joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e1c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4360cc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44a9cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x1c], 3
mov dword [esi + 0x30], 0
cmp dword [esi + 4], eax
je 0x42e220
cmp dword [esi + 8], eax
jbe 0x42e21e
mov edx, dword [esi]
mov ecx, edx
lea esp, [esp]
cmp dword [ecx], 0
jne 0x42e23e
inc eax
add ecx, 4
cmp eax, dword [esi + 8]
jb 0x42e210
xor eax, eax
mov dword [esi + 0x94], eax
test eax, eax
je 0x42e298
lea ebx, [ebx]
mov ebx, dword [esi + 0x94]
test ebx, ebx
jne 0x42e243
xor ecx, ecx
jmp 0x42e26b
mov eax, dword [edx + eax*4]
jmp 0x42e220
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x42e26b
mov edi, dword [esi + 8]
mov eax, dword [ebx + 0xc]
xor edx, edx
div edi
inc edx
cmp edx, edi
jae 0x42e26b
mov eax, dword [esi]
cmp dword [eax + edx*4], 0
lea eax, [eax + edx*4]
je 0x42e266
mov ecx, dword [eax]
inc edx
test ecx, ecx
je 0x42e255
mov dword [esi + 0x94], ecx
mov edi, dword [ebx + 4]
test edi, edi
je 0x42e288
mov ecx, edi
call fcn.0042d0d0
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esi + 0x94], 0
jne 0x42e230
mov ecx, esi
call fcn.0042c810
lea ecx, [esi + 0xa0]
call fcn.0042d120
lea ecx, [esi + 0x64]
call fcn.0042c900
lea ecx, [esi + 0x34]
call fcn.0042c900
mov ecx, esi
call fcn.0042c900
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x430100
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x4363e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x44a9cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
cmp dword [0x44aa9c], 0
jne 0x430223
mov eax, dword [0x44aae8]
mov edx, dword [eax + 0xc]
mov ecx, 0x44aae8
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x400
or eax, ecx
mov dword [esp + 0x18], 0
jge 0x430174
push 0x400
lea ecx, [esp + 0x10]
call fcn.004039e0
mov esi, dword [esp + 0xc]
push 0x400
push esi
push 0x21
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
mov eax, dword [esi - 8]
push eax
push esi
call dword [sym.imp.MSVCR90.dll_wcsnlen]
add esp, 8
test eax, eax
jl 0x43023a
cmp eax, dword [esi - 8]
jg 0x43023a
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
jle 0x4301ff
lea edx, [esp + 0xc]
push 0x438b14
push edx
mov dword [0x44aa9c], 1
call fcn.0040d320
add esp, 8
test al, al
je 0x4301df
mov dword [0x44aa98], 1
lea eax, [esp + 0xc]
push 0x43f110
push eax
call fcn.0040d320
add esp, 8
test al, al
je 0x4301ff
mov dword [0x44aa98], 2
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430223
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x44aa98]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
push 0x80070057
call fcn.00401000
int3
Function at 0x431e5e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a9cc]
jne 0x431e68
repz ret
jmp fcn.00432456
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x57dc266b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2fda208d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46f004]
jne 0x40100a
repz ret
jmp fcn.00401858

Function at 0x4068b8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404555
and dword [ebp - 4], 0
cmp dword [0x471258], 0
mov ebx, eax
jne 0x406969
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406a1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406a1a
push eax
call fcn.004044e3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x471258], eax
call esi
push eax
call fcn.004044e3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47125c], eax
call esi
push eax
call fcn.004044e3
mov dword [esp], 0x46c98c
push edi
mov dword [0x471260], eax
call esi
push eax
call fcn.004044e3
pop ecx
mov dword [0x471268], eax
test eax, eax
je 0x406969
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004044e3
pop ecx
mov dword [0x471264], eax
mov eax, dword [0x471264]
cmp eax, ebx
je 0x4069c1
cmp dword [0x471268], ebx
je 0x4069c1
push eax
call fcn.0040455e
push dword [0x471268]
mov esi, eax
call fcn.0040455e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4069c1
test edi, edi
je 0x4069c1
call esi
test eax, eax
je 0x4069b8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4069b8
test byte [ebp - 0xc], 1
jne 0x4069c1
or dword [ebp + 0x10], 0x200000
jmp 0x4069fa
mov eax, dword [0x47125c]
cmp eax, ebx
je 0x4069fa
push eax
call fcn.0040455e
pop ecx
test eax, eax
je 0x4069fa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4069fa
mov eax, dword [0x471260]
cmp eax, ebx
je 0x4069fa
push eax
call fcn.0040455e
pop ecx
test eax, eax
je 0x4069fa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x471258]
call fcn.0040455e
pop ecx
test eax, eax
je 0x406a1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406a1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46b430
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x46f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc08], eax
cmp esi, 0x182
jne 0x46b46a
lea ecx, [ebp - 0xc2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x46b488
cmp esi, 0x19f
jne 0x46b488
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor edi, edi
test esi, esi
jle 0x46b531
push ebx
mov ebx, dword [ebp - 0xc08]
lea esp, [esp]
lea esi, [ebp - 0xc0c]
mov dword [ebp - 0xc0c], 0
call fcn.0046b420
mov dl, byte [ebp - 0xc0c]
mov eax, dword [ebp - 0xc08]
mov esi, dword [ebp + 0xc]
xor byte [eax + edi], dl
cmp esi, 0xf
jne 0x46b527
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.wepetejef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.wujokinozalucawisuhej
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea edx, [ebp - 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebx
push str.naxoj
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, esi
jl 0x46b4a0
pop ebx
pop edi
cmp esi, 0x2d
pop esi
jne 0x46b54c
mov dword [0x27bc038], 0xa62e7790
mov dword [0x27bc03c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x46b560
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x27bbf04]
push esi
push edi
mov edi, dword [0x27bbd4c]
mov esi, eax
cmp eax, 0x5dd
jne 0x46b582
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x470010]
call fcn.0046b3f0
cmp dword [0x27bbf04], 0x2f
jne 0x46b59d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push edi
call fcn.0046b430
add esp, 8
cmp dword [0x27bbf04], 0x568
pop edi
pop esi
jne 0x46b5c7
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x315c430f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x40c52e06
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40157c
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [0x43b284]
push esi
mov esi, dword [0x44f5dc]
push edi
xor edi, edi
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x8c], eax
call ebx
mov dword [esi + 0x94], eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x401612
push edi
push edi
call fcn.0041e0c9
add esp, 0x18
pop edi
mov dword [esi + 0x88], eax
pop esi
pop ebx
pop ecx
ret
Function at 0x40167e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x40167e
lcall 0x5de5, 0x8b10c483
jmp loc.0085616c
Function at 0x40607d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422274], 0
push esi
jne 0x4060b4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40608e
mov dword [ecx*4 + 0x422270], eax
inc ecx
cmp ecx, 0x100
jl 0x406089
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4060e5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422270]
xor eax, esi
inc ecx
dec edx
jne 0x4060c7
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7b5537ef
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x30c77a5d
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, edi
mov dword [ebp - 4], edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001014
push 0
sub esi, ecx
pop ecx
push ecx
pop edx
je 0x1000103b
movsx eax, byte [edi + edx]
xor ecx, 0x9385729
add ecx, eax
and ecx, 0x1fffffff
inc edx
cmp edx, esi
jb 0x10001024
mov edi, dword [ebp - 4]
xor esi, esi
mov dword [ebp - 4], 0x1a
add edi, ecx
je 0x10001068
xor edx, edx
mov eax, edi
div dword [ebp - 4]
mov eax, edi
add dl, 0x41
mov byte [ebx + esi], dl
xor edx, edx
push 7
pop edi
div edi
inc esi
mov edi, eax
test edi, edi
jne 0x1000104b
test ecx, ecx
je 0x1000108b
push 0x1a
pop edi
xor edx, edx
mov eax, ecx
div edi
mov eax, ecx
add dl, 0x41
mov byte [ebx + esi], dl
xor edx, edx
push 3
pop ecx
div ecx
inc esi
mov ecx, eax
test ecx, ecx
jne 0x1000106f
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebx
leave
ret

Function at 0x10001094
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
lea eax, [ebp - 4]
mov esi, edx
push eax
push edi
push 0xf003f
push edi
push 0x10002024
push edi
push str.SoftwareNugen_Audio
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [ebp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100010c6
sub ecx, edx
push ecx
push dword [ebp + 8]
push 1
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret

Function at 0x100010ed
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor edi, edi
mov edx, edi
cmp dword [ebp - 4], edx
jbe 0x10001130
movsx ecx, byte [ebp + edx - 0x24]
imul eax, edi, 0x89acbd7
sub ecx, eax
and ecx, 0x1fffffff
inc edx
mov edi, ecx
cmp edx, dword [ebp - 4]
jb 0x10001115
push edi
push 0x10002040
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_sprintf]
push dword [ebp + 0xc]
mov edx, edi
lea ecx, [ebp - 0x64]
call section..text
push dword [ebp + 0xc]
lea eax, [ebp - 0xa4]
push str.KEY__s
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x64]
mov ecx, 0x80000001
push eax
lea edx, [ebp - 0xa4]
call fcn.10001094
lea eax, [ebp - 0x64]
mov ecx, 0x80000002
push eax
lea edx, [ebp - 0xa4]
call fcn.10001094
add esp, 0x24
pop edi
leave
ret 8
Function at 0x40b980
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40bb4e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b9ab
mov eax, 0x7000000
jmp 0x40b9b3
test eax, eax
je 0x40bb29
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.004603f0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x568140]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40bb41
cmp ecx, 0x21
jae 0x40bb35
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045ac40
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045ad10
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4edba8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4edc10]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40bb04
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4edc58]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004604d0
mov eax, ecx
mov ecx, 0x21
call fcn.00460580
nop
call fcn.0045f030
jmp fcn.0040b980
Function at 0x4134d0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4136f4
sub esp, 0x18
mov eax, dword [0x59eccc]
test eax, eax
jne 0x4136dd
nop
lea eax, [0x59ecb8]
mov dword [esp], eax
call fcn.00409770
mov eax, dword [0x59ecbc]
test eax, eax
je 0x413519
cmp dword [eax + 8], 0xcc
jne 0x41358f
mov edx, dword [0x59ecb0]
test edx, edx
jne 0x413571
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5a14d0]
mov dword [esp + 8], eax
call fcn.0040bb60
mov eax, dword [esp + 0xc]
mov dword [0x59ecb0], eax
mov ecx, dword [0x59ec74]
mov dword [eax], ecx
mov eax, dword [0x59ecb0]
mov dword [0x59ec74], eax
movzx eax, byte [0x59f140]
test al, al
jne 0x413571
xor eax, eax
jmp 0x413689
mov edx, dword [0x59ecb0]
mov ebx, dword [edx + 4]
mov dword [0x59ecb0], ebx
mov ebx, dword [0x59ecbc]
mov dword [edx + 4], ebx
mov dword [0x59ecbc], edx
mov edx, dword [0x59ecbc]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413671
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402140
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x59ee50]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4135ed
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x4135fa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00460440
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x59ee50]
test edx, edx
jne 0x413626
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413647
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00460440
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00460440
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00460440
nop
lea eax, [0x59ecb8]
mov dword [esp], eax
call fcn.00409970
nop
lea eax, [0x59ecb4]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004022c0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004604d0
lea esi, [0x59f140]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413571
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4136d3
lea edx, [0x5641d8]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41367b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004604c0
mov ecx, 5
call fcn.004604c0
lea eax, [0x4ce880]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00434a10
nop
call fcn.0045f030
jmp fcn.004134d0
Function at 0x426af0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426c60
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00424880
mov eax, dword [esp + 4]
test eax, eax
je 0x426c49
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00422600
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00409770
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x426b87
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x426bed
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x426b9c
cmp byte [ebp + 6], dl
je 0x426ba7
cmp esi, ebx
ja 0x426bed
jne 0x426b85
cmp byte [ebp + 6], dl
jbe 0x426b85
jmp 0x426bed
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409970
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426be4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426be4
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.004269f0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409970
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x426c40
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x426c40
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4cface]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00434a10
nop
call fcn.0045f030
jmp fcn.00426af0
Function at 0x4270e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4271fc
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x427175
cmp cl, 2
je 0x42711d
cmp cl, 3
jne 0x4271e5
mov byte [eax + 8], 1
jmp 0x4271e1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c310
nop
lea eax, [0x583298]
mov dword [esp], eax
call fcn.00409770
nop
mov eax, dword [0x583264]
sub eax, dword [0x583248]
mov dword [0x583264], eax
mov eax, dword [0x583254]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x583254], ecx
nop
lea eax, [0x583298]
mov dword [esp], eax
call fcn.00409970
jmp 0x4271e1
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004134d0
nop
lea eax, [0x583298]
mov dword [esp], eax
call fcn.00409770
nop
mov eax, dword [0x58323c]
sub eax, dword [0x583220]
mov dword [0x58323c], eax
mov eax, dword [0x58322c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x58322c], ecx
nop
nop
lea eax, [0x583298]
mov dword [esp], eax
call fcn.00409970
add esp, 0x14
ret
lea eax, [0x4cc0ca]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00434a10
nop
call fcn.0045f030
jmp fcn.004270e0