x3c]
inc edi
inc eax
mov dword [ecx + 0x3c], eax
jmp 0x41a990
cmp al, 0x72
jne 0x41a984
mov byte [edi], 0xd
mov eax, dword [ecx + 0x3c]
inc edi
inc eax
mov dword [ecx + 0x3c], eax
jmp 0x41a990
mov dword [ecx + 0x3c], esi
mov al, byte [esi]
mov byte [edi], al
jmp 0x41a98f
mov byte [edi], bl
inc edi
mov edx, dword [ecx + 0x3c]
inc edx
mov dword [ecx + 0x3c], edx
mov bl, byte [edx]
cmp bl, 0x22
jne 0x41a925
mov eax, dword [ecx + 0x3c]
pop esi
pop ebx
lea edx, [eax + 1]
mov dword [ecx + 0x3c], edx
mov edx, dword [ecx + 0x40]
cmp eax, edx
jb 0x41a9c5
push 0
push str.End_of_file
push 0xa
call fcn.00419f70
push 1
call fcn.00465bed
mov byte [edi], 0
inc edi
mov eax, edi
pop edi
sub eax, ebp
pop ebp
ret 4
Function at 0x41f5a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0x800000
ja 0x41f5ec
mov al, byte [esi + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
and eax, 1
shl ecx, 1
or eax, ecx
push edx
shl eax, 7
mov dword [esi], eax
call fcn.004642ac
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov byte [esi + 0xc], al
and eax, 0xff
shr eax, 1
shl ecx, 8
or edx, eax
mov eax, ecx
add esp, 4
cmp eax, 0x800000
mov dword [esi], edx
mov dword [esi + 4], ecx
jbe 0x41f5ad
mov edi, dword [esi + 4]
mov ecx, dword [esp + 0xc]
mov eax, dword [esi]
xor edx, edx
shr edi, cl
div edi
mov dword [esi + 8], edi
pop edi
pop esi
mov edx, eax
shr edx, cl
test edx, edx
je 0x41f610
mov eax, 1
shl eax, cl
dec eax
ret 4

Function at 0x41f6e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x41f6ff
mov ecx, dword [esi + 0x14]
mov dword [esi + 4], eax
inc ecx
mov dword [esi + 8], 0
mov dword [esi + 0x14], ecx
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jge 0x41f715
add eax, eax
cmp eax, ecx
mov dword [esi + 0xc], eax
jle 0x41f715
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
mov ecx, dword [esi + 0x1c]
xor edi, edi
push ebx
mov di, word [ecx + eax*2]
lea ecx, [eax - 1]
test ecx, ecx
mov edx, edi
je 0x41f74c
mov ebx, dword [esi + 0x20]
xor eax, eax
mov ax, word [ebx + ecx*2]
mov ebx, dword [esi + 0x1c]
sub edx, eax
or al, 2
mov word [ebx + ecx*2], dx
mov ebx, dword [esi + 0x20]
sar eax, 1
sub edi, eax
mov word [ebx + ecx*2], ax
dec ecx
jne 0x41f72a
mov ecx, dword [esi + 0x20]
mov ax, word [ecx]
mov ebx, eax
and ebx, 0xffff
cmp edx, ebx
pop ebx
je 0x41f77c
mov edx, dword [esi + 0x1c]
push edx
push str.BUG:_rescaling_left__d_total_frequency_n
push 0x48e888
call fcn.004661fa
add esp, 0xc
push 1
call fcn.00465bed
or al, 2
shr ax, 1
mov word [ecx], ax
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov cx, word [eax]
sub edi, ecx
mov ecx, dword [esi + 0xc]
mov eax, edi
cdq
idiv ecx
mov dword [esi + 0x14], eax
mov eax, edi
cdq
idiv ecx
mov eax, dword [esi + 0x24]
sub ecx, edx
mov dword [esi + 8], edx
test eax, eax
mov dword [esi + 4], ecx
je 0x41f7e5
mov edi, dword [esi]
test edi, edi
je 0x41f7e5
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
xor edx, edx
mov dx, word [eax + edi*2]
dec edx
sar edx, cl
dec edi
xor ecx, ecx
mov cx, word [eax + edi*2]
mov eax, ecx
mov cl, byte [esi + 0x18]
shr eax, cl
cmp eax, edx
jg 0x41f7e1
mov ecx, dword [esi + 0x24]
inc eax
cmp eax, edx
mov word [ecx + eax*2 - 2], di
jle 0x41f7d4
test edi, edi
jne 0x41f7b3
pop edi
pop esi
ret
Function at 0x425be0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push edx
call fcn.00405de0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425d19
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [edx]
push 0x498994
push ecx
mov ecx, dword [esp + 0x1c]
push 0
push eax
push ecx
mov dword [esp + 0x34], 0x1ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
cmp eax, 4
je 0x425c98
cmp eax, 3
je 0x425c98
cmp eax, 1
je 0x425cae
mov eax, dword [esp + 0x2c]
mov esi, dword [eax]
cmp byte [esi], 0
je 0x425d01
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [ebx + 1]
push ecx
call fcn.004640eb
mov ebp, dword [esp + 0x28]
add esp, 4
mov ecx, ebx
mov dword [ebp], eax
jmp 0x425ce8
mov ecx, dword [0x498994]
push 0xa
push 0x498994
push ecx
call fcn.00465f07
add esp, 0xc
mov edx, 0x498994
test edx, edx
je 0x425d01
mov al, byte [0x498994]
test al, al
je 0x425d01
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea eax, [ebx + 1]
push eax
call fcn.004640eb
mov ebp, dword [esp + 0x28]
add esp, 4
mov ecx, ebx
mov esi, 0x498994
mov dword [ebp], eax
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov byte [eax + ebx], 0
jmp 0x425d0c
mov ebp, dword [esp + 0x24]
mov dword [ebp], 0x496630
mov eax, dword [esp + 0x14]
cmp eax, 0x496630
je 0x425d7f
jmp 0x425d76
mov ecx, dword [esp + 0x2c]
mov esi, dword [ecx]
cmp byte [esi], 0
je 0x425d60
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea edx, [ebx + 1]
push edx
call fcn.004640eb
mov ebp, dword [esp + 0x28]
mov ecx, ebx
mov edi, eax
add esp, 4
mov dword [ebp], eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp]
mov byte [ecx + ebx], 0
jmp 0x425d6b
mov ebp, dword [esp + 0x24]
mov dword [ebp], 0x496630
mov eax, dword [esp + 0x14]
cmp eax, 0x496630
je 0x425d7f
push eax
call fcn.004640e0
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x425d90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea edx, [esp + 8]
push esi
push eax
push edx
call fcn.00405de0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425e28
mov edx, dword [esp + 0x18]
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
mov eax, dword [edx]
push 0x498794
push ecx
mov ecx, dword [esp + 0x10]
push 0
push eax
push ecx
mov dword [esp + 0x28], 0x1ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x425e0d
push 0x498794
call fcn.004658ad
add esp, 4
mov esi, eax
jmp 0x425e1d
cmp eax, 4
je 0x425e17
cmp eax, 3
jne 0x425e1d
mov esi, dword [0x498794]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
cmp eax, 0x496630
je 0x425e3c
push eax
call fcn.004640e0
add esp, 4
mov eax, esi
pop esi
add esp, 0x10
ret 8

Function at 0x425e50
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
lea edx, [esp + 4]
push eax
push edx
call fcn.00405de0
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0x496618
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425ec3
mov ecx, dword [esp + 0x14]
push edi
mov edx, dword [ecx]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
mov edx, dword [esp + 0x1c]
push 1
push eax
mov eax, dword [edx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [esp + 4]
cmp eax, 0x496630
je 0x425ed7
push eax
call fcn.004640e0
add esp, 4
add esp, 0xc
ret 8

Function at 0x425ee0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
lea edx, [esp + 4]
push eax
push edx
call fcn.00405de0
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0x496618
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425f47
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 4
push ecx
mov ecx, dword [esp + 8]
push 4
push eax
mov eax, dword [edx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
cmp eax, 0x496630
je 0x425f5b
push eax
call fcn.004640e0
add esp, 4
add esp, 0xc
ret 8
Function at 0x445660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, 0x80
xor ebp, ebp
mov ecx, dword [0x496760]
mov eax, dword [ecx + 0x214]
push eax
call fcn.0040b980
push eax
mov ecx, esi
call fcn.00446630
test eax, eax
je 0x445695
mov ecx, 0x5e0588
call fcn.00434e30
test byte [esi + 0x28], bl
je 0x44578c
cmp dword [esi + 0xb0], ebp
je 0x4456b1
mov ecx, esi
call fcn.00446280
mov esi, eax
jmp 0x44566d
mov eax, dword [esi + 0x28]
mov ecx, eax
and ecx, 0x7c
cmp cl, 0x64
jne 0x445746
mov edx, dword [esi + 0xc0]
mov ecx, dword [esi + 0xc4]
or eax, ebx
mov dword [esi + 0xbc], edx
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0xb4]
cmp eax, ebp
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xc4], edx
mov dword [esi + 0xcc], ebp
mov dword [esi + 0xc8], ebp
je 0x44578c
mov ecx, dword [esi + 0xbc]
mov dword [eax + 0xbc], ecx
mov edx, dword [esi + 0xc0]
mov dword [eax + 0xc0], edx
mov edx, dword [eax + 0x28]
mov ecx, dword [esi + 0xc4]
or edx, ebx
mov dword [eax + 0xc4], ecx
mov dword [eax + 0x28], edx
mov dword [eax + 0xcc], ebp
mov dword [eax + 0xc8], ebp
mov eax, dword [eax + 0xb4]
cmp eax, ebp
jne 0x4456ff
pop edi
pop esi
pop ebp
pop ebx
ret
cmp esi, ebp
mov edi, esi
je 0x44578c
mov ebx, 0xffffff7f
mov edx, dword [edi + 0x28]
mov dword [edi + 0xcc], ebp
and edx, ebx
mov dword [edi + 0x28], edx
fld dword [esi + 0x20]
fmul dword [0x48069c]
call fcn.00465eb8
cdq
xor eax, edx
sub eax, edx
add eax, 0xa
cdq
sub eax, edx
sar eax, 1
neg eax
mov dword [edi + 0xc8], eax
mov edi, dword [edi + 0xb4]
cmp edi, ebp
jne 0x445751
pop edi
pop esi
pop ebp
pop ebx
ret