joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c550
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003c64a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1003c643
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x1003c629
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1003c629
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1003c629
mov edx, dword [esi]
test edx, edx
jne 0x1003c5f2
push 0x200
push edx
push dword [0x10064120]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1003c643
jmp 0x1003c61d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003c61d
shl eax, 3
push eax
push edx
push 0
push dword [0x10064120]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1003c643
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1003c5b1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1003c6a2
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x1003c6a2
xor ecx, ecx
mov dword [ebp - 0x24], ecx
nop dword [eax + eax]
mov eax, dword [esi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1003c693
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x28]
mov ecx, edi
call fcn.1003c3e0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
inc ebx
add ecx, 4
mov dword [ebp - 0x24], ecx
cmp ebx, dword [esi + 8]
jb 0x1003c660
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004ed27
mov esp, ebp
pop ebp
ret

Function at 0x1003c6c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x1003c724
push ebx
xor ebx, ebx
cmp dword [edi + 8], ebx
jbe 0x1003c713
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1003c703
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
inc ebx
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, dword [edi + 8]
jb 0x1003c6e0
pop esi
push dword [edi]
push 0
push dword [0x10064120]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1003c730
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10064600]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1003c791
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ed27
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1003c7b2
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1003c7d3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1003c7d3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1003c7cd
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1003c7d3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1004ed27
mov esp, ebp
pop ebp
ret
Function at 0x1003dc20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050e02
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x220
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], 1
push eax
push 0x20019
push 0
push str.SOFTWAREWhalebox_StudioDynast.io
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003dde4
xor esi, esi
mov dword [ebp - 0x21c], 0xff
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
push esi
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1003ddd8
nop dword [eax + eax]
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003dd20
push ecx
lea ecx, [ebx + 8]
sub eax, edx
push 0x10
push ecx
push ecx
lea edx, [ebp - 0x118]
add edx, eax
lea ecx, [ebp - 0x118]
call fcn.10048bb0
add esp, 0x10
test al, al
je 0x1003dd7e
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0xff
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1003ddb6
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0xff
push eax
lea eax, [ebp - 0x118]
inc esi
push eax
push esi
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x1003dd10
jmp 0x1003ddd8
lea ecx, [ebp - 0x218]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003ddc0
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
mov ecx, edi
call fcn.100476b0
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebx + 8]
call fcn.10047500
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x1003de06
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x1003de06
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004ed27
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10046cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10046d09
sub eax, 1
jne 0x10046d3e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push eax
push eax
push 0x10041740
push eax
push eax
call edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10041750
push 0
push 0
call edi
push 0
push 0
push dword [ebp + 8]
push 0x10046c60
push 0
push 0
call edi
pop edi
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x10064310], 0
je 0x10046d3e
xor edx, edx
xor ecx, ecx
call fcn.1003cc70
push dword [0x100642fc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x100642fc], 0
mov dword [0x10064310], 0
mov eax, 1
pop ebp
ret 0xc

Function at 0x10046ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10046ed1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10046ec0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0xae86dd
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae86dd
ret
Function at 0x401000
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x10], 0xff0ff
mov dword [ebp - 8], 0x104
mov dword [ebp - 0xc], 1
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x4010ce
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push 0x403150
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
lea eax, [ebp - 0x114]
push eax
mov byte [ebp - 0x111], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 0x10]
push ecx
push 0x403188
lea edx, [ebp - 0x114]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push 0x42c868
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x42c868
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0x20119
push 0
push 0x40318c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 0x42c868
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x4031bc
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x42c868
mov esp, ebp
pop ebp
ret

Function at 0x401120
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp eax, edi
je 0x40118c
cmp dword [ebp + 8], edi
je 0x40118c
cmp ebx, edi
je 0x40118c
push esi
push edi
push 0x80
push 2
push edi
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401182
mov ecx, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
push eax
push ebx
push ecx
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40117b
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x40117b
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x568a93
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00567984
and dword [ebp - 4], 0
cmp dword [0x573c68], 0
mov ebx, eax
jne 0x568b44
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x568bf5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x568bf5
push eax
call fcn.00567912
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x573c68], eax
call esi
push eax
call fcn.00567912
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x573c6c], eax
call esi
push eax
call fcn.00567912
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x573c70], eax
call esi
push eax
call fcn.00567912
pop ecx
mov dword [0x573c78], eax
test eax, eax
je 0x568b44
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00567912
pop ecx
mov dword [0x573c74], eax
mov eax, dword [0x573c74]
cmp eax, ebx
je 0x568b9c
cmp dword [0x573c78], ebx
je 0x568b9c
push eax
call fcn.0056798d
push dword [0x573c78]
mov esi, eax
call fcn.0056798d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x568b9c
test edi, edi
je 0x568b9c
call esi
test eax, eax
je 0x568b93
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x568b93
test byte [ebp - 0xc], 1
jne 0x568b9c
or dword [ebp + 0x10], 0x200000
jmp 0x568bd5
mov eax, dword [0x573c6c]
cmp eax, ebx
je 0x568bd5
push eax
call fcn.0056798d
pop ecx
test eax, eax
je 0x568bd5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x568bd5
mov eax, dword [0x573c70]
cmp eax, ebx
je 0x568bd5
push eax
call fcn.0056798d
pop ecx
test eax, eax
je 0x568bd5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x573c68]
call fcn.0056798d
pop ecx
test eax, eax
je 0x568bf5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x568bf7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x56a8fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x570e88]
jne 0x56a908
repz ret
jmp fcn.0056c025
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x57a0f44
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x39fb1c08
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x431006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4036b0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0xe622cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403880
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.00470f50
jmp fcn.004036b0
Function at 0x40c170
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0xe622cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c33b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40c199
mov eax, 0x7000000
jmp 0x40c1a1
test eax, eax
je 0x40c316
mov dword [esp + 0x34], eax
mov ecx, dword [0xe622cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x448]
mov ebx, dword [ecx + 0x44c]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x448], ebx
mov dword [ecx + 0x44c], ebp
mov dword [esp], edx
call fcn.00472300
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0xe03580]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40c32e
cmp edx, 0x21
jae 0x40c322
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.00462f50
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00463020
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0xb2cbd8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0xb2cc30]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40c2f1
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0xb2cc68]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.004723e0
mov eax, edx
mov ecx, 0x21
call fcn.004724b0
nop
call fcn.00470f50
jmp fcn.0040c170
Function at 0x4143e0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0xe622cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4145de
sub esp, 0x18
mov eax, dword [0xe621ac]
test eax, eax
jne 0x4145c7
nop
nop
lea eax, [0xe6219c]
mov dword [esp], eax
call fcn.0040a7c0
mov eax, dword [0xe621a0]
test eax, eax
je 0x414428
cmp dword [eax + 8], 0xcc
jne 0x41449e
mov edx, dword [0xe621a4]
test edx, edx
jne 0x414480
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xe66f90]
mov dword [esp + 8], eax
call fcn.0040c350
mov eax, dword [esp + 0xc]
mov dword [0xe621a4], eax
mov ecx, dword [0xe621a8]
mov dword [eax], ecx
mov eax, dword [0xe621a4]
mov dword [0xe621a8], eax
movzx eax, byte [0xe62b00]
test al, al
jne 0x414480
xor eax, eax
jmp 0x414598
mov edx, dword [0xe621a4]
mov ebx, dword [edx + 4]
mov dword [0xe621a4], ebx
mov ebx, dword [0xe621a0]
mov dword [edx + 4], ebx
mov dword [0xe621a0], edx
mov edx, dword [0xe621a0]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x414577
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00477160
mov eax, dword [0xe62660]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x4144f0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x414530
call fcn.004723c0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0xe6219c]
mov dword [esp], eax
call fcn.0040a9e0
nop
lea eax, [0xe62198]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004772e0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004723e0
lea edx, [0xdfd4f0]
movzx ebx, byte [edx + eax]
lea ebp, [0xe62b00]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x414480
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x414581
mov ecx, 5
call fcn.004723d0
lea eax, [0x931ac5]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046bcd0
nop
call fcn.00470f50
jmp fcn.004143e0