joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b458
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
mov dword [esp], eax
call fcn.00412360
mov dword [esp + 4], ebx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.00412360
mov dword [esp + 4], ebx
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.00412360
add eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [edi + edi]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], edi
je 0x40b51c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.00412360
lea ecx, [ebx + eax]
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call fcn.0040ba50
mov ecx, dword [ebp - 0x2c]
cmp eax, 0xa6caa1c5
jne 0x40b50a
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.00412360
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], ebx
add eax, ebx
movzx edx, word [edx]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
call fcn.00412360
jmp 0x40b51e
mov dword [esp], ecx
inc edi
call fcn.0040ba50
cmp eax, 0xffe885ef
jne 0x40b4aa
jmp 0x40b4e2
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [0x417330]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x48e]
test eax, eax
je 0x40b633
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x444]
test edx, edx
jne 0x40b633
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], 0
mov esi, dword [eax + ecx + 0x78]
add esi, eax
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
add ecx, eax
add edi, eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi + 0x18]
add ebx, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], edi
je 0x40b62a
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
mov esi, dword [edi + esi*4]
cmp word [eax + esi], 0x775a
jne 0x40b625
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
test ebx, ebx
movzx esi, word [edi + esi*2]
jne 0x40b603
mov edi, dword [ebp - 0x18]
mov ebx, dword [edi + esi*4]
add ebx, eax
jmp 0x40b625
mov ecx, dword [ebp - 0x18]
mov edi, dword [ecx + esi*4]
add edi, eax
mov esi, edi
sub edi, ebx
mov ecx, edi
cmp ebx, esi
jbe 0x40b61b
mov edi, ebx
sub edi, esi
mov ecx, edi
test edx, edx
je 0x40b623
cmp edx, ecx
jbe 0x40b625
mov edx, ecx
inc dword [ebp - 0x10]
jmp 0x40b5d2
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x444], edx
add esp, 0x18
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d8f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x40d923
cmp dword [ebp + 0xc], 0
jne 0x40d92a
xor eax, eax
jmp 0x40da08
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x40d923
lea eax, [ebx + ecx]
mov dword [ebp - 0x40], edx
mov edi, dword [eax + esi*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
add edi, ebx
mov dword [ebp - 0x3c], ecx
mov dword [esp], edi
call fcn.0040b9fc
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x40da02
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x40d9a9
mov eax, dword [ebp - 0x24]
jmp 0x40da08
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x40d9a4
mov dword [esp], edi
call fcn.00412e48
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x417330]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x40d923
lea edx, [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
sub esp, 0x10
test eax, eax
jns 0x40d9a4
jmp 0x40d923
inc esi
jmp 0x40d951
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x412360
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp dword [eax + 0x14], edx
ja 0x4123a6
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x4123a4
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x41239f
mov esi, dword [eax + 0x10]
add esi, ebx
cmp esi, edx
jbe 0x41239f
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x4123a6
add eax, 0x28
jmp 0x412384
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x403281
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 0
mov esi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [0x4f9b60]
mov edi, eax
push edx
movzx esi, si
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x4032b8
push 0x409
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop edi
pop esi
pop ebx
ret

Function at 0x40339d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
movzx edx, di
shr edx, 4
push 6
inc edx
pop ecx
call fcn.00403281
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
and edi, 0xf
xor eax, eax
cmp ax, di
jae 0x4033d6
mov ecx, edi
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4033c8
movzx eax, word [esi]
mov ecx, 0x104
inc eax
cmp eax, ecx
cmovg eax, ecx
push eax
lea eax, [esi + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
movzx ecx, word [esi]
mov eax, 0x103
cmp ax, cx
jb 0x4033ff
mov eax, ecx
pop edi
xor ecx, ecx
pop esi
mov word [ebx + eax*2], cx
pop ebx
ret

Function at 0x409f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409fdb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409fcc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x409fc8
cmp esi, ecx
jae 0x409fcc
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x409fb6
cmp esi, ecx
jb 0x409fd0
xor eax, eax
jmp 0x409fda
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a38d
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0x220
mov eax, 0x4a8596
call fcn.00483391
xor esi, esi
lea eax, [ebp - 0x224]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a4d6
mov edi, 0x104
lea eax, [ebp - 0x218]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0040a098
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040a8a3
mov dword [ebp - 4], esi
mov eax, str.___d
test eax, 0xffff0000
jne 0x40a40c
movzx eax, ax
lea ecx, [ebp - 0x21c]
push eax
call fcn.0040a8cc
jmp 0x40a418
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0040a76b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040a6eb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
push eax
call fcn.0040a61a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x220]
call fcn.0040a678
pop ecx
pop ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x228]
call fcn.0040a888
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x22c]
call fcn.0040a888
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x21c]
call fcn.0040a888
mov eax, dword [ebp - 0x220]
cmp dword [eax - 4], ebx
jle 0x40a4a6
push dword [eax - 0xc]
lea ecx, [ebp - 0x220]
call fcn.0040a7bb
mov eax, dword [ebp - 0x220]
push edi
push eax
push ebx
push esi
push 0x4ce294
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040a888
call fcn.0048333b
ret

Function at 0x40a4dc
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x420
mov eax, 0x4a85d4
call fcn.00483391
xor esi, esi
lea eax, [ebp - 0x428]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a5bc
push 0x104
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push 0x4ce294
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a5bc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x424]
call fcn.0040a6eb
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x424]
cmp dword [eax - 0xc], esi
jl 0x40a597
lea ecx, [ebp - 0x420]
push ecx
push eax
call fcn.0048475e
pop ecx
pop ecx
test eax, eax
jne 0x40a59c
or eax, 0xffffffff
jmp 0x40a5a4
sub eax, dword [ebp - 0x424]
sar eax, 1
test eax, eax
setg bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.0040a888
mov al, bl
jmp 0x40a5be
xor al, al
call fcn.0048333b
ret
Function at 0x40cda2
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x4a8f95
call fcn.00483391
mov esi, ecx
mov dword [ebp - 0x30], esi
or ebx, 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x40cdc2
xor eax, eax
jmp 0x40cf35
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40cdf0
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40cdf0
lea eax, [edi - 1]
mov dword [edx], eax
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
jmp 0x40cf35
cmp dword [esi + 0x4c], 0
jne 0x40cdfd
mov eax, ebx
jmp 0x40cf35
mov ecx, esi
call fcn.0040daaa
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x40ce24
push dword [esi + 0x4c]
movsx ecx, al
push ecx
call fcn.00488964
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x40cdf6
mov dword [ebp - 0x18], ecx
push ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x29], al
mov dword [ebp - 0x14], 0xf
call fcn.0040d754
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29]
push eax
push dword [ebp - 0x34]
call dword [edi + 0x1c]
test eax, eax
js 0x40cf20
cmp eax, 1
jg 0x40cefc
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x40ced2
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.00489d4b
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x40cf20
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x29]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x40], eax
jne 0x40cf23
test edx, edx
jne 0x40ce52
cmp dword [ebp - 0x18], 0x20
jae 0x40cf20
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040d8af
jmp 0x40ce4f
cmp eax, 3
jne 0x40cf20
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
movsx eax, byte [ebp - 0x29]
push eax
call fcn.00488964
pop ecx
pop ecx
cmp eax, ebx
mov ecx, ebx
cmovne ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
jmp 0x40cf23
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040d685
mov eax, dword [ebp + 8]
call fcn.0048333b
ret 4
Function at 0x40db32
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4a90ad
call fcn.00483391
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40dc37
cmp byte [ebx + 0x3d], 0
je 0x40dc37
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40db67
xor al, al
jmp 0x40dc39
xor eax, eax
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 8
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0040d754
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40dbcb
sub eax, 1
je 0x40dbcf
dec eax
sub eax, 1
je 0x40dc21
xor bl, bl
jmp 0x40dc23
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x40dc07
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00489d4b
add esp, 0x10
cmp esi, eax
jne 0x40dbc7
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x40dc21
test esi, esi
jne 0x40db91
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040d8af
jmp 0x40db8b
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push 0
push 1
call fcn.0040d685
mov al, bl
jmp 0x40dc39
mov al, 1
call fcn.0048333b
ret
Function at 0x42914e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movss xmm1, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x4c]
call fcn.004057ab
mov eax, dword [edi + 0x514]
xor ecx, ecx
sub eax, dword [edi + 0x510]
push 0xc
cdq
pop esi
idiv esi
movss xmm1, dword [edi + 0x8c]
movss xmm5, dword [0x4d5690]
movss xmm4, dword [0x4d5410]
movss dword [ebp - 4], xmm1
mov dword [ebp - 8], ecx
test eax, eax
je 0x4292a4
mov dword [ebp + 8], ecx
cvttss2si eax, xmm1
movss xmm2, dword [edi + 0x310]
movaps xmm3, xmm1
movss xmm1, dword [edi + 0x30c]
movd xmm0, eax
mov eax, dword [edi + 0x510]
cvtdq2ps xmm0, xmm0
subss xmm3, xmm0
movss xmm0, dword [edi + 0x2d8]
mulss xmm1, xmm3
mulss xmm2, xmm3
mulss xmm3, dword [0x4d5450]
mulss xmm1, xmm0
mulss xmm2, xmm0
subss xmm3, xmm4
xorps xmm1, xmm5
movss dword [ecx + eax], xmm1
mov eax, dword [edi + 0x510]
xorps xmm2, xmm5
movss dword [ecx + eax + 4], xmm2
movss xmm0, dword [edi + 0x370]
mov esi, dword [edi + 0x510]
movss dword [ebp - 0xc], xmm0
add esi, ecx
movaps xmm0, xmm3
call fcn.00403852
movss xmm4, dword [0x4d5410]
movaps xmm1, xmm4
mov ecx, dword [ebp - 8]
subss xmm1, xmm0
movss xmm5, dword [0x4d5690]
push 0xc
mulss xmm1, dword [ebp - 0xc]
movss dword [esi + 8], xmm1
movaps xmm1, xmm4
mov eax, dword [edi + 0x514]
sub eax, dword [edi + 0x510]
cdq
pop esi
idiv esi
add dword [ebp + 8], esi
movd xmm0, eax
shr eax, 0x1f
inc ecx
cvtdq2pd xmm0, xmm0
mov dword [ebp - 8], ecx
addsd xmm0, qword [eax*8 + 0x4d5670]
mov eax, dword [edi + 0x514]
sub eax, dword [edi + 0x510]
cdq
idiv esi
cvtpd2ps xmm0, xmm0
cmp ecx, eax
mov ecx, dword [ebp + 8]
divss xmm1, xmm0
addss xmm1, dword [ebp - 4]
movss dword [ebp - 4], xmm1
jb 0x4291a4
divss xmm4, dword [edi + 0x120]
movss xmm3, dword [edi + 0x30c]
movss xmm2, dword [edi + 0x310]
mulss xmm3, dword [0x4d539c]
mulss xmm2, dword [0x4d539c]
movss xmm1, dword [edi + 0x8c]
mulss xmm3, xmm1
mulss xmm2, xmm1
mulss xmm3, xmm4
mulss xmm2, xmm4
xorps xmm3, xmm5
movss dword [edi + 0x520], xmm3
xorps xmm2, xmm5
movss dword [edi + 0x524], xmm2
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x446a70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x2ec
mov eax, 0x4b44f2
call fcn.00483391
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x446b89
lea esi, [edi + 0x1c]
cmp dword [esi + 0x14], 8
jb 0x446a98
mov eax, dword [esi]
jmp 0x446a9a
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446ab1
mov ecx, esi
call fcn.004584b8
jmp 0x446b89
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040344b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x248]
push eax
mov ecx, esi
call fcn.00458422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push 0
push eax
call fcn.00446f52
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x248]
push 0
push ebx
call fcn.00403470
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.00446caa
mov byte [ebp - 4], 4
lea eax, [ebp - 0x230]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00446c53
push 0
push dword [edi + 0x38]
lea ecx, [ebp - 0x2f8]
push dword [edi + 0x34]
call fcn.00446d42
lea ecx, [ebp - 0x2f8]
call fcn.00446ba2
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.004583f1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x290]
call fcn.00446bd4
lea ecx, [ebp - 0x290]
call fcn.0040d35d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push ebx
call fcn.00403470
call fcn.0048333b
ret
Function at 0x44b031
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
push ebx
push esi
mov ebx, ecx
push edi
push 0
mov ecx, dword [ebx + 0x384]
call fcn.00449c22
test al, al
je 0x44b1d7
lea eax, [esp + 0x88]
lea ecx, [ebx + 0x3c0]
push eax
call fcn.00449827
pop ecx
push 0x18
pop ecx
push dword [ebx + 0x2fc]
mov esi, eax
lea edi, [esp + 0x1c]
push dword [ebx + 0x324]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x20]
call fcn.004498ec
movzx eax, byte [ebx + 0x258]
lea ecx, [esp + 0x78]
mov edx, dword [ebx + 0x20c]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
call fcn.00469570
mov edi, eax
mov esi, 0xff
mov dword [esp + 0x14], edi
xorps xmm1, xmm1
movss xmm0, dword [edi]
comiss xmm0, dword [0x4d5410]
jb 0x44b0c9
mov dword [esp + 0xc], esi
jmp 0x44b0f1
comiss xmm1, xmm0
jb 0x44b0d5
and dword [esp + 0xc], 0
jmp 0x44b0f1
mulss xmm0, dword [0x4d54ec]
addss xmm0, dword [0x4d53dc]
call fcn.004a6700
mov dword [esp + 0xc], eax
xorps xmm1, xmm1
movss xmm0, dword [edi + 4]
comiss xmm0, dword [0x4d5410]
jb 0x44b105
mov dword [esp + 0x10], esi
jmp 0x44b12a
comiss xmm1, xmm0
jb 0x44b111
and dword [esp + 0x10], 0
jmp 0x44b12a
mulss xmm0, dword [0x4d54ec]
addss xmm0, dword [0x4d53dc]
call fcn.004a6700
mov dword [esp + 0x10], eax
movss xmm0, dword [edi + 8]
xorps xmm1, xmm1
comiss xmm0, dword [0x4d5410]
jb 0x44b13f
mov edi, esi
jmp 0x44b162
comiss xmm1, xmm0
jb 0x44b148
xor edi, edi
jmp 0x44b162
mulss xmm0, dword [0x4d54ec]
addss xmm0, dword [0x4d53dc]
call fcn.004a6700
mov edi, eax
xorps xmm1, xmm1
mov eax, dword [esp + 0x14]
movss xmm0, dword [eax + 0xc]
comiss xmm0, dword [0x4d5410]
jae 0x44b194
comiss xmm1, xmm0
jb 0x44b17d
xor esi, esi
jmp 0x44b194
mulss xmm0, dword [0x4d54ec]
addss xmm0, dword [0x4d53dc]
call fcn.004a6700
mov esi, eax
mov ecx, dword [ebx + 0x384]
lea eax, [esp + 0x18]
shl esi, 8
or esi, dword [esp + 0xc]
shl esi, 8
or esi, dword [esp + 0x10]
shl esi, 8
or esi, edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x6c], esi
xor esi, esi
push eax
push esi
push esi
call fcn.00449c89
mov ecx, dword [ebx + 0x384]
push esi
call fcn.00449c63
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c543
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], edx
cmp dword [esi + 0x28], edx
jne 0x45c660
push edi
mov dword [esi + 0x28], 0x4ffa30
mov edi, edx
mov dword [ebp - 8], edx
movd xmm0, edx
mov eax, edx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
push ecx
push ecx
addsd xmm0, qword [eax*8 + 0x4d5670]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x4d535c]
movss dword [ebp - 0x18], xmm0
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.0048cf00
fstp dword [ebp - 0xc]
movss xmm0, dword [ebp - 0xc]
call fcn.0040fa46
movss dword [ebp - 0x10], xmm0
xorps xmm1, xmm1
divss xmm0, dword [0x4d5420]
cvtss2sd xmm1, xmm0
movss dword [ebp - 0x14], xmm0
movsd qword [esp], xmm1
call fcn.0048cdb0
fstp dword [ebp - 0xc]
movss xmm0, dword [ebp - 0xc]
pop ecx
pop ecx
call fcn.00416470
movss xmm3, dword [ebp - 0x14]
movss xmm1, dword [ebp - 0x10]
divss xmm1, xmm3
mov eax, dword [esi + 0x28]
mov edx, dword [ebp - 4]
divss xmm3, dword [ebp - 0x10]
mulss xmm1, xmm0
xorps xmm3, xmmword [0x4d5690]
subss xmm1, dword [ebp - 0x18]
movss dword [edi + eax], xmm1
mov eax, dword [esi + 0x28]
movss dword [edi + eax + 4], xmm3
mov eax, 0xff
sub eax, edx
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, dword [esi + 0x28]
mov esi, 0x4ffa30
and ecx, 0xffff0000
shl ecx, 8
inc edx
mov dword [edi + eax + 8], ecx
lea edi, [edi + 0x4fee30]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x1c]
add edi, 0xc
mov dword [ebp - 8], edi
cmp edi, 0xc00
jb 0x45c56a
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d5bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8629
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
push edi
mov eax, dword [0x4f91bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0xf
lea ecx, [edi + 0x92c]
call fcn.00405d78
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x900]
call fcn.0041ec5e
mov byte [ebp - 4], 0xd
lea esi, [edi + 0x844]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0xb4]
call fcn.00405d78
mov byte [ebp - 4], 0xd
mov ecx, esi
call fcn.0040ea55
mov byte [ebp - 4], 0xc
lea ecx, [edi + 0x750]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
call fcn.0040ea55
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x69c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xb
call fcn.0040ea55
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0x5dc]
call fcn.0045d729
mov byte [ebp - 4], 9
lea ecx, [edi + 0x5b4]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
call fcn.004058de
mov byte [ebp - 4], 8
lea ecx, [edi + 0x58c]
call fcn.00404bbc
mov byte [ebp - 4], 7
lea ecx, [edi + 0x564]
call fcn.004058de
mov byte [ebp - 4], 6
lea ecx, [edi + 0x53c]
call fcn.004058de
mov byte [ebp - 4], 5
lea ecx, [edi + 0x500]
call fcn.0040588e
mov byte [ebp - 4], 4
lea ecx, [edi + 0x4c4]
call fcn.0040588e
mov byte [ebp - 4], 3
lea ecx, [edi + 0x488]
call fcn.0040588e
mov byte [ebp - 4], 2
lea ecx, [edi + 0x44c]
call fcn.0040588e
mov byte [ebp - 4], 1
lea ecx, [edi + 0x410]
call fcn.0040588e
mov byte [ebp - 4], 0
lea ecx, [edi + 0x3c8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
call fcn.0040588e
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00416c0c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret