joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018c7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xcc
mov dword [ebp - 0xa4], 0x477fe8
mov dword [ebp - 0xa0], 0x47983c
lea eax, [ebp - 0x9c]
mov dword [eax], ebp
mov edx, 0x401ab0
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0xbc]
mov dword [esp], eax
call fcn.00407aaf
mov dword [ebp - 0x20], 0xffffffff
lea eax, [ebp - 0x44]
mov ecx, eax
call fcn.00417100
mov edx, dword [str.VO7R]
mov ecx, dword [section..data]
mov eax, dword [0x47c004]
lea ebx, [ecx + eax]
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [ebp - 0xb8], 1
mov ecx, eax
call fcn.004168d8
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov edx, eax
lea eax, [ebp - 0x78]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp], edx
mov ecx, eax
call fcn.00416bdc
sub esp, 8
mov ecx, dword [0x489024]
mov edx, dword [0x489020]
lea eax, [ebp - 0x84]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
lea edx, [ebp - 0x78]
mov dword [esp], edx
mov dword [ebp - 0xb8], 2
mov ecx, eax
call fcn.00416adc
sub esp, 0xc
lea eax, [ebp - 0x84]
mov ecx, eax
call fcn.00420c4c
mov dword [esp], eax
mov dword [ebp - 0xb8], 3
call fcn.0047779c
mov dword [0x489028], eax
lea eax, [ebp - 0x84]
mov ecx, eax
call fcn.00420c4c
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x84]
mov ecx, eax
call fcn.00462c40
mov edx, dword [0x489028]
mov esi, dword [ebp - 0xc0]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00401344
mov eax, dword [0x489020]
test eax, eax
je 0x401a1b
mov eax, dword [0x489020]
mov dword [esp], eax
call fcn.00477784
mov dword [0x489020], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0xb8], 3
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
lea eax, [ebp - 0x84]
mov ecx, eax
call fcn.00462da8
lea eax, [ebp - 0x78]
mov ecx, eax
call fcn.00416ca0
lea eax, [ebp - 0x44]
mov ecx, eax
call fcn.00417130
jmp 0x401afb
lea eax, [ebp - 0xbc]
mov dword [esp], eax
call fcn.00407b05
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401d44
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
push ecx
mov eax, dword [eax + 0xc]
movsx ecx, byte [eax]
cmp cl, 0x6e
jne 0x401d69
lea edx, [eax + 1]
mov edi, 1
mov dword [esi + 0xc], edx
movsx ecx, byte [eax + 1]
xor ebx, ebx
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x401d7a
test edi, edi
je 0x401db0
neg ebx
jmp 0x401db0
lea eax, [ecx - 0x30]
mov ecx, 0xa
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, 0x7fffffff
sub eax, edx
cdq
idiv ecx
cmp eax, ebx
jl 0x401dad
imul ebx, ebx, 0xa
mov eax, dword [ebp - 0x10]
add ebx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + 1]
mov dword [esi + 0xc], edx
movsx ecx, byte [eax + 1]
jmp 0x401d6b
or ebx, 0xffffffff
pop edx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403d43
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push ebx
mov ebx, eax
mov eax, dword [ecx]
cmp eax, 3
je 0x403e48
sub eax, 0x19
cmp eax, 0x3a
ja case.0x403d63.40
jmp dword [eax*4 + 0x47f1f8]
mov edx, str._restrict
jmp 0x403d76
mov edx, str._volatile
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.0040214f
mov edx, str._const
jmp 0x403d76
mov edx, str._transaction_safe
jmp 0x403d76
mov edx, str._noexcept
jmp 0x403d9a
mov edx, str._throw
mov eax, ebx
call fcn.0040214f
cmp dword [esi + 0x10], 0
je case.0x403d63.33
mov edx, 0x28
mov eax, ebx
call fcn.004020ce
mov ecx, dword [esi + 0x10]
jmp 0x403e5c
mov edx, 0x20
mov eax, ebx
call fcn.004020ce
mov ecx, dword [esi + 0x10]
jmp 0x403e79
mov edx, 0x2a
jmp 0x403e6d
mov edx, 0x20
mov eax, ebx
call fcn.004020ce
mov edx, 0x26
jmp 0x403e6d
mov edx, 0x20
mov eax, ebx
call fcn.004020ce
mov edx, 0x47f1ce
jmp 0x403d76
mov edx, str.__Complex
jmp 0x403d76
mov edx, str.__Imaginary
jmp 0x403d76
cmp byte [ebx + 0x104], 0x28
je 0x403e2f
mov edx, 0x20
mov eax, ebx
call fcn.004020ce
mov ecx, dword [esi + 0xc]
mov edx, 0x11
mov eax, ebx
call fcn.00402501
mov edx, 0x47f1e7
jmp 0x403d76
mov ecx, dword [ecx + 0xc]
jmp 0x403e79
mov edx, str.___vector_
mov eax, ebx
call fcn.0040214f
mov ecx, dword [esi + 0xc]
mov edx, 0x11
mov eax, ebx
call fcn.00402501
mov edx, 0x29
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.004020ce
mov ecx, esi
mov eax, ebx
mov edx, 0x11
pop ebx
pop esi
pop ebp
jmp fcn.00402501
pop ebx
pop esi
pop ebp
ret

Function at 0x4041b1
Capabilities:
Parse credit card information

Disassembly:
cmp dword [ecx], 0x33
jne 0x4041c4
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 4]
jmp fcn.0040210c
mov edx, 0x11
jmp fcn.00402501

Function at 0x407414
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x407439
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x407439
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x40743d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x407471
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x40746b
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x407473
inc ebx
add eax, 0x28
jmp 0x407459
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x40fe4a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov ebx, eax
sub esp, 0x50
mov dword [esp], eax
call fcn.0040fa54
dec eax
jne 0x40fe9f
xor eax, eax
lea edi, [ebp - 0x3d]
lea ebx, [ebp - 0x3d]
mov ecx, 0x35
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.0040fe20
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
mov dword [ebx], 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret

Function at 0x40ff35
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
call fcn.0040feac
mov eax, dword [0x47c234]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push ecx
test eax, eax
jne 0x41003e
call fcn.0040fd82
mov ebx, eax
test eax, eax
je 0x41003e
mov dword [eax + 0x24], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x38]
mov dword [ebx + 0x1c], 0xffffffff
call fcn.0040fe4a
mov edx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebp - 0x1c], edx
mov dword [ebx + 0x14], eax
call edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, dword [ebp - 0x1c]
mov esi, eax
call edx
xor edx, edx
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebx + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
jne 0x410005
call sub.msvcrt.dll_abort
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
xor ecx, ecx
push edx
mov dword [ebx + 0x6c], eax
mov al, byte [ebx + 0x20]
mov dword [ebx + 0x68], ecx
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov dword [esp + 4], ebx
mov eax, dword [0x47c234]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
push esi
test eax, eax
je 0x410000
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410bc9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
call fcn.0040ff35
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.00410696
test byte [ebx + 0x20], 0x30
jne 0x410c06
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x47c234]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x410c9a
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
jne 0x410c42
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x410c38
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x410c7d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x410c5a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
je 0x410c9a
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.00410048
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x47c234]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]

Function at 0x4168d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 0x10], 0
jne 0x4168f1
mov eax, 0
jmp 0x4169d5
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41691e
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, 0
jmp 0x4169d5
mov eax, dword [ebp + 8]
movzx eax, ax
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41695a
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, 0
jmp 0x4169d5
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
mov ecx, eax
call fcn.004169dc
sub esp, 8
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4169a9
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, 0
jmp 0x4169d5
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4169d2
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, 0
jmp 0x4169d5
mov eax, dword [ebp - 0x18]
leave
ret 0xc
Function at 0x416ddc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x54]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401344
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0x14]
movzx eax, ax
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x416e9a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
add edx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x50]
cmp eax, edx
jae 0x416e76
mov eax, 0
jmp 0x416eb1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401344
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jl 0x416e2f
mov eax, 1
leave
ret

Function at 0x41702c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x10], eax
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x22
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call eax
sub esp, 0x14
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x4170fa
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, 0
div dword [ebp - 0x10]
mov eax, edx
test eax, eax
je 0x4170fa
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call eax
sub esp, 4
nop
leave
ret
Function at 0x45e130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x1c
mov ecx, dword [ecx]
mov ebx, dword [ebp + 8]
mov eax, ecx
not eax
test ax, 0x101
jne 0x45e14e
add dword [ebx + 8], 0xc
mov al, byte [esi]
mov byte [ebp - 0x19], al
test al, al
jns 0x45e178
xor edx, edx
test byte [esi + 1], 2
je 0x45e16a
mov eax, dword [ebx + 0x14]
mov edi, 0x64
cdq
idiv edi
mov eax, dword [esi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [ebx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x45e20f
mov al, byte [ebp - 0x19]
not eax
test al, 0x18
je 0x45e1f0
test byte [ebp - 0x19], 4
je 0x45e1f0
mov eax, dword [ebx + 0x14]
add eax, 0x76c
call fcn.004510ac
mov edi, dword [ebx + 0x1c]
movzx eax, al
mov edx, eax
mov dword [ebp - 0x20], eax
xor eax, eax
neg edx
and edx, 0x1a
movzx ecx, word [edx + eax*2 + 0x4823a0]
cmp ecx, edi
jg 0x45e1c5
inc eax
jmp 0x45e1b6
test byte [ebp - 0x19], 8
jne 0x45e1d1
lea edx, [eax - 1]
mov dword [ebx + 0x10], edx
test byte [ebp - 0x19], 0x10
jne 0x45e1ed
imul edx, dword [ebp - 0x20], 0xd
lea eax, [eax + edx - 1]
movzx eax, word [eax + eax + 0x4823a0]
sub edi, eax
inc edi
mov dword [ebx + 0xc], edi
or byte [esi], 0x18
mov al, byte [esi]
mov edx, dword [ebx + 0x10]
mov byte [ebp - 0x19], al
test al, 8
jne 0x45e201
cmp edx, 0xb
ja 0x45e20f
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
call fcn.004509cc
mov dword [ebx + 0x18], eax
mov eax, dword [esi]
and ax, 0x404
cmp ax, 0x400
jne 0x45e250
mov edi, dword [ebx + 0x10]
test byte [ebp - 0x19], 8
jne 0x45e229
cmp edi, 0xb
ja 0x45e250
mov eax, dword [ebx + 0x14]
add eax, 0x76c
call fcn.004510ac
mov edx, dword [ebx + 0xc]
movzx eax, al
imul eax, eax, 0xd
add eax, edi
movzx eax, word [eax + eax + 0x4823a0]
lea eax, [edx + eax - 1]
mov dword [ebx + 0x1c], eax
test byte [ebp - 0x19], 0x60
je 0x45e315
test byte [ebp - 0x19], 2
je 0x45e315
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
test byte [ebp - 0x19], 4
jne 0x45e2ba
mov al, byte [ebp - 0x19]
mov ecx, 1
xor edx, edx
shr al, 5
and eax, 1
xor eax, 1
mov edi, eax
mov eax, dword [ebp - 0x20]
call fcn.004509cc
mov ecx, 7
sub eax, edi
mov edx, eax
mov eax, ecx
sub eax, edx
cdq
idiv ecx
mov al, byte [esi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea esi, [edx + eax]
mov eax, dword [ebx + 0x18]
sub eax, edi
add eax, 7
cdq
idiv ecx
add esi, edx
mov dword [ebx + 0x1c], esi
mov al, byte [ebp - 0x19]
not eax
test al, 0x18
je 0x45e315
mov eax, dword [ebp - 0x20]
add eax, 0x76c
call fcn.004510ac
xor ecx, ecx
movzx edx, al
mov eax, dword [ebx + 0x1c]
mov esi, edx
neg esi
and esi, 0x1a
movzx edi, word [esi + ecx*2 + 0x4823a0]
cmp edi, eax
jg 0x45e2ee
inc ecx
jmp 0x45e2df
test byte [ebp - 0x19], 8
jne 0x45e2fa
lea esi, [ecx - 1]
mov dword [ebx + 0x10], esi
test byte [ebp - 0x19], 0x10
jne 0x45e315
imul edx, edx, 0xd
lea edx, [ecx + edx - 1]
movzx edx, word [edx + edx + 0x4823a0]
sub eax, edx
inc eax
mov dword [ebx + 0xc], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x407ac0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x407c87
mov eax, dword [0x7fcb80]
mov ecx, dword [esp + 0xc]
imul eax, ecx
mov edx, dword [esp + 8]
add eax, edx
mov ebx, dword [esp + 4]
jmp 0x407b54
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 8]
cmp ecx, 0x10
jae 0x407aef
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x407bec
cmp ecx, 4
jb 0x407c55
je 0x407c40
cmp ecx, 8
jbe 0x407c12
cmp ecx, 0x10
jbe 0x407b96
mov ebp, dword [0x7fcb84]
imul ebp, edx
mov esi, dword [0x7fcb88]
imul esi, edx
mov edi, dword [0x7fcb8c]
imul edi, edx
jmp 0x407b49
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul ebx, eax, 0xbce2d621
rol ebx, 0xf
imul ebx, ebx, 0xc70f85e1
xor ebx, dword [edx + 4]
imul edx, ebx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ebp]
nop
nop
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x10], eax
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
nop
nop
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407bec
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407bec
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407bec
call fcn.004535d0
jmp fcn.00407ac0
Function at 0x40b220
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b3f3
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40b3c6
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00454af0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x24]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x4f8660]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b3e6
cmp ecx, 0x21
jae 0x40b3da
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044e540
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0044e610
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x526f68]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x526fd0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b3a1
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x527010]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40b24d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00454bd0
mov eax, ecx
mov ecx, 0x21
call fcn.00454c70
nop
call fcn.004535d0
jmp fcn.0040b220