joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40389c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00403a8f
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0040e5e4
xor ebx, ebx
cmp eax, ebx
jne 0x403a4a
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00403a8f
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0040b2c3
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0045cbb8
add esp, 0x10
test eax, eax
jne 0x403965
push esi
call 0x400f4e
mov esi, eax
cmp esi, ebx
pop ecx
je 0x403965
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x403950
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x403965
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x40395e
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0040faf7
cmp byte [esp + 0x13], bl
je 0x403995
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00403acc
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x403a05
push 0x14
call fcn.0045be25
cmp eax, ebx
pop ecx
je 0x4039bf
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4039c1
xor edi, edi
cmp edi, ebx
je 0x403a05
push esi
push edi
call fcn.00402ff2
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004030ba
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004031e3
add esp, 0x18
call fcn.00403a8f
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0040dcb1
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x403a1c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x403a2e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x403a71
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x403a71
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004030ba
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004031e3
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417610
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417636
mov eax, dword [0x4baa90]
test eax, eax
je 0x41762c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baa90], eax
test eax, eax
pop ebx
je 0x4176d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x4baa90]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x4baa8c], eax
call esi
mov ecx, dword [0x4baa8c]
mov dword [0x4baa94], eax
test ecx, ecx
je 0x4176c7
test eax, eax
je 0x4176c7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x4baa90], 0
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x44745c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0044764f
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004521a4
xor ebx, ebx
cmp eax, ebx
jne 0x44760a
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0044764f
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0044ee83
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004a0778
add esp, 0x10
test eax, eax
jne 0x447525
push esi
call fcn.00444b0e
mov esi, eax
cmp esi, ebx
pop ecx
je 0x447525
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x447510
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x447525
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x44751e
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004536b7
cmp byte [esp + 0x13], bl
je 0x447555
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0044768c
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4475c5
push 0x14
call fcn.0049f9e5
cmp eax, ebx
pop ecx
je 0x44757f
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x447581
xor edi, edi
cmp edi, ebx
je 0x4475c5
push esi
push edi
call fcn.00446bb2
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00446c7a
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00446da3
add esp, 0x18
call fcn.0044764f
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00451871
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4475dc
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4475ee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x447631
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x447631
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00446c7a
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00446da3
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469d17
Capabilities:
Encode data using xor

Disassembly:
jo 0x469d6e
call dword [eax + eax - 0x247a8566]
test byte [ecx - 0x7faa6e2a], dh
fild dword [ecx + esi*4 - 0x7faa6e2a]
aad 0xf1
pop esi
xor byte [edx], 0x2e
add eax, 0x85e251d0
and eax, 0x90390b97
aad 0x9b
jg 0x469d1f
xlatb
shr ebx, cl
arpl word [edx - 0x6b], di
and ax, 0xd690
movsd dword es:[edi], dword [esi]
cmp eax, dword [ebp + edi*8 + 0x70]
xchg ebp, eax
cli
push edi
inc ecx
xor byte [esi - 0xb], dl
xchg ebp, eax
xchg ebp, eax
mov cl, 0x3e
mov dh, 0x44
push esi
invalid
mov esi, gs
push 0xb7292b2f
lodsd eax, dword [esi]
shr byte [eax - 0x64], 1
mov al, byte [0x36a6446a]
adc bh, dl
fcom st(1)
mov cl, 0xb3
or ah, byte [edi + 0x6a]
fbstp tbyte [ecx + 0x25]
mov ah, 0xfe
pushal
adc al, 0x95
mov ebp, 0x498ba418
sbb dl, byte [0x7d73b623]
inc eax
push esi
mov byte [0x6f9129c5], 0x1f
lahf
adc ah, ah
add al, 0x11
add byte [eax + 0x3d], ah
lcall 0x45ed, 0x608458ac
cmp cl, byte [edx + 8]
lcall 0xa545, 0xc640dda0
adc byte [eax - 0x73], ah
dec edx
salc
dec edi
and eax, 0x40eb5cb9
or ebp, dword [ecx - 0x18fedc56]
xchg edx, eax
call 0x8c2ed260
jno 0x469dfb
bound edx, qword [eax]
adc edi, esi
adc byte [ecx], dh
and bh, byte [0x5eae615]
and eax, 0x5f86f5
mov word [ecx - 0x20daa7db], ss
in eax, 0x21
mov ebp, 0x21152d40
cmovne edx, dword [ebx]
arpl word [esi], ax
idiv dword [edx]
add eax, 0xdc026c3f
xchg ebx, eax
xor eax, 0xdd5fd7c1
mov eax, dword [0x4c451bb5]
invalid

Function at 0x47186b
Capabilities:
Packed with generic packer

Disassembly:
xchg ebp, eax
ror dword [ebx + 0x5de58bc1], 0xc3
push 0x18
mov eax, 0x49008a
call 0x4d5071
call 0x9113e550
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x14
adc al, 0x8b
inc ebp
or al, 0x53
mov ebx, dword [ebp + 0x10]
push esi
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dl, byte [ebx]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x14]
mov byte [eax], dl
mov eax, 1
push edi
cmp ecx, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
jbe 0x471bce
Function at 0x493bc3
Capabilities:
Encode data using xor

Disassembly:
push 0x3b
lds esi, [eax + 0x2ab57ce5]
mov ah, 0x46
loopne 0x493bc4
popal
dec edi
cmp dword [eax], edi
sbb ebp, dword [edx + 0x7a]
cmp ebp, ecx
cmp ebp, ebp
fcmovne st(0), st(5)
test eax, 0x6d60f6f8
jne 0x493bd5
xor eax, 0x4418e48b
in eax, dx
not byte [ebx - 0x59]
std
xor dword [eax], ebp
and cl, byte [ebx + 0x3ed97721]
invalid
js 0x493b4d
mov bh, dl
xlatb
rcr byte [0xb858a1f4], 0x49
and ch, 0x86
lea esi, [ebx]
sbb byte [esi + edx*4 - 0x13d5412f], 0x3a
pop eax
sar dword [esi + 0x583aec2a], 1
mov cl, 0xff
mov al, 0xd4
lodsd eax, dword [esi]
fidivr word [esi + ebp - 0x4ccf9121]
ljmp 0xf02a

Function at 0x496751
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x4967cc
sub al, 0x60
ljmp 0x4224
cmp ch, ch
inc ebp
mov eax, 0x6d32d570
vpmaddwd xmm2, xmm5, xmmword [ebx - 0x2b]
xchg esp, eax
mov ecx, 0x74d5d11f
inc eax
in al, 0xca
mov edi, 0x4d1339f7
push ebx
test dword [ebp + 0x21], ebp
je 0x496869
wait
or byte [esi + 0x10f87d4a], ah
aaa
pop ss
sbb dh, 7
jp 0x496842
int3
and eax, 0x59432400
sti
fdivr qword [ebx - 0x45]
sbb esp, dword [ebx]
push cs
inc edx
dec ebp
les ebx, [eax - 0x33]
adc eax, 0x1dc1de79
pop eax
int 0x67
adc eax, 0x1dc1de79
invalid
out 0x13, eax
mov dword [0x9640dc48], eax
sub al, bl
push ebx
push ebx
pop ss
and dword [eax], esi
loope 0x4968c3
sub word [edi], dx
stosb byte es:[edi], al
int 0xf1
and al, 0x29
sub dword [ebp - 0x45], 0x3d8fe5a2
insd dword es:[edi], dx
mov ebx, 0x3d8fe5a2
sbb eax, 0x7d27eefd
cmp dword [edx], esi
in eax, dx
dec byte [edi + 0x22264283]
mov bh, 0x2a
or bl, ah
arpl word [edi + 0x56655b76], bp
xor dword [ebx + eax + 0x6c], ebx
rol byte [ebx - 0x30], cl
jge 0x49691e
scasd eax, dword es:[edi]
pop ds
and al, 0xfe
jmp 0x496833
jnp 0x496882
add eax, 0xa628fd54
ljmp 0xda3f
push esp
invalid
div al
cwde
jb 0x4968b5
scasb al, byte es:[edi]
pop esi
invalid
Function at 0x406410
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40662e
sub esp, 0x10
movzx eax, byte [0x8a5e52]
test al, al
jne 0x406606
mov eax, dword [0x8a60f0]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov edx, dword [esp + 0x18]
add eax, edx
mov ebx, dword [esp + 0x14]
jmp 0x4064c1
mov edx, dword [ebx]
xor edx, eax
nop
nop
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
nop
mov edx, dword [ebx + 4]
xor edx, ebp
nop
nop
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
nop
mov edx, dword [ebx + 8]
xor edx, esi
nop
nop
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
nop
mov edx, dword [ebx + 0xc]
xor edx, edi
nop
nop
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
jae 0x406451
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x406560
cmp ecx, 4
jb 0x4065d1
je 0x4065ba
cmp ecx, 8
jbe 0x406589
cmp ecx, 0x10
jbe 0x406503
mov ebp, dword [0x8a60f4]
imul ebp, edx
mov esi, dword [0x8a60f8]
imul esi, edx
mov edi, dword [0x8a60fc]
imul edi, edx
jmp 0x4064b6
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
nop
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
nop
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
nop
nop
nop
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor ecx, eax
imul eax, ecx, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
nop
nop
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x406560
mov ecx, dword [ebx]
xor eax, ecx
nop
nop
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x406560
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
nop
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x406560
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.0044cd00
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
call fcn.0044b940
jmp fcn.00406410
Function at 0x409be0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409da0
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x409d85
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
nop
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0044d040
nop
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
nop
mov edi, dword [esp + 0x24]
shr edi, 0x1b
shl ebx, 5
or edi, ebx
test esi, esi
jne 0x409d99
cmp ecx, 0x21
jae 0x409d99
mov dword [esp + 0x10], edi
lea ebx, [0x86a420]
movsd xmm0, qword [ebx + ebp*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.00448120
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00448210
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
mulsd xmm2, qword [esp + 8]
movsd xmm1, qword [0x6e0d08]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x6e0d78]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x409d60
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x6e0db0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x409c0d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
call fcn.00427150
ud2
call fcn.0044b940
jmp fcn.00409be0
Function at 0x413590
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41379b
sub esp, 0x18
mov eax, dword [0x8a5edc]
test eax, eax
jne 0x413783
lea eax, [0x8a5ec8]
mov dword [esp], eax
call fcn.00407b80
mov eax, dword [0x894508]
test eax, eax
je 0x4135dc
cmp dword [eax + 8], 0xcc
jne 0x4136a3
mov eax, dword [0x894500]
test eax, eax
jne 0x413685
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x8a7d78]
mov dword [esp + 8], eax
call fcn.00409db0
mov eax, dword [esp + 0xc]
mov dword [0x894500], eax
mov ecx, dword [0x8944dc]
mov dword [eax], ecx
mov eax, dword [0x894500]
mov dword [0x8944dc], eax
movzx eax, byte [0x8a6300]
test al, al
jne 0x413685
xor eax, eax
jmp 0x413642
lea ebp, [0x8a6300]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jge 0x413685
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
cmp ebx, 5
jae 0x41377c
lea ecx, [0x86511c]
movzx ebx, byte [ecx + ebx]
cmp edx, 0x80
jb 0x413635
jmp 0x41377c
mov eax, dword [0x894500]
mov ecx, dword [eax + 4]
mov dword [0x894500], ecx
mov ecx, dword [0x894508]
mov dword [eax + 4], ecx
mov dword [0x894508], eax
mov eax, dword [0x894508]
mov ecx, dword [eax + 8]
cmp ecx, 0xcc
jae 0x413775
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
lea ecx, [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00402320
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x8a6100]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413766
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x8a6100]
test edx, edx
jne 0x413743
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x8a5e47], 1
lea eax, [0x8a5ec8]
mov dword [esp], eax
call fcn.00407d60
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0044d090
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0044d090
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0044d090
jmp 0x41372a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0044d090
mov eax, edx
jmp 0x413700
call fcn.00427150
ud2
call fcn.00427150
ud2
lea eax, [0x68b513]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00428450
ud2
call fcn.0044b940
jmp fcn.00413590
Function at 0x421c90
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421d9a
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x421d17
cmp cl, 2
jne 0x421d82
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00422910
lea eax, [0x899e4c]
mov dword [esp], eax
call fcn.00407b80
nop
mov eax, dword [0x899e40]
sub eax, dword [0x899e28]
mov dword [0x899e40], eax
mov eax, dword [0x899e34]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x899e34], ecx
lea eax, [0x899e4c]
mov dword [esp], eax
call fcn.00407d60
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413590
lea eax, [0x899e4c]
mov dword [esp], eax
call fcn.00407b80
nop
mov eax, dword [0x899e1c]
sub eax, dword [0x899e04]
mov dword [0x899e1c], eax
mov eax, dword [0x899e10]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x899e10], ecx
lea eax, [0x899e4c]
mov dword [esp], eax
call fcn.00407d60
jmp 0x421d13
lea eax, [0x687c27]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00428450
ud2
call fcn.0044b940
jmp fcn.00421c90

Function at 0x422e30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422f10
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
jne 0x422ef0
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jg 0x422e7d
test cl, cl
jne 0x422e76
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.0042b9a0
jmp 0x422e6a
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0044d187
lea ecx, [0x449dd0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.0044b820
movzx ecx, byte [esp + 0x40]
test cl, cl
jmp 0x422e68
lea eax, [0x68611e]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0042b920
movzx ecx, byte [esp + 0x40]
jmp 0x422e56
call fcn.0044b940
jmp fcn.00422e30
Function at 0x42f260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6a], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.0042f220
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0042b3b0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
jbe 0x42f44a
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x44abb0]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.0044b820
movzx eax, byte [0x89dd48]
test al, al
jne 0x42f423
lea eax, [0x8956e4]
mov dword [esp], eax
call fcn.00402200
mov eax, dword [esp + 4]
test eax, eax
jne 0x42f3fc
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
nop
mov ecx, dword [ecx + 0x11d0]
test ecx, ecx
jne 0x42f3d1
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
nop
mov edx, dword [edx + 0x14]
mov dword [ecx + 0x164], edx
mov byte [eax + 0x6c], 1
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0xbc], 0
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
nop
mov dword [ecx + 0x30], 0
mov edx, dword [eax + 0x18]
nop
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 8]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.004023e0
mov eax, dword [0x8956d8]
test eax, eax
jne 0x42f3ad
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
lea eax, [0x69c464]
mov dword [esp], eax
call fcn.0044b820
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0042f220
jmp 0x42f39f
lea eax, [0x69c560]
mov dword [esp], eax
call fcn.0044b820
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042f220
mov eax, dword [esp + 0xc]
jmp 0x42f340
lea eax, [0x69c468]
mov dword [esp], eax
call fcn.0044b820
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042f220
jmp 0x42f325
lea eax, [0x69c5a8]
mov dword [esp], eax
call fcn.0044b820
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042f220
jmp 0x42f30b
cmp dword [eax + 4], ecx
jb 0x42f2d2
jmp 0x42f2fc