joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b473f9d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1b473fbf
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1b473fbf
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1b473fbf
ret
cmp word [ebx + 4], 0x14c
jne 0x1b473fbf
test word [ebx + 0x16], 2
je 0x1b473fbf
test word [ebx + 0x16], 0x100
je 0x1b473fbf
cmp word [ebx + 0x18], 0x10b
jne 0x1b473fbf
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1b473fbf
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1b47404b
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1b473fdf
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1b45af2a
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1b473fbf
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1b47404b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1b473fbf
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1b473fbf
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1b473fbf
ret
cmp word [ebx + 4], 0x14c
jne 0x1b473fbf
test word [ebx + 0x16], 2
je 0x1b473fbf
test word [ebx + 0x16], 0x100
je 0x1b473fbf
cmp word [ebx + 0x18], 0x10b
jne 0x1b473fbf
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1b473fbf
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1b47404b
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1b473fdf
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1b45af2a
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1b473fbf
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1b474102
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1b47415b
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1b474102
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1b474111
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1b879db4
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1b474162
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1b45afd8
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1b474201
add edi, 4
add eax, 2
dec ecx
jne 0x1b474147
call 0x1b4741ae
loope 0x1b4741a4
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1b4741fe
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1b47420f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1b4741c2
cmp eax, ecx
ja 0x1b4741c2
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1b47424c
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1b474242
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1b45b4b7
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1b474111
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1b47415b
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1b474102
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1b474111
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1b879db4
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1b474162
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1b45afd8
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1b474201
add edi, 4
add eax, 2
dec ecx
jne 0x1b474147
call 0x1b4741ae
loope 0x1b4741a4
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1b4741fe
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1b47420f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1b4741c2
cmp eax, ecx
ja 0x1b4741c2
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1b47424c
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1b474242
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1b45b4b7
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40ab10
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [edi + 0x8c]
cmp dword [eax + 0x768], 0
push esi
je 0x40ab8a
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x1e
je 0x40ab3b
test ecx, ecx
jne 0x40ab48
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 0xf
jne 0x40ab48
mov esi, dword [edi + 0x160]
call fcn.00425840
pop esi
ret
cmp dword [eax + 0x768], 0
je 0x40ab8a
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x11
je 0x40ab71
cmp ecx, 0x21
je 0x40ab71
test ecx, ecx
jne 0x40ab8a
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 5
jne 0x40ab8a
cmp dword [eax + 0x7f8], 0
jne 0x40ab3b
mov eax, dword [eax + 0x82c]
test eax, eax
je 0x40ab8a
cmp dword [eax + 0x2c], 0
jg 0x40ab3b
xor esi, esi
lea esp, [esp]
mov eax, esi
call fcn.0040d660
jmp 0x79b9da
Function at 0x412c30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x290
cmp dword [ebx + 0x5618], 0
push ebp
push esi
push edi
jg 0x412cd4
mov eax, dword [ebx + 0x5550]
cmp eax, 0x29
je 0x412c79
cmp eax, 0x2a
je 0x412c79
cmp eax, 0x2b
je 0x412c6f
cmp eax, 0x2c
je 0x412c6f
cmp eax, 0x2d
je 0x412c6f
mov esi, 3
lea edi, [esi + 4]
jmp 0x412c81
mov esi, 3
lea edi, [esi + 2]
jmp 0x412c81
mov esi, 2
lea edi, [esi + 1]
lea eax, [esp + 0xc]
call fcn.00412a90
mov eax, dword [esp + 0x294]
cmp esi, eax
jle 0x412c97
mov esi, eax
test eax, eax
je 0x412cd4
test esi, esi
jle 0x412cd4
mov ebp, esi
mov edx, ebx
call fcn.0040d770
mov esi, eax
jmp 0x794956
pop edi
pop esi
pop ebp
add esp, 0x290
ret

Function at 0x412ce0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [edi + 0x8c]
mov eax, dword [eax + 0x7f8]
sub esp, 0x10
cmp eax, 0x10
push ebx
push esi
je 0x412e2a
cmp eax, 0x20
je 0x412e2a
mov eax, dword [edi + 0x554c]
cmp eax, 4
je 0x412d1d
cmp eax, 5
jne 0x412dba
mov ebx, edi
call fcn.00412c30
mov edx, edi
call fcn.00412850
lea esi, [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
call fcn.0041cad0
test al, al
je 0x412e2a
jmp 0x412d50
mov eax, dword [esp + 0xc]
cmp dword [eax + 8], 1
jne 0x412e17
cmp dword [eax + 0x18], 0x64
jl 0x412e17
mov ecx, dword [edi + 0x8c]
cmp dword [ecx + 0x7f8], 0x2d
jne 0x412d8e
mov eax, dword [edi + 0x5564]
call fcn.005af400
cmp eax, dword [edi + 0x557c]
jg 0x412e17
mov edx, edi
call fcn.0040d770
mov ebx, dword [edi + 0x557c]
mov esi, eax
lea edx, [esi*8]
sub edx, esi
cmp esi, 0x19
lea eax, [edx*4 + 0x69da80]
mov dword [esp + 0x14], eax
jne 0x412dd4
xor eax, eax
jmp 0x412ddc
cmp eax, 2
je 0x412dc8
cmp eax, 3
jne 0x412d24
push edi
call fcn.004128f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov eax, edi
call fcn.0040dc50
jmp 0x7948c7
lea esi, [esp + 0xc]
mov edx, edi
call fcn.0041cad0
test al, al
jne 0x412d50
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412ee0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [edi + 0x160]
sub esp, 0x2a0
push ebx
push esi
call fcn.00426850
mov eax, dword [edi + 0x8c]
xor esi, esi
cmp dword [eax + 0x768], esi
je 0x412fa0
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x30
je 0x412f2c
cmp ecx, esi
jne 0x412fa0
mov eax, dword [eax + 0x82c]
cmp dword [eax + 0x24], 0x2d
jne 0x412fa0
lea eax, [esp + 0x18]
call fcn.00412a90
mov dword [esp + 8], esi
mov esi, dword [edi + 0x557c]
mov ecx, esi
imul ecx, ecx, 0x32
add ecx, dword [esp + 8]
mov ebx, dword [edi + ecx*4 + 0x6b4]
cmp ebx, 0xffffffff
je 0x413072
cmp ebx, 0x14
je 0x412f6f
cmp ebx, 0xc
je 0x412f6f
push ebx
push edi
lea eax, [esp + 0x20]
call fcn.00412b60
jmp 0x412f8b
cmp ebx, 0x19
jne 0x412f78
xor eax, eax
jmp 0x412f80
push ebx
mov eax, edi
call fcn.0040dc50
push eax
push ebx
mov ebx, esi
mov eax, edi
call fcn.0040ddc0
mov eax, dword [esp + 8]
add eax, 1
cmp eax, 0x32
mov dword [esp + 8], eax
jl 0x412f39
jmp 0x413072
mov dword [esp + 8], esi
mov ebx, dword [edi + 0x557c]
mov edx, ebx
imul edx, edx, 0x32
add edx, dword [esp + 8]
mov esi, dword [edi + edx*4 + 0x6b4]
cmp esi, 0xffffffff
je 0x413072
cmp esi, 0xd
jne 0x413044
mov eax, edi
call fcn.0040dd90
test al, al
jne 0x413044
mov dword [esp + 0xc], 4
nop
mov ebx, dword [edi + 0x557c]
push 0
mov eax, edi
call fcn.0040dc50
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x98]
sub eax, 1
cmp dword [edi + 0xa0], eax
jae 0x41303b
mov eax, 5
mov byte [esp + 0x10], 0
call fcn.005af400
test eax, eax
jne 0x41301c
mov byte [esp + 0x10], 1
lea esi, [edi + 0x90]
call fcn.0041dda0
mov ecx, dword [esp + 0x10]
push ebx
push 0
push ecx
push 0
push eax
mov eax, dword [esp + 0x28]
call fcn.00522580
sub dword [esp + 0xc], 1
jne 0x412fe0
jmp 0x41305e
cmp esi, 0x19
jne 0x41304d
xor eax, eax
jmp 0x413055
push esi
mov eax, edi
call fcn.0040dc50
push eax
push esi
mov eax, edi
call fcn.0040ddc0
mov eax, dword [esp + 8]
add eax, 1
cmp eax, 0x32
mov dword [esp + 8], eax
jl 0x412fa4
mov edx, dword [edi + 0x5564]
mov esi, dword [edi + 0x557c]
sub edx, 1
cmp esi, edx
jne 0x41309e
mov ecx, dword [edi + 0x8c]
call fcn.00453740
test al, al
jne 0x41309e
mov dword [edi + 0x5574], 0xc8
push esi
mov edx, edi
call fcn.00409080
test al, al
je 0x4130b4
mov dword [edi + 0x5614], 0x64
add esi, 1
add dword [edi + 0x5580], 1
jmp 0x79be04
Function at 0x45f720
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi]
fldz
sub esp, 0x18
cmp byte [eax + 0x8c5], 0
push ebx
push edi
jne 0x45f781
mov ecx, dword [0x6a9f00]
fst dword [esp + 8]
fcomp dword [ecx + 0xa0]
mov edi, dword [eax + 0x784]
fnstsw ax
test ah, 0x44
jnp 0x45f76b
fld dword [ecx + 0xa0]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0xc]
add esp, 4
fld dword [esp + 8]
push ecx
mov eax, 3
fstp dword [esp]
mov ecx, edi
call fcn.00515020
jmp 0x45f783
fstp st(0)
fld qword [0x679998]
mov dword [esp + 0x10], 0
call fcn.00639f90
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fmul qword [0x6796a0]
fstp dword [esp + 8]
fld qword [0x679998]
call fcn.0063a180
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fmul qword [0x6796a0]
fstp dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 8]
add eax, 0x19
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x20]
sub eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
lea edi, [eax + 0xc8]
add ebx, 0x19
call fcn.0041df60
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 7
push ecx
push edx
mov edi, eax
mov eax, dword [esp + 0x28]
push ebx
push edi
call fcn.0046c730
push 0
mov eax, esi
call fcn.0045eb10
jmp 0x798de1
Function at 0x4679b0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp byte [ebp + 0x144], 0
push esi
push edi
je 0x4679fc
cmp dword [ebp + 0x24], 0x13
jne 0x4679fc
mov ecx, dword [ebp + 4]
mov edx, dword [ebp + 0x12c]
add ecx, 0x90
test edx, edx
je 0x4679fc
movzx eax, dx
cmp eax, dword [ecx + 8]
jae 0x4679fc
imul eax, eax, 0x15c
add eax, dword [ecx]
cmp dword [eax + 0x158], edx
jne 0x4679fc
mov ecx, eax
call fcn.005302f0
mov esi, ebp
jmp loc.00796ea0
Function at 0x46ecb0
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push ebp
push esi
push edi
mov edi, ecx
jmp loc.00797228
Function at 0x522580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
add eax, 0x30c
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push esi
mov eax, edi
fstp dword [edi + 0x2c]
call fcn.00531880
mov ecx, dword [ebp + 0xc]
fstp dword [edi + 0x30]
fldz
mov dl, byte [ebp + 0x10]
xor ebx, ebx
fst dword [edi + 0x34]
mov eax, 0x78
fst dword [edi + 0x120]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x65]
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x24], ecx
mov byte [edi + 0x50], dl
mov byte [edi + 0x51], bl
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb0], ebx
mov byte [edi + 0xb8], bl
mov byte [edi + 0xb9], bl
mov byte [edi + 0xba], 1
mov byte [edi + 0xbb], 1
mov byte [edi + 0xbc], bl
mov byte [edi + 0xbd], bl
mov byte [edi + 0xbe], bl
mov dword [edi + 0xc4], ebx
mov dword [edi + 0xd8], ebx
mov byte [edi + 0xbf], bl
mov dword [edi + 0xc0], ebx
mov dword [edi + 0x38], ebx
call fcn.005af400
add eax, 0x190
mov dword [edi + 0x3c], eax
mov eax, 0xc
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, 0x24
mov dword [edi + 0x8c], eax
mov eax, 0x2a
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], eax
mov eax, 0x32
mov dword [edi + 0x9c], eax
or esi, 0xffffffff
lea ecx, [ebx + 0x73]
mov dword [edi + 0xa0], ebx
mov eax, 0x14
mov dword [edi + 0xa4], eax
mov dword [edi + 0x60], ebx
mov dword [edi + 0x80], esi
mov dword [edi + 0x28], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x88], bl
mov byte [edi + 0x70], bl
mov dword [edi + 0xf0], ebx
mov dword [edi + 0x98], ecx
mov dword [edi + 0xa8], ecx
mov byte [edi + 0x104], bl
mov dword [edi + 0x74], esi
fld1
mov byte [edi + 0x78], bl
fstp dword [edi + 0x11c]
mov dword [edi + 0x7c], esi
mov dword [edi + 0xdc], ebx
mov dword [edi + 0xd0], ebx
fst dword [edi + 0x84]
mov dword [edi + 0xe4], ebx
fstp dword [edi + 0x124]
mov dword [edi + 0x110], ebx
mov dword [edi + 0x114], ebx
mov dword [edi + 0x138], esi
mov dword [edi + 0x134], esi
mov dword [edi + 0x13c], esi
mov dword [edi + 0x118], ebx
mov dword [edi + 0x128], ebx
mov dword [edi + 0x12c], ebx
mov dword [edi + 0x140], ebx
mov dword [edi + 0x144], ebx
mov dword [edi + 0x130], esi
mov dword [edi + 0x148], esi
jmp fcn.007946b5
Function at 0x52bb40
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
cmp dword [edi + 0x28], 0x3c
push ebx
push esi
je 0x52bc9a
mov eax, dword [edi]
call fcn.004537d0
test al, al
je 0x52bb8b
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52bb8b
mov ecx, dword [eax + 0x4c]
cmp ecx, 0x19
jg 0x52bb82
mov ecx, 0x19
mov dword [eax + 0x4c], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.0052e780
test eax, eax
mov dword [esp + 0x10], eax
je 0x52bc9a
mov ecx, dword [eax + 0x24]
cmp ecx, 3
je 0x52bbb0
cmp ecx, 0x17
jne 0x52bc84
mov ebx, dword [edi + 0x1c]
imul ebx, ebx, 0x2710
lea esi, [esp + 0x14]
mov ecx, edi
add ebx, 0x4a768
call fcn.0052d9e0
mov edx, dword [edi + 0x24]
cmp edx, 0xb
fld dword [edi + 0x2c]
fadd qword [0x679908]
fstp dword [esp + 0xc]
fld dword [edi + 0x30]
fadd qword [0x6794c8]
fadd dword [esp + 0x20]
fstp dword [esp + 8]
je 0x52bc40
cmp edx, 0xe
je 0x52bc40
mov ecx, edi
call fcn.0052bee0
test al, al
je 0x52bc10
fld dword [esp + 0xc]
fadd qword [0x679550]
fstp dword [esp + 0xc]
jmp 0x52bc5c
cmp edx, 0x10
jne 0x52bc21
fld dword [esp + 8]
fadd qword [0x679550]
jmp 0x52bc58
cmp edx, 0x18
jne 0x52bc5c
fld dword [esp + 0xc]
fadd qword [0x679350]
fstp dword [esp + 0xc]
fld dword [esp + 8]
fadd qword [0x6794c8]
jmp 0x52bc58
fld dword [esp + 0xc]
fsub qword [0x679560]
fstp dword [esp + 0xc]
fld dword [esp + 8]
fadd qword [0x679590]
fstp dword [esp + 8]
mov edx, dword [edi]
fld dword [esp + 8]
mov eax, dword [edx + 0x820]
mov esi, dword [eax]
push 0x23
push ebx
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fstp dword [esp]
call fcn.00518a70
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xb8]
cmp ecx, 0x19
jg 0x52bc94
mov ecx, 0x19
jmp fcn.007946e8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x530510
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push edi
mov edi, ecx
push edi
call fcn.00530850
mov ecx, dword [edi + 0x110]
test ecx, ecx
je 0x53056b
mov eax, dword [0x6a9eb8]
mov edx, dword [eax + 0xc]
movzx eax, cx
cmp eax, dword [edx + 8]
jb 0x53053e
xor ecx, ecx
jmp 0x530558
imul eax, eax, 0x30c
add eax, dword [edx]
xor edx, edx
cmp dword [eax + 0x308], ecx
setne dl
sub edx, 1
and edx, eax
mov ecx, edx
test ecx, ecx
mov dword [edi + 0x110], 0
je 0x53056b
call fcn.00404fc0
mov ecx, dword [edi]
mov eax, dword [edi + 0x118]
test eax, eax
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
je 0x53059d
movzx ecx, ax
cmp ecx, dword [edx + 8]
jae 0x53059d
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, dword [edx]
cmp dword [ecx + 0x9c], eax
jne 0x53059d
call fcn.004733f0
mov ecx, dword [edi]
mov eax, dword [edi + 0x150]
test eax, eax
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
je 0x5305cf
movzx ecx, ax
cmp ecx, dword [edx + 8]
jae 0x5305cf
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, dword [edx]
cmp dword [ecx + 0x9c], eax
jne 0x5305cf
call fcn.004733f0
mov ecx, dword [edi]
mov eax, dword [edi + 0x144]
test eax, eax
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
je 0x530601
movzx ecx, ax
cmp ecx, dword [edx + 8]
jae 0x530601
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, dword [edx]
cmp dword [ecx + 0x9c], eax
jne 0x530601
call fcn.004733f0
push edi
jmp 0x798135
Function at 0x530a00
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 0xd8]
push esi
xor esi, esi
cmp eax, esi
push edi
je 0x530bb1
mov ebx, dword [ebp + 0x20]
add ebx, 1
cmp eax, 1
mov dword [esp + 0x20], esi
jne 0x530a7b
mov eax, ebp
call fcn.005330e0
test byte [esp + 0x24], 0x10
jne 0x530bab
lea eax, [esp + 0x20]
push eax
push str.anim_screendoor
lea edi, [esp + 0x2c]
mov esi, ebp
call fcn.005345f0
fld dword [esp + 0x24]
mov eax, dword [ebp]
mov ecx, dword [eax + 0x820]
mov esi, dword [ecx]
push 0xc
push ebx
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x30]
fstp dword [esp]
call fcn.00518a70
jmp 0x530b8e
cmp eax, 2
jne 0x530b40
mov edi, ebp
call fcn.0052f440
cmp byte [ebp + 0xbf], 0
je 0x530aa9
push esi
mov eax, ebp
call fcn.0052b5b0
mov byte [ebp + 0xbf], 0
mov dword [ebp + 0xc0], esi
fld dword [0x6796f4]
push ecx
fstp dword [esp]
push 0xa
push 3
push str.anim_gasp
mov dword [ebp + 0x28], 0x1e
call fcn.00528b00
mov eax, ebp
call fcn.005330e0
mov eax, dword [esp + 0x24]
and eax, 0x10
mov dword [esp + 0x18], eax
jne 0x530b1a
lea edx, [esp + 0x14]
push edx
push str.Zombie_paper_paper
lea edi, [esp + 0x28]
mov esi, ebp
call fcn.005345f0
fld dword [esp + 0x20]
mov edx, dword [ebp]
sub esp, 8
fstp dword [esp + 4]
mov eax, 0xd
fld dword [esp + 0x1c]
mov ecx, ebx
fstp dword [esp]
call fcn.00453c80
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x530b92
test byte [esp + 0x24], 1
jne 0x530b92
lea esi, [eax + 0x43]
mov eax, dword [ebp]
call fcn.00453630
push 0
lea edx, [esi + 0x32]
push 0xfffffffffffffff5
mov esi, ebp
call fcn.005322c0
jmp 0x530b92
cmp eax, 3
jne 0x530bab
mov eax, ebp
call fcn.005330e0
test byte [esp + 0x24], 0x10
jne 0x530bab
fld dword [ebp + 0x2c]
mov edx, dword [ebp]
fadd qword [0x679968]
sub esp, 8
mov eax, 0x36
mov ecx, ebx
fstp dword [esp + 0x28]
fld dword [ebp + 0x30]
fadd qword [0x679820]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp + 4]
fld dword [esp + 0x28]
fstp dword [esp]
call fcn.00453c80
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
xor esi, esi
cmp edx, esi
je 0x530bab
fld dword [ebp + 0x11c]
push ecx
fstp dword [esp]
call fcn.00518630
jmp 0x794dba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x126f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x12790
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x12770
xor eax, eax
push ebp
push 0x12769
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x127ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x12770
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret