joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af465
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5385d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x110], bl
call fcn.004b7880
add esp, 0xc
push str.Live2.ark
lea edi, [ebp - 0x110]
call fcn.00444791
pop ecx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x124]
mov edx, edi
call fcn.00402a41
test eax, eax
pop ecx
jne 0x4af4e1
xor eax, eax
jmp 0x4af566
call fcn.004a6bcb
push ebx
push ebx
mov esi, eax
call fcn.004610ab
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.004b77ce
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x2e6
push str..UpdatePAULA2.c
mov edx, 0x4d520c
lea ecx, [ebp - 0x110]
call fcn.0041e477
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x4af575
lea edi, [ebp - 0x110]
call fcn.0041c5ff
test eax, eax
je 0x4af563
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004a6bcb
sub eax, esi
cmp eax, 0x157c
ja 0x4af563
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4af50a
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7140
leave
ret
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.004b7b96
add esp, 0x10
cmp eax, esi
je 0x4af5a2
lea eax, [ebp - 0x110]
push eax
push str.:8:IsNewUpdateAvailable___encountered_a_problem:_fread___s___FAILED_to_read_the_archive_size_
call fcn.0041936e
pop ecx
pop ecx
push edi
push esi
lea eax, [ebp - 0x118]
push 4
push eax
call fcn.004b7b96
add esp, 0x10
cmp eax, esi
je 0x4af5cc
lea eax, [ebp - 0x110]
push eax
push str.:8:IsNewUpdateAvailable___encountered_a_problem:_fread___s___FAILED_to_read_the_archive_CheckSum_
call fcn.0041936e
pop ecx
pop ecx
mov ecx, edi
call fcn.0041e8bf
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x118]
jne 0x4af5f3
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x11c]
je 0x4af4da
mov eax, esi
jmp 0x4af566
Function at 0x4af5fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5385d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x110], bl
call fcn.004b7880
add esp, 0xc
mov edx, esi
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
call fcn.0047ebaf
test eax, eax
je 0x4af64d
xor eax, eax
jmp 0x4af769
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
mov edx, esi
call fcn.00402a41
test eax, eax
pop ecx
jne 0x4af675
push esi
push str.:6:SetLastSuccessfulUpdate___FAILED:_GetArchiveCheckSum___s___FAILED.
call fcn.00418e96
pop ecx
pop ecx
jmp 0x4af646
call fcn.004a6bcb
push ebx
push ebx
mov esi, eax
call fcn.004610ab
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.004b77ce
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x327
push str..UpdatePAULA2.c
mov edx, 0x4d57c8
lea ecx, [ebp - 0x110]
call fcn.0041e477
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x4af709
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004a6bcb
sub eax, esi
cmp eax, 0x157c
ja 0x4af6e8
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4af69e
call fcn.004a6bcb
sub eax, esi
push eax
lea eax, [ebp - 0x110]
push eax
push str.:8:SetLastSuccessfulUpdate___FAILED:_The_last_applied_update_file___s__could_not_be_opened_for_writing_after__ldms_
call fcn.00418e96
add esp, 0xc
jmp 0x4af646
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x118]
push 4
push eax
call fcn.004b6868
add esp, 0x10
cmp eax, esi
je 0x4af736
lea eax, [ebp - 0x110]
push eax
push str.:8:SetLastSuccessfulUpdate___encountered_a_problem:_fwrite___s___FAILED_to_write_the_archive_size_
call fcn.0041936e
pop ecx
pop ecx
push edi
push esi
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.004b6868
add esp, 0x10
cmp eax, esi
je 0x4af760
lea eax, [ebp - 0x110]
push eax
push str.:8:SetLastSuccessfulUpdate___encountered_a_problem:_fwrite___s___FAILED_to_write_the_archive_CheckSum_
call fcn.0041936e
pop ecx
pop ecx
mov ecx, edi
call fcn.0041e8bf
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7140
leave
ret
Function at 0x4b7140
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5385d0]
jne 0x4b714a
repz ret
jmp fcn.004be90a
Function at 0x4b78fa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4b7937
cmp dword [ebp + 0x14], edi
je 0x4b7937
cmp ecx, edi
jne 0x4b793e
call fcn.004bc9eb
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004bdab8
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4b7952
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4b7973
cmp ebx, 0xffffffff
je 0x4b7962
push ebx
push edi
push ecx
call fcn.004b7880
add esp, 0xc
cmp esi, edi
je 0x4b791f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4b791f
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4b798f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4b7996
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4b7a87
test word [esi + 0xc], 0x10c
je 0x4b79ea
mov eax, dword [esi + 4]
test eax, eax
je 0x4b79ea
jl 0x4b7ae8
cmp ebx, eax
mov edi, ebx
jb 0x4b79bb
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4b7a8f
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004c0e22
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4b7a7f
cmp ebx, dword [ebp - 0xc]
jb 0x4b7a57
cmp dword [ebp - 0xc], 0
je 0x4b7a14
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x4b7a09
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4b7a10
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4b7a1f
mov eax, closesocket
cmp ebx, eax
ja 0x4b7a1f
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4b7abb
push eax
push dword [ebp - 8]
push esi
call fcn.004be33a
pop ecx
push eax
call fcn.004c0d25
add esp, 0xc
test eax, eax
je 0x4b7afa
cmp eax, 0xffffffff
je 0x4b7ae8
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4b7a7f
push esi
call fcn.004be7ea
cmp eax, 0xffffffff
pop ecx
je 0x4b7aec
cmp dword [ebp - 4], 0
je 0x4b7abb
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4b799e
mov eax, dword [ebp + 0x14]
jmp 0x4b7939
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4b7aa6
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004b7880
add esp, 0xc
call fcn.004bc9eb
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4b792f
cmp dword [ebp + 0xc], 0xffffffff
je 0x4b7ad1
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004b7880
add esp, 0xc
call fcn.004bc9eb
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4b792f
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4b7939
or dword [esi + 0xc], 0x10
jmp 0x4b7aec
Function at 0x4c0f62
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x538d00]
je 0x4c0f7d
inc edi
cmp edi, 0x17
jb 0x4c0f6e
cmp edi, 0x17
jae 0x4c10fd
push ebp
push 3
call fcn.004c893d
cmp eax, 1
pop ecx
je 0x4c10c9
push 3
call fcn.004c893d
test eax, eax
pop ecx
jne 0x4c0fb1
cmp dword [0x5382f0], 1
je 0x4c10c9
cmp ebx, 0xfc
je 0x4c10fc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x547540
push ebp
call fcn.004c8549
add esp, 0xc
test eax, eax
je 0x4c0fe7
push esi
push esi
push esi
push esi
push esi
call fcn.004bd9bc
add esp, 0x14
push 0x104
mov esi, 0x547559
push esi
push 0
mov byte [0x54765d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c102b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004c8549
add esp, 0xc
test eax, eax
je 0x4c102b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004bd9bc
add esp, 0x14
push esi
call fcn.004b68f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4c1070
push esi
call fcn.004b68f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x547854
push 0x4d1208
sub ecx, eax
push ecx
push eax
call fcn.004c8496
add esp, 0x14
test eax, eax
je 0x4c1070
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004bd9bc
add esp, 0x14
jmp 0x4c1072
xor esi, esi
push 0x4e8784
push ebx
push ebp
call fcn.004c83d9
add esp, 0xc
test eax, eax
je 0x4c1092
push esi
push esi
push esi
push esi
push esi
call fcn.004bd9bc
add esp, 0x14
push dword [edi*8 + 0x538d04]
push ebx
push ebp
call fcn.004c83d9
add esp, 0xc
test eax, eax
je 0x4c10b4
push esi
push esi
push esi
push esi
push esi
call fcn.004bd9bc
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004c8780
add esp, 0xc
jmp 0x4c10fc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4c10fc
cmp ebp, 0xffffffff
je 0x4c10fc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x538d04]
push dword [esi]
call fcn.004b68f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4c1779
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4c17a6
call fcn.004bc9fe
mov dword [eax], esi
call fcn.004bc9eb
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004bdab8
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4c1782
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c17d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004bca11
pop ecx
call fcn.004bc9eb
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4c17fc
test al, 1
je 0x4c17fc
test byte [esp + 0xc], 2
je 0x4c17fc
call fcn.004bc9fe
mov dword [eax], 5
call fcn.004bc9eb
mov dword [eax], 0xd
jmp 0x4c17cc
xor eax, eax
pop esi
ret
Function at 0x4c8780
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004bf629
xor ebx, ebx
cmp dword [0x5479ac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4c8856
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4c8936
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4d5034
push edi
call esi
cmp eax, ebx
je 0x4c8936
push eax
call fcn.004bf5bb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5479ac], eax
call esi
push eax
call fcn.004bf5bb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5479b0], eax
call esi
push eax
call fcn.004bf5bb
mov dword [0x5479b4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004ba002
test eax, eax
pop ecx
pop ecx
je 0x4c8824
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004bd9bc
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4c8856
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004bf5bb
cmp eax, ebx
pop ecx
mov dword [0x5479bc], eax
je 0x4c8856
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004bf5bb
pop ecx
mov dword [0x5479b8], eax
mov eax, dword [0x5479b8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4c88db
cmp dword [0x5479bc], ecx
je 0x4c88db
push eax
call fcn.004bf632
push dword [0x5479bc]
mov esi, eax
call fcn.004bf632
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4c88db
cmp edi, ebx
je 0x4c88db
call esi
cmp eax, ebx
je 0x4c88a8
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4c88a8
test byte [ebp - 0x18], 1
jne 0x4c88db
lea eax, [ebp - 0x10]
push eax
call fcn.004ba075
test eax, eax
pop ecx
je 0x4c88c3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004bd9bc
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4c88d2
or dword [ebp + 0x10], 0x200000
jmp 0x4c8916
or dword [ebp + 0x10], 0x40000
jmp 0x4c8916
mov eax, dword [0x5479b0]
cmp eax, dword [ebp - 8]
je 0x4c8916
push eax
call fcn.004bf632
cmp eax, ebx
pop ecx
je 0x4c8916
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4c8916
mov eax, dword [0x5479b4]
cmp eax, dword [ebp - 8]
je 0x4c8916
push eax
call fcn.004bf632
cmp eax, ebx
pop ecx
je 0x4c8916
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5479ac]
call fcn.004bf632
cmp eax, ebx
pop ecx
je 0x4c8936
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c8938
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409681
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a344]
jne 0x40968b
repz ret
jmp fcn.0040e06c

Function at 0x41229c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b70f
and dword [ebp - 0x14], 0
cmp dword [0x46b46c], 0
mov dword [ebp - 0x18], eax
jne 0x41234f
push 0x403764
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4123f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403758
push ebx
call edi
test eax, eax
je 0x4123f7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403748
push ebx
mov dword [0x46b46c], eax
call edi
push eax
call esi
push 0x403734
push ebx
mov dword [0x46b470], eax
call edi
push eax
call esi
push 0x403718
push ebx
mov dword [0x46b474], eax
call edi
push eax
call esi
mov dword [0x46b47c], eax
test eax, eax
je 0x41234f
push 0x403700
push ebx
call edi
push eax
call esi
mov dword [0x46b478], eax
mov eax, dword [0x46b478]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4123a8
cmp dword [0x46b47c], ecx
je 0x4123a8
push eax
call esi
push dword [0x46b47c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4123a8
test ebx, ebx
je 0x4123a8
call edi
test eax, eax
je 0x41239f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41239f
test byte [ebp - 8], 1
jne 0x4123a8
or dword [ebp + 0x10], 0x200000
jmp 0x4123db
mov eax, dword [0x46b470]
cmp eax, dword [ebp - 0x18]
je 0x4123db
push eax
call esi
test eax, eax
je 0x4123db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4123db
mov eax, dword [0x46b474]
cmp eax, dword [ebp - 0x18]
je 0x4123db
push eax
call esi
test eax, eax
je 0x4123db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b46c]
call esi
test eax, eax
je 0x4123f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4123f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409681
leave
ret
Function at 0x414210
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413870
cmp dword [0x80b5c4], 0x37
jne 0x4142a1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x403f58
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x403fb4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x80c1a8]
mov edx, dword [0x808624]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3c205d0b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, str.9U_
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x55d72f39
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40aba0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40ad3b
sub esp, 0x3c
mov eax, dword [esp + 0x40]
cmp eax, 0x7000000
jle 0x40abcb
mov eax, 0x7000000
jmp 0x40abd3
test eax, eax
je 0x40ad2f
mov dword [esp + 0x18], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.0045d3c0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
add eax, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
lea esi, [0x5cb200]
movsd xmm0, qword [esi + ebp*8]
movsd qword [esp + 0x1c], xmm0
movsd xmm1, qword [esi + ecx*8]
movsd qword [esp + 0x24], xmm1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004570c0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x34], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
shl eax, 5
mov ecx, dword [esp + 0x10]
shr ecx, 0x1b
or ecx, eax
and ecx, 0xfffff
mov dword [esp], ecx
call fcn.00457190
movsd xmm0, qword [esp + 0x34]
movsd xmm1, qword [esp + 0x1c]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x24]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x536f58]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x536fc0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40ad0a
xorps xmm0, xmm0
mov eax, dword [esp + 0x18]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x537008]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x44], eax
add esp, 0x3c
ret
mov dword [esp + 0x44], 0
add esp, 0x3c
ret
call fcn.0045c000
jmp fcn.0040aba0
Function at 0x412ca0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412e8c
sub esp, 0x18
mov eax, dword [0x62f3c4]
test eax, eax
jne 0x412e75
nop
lea eax, [0x62f3b0]
mov dword [esp], eax
call fcn.00408a30
mov eax, dword [0x62f3b4]
test eax, eax
je 0x412ce9
cmp dword [eax + 8], 0xcc
jne 0x412d5f
mov eax, dword [0x62f3a8]
test eax, eax
jne 0x412d41
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x631c90]
mov dword [esp + 8], eax
call fcn.0040ad50
mov eax, dword [esp + 0xc]
mov dword [0x62f3a8], eax
mov ecx, dword [0x62f36c]
mov dword [eax], ecx
mov eax, dword [0x62f3a8]
mov dword [0x62f36c], eax
movzx eax, byte [0x62f900]
test al, al
jne 0x412d41
xor eax, eax
jmp 0x412e69
mov eax, dword [0x62f3a8]
mov ecx, dword [eax + 4]
mov dword [0x62f3a8], ecx
mov ecx, dword [0x62f3b4]
mov dword [eax + 4], ecx
mov dword [0x62f3b4], eax
mov eax, dword [0x62f3b4]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00402040
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x62f5e0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x412db2
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x412dbf
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045d410
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x62f5e0]
test edx, edx
jne 0x412deb
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x412e0c
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045d410
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045d410
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045d410
nop
lea eax, [0x62f3b0]
mov dword [esp], eax
call fcn.00408c30
nop
lea eax, [0x62f3ac]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004021c0
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
lea ecx, [0x5c725c]
movzx ebx, byte [ecx + ebx]
lea ebp, [0x62f900]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jl 0x412e36
jmp 0x412d41
lea eax, [0x509961]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004328e0
nop
call fcn.0045c000
jmp fcn.00412ca0