joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100118fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10011959
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001193a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10011957
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.100171a5
mov dword [eax], 0x57e8b72f
jmp 0x1001192f
jmp 0x10011982
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10011982
push 0
push 0
push 0
push 0
push 0x1c0c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x10016d7e
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016dab
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10016da9
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10016db3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x1001ca84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001caa8
push 0x10cb
push 0x1aed
push 0xc7c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x1001cac5
push 0
push 0
push 0
push 0
push 0x1c0c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret

Function at 0x1001de7e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001deac
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001deaa
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1001def7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001deda
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001def7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.100171a5
mov dword [eax], 0xfa51669
jmp 0x1001decf
mov esp, ebp
pop ebp
ret
Function at 0x100286fa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028720
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002871e
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x10028753
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10028753
push 0
push 0
push 0
push 0
push 0x1c0c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x1002ea85
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002eaa2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1002ebd8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1002eaf9
mov dword [ebp - 0xc], 1
jmp 0x1002eafd
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
je 0x1002eb1a
mov dword [ebp - 0x10], 1
jmp 0x1002eb1e
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x38]
mov dword [eax], 1
xor eax, eax
add eax, 0xffff7a94
jne 0x1002eb3c
xor eax, eax
inc eax
jne 0x1002eb3c
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1002eb4e
mov eax, 0xfffa
test eax, eax
je 0x1002eb4e
mov dword [ebp - 0x14], 1
jmp 0x1002eb52
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jle 0x1002eb63
mov dword [ebp - 0x1c], 1
jmp 0x1002eb67
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100171a5
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jle 0x1002eb92
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100171a5
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100171a5
mov esi, eax
push 2
mov ecx, dword [ebp - 4]
call fcn.100171a5
mov edi, eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100171a5
mov ecx, dword [edi]
imul ecx, dword [eax]
cmp dword [esi], ecx
jl 0x1002ebcc
mov dword [ebp - 0x20], 1
jmp 0x1002ebd0
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002fcbe
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002fce2
xor eax, eax
jmp 0x1002fe3d
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x1be7
lea eax, [ebp + 8]
push eax
call fcn.1002fa5e
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002fd0f
xor eax, eax
jmp 0x1002fe3d
lea eax, [ebp - 0xc]
push eax
push 0x717a
push 1
push dword [ebp - 8]
call fcn.1002f731
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002fd32
xor eax, eax
jmp 0x1002fe3d
push 0x7a43
lea eax, [ebp - 0xc]
push eax
push 0x18a1
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push 0x683
lea eax, [ebp - 4]
push eax
push 1
push 0x7814
call fcn.1002f7c9
add esp, 0x28
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 1
push 0x948
push 0x641f
lea eax, [ebp - 8]
push eax
call fcn.1002fabf
add esp, 0x18
push 0x313e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xe10
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.1002fb5b
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x1002fdba
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002fbf0
add esp, 0xc
push dword [ebp - 4]
call fcn.1002ec4f
pop ecx
test eax, eax
jne 0x1002fdcb
xor eax, eax
jmp 0x1002fe3d
push 0x478f
push 0x2b42
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002fc3a
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002fe25
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002fe02
xor eax, eax
jmp 0x1002fe3d
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002fe1b
xor eax, eax
jmp 0x1002fe3d
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002fe36
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002fe3a
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100484bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x100484d7
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100485ab
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
push 3
mov ecx, dword [ebp - 0x3c]
call fcn.100171a5
mov dword [eax], 2
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x1004857c
mov dword [ebp - 4], 1
jmp 0x10048580
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 4], eax
jge 0x1004859b
mov dword [ebp - 0x10], 1
jmp 0x1004859f
and dword [ebp - 0x10], 0
imul eax, dword [ebp - 0x10], 0x39a5
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x100616b0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x1067c55c]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x1067c748
call fcn.1005ff10
add esp, 8
mov esp, ebp
pop ebp
ret 4

Function at 0x10061c30
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009039c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x10061c54
jmp 0x10061cc3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x10061c68
jmp 0x10061cc3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x10061c94
jmp 0x10061cc3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x10061cb5
jmp 0x10061cc3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret
Function at 0x10084655
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009039c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10076bcc
mov dword [ebp - 0x14], eax
cmp dword [0x1067d734], esi
jne 0x10084748
push 0x800
push esi
push 0x10007d3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100846d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10084828
push esi
push esi
push 0x10007d3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10084828
push 0x10007d54
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10084828
push eax
call ebx
push 0x10007d60
push edi
mov dword [0x1067d734], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d70
push edi
mov dword [0x1067d738], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d84
push edi
mov dword [0x1067d73c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067d744], eax
test eax, eax
je 0x10084745
push 0x10007da0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067d740], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008476d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10084760
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10084782
push 4
pop eax
jmp 0x1008482a
cmp dword [ebp - 0x14], esi
je 0x10084782
push dword [0x1067d734]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10084767
mov eax, dword [0x1067d740]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100847e0
cmp dword [0x1067d744], edi
je 0x100847e0
push eax
call ebx
push dword [0x1067d744]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100847e0
test eax, eax
je 0x100847e0
call ecx
test eax, eax
je 0x100847d5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100847d5
test byte [ebp - 8], 1
jne 0x100847e0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10084810
mov eax, dword [0x1067d738]
cmp eax, edi
je 0x1008480d
push eax
call ebx
test eax, eax
je 0x1008480d
call eax
mov esi, eax
test esi, esi
je 0x1008480d
mov eax, dword [0x1067d73c]
cmp eax, edi
je 0x1008480d
push eax
call ebx
test eax, eax
je 0x1008480d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067d734]
call ebx
test eax, eax
je 0x10084828
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1008482a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x4de06ae
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x40f32181
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40b760
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b92e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b78b
mov eax, 0x7000000
jmp 0x40b793
test eax, eax
je 0x40b909
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.0045e6f0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x57e280]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b921
cmp ecx, 0x21
jae 0x40b915
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00458e70
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.00458f40
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x50203c]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5020a4]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b8e4
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5020ec]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045e7d0
mov eax, ecx
mov ecx, 0x21
call fcn.0045e870
nop
call fcn.0045d330
jmp fcn.0040b760
Function at 0x413480
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4136a4
sub esp, 0x18
mov eax, dword [0x5b3ffc]
test eax, eax
jne 0x41368d
nop
lea eax, [0x5b3fe8]
mov dword [esp], eax
call fcn.00409550
mov eax, dword [0x5b3fec]
test eax, eax
je 0x4134c9
cmp dword [eax + 8], 0xcc
jne 0x41353f
mov edx, dword [0x5b3fe0]
test edx, edx
jne 0x413521
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5b6830]
mov dword [esp + 8], eax
call fcn.0040b940
mov eax, dword [esp + 0xc]
mov dword [0x5b3fe0], eax
mov ecx, dword [0x5b3fa4]
mov dword [eax], ecx
mov eax, dword [0x5b3fe0]
mov dword [0x5b3fa4], eax
movzx eax, byte [0x5b44a0]
test al, al
jne 0x413521
xor eax, eax
jmp 0x413639
mov edx, dword [0x5b3fe0]
mov ebx, dword [edx + 4]
mov dword [0x5b3fe0], ebx
mov ebx, dword [0x5b3fec]
mov dword [edx + 4], ebx
mov dword [0x5b3fec], edx
mov edx, dword [0x5b3fec]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413621
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402140
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5b41a0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41359d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x4135aa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045e740
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5b41a0]
test edx, edx
jne 0x4135d6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4135f7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045e740
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045e740
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045e740
nop
lea eax, [0x5b3fe8]
mov dword [esp], eax
call fcn.00409750
nop
lea eax, [0x5b3fe4]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004022c0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045e7d0
lea esi, [0x5b44a0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413521
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413683
lea edx, [0x57a2dc]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41362b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045e7c0
mov ecx, 5
call fcn.0045e7c0
lea eax, [0x4dab9a]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00434610
nop
call fcn.0045d330
jmp fcn.00413480
Function at 0x426aa0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426c10
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00424830
mov eax, dword [esp + 4]
test eax, eax
je 0x426bf9
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004225b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409550
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x426b37
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x426b9d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x426b4c
cmp byte [ebp + 6], dl
je 0x426b57
cmp esi, ebx
ja 0x426b9d
jne 0x426b35
cmp byte [ebp + 6], dl
jbe 0x426b35
jmp 0x426b9d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409750
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426b94
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426b94
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.004269a0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409750
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426bf0
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426bf0
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4dc3e1]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00434610
nop
call fcn.0045d330
jmp fcn.00426aa0