joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46beb8
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x46bee6
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push edi
call fcn.0047f0f0
add esp, 4
inc eax
xor ecx, ecx
inc ecx
push eax
push edi
push ecx
push 0
push ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
pop edi
pop ebx
ret

Function at 0x46bfe9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4b6078]
mov ebx, dword [esp + 0x20]
xor eax, esp
test ebx, ebx
mov dword [esp + 8], eax
je 0x46c08a
mov edi, dword [esp + 0x24]
mov eax, esp
xor esi, esi
lea ecx, [esp + 4]
push eax
push esi
push ecx
push esi
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46c097
cmp dword [esp + 4], 1
jne 0x46c097
mov ebp, dword [esp]
xor esi, esi
inc ebp
xor eax, eax
inc eax
push esi
push eax
push ebp
call fcn.00410b8c
add esp, 0xc
mov ecx, edi
mov edi, eax
mov eax, esp
push eax
push edi
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46c08e
cmp dword [esp + 4], 1
jne 0x46c08e
mov eax, dword [esp]
cmp eax, ebp
jb 0x46c082
push 0x92
push str..._windows_winstore.c
push str.size___allocsize
call fcn.0047bdbf
add esp, 0xc
mov eax, dword [esp]
mov esi, edi
mov byte [edi + eax], 0
jmp 0x46c097
xor esi, esi
jmp 0x46c097
push edi
call fcn.00410c0e
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0046fa9a
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46c0ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [0x4b6078]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
xor ecx, esp
test eax, eax
mov dword [esp + 0xc], ecx
mov dword [esp], 4
je 0x46c100
mov edi, esp
lea ecx, [esp + 4]
lea ebx, [esp + 8]
push edi
push ecx
push ebx
push 0
push dword [esp + 0x34]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [edi]
mov edx, dword [ebx]
xor ecx, 4
xor edx, 4
or ecx, eax
or ecx, edx
jne 0x46c100
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0046fa9a
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x46c20f
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b6078]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
xor eax, esp
mov dword [esp + 4], eax
push dword [ebp]
push esi
push edi
call fcn.0046beb8
add esp, 0xc
xor ebx, ebx
push ebx
push str.IsBold
push esi
call fcn.00456122
add esp, 0xc
movzx ecx, byte [ebp + 4]
mov esi, eax
test edi, edi
mov dword [esp], ecx
je 0x46c26d
mov eax, 4
mov ecx, esp
push eax
push ecx
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00410c0e
add esp, 4
push ebx
push str.CharSet
mov ebp, dword [esp + 0x28]
push ebp
call fcn.00456122
add esp, 0xc
mov ebx, dword [esp + 0x24]
mov esi, eax
test edi, edi
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
je 0x46c2ae
mov eax, 4
mov ecx, esp
push eax
push ecx
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00410c0e
add esp, 4
xor eax, eax
push eax
push 0x49efef
push ebp
call fcn.00456122
add esp, 0xc
mov ecx, dword [ebx + 8]
mov esi, eax
test edi, edi
mov dword [esp], ecx
je 0x46c2e9
mov eax, 4
mov ecx, esp
push eax
push ecx
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00410c0e
add esp, 4
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046fa9a
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46c367
Capabilities:
Delete registry key

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x4b6078]
xor eax, esp
mov dword [esp + 4], eax
mov eax, esp
push eax
push str.SoftwareSimonTathamPuTTYSessions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46c3ca
mov edi, dword [esp + 0x14]
call fcn.00456342
mov esi, eax
push eax
push edi
call fcn.00467a26
add esp, 8
push dword [esi]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
call fcn.004563a4
add esp, 4
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004670a4
add esp, 4
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046fa9a
add esp, 8
pop esi
pop edi
ret
Function at 0x46c435
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b6078]
mov edi, dword [esp + 0x1c]
mov ebx, 0x105
xor eax, esp
mov dword [esp + 4], eax
mov dword [esp], ebx
push 0
push 1
push ebx
call fcn.00410b8c
add esp, 0xc
mov esi, eax
push ebx
push eax
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0xea
jne 0x46c4ad
xor ebp, ebp
inc ebp
jmp 0x46c47e
mov ebx, dword [esp]
push 0
push ebp
push ebx
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00410c1b
add esp, 0x18
mov esi, eax
push dword [esp]
push eax
mov eax, dword [esp + 0x24]
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0xea
je 0x46c47b
mov edi, eax
test eax, eax
jne 0x46c4c0
push dword [esp + 0x20]
push esi
call fcn.00467ab5
add esp, 8
mov eax, dword [esp + 0x1c]
test edi, edi
sete bl
inc dword [eax + 4]
push esi
call fcn.00410c0e
add esp, 4
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046fa9a
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46c7ab
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b6078]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
xor eax, esp
mov dword [esp + 4], eax
call fcn.00456342
mov esi, eax
push ebp
push ebx
push str._s__d:
push eax
call fcn.00456424
add esp, 0x10
push esi
push edi
call fcn.00467a26
add esp, 8
mov eax, esp
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46c82c
mov edi, dword [esp + 0x28]
push edi
call fcn.0047f0f0
add esp, 4
inc eax
xor ecx, ecx
inc ecx
push eax
push edi
push ecx
push 0
push dword [esi]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004563a4
add esp, 4
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046fa9a
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46c848
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov eax, dword [0x4b6078]
xor eax, esp
xor ecx, ecx
inc ecx
mov dword [esp + 0x404], eax
call fcn.0046c8df
cmp eax, 0xffffffff
je 0x46c8c6
mov esi, eax
lea ebx, [esp + 4]
mov eax, esp
push 0
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x46c8bf
mov eax, dword [esp]
test eax, eax
je 0x46c8bf
mov ebp, dword [esp + 0x41c]
mov edi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push eax
push ebx
call ebp
add esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0x400
push ebx
push esi
call edi
test eax, eax
je 0x46c8bf
mov eax, dword [esp]
test eax, eax
jne 0x46c89d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0046fa9a
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46cb4f
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x4b6078]
mov ecx, 2
xor eax, esp
mov dword [esp + 4], eax
call fcn.0046c8df
cmp eax, 0xffffffff
je 0x46cb8a
mov esi, eax
mov eax, esp
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046fa9a
add esp, 8
pop esi
ret
Function at 0x46ce83
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push edi
push esi
sub esp, 0x110
mov eax, dword [0x4b6078]
xor ecx, ecx
xor eax, esp
mov dword [esp + 0x10c], eax
call fcn.0046c8df
call fcn.00466cb4
mov edi, esp
push edi
push str.SoftwareSimonTathamPuTTY
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46cecd
mov ecx, dword [esp]
call fcn.0046cf5c
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push str.SoftwareSimonTatham
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x46cef9
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0046fa9a
add esp, 0x110
pop esi
pop edi
ret
push 0x4a6928
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [esp + 7]
push 0x105
push eax
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x46cee2
push edi
push str.Software
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46cee2
push 0x4a2b51
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46cee2

Function at 0x46cf5c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x110
mov eax, dword [0x4b6078]
mov esi, ecx
lea edi, [esp + 7]
xor eax, esp
mov dword [esp + 0x10c], eax
push 0x105
push edi
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x46cfcc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov eax, esp
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46cfb9
mov ecx, dword [esp]
call fcn.0046cf5c
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
call ebx
push 0x105
push edi
push 0
push esi
call ebp
test eax, eax
je 0x46cf99
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0046fa9a
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46cfe5
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, ecx
test edx, edx
je 0x46d031
xor ecx, ecx
xor eax, eax
cmp edx, 2
mov edx, 0x40000000
mov ebx, 0x80000000
sete al
setne cl
cmove ebx, edx
xor ebp, ebp
mov edx, eax
xor eax, 3
lea ecx, [ecx + ecx*2]
shl edx, 7
push ebp
push edx
push eax
push ebp
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
setne al
jmp 0x46d06d
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x46d065
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x46d065
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00467767
add esp, 4
push eax
push esi
push str.Unable_to_delete__s:__s
call fcn.00461782
add esp, 0xc
mov dword [edi], 0xffffffff
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46df14
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov ecx, dword [0x4b6078]
mov al, byte [esp + 0x124]
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
xor ebp, ebp
mov ebx, 0
xor ecx, esp
test al, al
mov dword [esp + 0x104], ecx
je 0x46df64
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
test edi, edi
mov dword [esi], 0x4c
je 0x46df7d
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
test al, al
mov dword [esi + 0x2c], ebp
je 0x46df8d
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x46df94
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x46dfb1
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
jb 0x46dfb1
mov byte [edi], 0
test bl, bl
je 0x46dfbe
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x104]
test esi, esi
setne bl
xor ecx, esp
call fcn.0046fa9a
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x484a24
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00484a2f

Function at 0x484dae
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00484db9

Function at 0x486527
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00486532

Function at 0x402e96
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x402ef4
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402ef4
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x402ef4
cmp dword [edx + ecx], 0x4550
jne 0x402ef4
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x402edf
mov edi, 0x8664
cmp ax, di
je 0x402ef4
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x402ef4
add ecx, 0xc
cmp esi, ecx
jae 0x402ef6
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x40c388
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
push edi
invalid
rol edi, 1
lodsd eax, dword es:[esi]
jp 0x40c3ac
xor ecx, ebp
invalid
cmp al, 0xd4
movsb byte es:[edi], byte [esi]
das
stosb byte es:[edi], al
jge 0x40c322
outsd dx, dword [esi]
cwde
sbb al, 0x99
fiadd word [0xfaa21a2b]
nop
dec edi
mov al, byte [0x350170ee]
xchg dword [ecx - 0xf], ebp
sub edx, dword [ebx + 0x7f]
sbb al, 0x78
ja 0x40c36d
lcall 0xc6da, 0x84858587
pushfd
cli
nop
jne 0x40c38c
sbb dword [ebp + esi*4 - 0xc6a9479], esp
push ebx
leave
push eax
lodsb al, byte [esi]
dec edx
in eax, dx
and byte [ebx], bh
add byte [edi - 0x22], cl
cmp al, 0x67
mov ch, dl
mov edi, 0xb9b46868
cmp al, 0x5f
pop ss
cld
and dh, byte [edx + 0x5d]
retf
Function at 0x407d44
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40d560
mov eax, esi
mov edx, 8
test al, 1
je 0x407d60
shr eax, 1
xor eax, 0xedb88320
jmp 0x407d62
shr eax, 1
dec edx
jne 0x407d53
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407d4c
pop esi
ret

Function at 0x407d8f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40d55c], 0
jne 0x407d9b
call fcn.00407d44
push 1
push 0x40d55c
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x407dc6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40d560]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407da1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40aad0
Capabilities:
Encode data using xor

Disassembly:
add bl, al
mov bh, 0x1c
pop ebp
sub al, 0x5f
mov al, 0xc7
xchg dword [esi + esi*4], esp
xor dword [ebx + ebx*4 - 0x35], ebx
test eax, 0x81bc7ce4
div byte [edx + 0x21e7ee8f]
inc edx
invalid
or byte [edi + 0x3b2beea8], 0xc5
stosd dword es:[edi], eax
mov dh, 0x78
cmp byte [esi + edi*2 + 0x68b9b436], bl
fcmovnbe st(0), st(4)
in al, dx
das
aas
loopne 0x40aa10
jp 0x40aaf7
cmp ah, byte [eax + esi + 0x5e]
ljmp 0x52f
xor byte [esi - 0x16], bl
in eax, dx
push 0xffffffffffffff87
das
add eax, 0xfab15cb4
imul byte [ecx + ecx*2 + 0x5f6100ff]
push cs
js 0x40ab12
int3
xor al, 0x90
in al, 9
lcall 0xd051, 0x6589964b
adc eax, edx
jecxz 0x40aa7d
xchg esi, eax
mov dword [ebp + 0x51], esp
rcl byte [ecx]
shl bl, 1
salc
cmpsb byte [esi], byte es:[edi]
push edx
clc
push ebx
cmp al, ch
loop 0x40aa61
shr byte [ecx - 0x78015196], 1
lahf
clc
xchg ebx, eax
loope 0x40aaea
xchg dword [edi + 0x2fe193f8], ebx
test byte [ebx + ebp], bh
neg byte [ebx + 0x6f31bc48]
push 0xb4d7c681
sti
les edi, [ebx - 0x49]
xor eax, 0xf8395ee1
cmp eax, edi
cmp eax, edi
jns 0x40aab5
in eax, dx
jb 0x40ab10
arpl word [esi], dx
jg 0x40ab3f
mov ebx, 0x9de40407
jecxz 0x40aa98
pop ebx
lodsd eax, dword [esi]
jnp 0x40aa9e
insb byte es:[edi], dx
mov dh, 0xbc
mov al, byte [0xcfe838aa]
cmpsb byte [esi], byte es:[edi]
ret
stosb byte es:[edi], al
cmp al, ch
iretd
daa
cld
invalid
push ebx
pop esp
pop ds
and dword [ebp + 0x233077d5], edx
add al, 0xe
fdiv st(5)
mov ebx, 0x50d49625
jae 0x40aadb
xchg edx, eax
fdivr st(5), st(0)
push 0x9f5a6e56
cmp ebp, dword [ebx - 0x49]
or eax, 0x56968a15
pop ss
adc ah, byte [edi + 0x2a]
inc esi
jbe 0x40aba0
cli
xlatb
cwde
dec ecx
jae 0x40ab63
mov bh, 0x6f
xchg esp, eax
mov esi, 0x7beca01b
xlatb
xchg ebp, eax
sub ch, byte [esi + 0x27]
test eax, 0x4f67cc07
jbe 0x40abd3
aad 0x89
sbb al, 8
into
jo 0x40ab76
jne 0x40ab9f
jecxz 0x40abb7
pop ecx
outsb dx, byte [esi]
and bl, byte es:[0x4a0659e5]
lahf
loope 0x40ab1a
out 0x74, al
inc edx
add ch, byte [ecx - 6]
dec esp
rcl dword [ecx], cl
nop
or al, 0x92
add bh, byte [ebp + 1]
push ds
test byte [ebp - 0x43], dl
arpl dx, ax
div dword [ebx - 0x3e]
lea ebx, [0x1f18cfa3]
xor byte [ebx - 9], dl
inc eax
cmc
scasb al, byte es:[edi]
dec edx
xchg ebp, eax
and ebx, dword [0x6958cace]
dec esp
test al, 0x9f
comiss xmm5, dword [esi - 0x1c]
test dword [esi - 0x22], ebx
inc ebp
cdq
das
outsb dx, byte [esi]
in al, 0x85
pop esi
fiadd word [ebp - 0x67]
fbld tbyte [ecx]
xchg ebp, eax
push cs
add bl, byte [edi - 0x1f8eb6ad]
wait
stosd dword es:[edi], eax
dec ebx
lea eax, [edx + 0x3954a4d1]
xchg esi, eax
xor eax, 0xaef5486e
movsb byte es:[edi], byte [esi]
push esp
cmp dword [esi - 0xab791cb], edx
scasb al, byte es:[edi]
cmp dword [edx - 0x5d], esp
jnp 0x40abe0
retf
mov al, 0x20
imul dword [edx]
imul ebp, dword [esi], 0xffffffe6
invalid
jns 0x40ab79
out dx, eax
stosd dword es:[edi], eax
jl 0x40ab9f
hlt
Function at 0x40a5b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a77f
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40a752
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00455810
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 0x24]
shr edi, 0x1b
shl ebx, 5
or edi, ebx
test esi, esi
jne 0x40a772
cmp ecx, 0x21
jae 0x40a766
mov dword [esp + 0x10], edi
lea ebx, [0x5885e0]
movsd xmm0, qword [ebx + ebp*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.004503d0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004504c0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
mulsd xmm2, qword [esp + 8]
movsd xmm1, qword [0x4fe4d8]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x4fe540]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40a72d
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4fe570]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40a5dd
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004558f0
mov eax, ecx
mov ecx, 0x21
call fcn.004559c0
nop
call fcn.00454020
jmp fcn.0040a5b0
Function at 0x4125f0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41280c
sub esp, 0x18
mov eax, dword [0x5a99e4]
test eax, eax
jne 0x4127f5
lea eax, [0x5a99d0]
mov dword [esp], eax
call fcn.00408430
mov eax, dword [0x5985fc]
test eax, eax
je 0x41263c
cmp dword [eax + 8], 0xcc
jne 0x412704
mov edx, dword [0x5985f4]
test edx, edx
jne 0x4126e6
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5ab098]
mov dword [esp + 8], eax
call fcn.0040a790
mov eax, dword [esp + 0xc]
mov dword [0x5985f4], eax
mov ecx, dword [0x5985d0]
mov dword [eax], ecx
mov eax, dword [0x5985f4]
mov dword [0x5985d0], eax
movzx eax, byte [0x5a9d00]
test al, al
jne 0x4126e6
xor eax, eax
jmp 0x4126a3
lea esi, [0x5a9d00]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4126e6
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4127eb
lea edx, [0x584104]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x412695
jmp 0x4127df
mov edx, dword [0x5985f4]
mov ebx, dword [edx + 4]
mov dword [0x5985f4], ebx
mov ebx, dword [0x5985fc]
mov dword [edx + 4], ebx
mov dword [0x5985fc], edx
mov edx, dword [0x5985fc]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4127d5
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020a0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5a9b20]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4127c6
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5a9b20]
test edx, edx
jne 0x4127a3
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x5a9969], 1
lea eax, [0x5a99d0]
mov dword [esp], eax
call fcn.00408610
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00455860
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00455860
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00455860
jmp 0x41278a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00455860
mov eax, edx
jmp 0x412760
mov ecx, 0xcc
call fcn.004558f0
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004558e0
mov ecx, 5
call fcn.004558e0
lea eax, [0x4e41c7]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0042db80
nop
call fcn.00454020
jmp fcn.004125f0
Function at 0x4219f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421af9
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x421a77
cmp cl, 2
jne 0x421ae2
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00426800
lea eax, [0x59d9d0]
mov dword [esp], eax
call fcn.00408430
nop
mov eax, dword [0x59d9c4]
sub eax, dword [0x59d9ac]
mov dword [0x59d9c4], eax
mov eax, dword [0x59d9b8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59d9b8], ecx
lea eax, [0x59d9d0]
mov dword [esp], eax
call fcn.00408610
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004125f0
lea eax, [0x59d9d0]
mov dword [esp], eax
call fcn.00408430
nop
mov eax, dword [0x59d9a0]
sub eax, dword [0x59d988]
mov dword [0x59d9a0], eax
mov eax, dword [0x59d994]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x59d994], ecx
lea eax, [0x59d9d0]
mov dword [esp], eax
call fcn.00408610
jmp 0x421a73
lea eax, [0x4e16f3]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0042db80
nop
call fcn.00454020
jmp fcn.004219f0