joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502660
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5484ec
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x502682
shr eax, 1
xor eax, 0xedb88320
jmp 0x502684
shr eax, 1
dec edx
jne 0x502670
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x502669
mov byte [0x5488ec], 1
pop esi
pop ebx
ret

Function at 0x5026a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5488ec], 0
jne 0x5026b7
call fcn.00502660
mov eax, edi
dec eax
test eax, eax
jl 0x5026df
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5484ec]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5026c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x50534c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5053e6.0
jmp dword [ecx*4 + 0x50537f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5053b1
sub dl, 8
je 0x5053c0
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x504ff8
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x505050
jmp case.0x5053e6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5053e6.0
movzx ecx, byte [ecx + 0x5053ed]
jmp dword [ecx*4 + 0x5053fe]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5050fc
jmp case.0x5053e6.0
cmp dl, 3
jne 0x50542b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x505150
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x50510c
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x505194
jmp case.0x5053e6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x505456
sub dl, 8
je 0x505462
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5051c0
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x50522c
jmp case.0x5053e6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x505481
sub dl, 8
je 0x50548d
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5052e8
jmp case.0x5053e6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x505310
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x505531
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00504504
test eax, eax
je 0x505531
mov eax, ebx
call fcn.0050553c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5054ca
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50553c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x50556d
dec al
je 0x5055a8
dec al
je 0x5055ed
dec al
je 0x505656
jmp 0x5056e0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5056e0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x50557d
jmp 0x5056e0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5056e0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5055b8
jmp 0x5056e0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5056e0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x50561c
xor ebp, ebp
jmp 0x50562c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x505635
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5055fd
jmp 0x5056e0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5056e0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5056af
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005026e8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x50566a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x516b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
mov ebp, eax
test edx, edx
je 0x516b13
test ebp, ebp
jne 0x516b1a
xor eax, eax
jmp 0x516bc9
mov bl, 2
mov byte [esp + 1], 0
mov dword [esp + 4], esi
mov edi, edx
dec edi
test edi, edi
jl 0x516bb0
inc edi
movzx eax, byte [ebp]
xor al, 0xac
inc ebp
cmp bl, 6
jne 0x516b69
mov edx, eax
and dl, 0x3f
movzx edx, dl
add edx, 0x3c
mov byte [esi], dl
inc esi
movzx eax, al
shr eax, 2
and al, 0x30
or byte [esp + 1], al
movzx eax, byte [esp + 1]
add eax, 0x3c
mov byte [esi], al
inc esi
mov byte [esp + 1], 0
jmp 0x516b9c
movzx edx, al
shr edx, 2
mov byte [esp], dl
movzx edx, byte [esp]
and dl, 0x3c
and al, 3
or dl, al
movzx eax, dl
add eax, 0x3c
mov byte [esi], al
inc esi
movzx eax, byte [esp + 1]
add eax, eax
add eax, eax
movzx edx, byte [esp]
and dl, 3
or al, dl
mov byte [esp + 1], al
movzx eax, bl
mov ecx, 6
xor edx, edx
div ecx
add dl, 2
mov ebx, edx
dec edi
jne 0x516b31
cmp bl, 2
je 0x516bc0
movzx eax, byte [esp + 1]
add eax, 0x3c
mov byte [esi], al
inc esi
mov eax, esi
sub eax, dword [esp + 4]
mov byte [esi], 0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x568e9e
Capabilities:
Packed with generic packer

Disassembly:
pushal
nop
pushal
push dword [esp]
jmp 0x586795
add al, 0x24
sbb eax, 0x648d609c
and al, 0x2c
jmp fcn.0051c38a
sub bl, bl
xchg ebx, eax
cmp al, al
pushfd
push dword [esp + 4]
mov byte [esp + 8], 0x1a
lea esp, [esp + 0x30]
jmp fcn.0051c6db
mov dword [esp + 0x40], eax
not ax
movzx ax, dl
mov byte [esp], 0xcb
mov eax, 0x4c2bd2
call fcn.00585cc7
loope 0x5867f9
sti
mov dh, 0xf6
jge 0x586778
cmp ebx, edx
loop 0x586766
in al, dx
scasd eax, dword es:[edi]
shr byte [ebp - 0x620d582c], cl
xor al, 0x67
adc bl, byte [ecx]
add eax, 0x97b33788
xchg esi, eax
mov dl, 0xdd
add byte [esi + 0x793533d4], 0xdb
jmp 0x586853
mov dh, 0x54
invalid
int3

Function at 0x56c6c7
Capabilities:
Encode data using xor

Disassembly:
call fcn.00558470
arpl word [edx], si
cwde
mov byte [0xa9c37f97], al
rcr bl, 0x62
cli
inc ecx
or eax, 0x19762b90
xor byte [esp + edi - 0x53], ah
loopne fcn.0056c6c7
pop edx
invalid

Function at 0x56ddb9
Capabilities:
Packed with generic packer

Disassembly:
push 0x25fdaba9
pushfd
jmp 0x57b2d3
mov eax, dword [eax + 0xc8801]
push ebp
jmp 0x582fb8
fcompi st(3)
dec ebx
mov byte [esp], al
push eax
mov dword [esp + 0x20], 0xdec42e9a
mov byte [esp + 4], 0x8e
pushal
pushfd
lea esp, [esp + 0x44]
jmp fcn.0051bc0e
lea eax, [eax + 0x679f3578]
call fcn.0057312c
pop edx
popal
test al, 0x18
das
jle 0x582f8d
xlatb
jno 0x582fcd
mov eax, dword [esi]
ror byte [esi - 0x43], cl
popfd
add byte [ebx + 0x3b13a75f], bl
jbe 0x582ff4
xor byte [eax], cl
stosd dword es:[edi], eax
sub eax, 0xf7fedb8f
mov ebp, eax
pop esp
mov ch, byte [ebx]
sub eax, 0xc4ba12a
stosd dword es:[edi], eax
bound esi, qword [edx + 0x1d332a26]
salc
stosb byte es:[edi], al
push esi
in al, dx
fsub st(6), st(0)
pop edx
or al, bl
into
in eax, 0x34
and byte [edi], al
arpl sp, ax
add al, 0xc2
and byte [ecx + 0x6719429d], ch
js 0x583005
ret 0xa920
ret 0x2a69
Function at 0x58cc18
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 0xc], ax
push dword [esp + 0x34]
ret 0x3c
std
jmp dword [eax - 0x64]
mov word [esp + 8], 0x46b9
mov dword [esp + 0x28], ebp
call fcn.0056271c
mov edi, 0x919b25a6
jge 0x58cbf2
mov al, 0xb2
test al, 0xe3
cmpsb byte [esi], byte es:[edi]
aam 0x4e
lcall 0x53d4, 0x74a5a19a
and edi, dword [esi + 0x3d]
cld
inc esp
aaa
inc edx
cmp byte [esi], ch
or eax, 0x27acd069
pushfd
ja 0x58cbce
sbb ecx, dword [ebx - 0x2e8ac56d]
popal
push ss
push ds
pop dword [edx]
xlatb
xchg esi, eax
test byte [edx + 0xf26f6a2], bh
push esi
xchg esi, eax
not byte [0xbd126e72]
invalid

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x4039f0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403bc0
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.0046bad0
jmp fcn.004039f0
Function at 0x40d750
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d91b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40d779
mov eax, 0x7000000
jmp 0x40d781
test eax, eax
je 0x40d8f6
mov dword [esp + 0x34], eax
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call fcn.0046ce80
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0xae3a00]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40d90e
cmp edx, 0x21
jae 0x40d902
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00464850
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00464920
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x89e888]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x89e8e0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d8d1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x89e918]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.0046cf60
mov eax, edx
mov ecx, 0x21
call fcn.0046d030
nop
call fcn.0046bad0
jmp fcn.0040d750
Function at 0x4180a0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41829e
sub esp, 0x18
mov eax, dword [0xb61884]
test eax, eax
jne 0x418287
nop
nop
lea eax, [0xb61874]
mov dword [esp], eax
call fcn.0040b330
mov eax, dword [0xb61878]
test eax, eax
je 0x4180e8
cmp dword [eax + 8], 0xcc
jne 0x41815e
mov edx, dword [0xb6187c]
test edx, edx
jne 0x418140
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xb666d0]
mov dword [esp + 8], eax
call fcn.0040d930
mov eax, dword [esp + 0xc]
mov dword [0xb6187c], eax
mov ecx, dword [0xb61880]
mov dword [eax], ecx
mov eax, dword [0xb6187c]
mov dword [0xb61880], eax
movzx eax, byte [0xb620e0]
test al, al
jne 0x418140
xor eax, eax
jmp 0x418258
mov edx, dword [0xb6187c]
mov ebx, dword [edx + 4]
mov dword [0xb6187c], ebx
mov ebx, dword [0xb61878]
mov dword [edx + 4], ebx
mov dword [0xb61878], edx
mov edx, dword [0xb61878]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x418237
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004030d0
mov eax, dword [0xb61af8]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x4181b0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x4181f0
call fcn.0046cf40
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0xb61874]
mov dword [esp], eax
call fcn.0040b550
nop
lea eax, [0xb61870]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00403250
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0046cf60
lea edx, [0xade158]
movzx ebx, byte [edx + eax]
lea ebp, [0xb620e0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x418140
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x418241
mov ecx, 5
call fcn.0046cf50
lea eax, [0x818882]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0043a730
nop
call fcn.0046bad0
jmp fcn.004180a0
Function at 0x42c910
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ca80
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42ca10
cmp cl, 1
je 0x42c9a2
cmp cl, 2
jne 0x42ca69
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00431f00
nop
nop
lea eax, [0xb2dcc0]
mov dword [esp], eax
call fcn.0040b330
mov eax, dword [0xb2dc64]
sub eax, dword [0xb2dc48]
nop
mov dword [0xb2dc64], eax
mov eax, dword [0xb2dc54]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xb2dc54], ecx
nop
lea eax, [0xb2dcc0]
mov dword [esp], eax
call fcn.0040b550
jmp 0x42ca65
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004180a0
nop
nop
lea eax, [0xb2dcc0]
mov dword [esp], eax
call fcn.0040b330
mov eax, dword [0xb2dc3c]
sub eax, dword [0xb2dc20]
nop
mov dword [0xb2dc3c], eax
mov eax, dword [0xb2dc2c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xb2dc2c], ecx
nop
lea eax, [0xb2dcc0]
mov dword [esp], eax
call fcn.0040b550
jmp 0x42ca65
cmp cl, 3
jne 0x42ca1b
mov byte [eax + 8], 1
jmp 0x42ca65
cmp cl, 4
jne 0x42ca69
nop
nop
lea eax, [0xb2dcc0]
mov dword [esp], eax
call fcn.0040b330
mov eax, dword [0xb2dcb4]
sub eax, dword [0xb2dc98]
nop
mov dword [0xb2dcb4], eax
mov eax, dword [0xb2dca4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xb2dca4], ecx
nop
nop
lea eax, [0xb2dcc0]
mov dword [esp], eax
call fcn.0040b550
add esp, 0x14
ret
lea eax, [0x81368e]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0043a730
nop
call fcn.0046bad0
jmp fcn.0042c910
Function at 0x432770
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x432856
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [eax + 0x88], 0
lea ecx, [0xb62090]
mov dword [esp], ecx
call fcn.00403040
mov eax, dword [esp + 4]
test eax, eax
je 0x432832
mov dword [esp + 8], 0
mov ecx, dword [0xb619d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x30]
lea edi, [esp + 0x10]
xor eax, eax
call fcn.0046d169
lea ecx, [0x432860]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
call fcn.0046b9e0
mov eax, dword [esp + 8]
cmp eax, 0x20
jge 0x43282e
jae 0x43284b
mov ecx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 8], 0
add esp, 0x2c
ret
lea eax, [fcn.004477d0]
inc eax
mov ecx, dword [esp + 0x30]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
add esp, 0x2c
ret
mov ecx, 0x20
call fcn.0046cf50
nop
call fcn.0046bad0
jmp fcn.00432770