joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486d20
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
xor eax, eax
cmp dword [edx + 0x24], eax
mov dword [esp], eax
jle 0x486e39
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esp + 0xc]
push eax
mov esi, ebx
call fcn.00485e20
mov edx, dword [ebx + 0xd14]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea ebp, [ebx + ecx*4]
mov ecx, dword [edx + 0x144]
mov edx, dword [esp + 0x10]
lea esi, [ecx + edx + 0x28]
mov edx, dword [ebp + 0xd8]
mov edi, eax
call fcn.00489b50
cmp byte [ebp + 0xd0], 0
je 0x486e11
mov eax, dword [ebp + 0xd4]
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x34]
cmp eax, 0x3c
je 0x486de2
cmp eax, 0x3d
je 0x486de2
cmp eax, 0x3e
je 0x486de2
cmp eax, 0x3f
je 0x486de2
cmp eax, 0x40
je 0x486de2
cmp eax, 0x41
je 0x486de2
cmp eax, 0x42
je 0x486de2
cmp eax, 0x43
je 0x486de2
cmp eax, 0x44
je 0x486de2
cmp eax, 0x45
je 0x486de2
cmp eax, 0x46
je 0x486de2
cmp eax, 0x47
je 0x486de2
cmp eax, 0x48
je 0x486de2
cmp eax, 0x49
je 0x486de2
cmp eax, 0x4a
jne 0x486de6
xor eax, eax
jmp 0x486e06
cmp eax, 0x30
jne 0x486dfc
cmp ecx, 0xffffffff
je 0x486dfc
lea ecx, [ecx + ecx*8]
mov eax, dword [ecx*4 + 0x69f2c4]
jmp 0x486e06
lea edx, [eax + eax*8]
mov eax, dword [edx*4 + 0x69f2c4]
mov dword [esi + 0x28], eax
mov byte [esi + 0x49], 1
mov byte [esi + 0x48], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
add dword [esp + 0x10], 0x50
add eax, 1
cmp eax, dword [edx + 0x24]
mov dword [esp + 0xc], eax
jl 0x486d44
pop edi
pop esi
pop ebp
mov eax, dword [ebx + 0xd14]
mov eax, dword [eax + 0x15c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x774]
mov byte [edx + 0x55], 0
mov ecx, dword [eax + 0x20]
mov edx, dword [0x6aa230]
lea ecx, [ecx + edx + 0xa]
mov edx, dword [eax]
mov byte [eax + 0x2c], 0
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x320]
mov edx, dword [ecx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x20]
push eax
call edx
add esp, 8
ret

Function at 0x4876f0
Capabilities:
Parse credit card information

Disassembly:
push 0xffffffffffffffff
push 0x64e87f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
mov ebx, dword [esp + 0xf8]
cmp ebx, 0x30
push ebp
push esi
mov esi, dword [esp + 0xf4]
push edi
mov edi, dword [esp + 0x108]
mov ebp, ebx
jne 0x487732
cmp edi, 0xffffffff
je 0x487732
mov ebp, edi
cmp ecx, 0xff
je 0x487748
push ecx
mov edx, ecx
lea eax, [esp + 0x50]
call fcn.005643d0
jmp 0x487772
fldz
fcomp dword [esp + 0x10c]
fnstsw ax
test ah, 5
jp 0x487782
push 0xff
mov edx, 0x80
push 0x80
mov ecx, edx
lea eax, [esp + 0x54]
call fcn.005643f0
mov ecx, esi
call fcn.00586cc0
mov cl, 1
mov eax, esi
call fcn.00586d10
jmp 0x7967d0
Function at 0x488590
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x64f7f8
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
mov ecx, dword [ebp]
cmp dword [ecx + 0x7fc], 3
push esi
push edi
jne 0x488ea6
mov eax, dword [ebp + 0x34]
cmp eax, 0xffffffff
je 0x488ea6
cmp dword [ecx + 0x768], 0
je 0x488666
cmp dword [ecx + 0x7f8], 0x12
jne 0x488666
mov eax, dword [ebp + 4]
mov ecx, dword [eax + 0x140]
cmp dword [ecx + 0x88], 0
jne 0x488638
push str._ADVICE_SLOT_MACHINE_PULL_
lea ecx, [esp + 0x14]
call fcn.00404450
mov dword [esp + 0x6c], 0
mov edi, dword [ebp + 4]
mov esi, dword [edi + 0x140]
mov ecx, 9
lea edx, [esp + 0x10]
call fcn.00459010
lea ecx, [esp + 0x10]
mov dword [edi + 0x55ec], 0xffffffff
call fcn.00404420
mov edx, dword [ebp + 4]
mov ecx, dword [edx + 0x160]
mov eax, dword [ecx + 0x70]
cmp eax, 2
jl 0x48864e
mov eax, 2
mov dword [ecx + 0x70], eax
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 4
mov esi, eax
cmp esi, 0x30
jne 0x488677
mov edx, dword [ebp + 0x38]
cmp edx, 0xffffffff
je 0x488677
mov esi, edx
jmp 0x796980
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x60
ret 4
Function at 0x522580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
add eax, 0x30c
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push esi
mov eax, edi
fstp dword [edi + 0x2c]
call fcn.00531880
mov ecx, dword [ebp + 0xc]
fstp dword [edi + 0x30]
fldz
mov dl, byte [ebp + 0x10]
xor ebx, ebx
fst dword [edi + 0x34]
mov eax, 0x78
fst dword [edi + 0x120]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x65]
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x24], ecx
mov byte [edi + 0x50], dl
mov byte [edi + 0x51], bl
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb0], ebx
mov byte [edi + 0xb8], bl
mov byte [edi + 0xb9], bl
mov byte [edi + 0xba], 1
mov byte [edi + 0xbb], 1
mov byte [edi + 0xbc], bl
mov byte [edi + 0xbd], bl
mov byte [edi + 0xbe], bl
mov dword [edi + 0xc4], ebx
mov dword [edi + 0xd8], ebx
mov byte [edi + 0xbf], bl
mov dword [edi + 0xc0], ebx
mov dword [edi + 0x38], ebx
call fcn.005af400
add eax, 0x190
mov dword [edi + 0x3c], eax
mov eax, 0xc
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, 0x24
mov dword [edi + 0x8c], eax
mov eax, 0x2a
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], eax
mov eax, 0x32
mov dword [edi + 0x9c], eax
or esi, 0xffffffff
lea ecx, [ebx + 0x73]
mov dword [edi + 0xa0], ebx
mov eax, 0x14
mov dword [edi + 0xa4], eax
mov dword [edi + 0x60], ebx
mov dword [edi + 0x80], esi
mov dword [edi + 0x28], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x88], bl
mov byte [edi + 0x70], bl
mov dword [edi + 0xf0], ebx
mov dword [edi + 0x98], ecx
mov dword [edi + 0xa8], ecx
mov byte [edi + 0x104], bl
mov dword [edi + 0x74], esi
fld1
mov byte [edi + 0x78], bl
fstp dword [edi + 0x11c]
mov dword [edi + 0x7c], esi
mov dword [edi + 0xdc], ebx
mov dword [edi + 0xd0], ebx
fst dword [edi + 0x84]
mov dword [edi + 0xe4], ebx
fstp dword [edi + 0x124]
mov dword [edi + 0x110], ebx
mov dword [edi + 0x114], ebx
mov dword [edi + 0x138], esi
mov dword [edi + 0x134], esi
mov dword [edi + 0x13c], esi
mov dword [edi + 0x118], ebx
mov dword [edi + 0x128], ebx
mov dword [edi + 0x12c], ebx
mov dword [edi + 0x140], ebx
mov dword [edi + 0x144], ebx
mov dword [edi + 0x130], esi
mov dword [edi + 0x148], esi
mov byte [edi + 0x14c], bl
mov dword [edi + 0x150], ebx
mov dword [edi + 0x154], esi
mov dword [edi + 0xf4], ebx
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], ebx
mov dword [edi + 0x100], ebx
mov edx, dword [edi + 4]
cmp edx, ebx
je 0x52279b
mov eax, dword [edi + 0x6c]
push eax
call fcn.00409080
test al, al
je 0x52279b
fld dword [edi + 0x2c]
fadd qword [0x6794c8]
fstp dword [edi + 0x2c]
mov eax, edi
call fcn.00524a70
jmp loc.0079b3b0
Function at 0x525dc0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
cmp eax, 0xb
push edi
jne 0x525f40
cmp byte [esi + 0xba], 0
je 0x525f40
cmp dword [esi + 0x64], 0
jne 0x525f40
push 2
push esi
call fcn.0052e780
test eax, eax
mov dword [esp + 0x10], eax
je 0x525efe
mov edi, dword [eax + 0x1c]
mov eax, dword [eax + 0x28]
mov edx, dword [esi + 4]
push 3
mov ebx, eax
call fcn.00408e40
test eax, eax
je 0x525e7b
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x28]
mov esi, dword [eax + 0x1c]
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov eax, ebx
call fcn.0041c680
add eax, 0x28
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fld dword [edi + 0x2c]
fcompp
fnstsw ax
test ah, 5
jp 0x526181
cmp dword [edi + 0x64], 0
jne 0x526181
cmp dword [edi + 0x7c], ebx
je 0x526181
mov eax, dword [esp + 0x10]
mov dword [edi + 0x64], 6
mov ecx, dword [eax + 0x28]
mov dword [edi + 0x7c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0x14
push 3
push str.anim_jump
mov edi, esi
mov dword [esi + 0x28], 0xc
call fcn.00528b00
mov eax, dword [esi + 0x118]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
and eax, 0xffff
lea eax, [eax + eax*4]
shl eax, 5
add eax, dword [edx]
mov edx, dword [esp + 0x10]
fild dword [eax + 0x1c]
fdiv dword [eax + 8]
mov eax, dword [esi + 8]
sub eax, dword [edx + 8]
jmp fcn.0079bb70
mov eax, dword [esi]
call fcn.004537d0
test al, al
je 0x526181
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, esi
call fcn.0042b810
test eax, eax
je 0x526181
mov eax, dword [ebp + 8]
mov dword [esi + 0x28], 0xd
xor esi, esi
call fcn.0052f2e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xc
jne 0x526181
mov edx, dword [esi]
fld dword [0x679610]
jmp fcn.0079bac0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x527750
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, eax
cmp byte [edi + 0xba], 0
je 0x527a98
mov eax, dword [edi + 0x68]
cmp eax, 0x64
jne 0x5277d9
mov eax, dword [edi]
mov edi, dword [edi + 0x144]
mov ecx, dword [eax + 0x820]
mov edx, dword [ecx + 8]
and edi, 0xffff
lea esi, [edi + edi*4]
shl esi, 5
add esi, dword [edx]
push 0x14
push esi
call fcn.00473310
fld dword [0x6797f0]
fstp dword [esi + 8]
lea eax, [esi + 0x1c]
fldz
push eax
fstp dword [esi + 4]
lea ecx, [esi + 0x18]
fld dword [0x679378]
push ecx
mov edx, str.anim_shooting
fstp dword [esi + 0x94]
mov eax, esi
mov dword [esi + 0x10], 3
mov dword [esi + 0x5c], 0
call fcn.004731d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
jmp fcn.0079c290
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x52edb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [esp + 0x10]
call fcn.00532140
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp 0x52ede0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
lea esi, [esp + 0xc]
call fcn.0041c950
test al, al
je 0x52ee7c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov esi, dword [esp + 0xc]
cmp edx, dword [esi + 0x1c]
jne 0x52ede0
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00467ef0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jge 0x52ee24
mov edx, dword [esp + 0x18]
lea eax, [ebx + edi]
add edx, ecx
jmp 0x52ee2f
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, edi
lea edx, [ebx + edi]
cmp eax, ecx
jg 0x52ee37
sub eax, ecx
jmp 0x52ee43
cmp eax, edx
jg 0x52ee3f
sub eax, ecx
jmp 0x52ee43
sub edx, ecx
mov eax, edx
cmp eax, 0x14
jl 0x52ede0
mov ecx, dword [ebp + 8]
push 1
push esi
call fcn.0052e4c0
test al, al
je 0x52ede0
mov eax, dword [esi + 0x24]
cmp eax, 0x15
je 0x52ede0
jmp 0x799500
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x52eee6
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x52eec2
cmp eax, 0x3e
je 0x52eec2
cmp eax, 0x3f
je 0x52eec2
cmp eax, 0x40
je 0x52eec2
cmp eax, 0x41
je 0x52eec2
cmp eax, 0x42
je 0x52eec2
cmp eax, 0x43
je 0x52eec2
cmp eax, 0x44
je 0x52eec2
cmp eax, 0x45
je 0x52eec2
cmp eax, 0x46
jne 0x52eee6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52eee6
mov edx, dword [edi + 4]
mov ecx, dword [edx + 0x160]
push ecx
call fcn.0042ba30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x539390
Capabilities:
Packed with generic packer

Disassembly:
push ecx
test ebx, ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi + 0x28]
mov dword [edi + 0xf0], eax
jge 0x5393b2
or dword [edi + 0xec], 2
jmp 0x5393c7
cmp ebx, 3
jne 0x5393c0
or dword [edi + 0xec], 4
jmp 0x5393c7
or dword [edi + 0xec], 1
push esi
push ebp
call fcn.005391c0
mov ecx, dword [edi + 0x6c]
test ecx, ecx
je 0x5393ec
mov edx, dword [ecx]
mov eax, dword [edx + 0x110]
push esi
push ebp
call eax
test al, al
jne 0x5393ec
mov ecx, edi
call fcn.005391a0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
mov eax, esi
mov ecx, ebp
mov edx, edi
call fcn.00538730
mov esi, eax
mov eax, dword [edi + 0x8c]
test eax, eax
je 0x53940f
mov esi, eax
test ebx, ebx
jge 0x539426
or dword [edi + 0xe8], 2
mov dword [edi + 0x1f4], 0xffffffff
jmp 0x53944f
cmp ebx, 3
jne 0x53943e
or dword [edi + 0xe8], 4
mov dword [edi + 0x1f4], 2
jmp 0x53944f
mov eax, 1
jmp 0x79f3c0
test esi, esi
mov dword [edi + 0x8c], esi
je 0x53948e
mov eax, dword [esi]
mov edx, dword [eax + 0xa8]
mov ecx, esi
call edx
test al, al
je 0x539473
mov eax, dword [edi]
mov edx, dword [eax + 0x20]
push esi
mov ecx, edi
call edx
mov eax, dword [esi]
mov eax, dword [eax + 0xd8]
mov byte [esi + 0x58], 1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ebx
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 4
Function at 0x61cfb2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x61cfef
cmp dword [ebp + 0x14], edi
je 0x61cfef
cmp ecx, edi
jne 0x61cff6
call fcn.0062120f
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0061c61b
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x61d00a
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x61d02b
cmp ebx, 0xffffffff
je 0x61d01a
push ebx
push edi
push ecx
call fcn.00626020
add esp, 0xc
cmp esi, edi
je 0x61cfd7
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x61cfd7
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x61d047
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x61d04e
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x61d13f
test word [esi + 0xc], 0x10c
je 0x61d0a2
mov eax, dword [esi + 4]
test eax, eax
je 0x61d0a2
jl 0x61d1a0
cmp ebx, eax
mov edi, ebx
jb 0x61d073
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x61d147
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0061be1b
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x61d137
cmp ebx, dword [ebp - 0xc]
jb 0x61d10f
cmp dword [ebp - 0xc], 0
je 0x61d0cc
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x61d0c1
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x61d0c8
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x61d0d7
mov eax, SysReAllocString
cmp ebx, eax
ja 0x61d0d7
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x61d173
push eax
push dword [ebp - 8]
push esi
call fcn.0062acfc
pop ecx
push eax
call fcn.0062b436
add esp, 0xc
test eax, eax
je 0x61d1b2
cmp eax, 0xffffffff
je 0x61d1a0
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x61d137
push esi
call fcn.0062ad55
cmp eax, 0xffffffff
pop ecx
je 0x61d1a4
cmp dword [ebp - 4], 0
je 0x61d173
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x61d056
mov eax, dword [ebp + 0x14]
jmp 0x61cff1
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x61d15e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00626020
add esp, 0xc
call fcn.0062120f
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x61cfe7
cmp dword [ebp + 0xc], 0xffffffff
je 0x61d189
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00626020
add esp, 0xc
call fcn.0062120f
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x61cfe7
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x61cff1
or dword [esi + 0xc], 0x10
jmp 0x61d1a4
Function at 0x796776
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ebx, eax
mov eax, dword [ebx + 0x34]
push edi
mov edi, dword [ebp + 4]
or edx, 0xffffffff
call fcn.0041dae0
mov edx, dword [ebp + 4]
mov esi, eax
mov dword [esp + 0x14], esi
call fcn.0041b980
mov eax, dword [ebx + 0x34]
pushal
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x82c]
xor byte [eax + ecx + 0x235], 1
popal
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x401647
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405120], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40508e], ecx
mov dword [0x405124], 0x30
mov dword [0x405128], 3
mov dword [0x405130], 0
mov dword [0x405134], 0
mov dword [0x40512c], 0x403148
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x405086], ebx
mov dword [0x405138], ebx
mov dword [0x405144], 0xf
mov dword [0x40514c], 0x405067
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40513c], eax
mov dword [0x405150], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x405140], eax
push 0x405124
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x405086]
push 0
push 0
push 0x2bc
push 0x1f4
push 0xa0
push 0x12c
push 0x40000
push str.Hello_word
push str.2class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x405118], eax
push 0
push dword [0x405118]
call sub.user32.dll_ShowWindow
push dword [0x405118]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0x405154
call sub.user32.dll_GetMessageA
or eax, eax
je 0x40176b
push 0x405154
call sub.user32.dll_TranslateMessage
push 0x405154
call sub.user32.dll_DispatchMessageA
jmp 0x401741
mov eax, dword [0x40515c]
mov esi, dword [0x4051b4]
lea ecx, [0x405086]
add esi, eax
call esi
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x699276a8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x35cb2bd2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x406af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x406b1b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407360
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x406b3d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x406b3f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x406bc3
jg 0x406b54
test esi, esi
je 0x406bc3
test ecx, ecx
jl 0x406b9d
jg 0x406b5e
test eax, eax
je 0x406b9d
cmp edi, ecx
jg 0x406b72
jl 0x406b68
cmp esi, eax
jae 0x406b72
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004fb890
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x406ba0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x406bc3
jg 0x406baa
test esi, esi
je 0x406bc3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x406bc3
push eax
push esi
push 1
push edx
call fcn.004ff3ad
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc