joyce8/EMBER2024-capa huggingface dataset:
Function at 0x671eb0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x6a0230
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x671ed4
add eax, 8
inc ebp
cmp eax, 0x6a02c0
jb 0x671ec5
cmp ecx, dword [ebp*8 + 0x6a0230]
jne 0x67207b
mov eax, dword [0x750c58]
cmp eax, 1
je 0x67203d
test eax, eax
jne 0x671f00
cmp dword [0x69d984], 1
je 0x67203d
cmp ecx, 0xfc
je 0x67207b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x671f3b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x671f84
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x67b1b4
add ebx, ecx
push ebx
call fcn.00668590
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x67b194
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x6a0234]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00674750
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0xafd300]
test eax, eax
je 0x67204e
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x672058
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x6a0234]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x674200
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x6743be
push 0x3d
push edi
call fcn.006753e0
mov esi, eax
add esp, 8
test esi, esi
je 0x6743be
cmp edi, esi
je 0x6743be
mov dl, byte [esi + 1]
mov ecx, dword [0x750bfc]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x750bf8]
cmp eax, ecx
jne 0x674257
push eax
call fcn.00674490
add esp, 4
mov dword [0x750bf8], eax
test eax, eax
jne 0x6742d2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x67427e
mov eax, dword [0x750c00]
test eax, eax
je 0x67427e
call fcn.0066f190
test eax, eax
je 0x6742cd
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x67428a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.00668220
add esp, 4
mov dword [0x750bf8], eax
test eax, eax
je 0x6743be
mov dword [eax], 0
mov eax, dword [0x750c00]
test eax, eax
jne 0x6742cd
push 4
call fcn.00668220
add esp, 4
mov dword [0x750c00], eax
test eax, eax
je 0x6743be
mov dword [eax], 0
mov eax, dword [0x750bf8]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.00674410
mov esi, eax
add esp, 8
test esi, esi
jl 0x6743cf
cmp dword [ebx], 0
je 0x6743cf
test ebp, ebp
je 0x6743c7
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.00666790
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x674329
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x674318
lea eax, [esi*4]
push eax
push ebx
call fcn.00675240
add esp, 8
test eax, eax
je 0x674343
mov dword [0x750bf8], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6743b6
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00668220
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x6743b6
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00666790
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [ebx + esi*4], edi
jmp 0x674347
test ebp, ebp
jne 0x6743b6
test esi, esi
jge 0x6743d9
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.00675240
add esp, 8
test eax, eax
je 0x6743be
mov dword [eax + esi*4], edi
mov dword [eax + esi*4 + 4], 0
mov dword [0x750bf8], eax
jmp 0x674347
Function at 0x674d70
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.00667670
mov eax, dword [0xafd400]
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
xor ebp, ebp
push esi
cmp ebx, eax
push edi
jae 0x674ed2
mov eax, ebx
mov ecx, ebx
sar eax, 5
and ecx, 0x1f
mov edx, dword [eax*4 + 0xafd300]
test byte [edx + ecx*8 + 4], 1
je 0x674ed2
push 1
push ebp
push ebx
call fcn.0066ed20
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x674edc
push 2
push ebp
push ebx
call fcn.0066ed20
add esp, 0xc
cmp eax, 0xffffffff
je 0x674edc
mov ecx, dword [esp + 0x101c]
mov esi, ecx
sub esi, eax
test esi, esi
jle 0x674e78
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x14]
push 0x8000
rep stosd dword es:[edi], eax
push ebx
call fcn.006754e0
add esp, 8
mov edi, eax
cmp esi, 0x1000
mov eax, 0x1000
jge 0x674e1f
mov eax, esi
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0066c1b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x674e3b
sub esi, eax
test esi, esi
jle 0x674e51
jmp 0x674e10
cmp dword [0x750bd4], 5
jne 0x674e4e
mov dword [0x750bd0], 0xd
or ebp, 0xffffffff
push edi
push ebx
call fcn.006754e0
mov edi, dword [esp + 0x18]
add esp, 8
push 0
push edi
push ebx
call fcn.0066ed20
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
jge 0x674eb9
push 0
push ecx
push ebx
call fcn.0066ed20
add esp, 0xc
push ebx
call fcn.00673320
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, eax
neg ebp
sbb ebp, ebp
neg ebp
dec ebp
cmp ebp, 0xffffffff
jne 0x674eb9
mov dword [0x750bd0], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x750bd4], eax
push 0
push edi
push ebx
call fcn.0066ed20
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
mov dword [0x750bd0], 9
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret
Function at 0x675580
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x67558b
xor eax, eax
ret
mov eax, dword [esp + 4]
push edi
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
push ebx
not eax
jb 0x67568d
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x67b240]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x67b240]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x67b240]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x67b240]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x67b240]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x67b240]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x67b240]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x67b240]
xor eax, edx
inc ecx
dec edi
jne 0x6755a6
test esi, esi
je 0x6756af
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x67b240]
xor eax, edx
inc ecx
dec esi
jne 0x675691
pop ebx
pop esi
not eax
pop edi
ret

Function at 0x676120
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x676139
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x67613b
xor eax, eax
test eax, eax
je 0x67614c
push eax
call fcn.00670c90
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x676150
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebp, ebp
push edi
je 0x67630a
push 0x3d
push ebp
call fcn.00676930
mov esi, eax
add esp, 8
test esi, esi
je 0x67630a
cmp ebp, esi
je 0x67630a
xor eax, eax
mov ecx, dword [0x750c04]
cmp word [esi + 2], ax
sete al
mov edi, eax
mov eax, dword [0x750c00]
cmp eax, ecx
mov dword [esp + 0x10], edi
jne 0x6761aa
push eax
call fcn.006763e0
add esp, 4
mov dword [0x750c00], eax
test eax, eax
jne 0x67622a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
mov ecx, dword [0x750bf8]
je 0x6761d2
test ecx, ecx
je 0x6761d2
call fcn.006768b0
test eax, eax
je 0x676225
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test edi, edi
je 0x6761de
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ecx, ecx
jne 0x676204
push 4
call fcn.00668220
add esp, 4
mov dword [0x750bf8], eax
test eax, eax
je 0x67630a
mov dword [eax], 0
mov eax, dword [0x750c00]
test eax, eax
jne 0x67622a
push 4
call fcn.00668220
add esp, 4
mov dword [0x750c00], eax
test eax, eax
je 0x67630a
mov dword [eax], 0
mov eax, dword [0x750c00]
mov ecx, dword [esp + 0x18]
sub esi, ebp
mov ebp, esi
mov ebx, eax
sar ebp, 1
push ebp
push ecx
call fcn.00676360
mov esi, eax
add esp, 8
test esi, esi
jl 0x67631c
cmp dword [ebx], 0
je 0x67631c
test edi, edi
je 0x676313
mov edx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push edx
call fcn.00666790
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x676283
mov eax, edi
mov ecx, dword [eax + 4]
add eax, 4
mov dword [edi], ecx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x676272
lea edx, [esi*4]
push edx
push ebx
call fcn.00675240
add esp, 8
test eax, eax
je 0x67629d
mov dword [0x750c00], eax
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x676302
mov eax, dword [esp + 0x18]
push eax
call fcn.00674730
add esp, 4
lea ecx, [eax + eax + 4]
push ecx
call fcn.00668220
mov esi, eax
add esp, 4
test esi, esi
je 0x676302
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.00676880
add esp, 8
lea eax, [esi + ebp*2 + 2]
neg edi
sbb edi, edi
mov word [esi + ebp*2], 0
not edi
and edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.00666790
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
mov dword [ebx + esi*4], eax
jmp 0x6762a1
test edi, edi
jne 0x676302
test esi, esi
jge 0x676326
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.00675240
add esp, 8
test eax, eax
je 0x67630a
mov edx, dword [esp + 0x18]
mov dword [eax + esi*4], edx
mov dword [eax + esi*4 + 4], 0
mov dword [0x750c00], eax
jmp 0x6762a1
Function at 0x676aa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
test ebx, ebx
je 0x676b11
push ebx
call fcn.00676bd0
add esp, 4
test eax, eax
jne 0x676adf
mov dword [0x750bd4], 0xf
mov dword [0x750bd0], 0xd
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x14]
add bl, 0x40
push 0x104
push edx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x2e
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x676b21
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x676bb7
inc eax
cmp eax, 0x104
ja 0x676bb7
mov edx, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
test edx, edx
jne 0x676b70
cmp eax, ecx
jg 0x676b4d
mov eax, ecx
push eax
call fcn.00668220
mov edx, eax
add esp, 4
test edx, edx
jne 0x676b8a
mov dword [0x750bd0], 0xc
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, ecx
jle 0x676b8a
mov dword [0x750bd0], 0x22
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret

Function at 0x676bd0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x676bde
mov eax, 1
ret
add al, 0x40
mov byte [esp + 5], 0x3a
mov byte [esp + 4], al
lea eax, [esp + 4]
push eax
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x676c0d
cmp eax, 1
je 0x676c0d
mov eax, 1
ret
xor eax, eax
ret
Function at 0x676e50
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x75106c]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
test eax, eax
jne 0x676e98
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x676e78
mov eax, 1
jmp 0x676e93
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x676f69
mov eax, 2
mov dword [0x75106c], eax
cmp eax, 1
jne 0x676eb8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x676f7b
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x676ed3
mov ecx, dword [0x750e20]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test esi, esi
jne 0x676ef2
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00668220
mov edi, eax
add esp, 4
test edi, edi
jne 0x676f06
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x676f60
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x676f44
mov edx, dword [esp + 0x24]
push eax
push eax
push 0xffffffffffffffff
push edi
push 1
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x676f60
push edi
call fcn.00666790
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push edi
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jne 0x676f70
push edi
call fcn.00666790
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.00666790
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407b90
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x407cb6
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.00407cc0
mov eax, dword [esp + 0xc]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 8]
shl ebx, 5
shr edi, 0x1b
or edi, ebx
lea ebx, [0x517040]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x407ca9
cmp ecx, 0x21
jae 0x407c9d
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00458f50
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x24], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.00458fd0
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x24]
movsd xmm2, qword [esp + 0x14]
addsd xmm1, xmm2
movsd xmm3, qword [esp + 0x1c]
subsd xmm3, xmm2
mulsd xmm0, xmm3
movsd xmm2, qword [0x4bd9b4]
mulsd xmm2, xmm0
addsd xmm1, xmm2
movsd qword [esp + 0x38], xmm1
add esp, 0x2c
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045d970
mov eax, ecx
mov ecx, 0x21
call fcn.0045da20
nop
call fcn.0045c4a0
jmp fcn.00407b90
Function at 0x414f80
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x415192
sub esp, 0x18
mov eax, dword [0x54ca94]
test eax, eax
jne 0x41517b
lea eax, [0x54ca7c]
mov dword [esp], eax
call fcn.00409570
mov eax, dword [0x54ca80]
test eax, eax
je 0x414fc8
cmp dword [eax + 8], 0xcc
jne 0x41503e
mov edx, dword [0x54ca74]
test edx, edx
jne 0x415020
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x54e5f8]
mov dword [esp + 8], eax
call fcn.0040bb70
mov eax, dword [esp + 0xc]
mov dword [0x54ca74], eax
mov ecx, dword [0x54ca30]
mov dword [eax], ecx
mov eax, dword [0x54ca74]
mov dword [0x54ca30], eax
movzx eax, byte [0x54ce40]
test al, al
jne 0x415020
xor eax, eax
jmp 0x415127
mov edx, dword [0x54ca74]
mov ebx, dword [edx + 4]
mov dword [0x54ca74], ebx
mov ebx, dword [0x54ca80]
mov dword [edx + 4], ebx
mov dword [0x54ca80], edx
mov edx, dword [0x54ca80]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x41510f
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402400
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x54cbf0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41509c
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x4150a9
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045d8e0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x54cbf0]
test edx, edx
jne 0x4150d5
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4150f6
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045d8e0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045d8e0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045d8e0
mov byte [0x54ca08], 1
lea eax, [0x54ca7c]
mov dword [esp], eax
call fcn.00409770
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.0045d970
lea esi, [0x54ce40]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x415020
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x415171
lea edx, [0x513134]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x415119
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045d960
mov ecx, 5
call fcn.0045d960
lea eax, [0x4b53d5]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00434a60
nop
call fcn.0045c4a0
jmp fcn.00414f80
Function at 0x425920
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x425a47
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00423380
mov eax, dword [esp + 4]
test eax, eax
je 0x425a30
mov dword [esp + 0xc], eax
call fcn.00444d60
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
call fcn.00420eb0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00422ee0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 6]
mov byte [esp + 0xb], dl
mov ebx, dword [esp + 0xc]
lea ebp, [ebx + 0x48]
mov dword [esp + 0x18], ebp
mov dword [esp], ebp
call fcn.00409570
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x4259b8
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x4259f9
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x4259cd
cmp byte [ebp + 6], dl
je 0x4259d8
cmp esi, ebx
ja 0x4259f9
jne 0x4259b6
cmp byte [ebp + 6], dl
jbe 0x4259b6
jmp 0x4259f9
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409770
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00444d80
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00425730
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409770
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00444d80
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4b6469]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00434a60
nop
call fcn.0045c4a0
jmp fcn.00425920

Function at 0x425f20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426019
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x425fa4
cmp cl, 2
je 0x425f5d
cmp cl, 3
jne 0x426002
mov byte [eax + 8], 1
jmp 0x425ffe
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042b550
lea eax, [0x531090]
mov dword [esp], eax
call fcn.00409570
lea eax, [0x531048]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00415ee0
lea eax, [0x531090]
mov dword [esp], eax
call fcn.00409770
jmp 0x425ffe
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00414f80
lea eax, [0x531090]
mov dword [esp], eax
call fcn.00409570
lea eax, [0x531024]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00415ee0
lea eax, [0x531090]
mov dword [esp], eax
call fcn.00409770
add esp, 0x14
ret
lea eax, [0x4b2e9f]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00434a60
nop
call fcn.0045c4a0
jmp fcn.00425f20