joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f0a
Capabilities:
Accept command line arguments
Create process on windows
Get session integrity level
Hide graphical window
Persist via run registry key
Query or enumerate registry value
Read .ini file
Set registry value
Terminate process

Disassembly:
push 0x402cb4
push dword fs:[0]
mov dword fs:[0], esp
call dword [sym.imp.shell32.dll_IsUserAnAdmin]
test eax, eax
jne 0x402f6f
push 0x100
push 0x402a0f
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push 5
push 0
push eax
push 0x402a0f
push 0x402a09
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov esp, dword fs:[0]
pop dword fs:[0]
add esp, 4
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
push 0
push 0x402b49
push 0
push 0x2001b
push 0
push 0
push 0
push 0x40235b
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
je 0x402fad
push 0x10
push 0
push 0x402446
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
jmp 0x403050
push 0x402357
push 0x402353
push 0
push 0
push 0x40238c
push dword [0x402b49]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x402fe8
cmp eax, 2
je 0x402ff4
push 0x10
push 0
push 0x40239d
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
jmp 0x403044
cmp dword [0x402353], 0x100
je 0x403044
push 0x34
push 0
push 0x40222b
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
cmp eax, 7
je 0x403044
mov dword [0x402353], 0x100
push 4
push 0x402353
push 4
push 0
push 0x40238c
push dword [0x402b49]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
push 0x40
push 0x40286d
push 0x401f0e
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push dword [0x402b49]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push 0x402c51
call dword [sym.imp.comctl32.dll_InitCommonControlsEx]
push 0
push 0x40308a
push 0
push 0x12d
push 0
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov esp, dword fs:[0]
pop dword fs:[0]
add esp, 4
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x401a3a
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45bc085
jg 0x401a60
inc edi
cmp edi, 0x323bbf1
jl 0x401a46
cmp dword [0x282843c], 0x400
jne 0x401aa0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
call dword [sym.imp.USER32.dll_ShowCursor]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
call fcn.00401e91
push esi
call fcn.00402033
push esi
call fcn.00402042
add esp, 0xc
xor edi, edi
cmp edi, 0xd036
jge 0x401ab1
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x401ad7
inc edi
cmp edi, 0x263ff
jl 0x401aa2
mov eax, dword [0x43a574]
mov dword [0x282843c], eax
call fcn.004017c2
mov edi, 0x3078f
cmp dword [0x282843c], 0x51f
jne 0x401b03
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401aeb
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10
Function at 0x40417b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403133
and dword [ebp - 0x14], 0
cmp dword [0x4450e4], 0
mov dword [ebp - 0x18], eax
jne 0x40422e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4042d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4042d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4450e4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4450e8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4450ec], eax
call edi
push eax
call esi
mov dword [0x4450f4], eax
test eax, eax
je 0x40422e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4450f0], eax
mov eax, dword [0x4450f0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404287
cmp dword [0x4450f4], ecx
je 0x404287
push eax
call esi
push dword [0x4450f4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404287
test ebx, ebx
je 0x404287
call edi
test eax, eax
je 0x40427e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40427e
test byte [ebp - 8], 1
jne 0x404287
or dword [ebp + 0x10], 0x200000
jmp 0x4042ba
mov eax, dword [0x4450e8]
cmp eax, dword [ebp - 0x18]
je 0x4042ba
push eax
call esi
test eax, eax
je 0x4042ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4042ba
mov eax, dword [0x4450ec]
cmp eax, dword [ebp - 0x18]
je 0x4042ba
push eax
call esi
test eax, eax
je 0x4042ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4450e4]
call esi
test eax, eax
je 0x4042d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4042d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044e6
leave
ret

Function at 0x4044e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420310]
jne 0x4044f0
repz ret
jmp fcn.004053b6
Function at 0x1b494c4e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1b48dfb2
xor ebx, ebx
cmp dword [0x1b4bfad4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1b494d25
push 0x1b463e1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1b494c90
xor eax, eax
jmp 0x1b494de9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1b463e10
push edi
call esi
cmp eax, ebx
je 0x1b494c89
push eax
call fcn.1b48df4c
mov dword [esp], 0x1b463e00
push edi
mov dword [0x1b4bfad4], eax
call esi
push eax
call fcn.1b48df4c
mov dword [esp], 0x1b463dec
push edi
mov dword [0x1b4bfad8], eax
call esi
push eax
call fcn.1b48df4c
mov dword [0x1b4bfadc], eax
lea eax, [ebp - 8]
push eax
call fcn.1b48f717
test eax, eax
pop ecx
pop ecx
je 0x1b494cf3
push ebx
push ebx
push ebx
push ebx
push ebx
call 0x1b4cbe4a
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1b494d25
push 0x1b463dd0
push edi
call esi
push eax
call fcn.1b48df4c
cmp eax, ebx
pop ecx
mov dword [0x1b4bfae4], eax
je 0x1b494d25
push 0x1b463db8
push edi
call esi
push eax
call fcn.1b48df4c
pop ecx
mov dword [0x1b4bfae0], eax
mov eax, dword [0x1b4bfae0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1b494d9e
cmp dword [0x1b4bfae4], esi
je 0x1b494d9e
push eax
call fcn.1b48dfbb
pop ecx
call eax
cmp eax, ebx
je 0x1b494d6b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1b4bfae4]
call fcn.1b48dfbb
pop ecx
call eax
test eax, eax
je 0x1b494d6b
test byte [ebp - 0x18], 1
jne 0x1b494d9e
lea eax, [ebp - 0xc]
push eax
call fcn.1b48f753
test eax, eax
pop ecx
je 0x1b494d86
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1b48f2dd
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1b494d95
or dword [ebp + 0x10], 0x200000
jmp 0x1b494dcf
or dword [ebp + 0x10], 0x40000
jmp 0x1b494dcf
mov eax, dword [0x1b4bfad8]
cmp eax, esi
je 0x1b494dcf
push eax
call fcn.1b48dfbb
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1b494dcf
mov eax, dword [0x1b4bfadc]
cmp eax, esi
je 0x1b494dcf
push dword [ebp - 4]
push eax
call fcn.1b48dfbb
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1b4bfad4]
call fcn.1b48dfbb
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1b49674c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1b4bd79c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.1b48f717
test eax, eax
pop ecx
je 0x1b496781
push edi
push edi
push edi
push edi
push edi
call 0x1b4cbe4a
add esp, 0x14
push 4
pop eax
call fcn.1b48a9e0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1b49688f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x1b496808
push 0x1b463d80
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x1b496808
push 0x1b463fb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1b496808
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x1b496808
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x1b496808
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.1b49332a
add esp, 0xc
test eax, eax
jl 0x1b49688f
not edi
and dword [ebp - 8], edi
je 0x1b49683a
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.1b49332a
add esp, 0xc
test eax, eax
jl 0x1b49688f
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x1b496845
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x1b496859
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x1b49688f
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1b49688f
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1b49688f
xor eax, eax
inc eax
jmp 0x1b496891
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1b4898a6
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x73d05337
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1b3f650a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x405660
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4058a0
sub esp, 0x20
movzx eax, byte [0x71dc1c]
test al, al
jne 0x405878
mov eax, dword [0x71de40]
mov ecx, dword [esp + 0x2c]
imul eax, ecx
mov edx, dword [esp + 0x28]
add eax, edx
mov ebx, dword [esp + 0x24]
jmp 0x405732
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea edx, [ebx + 4]
lea ecx, [ebx + 8]
add ebx, 0xc
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor eax, edi
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [edx]
xor ebp, edx
imul ebp, ebp, 0xc70f85e1
rol ebp, 0xf
imul ebp, ebp, 0x319bca41
mov ecx, dword [ecx]
xor esi, ecx
imul esi, esi, 0x319bca41
rol esi, 0xf
imul esi, esi, 0x8b421a21
mov edi, dword [ebx]
mov ecx, dword [esp + 0x10]
xor edi, ecx
imul edi, edi, 0x8b421a21
rol edi, 0xf
imul edi, edi, 0xbce2d621
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov edx, dword [esp + 0x14]
lea ebx, [edx + 0x10]
mov edx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x4056a4
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x405871
cmp ecx, 4
jb 0x40583a
je 0x405825
cmp ecx, 8
jbe 0x4057f7
cmp ecx, 0x10
jbe 0x405774
mov ebp, dword [0x71de44]
imul ebp, edx
mov esi, dword [0x71de48]
imul esi, edx
mov edi, dword [0x71de4c]
imul edi, edx
jmp 0x405723
mov edx, ebx
lea ebp, [ebx + 4]
lea esi, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebp]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [esi]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, dword [ecx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, ecx
shr ecx, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov edx, ebx
lea ebx, [ecx + ebx - 4]
mov ecx, dword [edx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x4057ce
mov ecx, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x4057ce
mov edx, ecx
shr ecx, 1
mov ebp, ebx
lea esi, [ecx + ebx]
lea edx, [edx + ebx - 1]
movzx ecx, byte [ebp]
xor ecx, eax
movzx eax, byte [esi]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
shl eax, 0x10
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x4057ce
mov ecx, eax
jmp 0x4057ce
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0044b750
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call fcn.0044a3c0
jmp fcn.00405660
Function at 0x40df00
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40e0c8
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40e0ad
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0044bd60
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x24]
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov ebx, ebp
add ebp, 1
mov ebp, 0
adc ebp, 0
test ebp, ebp
jne 0x40e0c1
cmp ecx, 0x21
jae 0x40e0c1
mov dword [esp + 0x10], esi
lea ebp, [0x6e2100]
movsd xmm0, qword [ebp + ebx*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebp + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.00446fa0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00447090
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm2, xmm1
movsd xmm1, qword [0x61d390]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x61d400]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40e088
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x61d430]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40df2d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
call fcn.00425810
ud2
call fcn.0044a3c0
jmp fcn.0040df00
Function at 0x411ec0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412101
sub esp, 0x24
mov eax, dword [0x71dc90]
test eax, eax
jne 0x4120e9
lea eax, [0x71dc80]
mov dword [esp], eax
call fcn.0040c0c0
mov eax, dword [0x70bd78]
test eax, eax
je 0x411f0d
mov eax, dword [eax + 8]
cmp eax, 0xcc
jne 0x411fd4
mov eax, dword [0x70bd70]
test eax, eax
jne 0x411fb6
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x71f898]
mov dword [esp + 8], eax
call fcn.0040e0e0
mov eax, dword [esp + 0xc]
mov dword [0x70bd70], eax
mov ecx, dword [0x70bd4c]
mov dword [eax], ecx
mov eax, dword [0x70bd70]
mov dword [0x70bd4c], eax
movzx eax, byte [0x71e000]
test al, al
jne 0x411fb6
xor eax, eax
jmp 0x411f73
lea ebp, [0x71e000]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jge 0x411fb6
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
cmp ebx, 5
jae 0x4120e2
lea ecx, [0x6dd0fc]
movzx ebx, byte [ecx + ebx]
cmp edx, 0x80
jb 0x411f66
jmp 0x4120e2
mov eax, dword [0x70bd70]
mov ecx, dword [eax + 4]
mov dword [0x70bd70], ecx
mov ecx, dword [0x70bd78]
mov dword [eax + 4], ecx
mov dword [0x70bd78], eax
mov eax, dword [0x70bd78]
mov ecx, dword [eax + 8]
lea edx, [eax + 8]
cmp ecx, 0xcc
jae 0x4120db
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00401570
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*4 + 0x10]
mov ebx, dword [0x71de50]
test ebx, ebx
jne 0x4120ba
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x71de50]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x412078
mov edx, dword [esp + 0x34]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x71dc05], 1
lea eax, [0x71dc80]
mov dword [esp], eax
call fcn.0040c290
add esp, 0x24
ret
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
mov dword [esp], ebx
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040e560
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040e560
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0040e560
jmp 0x41205f
mov dword [esp + 0x10], eax
mov dword [esp], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0040e560
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x412029
call fcn.00425810
ud2
call fcn.00425810
ud2
lea eax, [0x5f42e7]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00426d70
ud2
call fcn.0044a3c0
jmp fcn.00411ec0