joyce8/EMBER2024-capa huggingface dataset:
Function at 0x217ad3c1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x217ad3ec
xor eax, eax
pop esi
leave
ret
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], 0x104
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x217ad425
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.217ad3c1
pop ecx
cmp eax, esi
pop ecx
jne 0x217ad3ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
cmp eax, esi
sete cl
mov eax, ecx
jmp 0x217ad3e9

Function at 0x217ad5de
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x217ad630
push dword [ebp - 4]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x18]
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x217ad637
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 8], esi
push eax
push esi
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x217ad6ef
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x217ad6ef
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x2001f
push esi
push 0x217b3adc
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x217ad6fc
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.217ad5de
pop ecx
pop ecx
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x24]
inc dword [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x217ad666
xor eax, eax
cmp dword [ebp - 0x10], esi
sete al
jmp 0x217ad632
push dword [ebp - 0xc]
call edi
jmp 0x217ad6ef
Function at 0x217b0f1f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x217a58d0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x217b0f7a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x217a73e3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x217b0f6a
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4
xor eax, eax
jmp 0x217b0f75
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401bd7
pop dword [ebp - 0x40]
mov eax, 0x401bd7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x883a9b03
sub dword [ebp - 0x50], 0x39e855b8
mov dword [ebp - 0x4c], 0x84572132
add dword [ebp - 0x4c], 0xaddc2b13
mov dword [ebp - 0x48], 0x3e76b3c0
sub dword [ebp - 0x48], 0xf22a6f92
mov dword [ebp - 0x44], 0xad9c8b19
sub dword [ebp - 0x44], 0xad9c8b19
lea eax, [ebp - 0x50]
push eax
mov eax, 0x13f95774
sub eax, 0x13b8e714
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc403856d
sub dword [ebp - 0x50], 0x4f911c17
mov dword [ebp - 0x4c], 0xc410520c
add dword [ebp - 0x4c], 0x7d5c0f69
mov dword [ebp - 0x48], 0x25696e5f
add dword [ebp - 0x48], 0x3e05fe0d
mov dword [ebp - 0x44], 0x1fb8b68f
sub dword [ebp - 0x44], 0x1fb8b68f
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x9597d986
add eax, 0x6aa8977a
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a56b
push 0
call eax
mov ecx, 0xc245a58e
add ecx, 0x3dbab180
xor esi, esi
add esi, eax
mov edx, 0x31cc397b
sub edx, 0x318b397b
add edx, dword [ebp - 0x40]
mov ebx, 0x38a8f4a2
add dword [ebp - 0x24], 0x6720769
mov edi, dword [edx]
add dword [ebp - 0x28], 0xa3ad9ea6
sub edi, ebx
xor dword [ebp - 0x34], 0x48e34299
mov dword [esi], edi
sub dword [ebp - 0x10], edx
add esi, 0x37b5bc2b
sub esi, 0x37b5bc27
add edx, 0x889b6b02
add edx, 0x77649502
loop 0x401cf0
add eax, 0xb8b200bf
sub eax, 0xb8b0b1b4
mov ebx, eax
add eax, 0x911f6342
add eax, 0x6ee09cc3
mov ecx, 0x25db8509
sub ecx, 0x259b8509
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401341
Capabilities:
Create process on windows

Disassembly:
push 0x18
mov eax, 0x4030dd
call fcn.00402fe0
mov ebx, ecx
mov esi, str.close
mov eax, edx
mov di, word [eax]
cmp di, word [esi]
jne 0x40137c
test di, di
je 0x401378
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x40137c
add eax, 4
add esi, 4
test cx, cx
jne 0x401356
xor eax, eax
jmp 0x401381
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4013b6
inc dword [0x407060]
lea ecx, [ebp - 0x24]
inc dword [0x407064]
push str.Testfile.txt
call fcn.004018bb
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
call fcn.00401204
pop ecx
lea ecx, [ebp - 0x24]
call fcn.0040185f
jmp 0x401416
mov ecx, str.StartFreelancer
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x4013e3
test si, si
je 0x4013df
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x4013e3
add eax, 4
add ecx, 4
test si, si
jne 0x4013bd
xor eax, eax
jmp 0x4013e8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401407
push 5
push eax
push 0x404334
push str.C:Program_Files__x86_Microsoft_GamesFLHDEXEFreelancer.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401416
push 0
push str.Nachricht_der_Webseite
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00402fbd
ret
Function at 0x42ab30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x44dd00], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x44dd08], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x44dd04], edx
mov dword [0x44dd18], 0
push 0
push 0
push 0
push 0x42aa80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x42abb0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x449ca0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov ecx, 0x20
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0
mov dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 8
jae 0x42ad4d
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 8
jae 0x42ac44
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x94]
movzx ecx, byte [eax]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
jmp 0x42ac4e
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x94], 8
jae 0x42ac86
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x94]
movzx edx, byte [ecx]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x94]
add eax, 1
mov dword [ebp - 0x94], eax
jmp 0x42ac90
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x98]
shr edx, 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xa0]
shr ecx, 4
mov edx, dword [ebp - 0x98]
and edx, 3
shl edx, 4
or ecx, edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov cx, word [ebp + ecx*2 - 0x90]
mov word [edx + eax*2], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x9c]
shr eax, 6
mov ecx, dword [ebp - 0xa0]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov ax, word [ebp + eax*2 - 0x90]
mov word [ecx + edx*2], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x9c]
and edx, 0x3f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp + edx*2 - 0x90]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x42abea
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, 0x3d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov word [edx + ecx*2], ax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041422b
mov esp, ebp
pop ebp
ret
Function at 0x430690
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.00401c90
add esp, 4
test eax, eax
jne 0x4306a5
jmp 0x4306df
push 0x80
mov ecx, dword [ebp + 8]
call fcn.00404b40
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
call fcn.00404b40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4306df
push 0x186a0
mov ecx, dword [ebp + 8]
push ecx
push 2
call fcn.004355e0
add esp, 0xc
pop ebp
ret

Function at 0x434790
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4347b4
mov eax, 3
jmp 0x4348cc
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4347d0
mov eax, 2
jmp 0x4348cc
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x4348ab
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x434809
mov eax, 0xd
jmp 0x4348cc
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407e4e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00414240
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x442538
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43487c
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x4348a6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00407e43
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x4348a6
mov eax, pe_nt_image_headers32
jmp 0x4348cc
jmp 0x4347df
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4348c3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4348ca
mov eax, 0xd
jmp 0x4348cc
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4348e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0xfeff
mov word [ebp - 8], ax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x434922
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x434983
push 0
lea edx, [ebp - 4]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434944
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x434983
push 0
lea edx, [ebp - 4]
push edx
push 0x4424a8
call fcn.004142ba
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str._SESSION_
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434977
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x434983
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4033b1
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4033ec
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4033d3
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4033e4
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4033ee
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4033c9
xor eax, eax
pop edi
pop esi
ret
Function at 0x407e40
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40803e
sub esp, 0x10
movzx eax, byte [0xc1063b]
test al, al
jne 0x408016
mov eax, dword [0xc10a20]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov edx, dword [esp + 0x18]
add eax, edx
mov ebx, dword [esp + 0x14]
jmp 0x407ee6
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
nop
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
jae 0x407e81
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x407f7a
cmp ecx, 4
jb 0x407fe4
je 0x407fcf
cmp ecx, 8
jbe 0x407fa3
cmp ecx, 0x10
jbe 0x407f28
mov ebp, dword [0xc10a24]
imul ebp, edx
mov esi, dword [0xc10a28]
imul esi, edx
mov edi, dword [0xc10a2c]
imul edi, edx
jmp 0x407edb
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor ecx, eax
imul eax, ecx, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407f7a
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407f7a
mov edx, ebx
lea ebx, [ecx + ebx - 1]
movzx ebp, byte [edx]
xor eax, ebp
shr ecx, 1
movzx ecx, byte [edx + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [ebx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x407f7a
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.00452200
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
call fcn.00450d20
jmp fcn.00407e40
Function at 0x40b740
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b90f
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40b8e2
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00452560
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 0x24]
shr edi, 0x1b
shl ebx, 5
or edi, ebx
test esi, esi
jne 0x40b902
cmp ecx, 0x21
jae 0x40b8f6
mov dword [esp + 0x10], edi
lea ebx, [0x813600]
movsd xmm0, qword [ebx + ebp*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.0044ce80
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0044cf70
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
mulsd xmm2, qword [esp + 8]
movsd xmm1, qword [0x992e78]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x992f28]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b8bd
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x992fc8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40b76d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00452640
mov eax, ecx
mov ecx, 0x21
call fcn.00452720
nop
call fcn.00450d20
jmp fcn.0040b740
Function at 0x415710
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41592c
sub esp, 0x18
mov eax, dword [0xc1078c]
test eax, eax
jne 0x415915
lea eax, [0xc10778]
mov dword [esp], eax
call fcn.00409600
mov eax, dword [0xbfc9b0]
test eax, eax
je 0x41575c
cmp dword [eax + 8], 0xcc
jne 0x415824
mov edx, dword [0xbfc9a8]
test edx, edx
jne 0x415806
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xc128d8]
mov dword [esp + 8], eax
call fcn.0040b920
mov eax, dword [esp + 0xc]
mov dword [0xbfc9a8], eax
mov ecx, dword [0xbfc984]
mov dword [eax], ecx
mov eax, dword [0xbfc9a8]
mov dword [0xbfc984], eax
movzx eax, byte [0xc10c40]
test al, al
jne 0x415806
xor eax, eax
jmp 0x4157c3
lea esi, [0xc10c40]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x415806
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x41590b
lea edx, [0x80c13c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4157b5
jmp 0x4158ff
mov edx, dword [0xbfc9a8]
mov ebx, dword [edx + 4]
mov dword [0xbfc9a8], ebx
mov ebx, dword [0xbfc9b0]
mov dword [edx + 4], ebx
mov dword [0xbfc9b0], edx
mov edx, dword [0xbfc9b0]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4158f5
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402550
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xc10a30]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4158e6
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xc10a30]
test edx, edx
jne 0x4158c3
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0xc10632], 1
lea eax, [0xc10778]
mov dword [esp], eax
call fcn.004097e0
add esp, 0x18
ret
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.004525b0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.004525b0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.004525b0
jmp 0x4158aa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.004525b0
mov eax, edx
jmp 0x415880
mov ecx, 0xcc
call fcn.00452640
mov eax, ebx
mov ecx, 0x80
call fcn.00452630
mov ecx, 5
call fcn.00452630
lea eax, [0x90d5ff]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0042c440
nop
call fcn.00450d20
jmp fcn.00415710
Function at 0x424de0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424ee9
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x424e67
cmp cl, 2
jne 0x424ed2
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00425b40
lea eax, [0xc0467c]
mov dword [esp], eax
call fcn.00409600
nop
mov eax, dword [0xc04670]
sub eax, dword [0xc04658]
mov dword [0xc04670], eax
mov eax, dword [0xc04664]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xc04664], ecx
lea eax, [0xc0467c]
mov dword [esp], eax
call fcn.004097e0
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00415710
lea eax, [0xc0467c]
mov dword [esp], eax
call fcn.00409600
nop
mov eax, dword [0xc0464c]
sub eax, dword [0xc04634]
mov dword [0xc0464c], eax
mov eax, dword [0xc04640]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xc04640], ecx
lea eax, [0xc0467c]
mov dword [esp], eax
call fcn.004097e0
jmp 0x424e63
lea eax, [0x908783]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0042c440
nop
call fcn.00450d20
jmp fcn.00424de0