joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [ebp - 0x78], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0x26]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x405374
mov edi, eax
xor eax, eax
movzx ecx, word [ebx + eax]
mov word [edi + eax], cx
add eax, 2
test cx, cx
jne 0x4051b0
mov dword [esp + 4], str..update_timestamp
mov dword [esp], edi
call sym._lstrcatW_8
mov esi, dword [sym.imp.ucrtbase.dll__wopen]
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], edi
call esi
mov ebx, eax
cmp eax, 0xffffffff
je 0x4052f9
lea eax, [ebp - 0x70]
mov dword [esp + 8], 0x63
mov dword [ebp - 0x74], eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__read]
test eax, eax
js 0x40525f
mov byte [ebp + eax - 0x70], 0
mov eax, dword [ebp - 0x74]
mov dword [esp + 8], 7
mov dword [esp + 4], str.disable
mov dword [esp], eax
call sym._strncmp
mov esi, eax
test eax, eax
je 0x4052dd
mov eax, dword [ebp - 0x74]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strtoul]
cmp eax, dword [ebp - 0x78]
je 0x405363
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__lseek]
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__chsize]
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], str._lu_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym._sprintf.constprop.0
mov dword [esp], ebx
mov esi, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__write]
cmp esi, eax
je 0x40536a
test byte [0x40a160], 4
jne 0x40532f
mov dword [esp + 4], 0
xor esi, esi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__chsize]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__close]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 2
je 0x405308
xor esi, esi
jmp 0x4052e6
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x301
mov dword [esp], edi
call esi
mov ebx, eax
cmp eax, 0xffffffff
je 0x405304
lea eax, [ebp - 0x70]
mov dword [ebp - 0x74], eax
jmp 0x405289
mov eax, edi
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.failed_to_update_timestamp_in__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.update_timestamp
mov dword [esp + 4], 0x40a160
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x4052ca
xor esi, esi
jmp 0x4052dd
mov esi, 1
jmp 0x4052dd
xor esi, esi
jmp 0x4052ef
Function at 0x4c4fb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6d000]
push edi
or ebp, 0xffffffff
jmp 0x4c4fd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c4fd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4fc8
mov eax, 1
add ebx, ebx
jne 0x4c4feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c4ffc
jne 0x4c501b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c501b
dec eax
add ebx, ebx
jne 0x4c5008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c4fe0
add ebx, ebx
jne 0x4c5017
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c506d
xor ecx, ecx
sub eax, 3
jb 0x4c5033
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c50a2
sar eax, 1
mov ebp, eax
jmp 0x4c503e
add ebx, ebx
jne 0x4c503e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c500c
inc ecx
add ebx, ebx
jne 0x4c504c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c500c
add ebx, ebx
jne 0x4c5059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c504e
jne 0x4c506a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c504e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c508c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c507e
jmp 0x4c4fce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c508c
add edi, ecx
jmp 0x4c4fce
pop esi
mov edi, esi
mov ecx, 0x960
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c50aa
cmp byte [edi], 4
jne 0x4c50aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c50af
lea edi, [esi + 0xb3000]
mov eax, dword [edi]
or eax, eax
je 0x4c5127
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd6008]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd6454]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c50dc
mov ecx, edi
jns 0x4c510b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd6458]
or eax, eax
je 0x4c5121
mov dword [ebx], eax
add ebx, 4
jmp 0x4c50f9
call dword [esi + 0xd6468]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4c5158
cmp al, 0xef
ja 0x4c514b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4c512d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4c513a
mov ebp, dword [esi + 0xd645c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c518c
sub esp, 0xffffff80
jmp 0x42064d
Function at 0x401000
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x112c
call fcn.00401b90
push ebx
push ebp
push esi
push edi
push 0x186
push 0x407c64
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x407c64
or ecx, 0xffffffff
xor eax, eax
push str.Waiting_for_HE_pwnage_
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x407c64
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x407ad4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 0x6c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx + 0x407ad1], 0x64
mov byte [edx + 0x407ad2], al
mov byte [edx + 0x407ad3], al
call fcn.00401b50
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 4
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x13c]
push ecx
push 0x1000
push edx
call sub.PSAPI.DLL_EnumProcesses
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
shr eax, 2
mov dword [esp + 0x18], eax
je 0x40107c
lea eax, [esp + 0x13c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [0x40713c]
mov edx, dword [str.unknown]
mov dword [esp + 0x3c], eax
mov ebx, dword [ecx]
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x40]
push ebx
mov dword [esp + 0x3c], edx
push eax
push 0x410
rep stosd dword es:[edi], eax
call ebp
mov esi, eax
test esi, esi
je 0x4011a6
lea ecx, [esp + 0x34]
lea edx, [esp + 0x20]
push ecx
push 4
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40111f
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x38]
push 0x104
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
lea edx, [esp + 0x38]
push str.hl.exe
push edx
call fcn.00401ad0
add esp, 8
test eax, eax
jne 0x40114b
lea eax, [esp + 0x38]
push str.cstrike.exe
push eax
call fcn.00401ad0
add esp, 8
test eax, eax
je 0x4011a6
push str.Skyns_HE_Loaded_
call fcn.00401b50
xor ecx, ecx
add esp, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push ebx
mov dword [esp + 0x30], ecx
push 1
push 0x1f0fff
mov dword [esp + 0x3c], ecx
call ebp
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
push edx
push 0x407ad4
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4011cb
push str.Injection_Failed
call fcn.00401b50
mov eax, dword [esp + 0x28]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jb 0x4010bb
jmp 0x40107c
push str.DLL_Injected_
call fcn.00401b50
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x112c
ret
Function at 0x401610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
sub esp, 0x114
mov dword [0x407e00], 0x10003
push ebx
mov ebx, dword [esp + 0x120]
push ebp
push 0x407e00
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x401645
pop ebp
pop ebx
add esp, 0x114
ret
mov ecx, dword [ebx + 8]
push ecx
call fcn.00401380
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x401660
pop ebp
pop ebx
add esp, 0x114
ret
mov edx, dword [esp + 0x120]
push ebp
push edx
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004012b0
add esp, 0x10
test eax, eax
jne 0x401685
pop ebp
pop ebx
add esp, 0x114
ret
push 0x110
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x4083a4], eax
jne 0x4016a4
pop ebp
pop ebx
add esp, 0x114
ret
mov ecx, dword [ebx]
push 0x4083a0
push 0x40
push 0x110
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, dword [0x4083a4]
mov eax, dword [ebx]
push 0x408674
push 0x110
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x4016f1
mov ecx, dword [0x4083a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov eax, dword [ebx]
push 0x408678
lea edx, [esp + 0x10]
push 0x110
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401726
mov ecx, dword [0x4083a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
push esi
push edi
mov ecx, 0xb3
mov esi, 0x407e00
mov edi, 0x4080d0
rep movsd dword es:[edi], dword [esi]
mov dword [0x408188], ebp
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0xa]
mov dword [0x40867c], eax
mov dword [0x4083a8], 0x10003
push 0x32
call esi
mov ecx, dword [ebx + 4]
push 0x4083a8
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [0x408460]
mov eax, dword [0x40867c]
cmp edx, eax
jne 0x401761
mov eax, dword [0x408458]
mov dword [0x408684], eax
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [0x4083a4]
mov eax, dword [ebx]
push 0x408678
push 0x110
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
pop edi
pop esi
test eax, eax
jne 0x4017d0
mov ecx, dword [0x4083a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov edx, dword [0x4083a4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x4083a0]
mov edx, dword [0x408680]
lea eax, [esp + 8]
push eax
mov eax, dword [ebx]
push ecx
push 0x110
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [0x407eb8], ebp
mov ecx, dword [ebx + 4]
push 0x407e00
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
neg eax
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x114
ret
Function at 0x401830
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 0x118
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.VirtualAllocEx
push esi
call edi
push str.VirtualFreeEx
push esi
mov ebx, eax
call edi
mov edi, eax
test edi, edi
je 0x401868
test ebx, ebx
jne 0x401881
push 0
push 0
push str.couldnt_import_virtualallocex
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [esp + 0x12c]
push 0x40
push 0x1000
push 0x111
mov eax, dword [esi]
push 0
push eax
call ebx
test eax, eax
mov dword [0x408680], eax
je 0x40193f
mov ecx, dword [esp + 0x128]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0
call fcn.004012b0
add esp, 0x10
test eax, eax
je 0x40192a
mov eax, dword [0x408680]
mov ecx, dword [esi]
push 0x408678
lea edx, [esp + 0x14]
push 0x111
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401908
mov edx, dword [0x408680]
mov eax, dword [esi]
push 0x4000
push 0x111
push edx
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
mov eax, dword [0x408680]
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push eax
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x40194b
mov eax, dword [0x408680]
mov ecx, dword [esi]
push 0x4000
push 0x111
push eax
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x408684
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
push 0x4000
push 0x111
jne 0x401986
mov edx, dword [0x408680]
mov eax, dword [esi]
push edx
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x118
ret
mov ecx, dword [0x408680]
mov edx, dword [esi]
push ecx
push edx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x408684]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
add esp, 0x118
ret
Function at 0x403465
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407570
cmp edx, dword [eax]
je 0x403487
add eax, 8
inc ecx
cmp eax, 0x407600
jl 0x403478
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407570]
jne 0x4035b5
mov eax, dword [0x4087b0]
cmp eax, 1
je 0x40358f
test eax, eax
jne 0x4034b8
cmp dword [0x407234], 1
je 0x40358f
cmp edx, 0xfc
je 0x4035b5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4034ef
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404980
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004036f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403532
lea eax, [ebp - 0x1a4]
push eax
call fcn.004036f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40646c
push edi
call fcn.00404ee0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404980
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404990
lea eax, [ebp - 0xa0]
push 0x40644c
push eax
call fcn.00404990
push dword [esi + 0x407574]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404990
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00404e50
add esp, 0x2c
pop edi
jmp 0x4035b5
lea eax, [ebp + 8]
lea esi, [esi + 0x407574]
push 0
push eax
push dword [esi]
call fcn.004036f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x410620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40c015
lea edi, [esi - 0xb015]
push edi
or ebp, 0xffffffff
jmp 0x410642
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410649
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410638
mov eax, 1
add ebx, ebx
jne 0x41065b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41066c
jne 0x41068b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41068b
dec eax
add ebx, ebx
jne 0x410678
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x410650
add ebx, ebx
jne 0x410687
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4106dd
xor ecx, ecx
sub eax, 3
jb 0x4106a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410712
sar eax, 1
mov ebp, eax
jmp 0x4106ae
add ebx, ebx
jne 0x4106ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41067c
inc ecx
add ebx, ebx
jne 0x4106bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41067c
add ebx, ebx
jne 0x4106c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4106be
jne 0x4106da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4106be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4106fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4106ee
jmp 0x41063e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4106fc
add edi, ecx
jmp 0x41063e
pop esi
mov edi, esi
mov ecx, 0x8000
jmp 0x41074d
mov al, byte [edi]
inc edi
cmp al, 0x80
jb 0x41072d
cmp al, 0x8f
ja 0x41072d
cmp byte [edi - 2], 0xf
je 0x410733
sub al, 0xe8
cmp al, 1
ja 0x410757
cmp ecx, 4
jb 0x41075c
mov eax, dword [edi]
sub al, 3
jne 0x410757
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jb 0x41075c
mov al, byte [edi]
inc edi
jmp 0x41072d
sub ecx, 1
jae 0x41071c
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x4107a4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10058]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410762
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10060]
or eax, eax
je 0x41079e
mov dword [ebx], eax
add ebx, 4
jmp 0x41077f
call dword [esi + 0x1005c]
mov ebp, dword [esi + 0x10064]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4107d8
sub esp, 0xffffff80
jmp 0x401225