joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408274
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
xor ecx, ecx
lea eax, [ebp - 0x18]
sub esp, 0x48
mov dword [0x454d20], 0x44
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x454d20
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x4082e0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x4082e4
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x408556
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
mov ebx, eax
inc eax
je 0x408584
mov dword [esp], esi
mov eax, ebx
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x40858f
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00408556
push ecx
cmp eax, 0xffffffff
je 0x4085e4
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x4085dc
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push edx
jne 0x4085d5
test byte [ebp + 0xc], 4
jne 0x4085e4
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x4085e4
mov eax, 1
jmp 0x4085e6
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4085b9
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x4085ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x40860a
xor eax, eax
mov dword [esp + 0x14], eax
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x408643
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x64
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
div ecx
xor eax, eax
add word [ebp - 0xc], dx
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
jne 0x4086a2
dec esi
jne 0x408653
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x4086ad
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x4086ea
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4086f1
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x40872e
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x408932
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x30
mov dword [ebp - 0x10], 0x2000
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0x18], 0
setne al
shl eax, 8
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040887e
sub esp, 0x10
test eax, eax
je 0x408980
mov word [ebx], 0
jmp 0x4089d3
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
push edx
mov word [ebx + 0x1ffe], 0
jne 0x408979
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x408979
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x408fdb
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x450d20
mov dword [esp + 4], eax
call fcn.00408aac
push ebx
push ebx
mov dword [esp], 0x450d20
call fcn.0040843c
push edx
test eax, eax
jne 0x40900c
xor eax, eax
jmp 0x409086
mov dword [esp], eax
mov ebx, eax
call fcn.00408b68
push ecx
test byte [0x41812c], 0x80
je 0x40902c
movzx eax, word [ebx]
test eax, eax
je 0x409008
cmp eax, 0x5c
je 0x409008
sub ebx, 0x450d20
sar ebx, 1
mov dword [esp], 0x450d20
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
cmp ebx, eax
mov dword [esp], 0x450d20
jge 0x40906b
call fcn.00408fa3
push edx
test eax, eax
je 0x40905c
test byte [eax], 0x10
je 0x409008
mov dword [esp], 0x450d20
call fcn.004083cb
push eax
jmp 0x409034
call fcn.00408ae0
push eax
mov dword [esp], 0x450d20
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
inc eax
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x40908d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x4090cb
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x4090d2
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40d3a0
add eax, ebx
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4
Function at 0x409adc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x454d84], 0
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x409b19
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409b04
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409af6
mov dword [ecx*4 + 0x454d80], eax
inc ecx
cmp ecx, 0x100
jne 0x409aef
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409b3b
mov cl, byte [edx]
inc edx
xor cl, al
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x454d80]
jmp 0x409b23
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4a2c25
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4b1800
call fcn.004a6f80
call fcn.004a6c51
movzx esi, ax
push 2
call fcn.004a6a51
pop ecx
mov eax, 0x5a4d
cmp word [sym.imp.uxtheme.dll_GetThemeTextExtent], ax
je 0x4a2adc
xor ebx, ebx
jmp 0x4a2b0f
mov eax, dword [0x40003c]
cmp dword [eax + sym.imp.uxtheme.dll_GetThemeTextExtent], 0x4550
jne 0x4a2ad8
mov ecx, 0x10b
cmp word [eax + reloc.uxtheme.dll_HitTestThemeBackground], cx
jne 0x4a2ad8
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4a2b0f
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004a6473
or eax, eax
jne 0x4a2b23
push 0x1c
call fcn.004a2bfe
pop ecx
call fcn.004a5ed6
or eax, eax
jne 0x4a2b34
push 0x10
call fcn.004a2bfe
pop ecx
call fcn.004a6b38
and dword [ebp - 4], 0
call fcn.004a6488
or eax, eax
jns 0x4a2b4e
push 0x1b
call fcn.004a2bfe
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5c1d30], eax
call fcn.004a6b78
mov dword [0x5bc4c8], eax
call fcn.004a6736
or eax, eax
jns 0x4a2b74
push 8
call fcn.004a5fb1
pop ecx
call fcn.004a696f
or eax, eax
jns 0x4a2b85
push 9
call fcn.004a5fb1
pop ecx
push 1
call fcn.004a5feb
pop ecx
or eax, eax
je 0x4a2b98
push eax
call fcn.004a5fb1
pop ecx
call fcn.004a6f28
push esi
push eax
push 0
push sym.imp.uxtheme.dll_GetThemeTextExtent
call main
push eax
pop esi
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x4a2bba
push esi
call fcn.004a6247
call fcn.004a5fdc
jmp 0x4a2bef
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.004a6fc5
ret
call fcn.004a6a9e
jmp 0x4a2aae
Function at 0x1a18ffc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1a19006
pushal
call 0x1a1900c
pop ebp
sub ebp, 0x10
sub ebp, 0x1618ffc
jmp 0x1a19022
mov eax, 0x1618ffc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ab
mov edx, 0xdfda9b3c
xor byte [eax], dl
inc eax
dec ecx
jne 0x1a19039
jmp 0x1a1904c
mov bh, 0xf1
mov bh, 0xb5
add byte [esp + edi], bh
cmp al, 0xbd
std
les edi, [esp + edi]
cmp al, 0x3f
int1
test byte [ecx], bh
cmp al, 0x3c
cmp al, 0x86
adc al, 0x3c
cmp al, 0x3c
retf
Function at 0x40a340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1e]
pop ebp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40a35f
add ecx, 0xc
mov edi, 0xc02c1587
inc eax
adc dword [ebx], 0xc25d5ec0
cmp eax, dword [eax]
adc eax, eax
pop esi
pop ebp
ret 0x3b
or dword [edx + 1], 0x75
or al, 0x8b
inc ecx
or byte [eax - 1], dl
xlatb
xor ch, bl
inc eax
add byte [edi + ecx], dl
jne 0x40a36a
add dl, byte [ebp - 0x1d]
mov edi, dword [ebx]
or byte [ecx + 0xf], dl
adc eax, 0x4044e7
test ebx, ecx
jne 0x40a358
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call esi
test dword [eax + 0x74], esi
leave
call esi
add eax, 0xafc80
pop esi
pop ebp
ret 4
Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [edx]
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [edx]
adc byte [ebx + 0x4e8b1046], cl
adc al, 0xb
rol edi, 0x45
adc byte [eax], al
add byte [eax], al
add byte [edi + 0x71], ch
mov al, byte [esi + 8]
test al, al
je 0x40b10d
mov edx, dword [esi + 4]
lea ecx, [ebp + 8]
pop ss
jae 0x40b0fd
push 0
push 0
push 0
push edx
push cs
int3
pop esi
mov dword [edx], eax
mov eax, 0xb
pop ebp
invalid
mov eax, dword [esi + 0xc]
test eax, eax
jb 0x40b171
mov cl, byte [esi + 8]
test cl, cl
jne 0x40b137
mov ecx, dword [esi + 0x50]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov ecx, 0x20
call fcn.0040b810
push esi
or al, 0x89
inc edx
add dword [esi + eax*2], 0xc558b0c
push ebx
add al, 0x46
or al, 0x8b
push ebp
or al, 0x53
lea ecx, [ebp + 0x10]
push eax
mov eax, dword [esi + 4]
pop edx
scasd eax, dword es:[edi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
cmpsb byte [esi], byte es:[edi]
pop es
xor eax, eax
jmp 0x40b285
cmp eax, 0xcf0b0065
jne 0xc5b24f
mov esi, dword [eax]
pushfd
add dword [eax], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
leave
jne 0x40b1a2
jg 0x40b202
test eax, eax
push es
adc byte [edx], ch
cli
aam 3
add byte [ebx - 0xf17afaf], bl
rol dword [eax], 1
add bl, ch
mov esi, 0x489ec123
and eax, ecx
sahf
dec eax
push dword [ebp + 4]
or eax, eax
jmp 0x40b1bd
add byte [eax], 0
add byte [ebx + ebp*8 + 0x63], dh
bnd je 0x40b1f8
mov eax, dword [0x418760]
sbb eax, 0xc085045e
jns 0x40b1d6
push eax
push str.CancelIo
add byte [ecx], al
push eax
call 0x3fcf40
cmpsd dword [esi], dword es:[edi]
les ecx, [ebx]
ret 0x4124
rcr bh, 0
mov ecx, dword [esi - 0x49]
mov edx, dword [esi + 4]
lea eax, [ebp + 0x10]
push 1
push eax
push ecx
add dword [eax + 0x51], edx
mov bh, 0xff
adc eax, sym.imp.KERNEL32.dll_GetOverlappedResult
test dword [esi + 0x74], edi
add al, 0x33
sal bl, 0xb5
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
dec dword [edx - 0x7b]
sal byte [edi], 0x74
call ebx
add eax, 0xafc80
cmp eax, 0xb0064
je 0x40b235
cmp eax, 0xa70b00f3
jne 0x40b1f5
cmp edi, 0x102
jne 0x40b24f
jne 0x40b28c
adc al, 0x8b
push ebp
adc byte [ebx + 0x5f], bl
mov eax, 0x11177
mov dword [ecx], edx
pop esi
pop ebp
sub edi, dword [0xafced]
in eax, dx
cld
or al, byte [eax]
cmp eax, 0xafced
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x40b29e
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
pop ebx
pop edi
mov eax, 0x1117e
mov dword [ebp - 0x743c74a2], edi
pop edi
or dword [ecx - 0x758b8b68], edi
mov ebx, dword [edi + 9]
mov ecx, 0x8a747498
push esi
or byte [ebx - 0x74ee8a2e], bh
push esi
push eax
add ecx, ecx
mov ecx, dword [esi + 0x54]
out 0xd1, eax
add byte [ecx + 0x4e8950b6], cl
push esp
iretd
Function at 0x407ed0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x408097
mov eax, dword [0x7a0960]
mov ecx, dword [esp + 0xc]
imul eax, ecx
mov edx, dword [esp + 8]
add eax, edx
mov ebx, dword [esp + 4]
jmp 0x407f64
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 8]
cmp ecx, 0x10
jae 0x407eff
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x407ffc
cmp ecx, 4
jb 0x408065
je 0x408050
cmp ecx, 8
jbe 0x408022
cmp ecx, 0x10
jbe 0x407fa6
mov ebp, dword [0x7a0964]
imul ebp, edx
mov esi, dword [0x7a0968]
imul esi, edx
mov edi, dword [0x7a096c]
imul edi, edx
jmp 0x407f59
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul ebx, eax, 0xbce2d621
rol ebx, 0xf
imul ebx, ebx, 0xc70f85e1
xor ebx, dword [edx + 4]
imul edx, ebx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ebp]
nop
nop
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x10], eax
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407ffc
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407ffc
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407ffc
call fcn.0045c8b0
jmp fcn.00407ed0
Function at 0x40ba50
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40bc23
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40bbf6
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0045ddc0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x24]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x7555e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40bc16
cmp ecx, 0x21
jae 0x40bc0a
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00455300
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004553d0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x65bb68]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x65bbd0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40bbd1
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x65bc10]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40ba7d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.0045dea0
mov eax, ecx
mov ecx, 0x21
call fcn.0045df70
nop
call fcn.0045c8b0
jmp fcn.0040ba50
Function at 0x414a60
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414c7f
sub esp, 0x18
mov eax, dword [0x7a0710]
test eax, eax
jne 0x414c68
nop
nop
lea eax, [0x7a06f4]
mov dword [esp], eax
call fcn.00409820
mov eax, dword [0x7a06f8]
test eax, eax
je 0x414aae
cmp dword [eax + 8], 0xcc
jne 0x414b76
mov edx, dword [0x7a06ec]
test edx, edx
jne 0x414b58
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x7a2bf8]
mov dword [esp + 8], eax
call fcn.0040bc30
mov eax, dword [esp + 0xc]
mov dword [0x7a06ec], eax
mov ecx, dword [0x7a06a8]
mov dword [eax], ecx
mov eax, dword [0x7a06ec]
mov dword [0x7a06a8], eax
movzx eax, byte [0x7a0c20]
test al, al
jne 0x414b58
xor eax, eax
jmp 0x414b15
lea esi, [0x7a0c20]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x414b58
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x414c5e
lea edx, [0x74f200]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x414b07
jmp 0x414c52
mov edx, dword [0x7a06ec]
mov ebx, dword [edx + 4]
mov dword [0x7a06ec], ebx
mov ebx, dword [0x7a06f8]
mov dword [edx + 4], ebx
mov dword [0x7a06f8], edx
mov edx, dword [0x7a06f8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414c48
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020b0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x7a0970]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x414c39
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x7a0970]
test edx, edx
jne 0x414c16
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x7a0674], 1
nop
lea eax, [0x7a06f4]
mov dword [esp], eax
call fcn.00409a30
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.0045de10
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.0045de10
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.0045de10
jmp 0x414bfc
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.0045de10
mov eax, edx
jmp 0x414bd2
mov ecx, 0xcc
call fcn.0045dea0
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.0045de90
mov ecx, 5
call fcn.0045de90
lea eax, [0x615af6]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004321d0
nop
call fcn.0045c8b0
jmp fcn.00414a60