joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402762
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ebx, 0xd38a
pop ebx
imul eax, dword [ebp - 0x2c], 0x138
aam 0x38
add dword [eax], eax
add byte [0x55f3663b], al
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e5c], eax
mov dword [ebp - 0x1630], 1
push ebx
sub ebx, 0x4d5a
pop ebx
push edx
push esi
add esp, 4
sub edx, 0x15e92
pop edx
push esi
push ebx
add esp, 4
and esi, 0x6717
xor esi, 0xc242
invalid
test byte [esi + 0x6d], 0

Function at 0x402847
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
enter 0x1029, 1
add byte [eax + 0x53], bl
push ebx
add esp, 4
sub ebx, 0x11aa
pop ebx
push ecx
push edx
add esp, 4
sub ecx, 0x1526b
pop ecx
push ebx
or ebx, 0x14dc5
xor ebx, 0xec01
pop ebx
push ecx
xor ecx, 0x176
pop ecx
push esi
or esi, 0x71a6
into
cmpsb byte [esi], byte es:[edi]
jno 0x402881
add byte [ecx + 0x154c6], al
add bl, ch
invalid
pop esi
push eax
or eax, 0x13639
pop eax
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e64], eax
push edx
push eax
add esp, 4
sub edx, 0x15826
xor edx, 0x14801
sub edx, 0x12bb6
mov dh, 0x2b
add dword [eax], eax
pop edx
push esi
push edi
add esp, 4
xor esi, 0xcd5d
or esi, 0x15890
pop esi
push edx
jmp 0x4028f2
pop edx
mov eax, dword [ebp - 0x163c]
add eax, 0x138
imul ecx, dword [ebp - 0x1638], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1638], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1638]
mov dword [ebp - 0x1e60], eax
mov eax, dword [ebp - 0x1e60]
mov dword [ebp - 0x1e68], eax
mov ecx, dword [ebp - 0x1e64]
cmp ecx, dword [ebp - 0x1e68]
jae 0x40294f
mov dword [ebp - 0x15ac], 1
jmp 0x402959
mov dword [ebp - 0x15ac], 0
mov dl, byte [ebp - 0x15ac]
mov byte [ebp - 0x3ad], dl
Function at 0x4028d4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
enter 0x1029, 1
add byte [eax + 0x53], bl
push ebx
add esp, 4
sub ebx, 0x11aa
pop ebx
push ecx
push edx
add esp, 4
sub ecx, 0x1526b
pop ecx
push ebx
or ebx, 0x14dc5
xor ebx, 0xec01
pop ebx
push ecx
xor ecx, 0x176
pop ecx
push esi
or esi, 0x71a6
into
cmpsb byte [esi], byte es:[edi]
jno 0x402881
add byte [ecx + 0x154c6], al
add bl, ch
invalid
pop esi
push eax
or eax, 0x13639
pop eax
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e64], eax
push edx
push eax
add esp, 4
sub edx, 0x15826
xor edx, 0x14801
sub edx, 0x12bb6
mov dh, 0x2b
add dword [eax], eax
pop edx
push esi
push edi
add esp, 4
xor esi, 0xcd5d
or esi, 0x15890
pop esi
push edx
jmp 0x4028f2
pop edx
mov eax, dword [ebp - 0x163c]
add eax, 0x138
imul ecx, dword [ebp - 0x1638], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1638], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1638]
mov dword [ebp - 0x1e60], eax
mov eax, dword [ebp - 0x1e60]
mov dword [ebp - 0x1e68], eax
mov ecx, dword [ebp - 0x1e64]
cmp ecx, dword [ebp - 0x1e68]
jae 0x40294f
mov dword [ebp - 0x15ac], 1
jmp 0x402959
mov dword [ebp - 0x15ac], 0
mov dl, byte [ebp - 0x15ac]
mov byte [ebp - 0x3ad], dl

Function at 0x402965
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x4059cc
push edx
push ecx
add esp, 4
xor edx, 0x6017
and edx, 0x503
xor edx, 0x18118
pop edx
push ebx
xor ebx, 0x66d0
or ebx, 0x1137f
pop ebx
push ecx
push eax
add esp, 4
and ecx, 0xd1d2
pop ecx
push ecx
xor ecx, 0xb240
pop ecx
push ecx
and ecx, 0x14e03
and ecx, 0x9e2a
loope 0x4029e2
sahf
add byte [eax], al
pop ecx
push eax
xor eax, 0x1dc0
pop eax
push eax
or eax, 0x5ad8
sub eax, 0x15f2c
add eax, 0xa780
pop eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x138
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor ecx, edx
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1e6c], ecx
mov ecx, dword [ebp - 0x1e6c]
mov dword [ebp - 0x1e70], ecx
cmp dword [ebp - 0x1e70], 0x63c1
jne 0x402b53
push ecx
and ecx, 0xed97
add ecx, 0xcc37
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0x93d4
call 0x402a47
add byte [ebx + 0x35], al
inc edx
inc esi
cmp eax, dword [ebx + 0x40]
dec ebx
inc ecx
add esp, 4
or edi, 0x15205
pop edi
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
invalid
xchg ebp, eax

Function at 0x40714e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x407157
sub ecx, 0x166d
pop ecx
mov dword [ebp - 0x7a0], 0
jmp 0x407857
Function at 0x408378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
inc edx
and al, 0x89
test dword [esi], esp
invalid
Function at 0x40c4ad
Capabilities:
Encode data using xor

Disassembly:
pop es
pop es
mov al, ch
shr dword [ebx - 0x777f8f9], 1
dec edi
jae 0x40c4c2
pop es
pushal
pop esi
push edi
mov cl, bl
or ecx, dword [eax + 0x76d94f6]
pop es
push di
not byte [ebp + ebp*2 + 0x57660707]
mov bh, dh
in eax, dx
cld
pop es
Function at 0x401005
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x40100f
repz ret
jmp fcn.004011c4

Function at 0x403145
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402029
and dword [ebp - 4], 0
cmp dword [0x40b668], 0
mov ebx, eax
jne 0x4031f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4032a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4032a7
push eax
call fcn.00401fb7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b668], eax
call esi
push eax
call fcn.00401fb7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b66c], eax
call esi
push eax
call fcn.00401fb7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b670], eax
call esi
push eax
call fcn.00401fb7
pop ecx
mov dword [0x40b678], eax
test eax, eax
je 0x4031f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401fb7
pop ecx
mov dword [0x40b674], eax
mov eax, dword [0x40b674]
cmp eax, ebx
je 0x40324e
cmp dword [0x40b678], ebx
je 0x40324e
push eax
call fcn.00402032
push dword [0x40b678]
mov esi, eax
call fcn.00402032
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40324e
test edi, edi
je 0x40324e
call esi
test eax, eax
je 0x403245
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403245
test byte [ebp - 0xc], 1
jne 0x40324e
or dword [ebp + 0x10], 0x200000
jmp 0x403287
mov eax, dword [0x40b66c]
cmp eax, ebx
je 0x403287
push eax
call fcn.00402032
pop ecx
test eax, eax
je 0x403287
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403287
mov eax, dword [0x40b670]
cmp eax, ebx
je 0x403287
push eax
call fcn.00402032
pop ecx
test eax, eax
je 0x403287
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b668]
call fcn.00402032
pop ecx
test eax, eax
je 0x4032a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4032a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4052e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x498040]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [esp + 0x20], ecx
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
xor eax, eax
mov dword [esp + 0xc], edx
cmp ax, word [ecx + 6]
jae 0x405436
mov eax, edx
mov dword [esp + 0x40], 0
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
movaps xmmword [esp + 0x30], xmm0
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405360
sub eax, esi
lea ecx, [esp + 0x30]
push eax
push edx
call fcn.00413000
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x30]
mov esi, dword [esp + 0x30]
cmp ecx, 0xf
mov dword [esp + 0x18], esi
cmova eax, esi
cmp dword [esp + 0x40], 5
jne 0x4053e8
cmp dword [eax], 0x7865742e
jne 0x4053e8
cmp byte [eax + 4], 0x74
jne 0x4053e8
mov eax, dword [esp + 0xc]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x24], eax
mov edi, dword [eax + 0xc]
add edi, dword [esp + 0x14]
mov dword [esp + 0x28], edi
cmp dword [eax + 8], ecx
jbe 0x4053d3
mov esi, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
crc32 ecx, eax
cmp edx, dword [esi + 8]
jb 0x4053c0
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
movq xmm0, qword [esp + 0x24]
movq qword [edi], xmm0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x405412
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x405408
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40544b
push ecx
push esi
call fcn.004250be
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
inc ecx
add edx, 0x28
mov dword [esp + 0x10], ecx
movzx eax, word [eax + 6]
mov dword [esp + 0xc], edx
cmp ecx, eax
jl 0x405342
mov ecx, dword [esp + 0x5c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00424d75
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x4075c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x47], 0
je 0x407754
movaps xmm5, xmmword [0x491930]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x491cb0]
mov edx, 0xffffffdb
movups xmm4, xmmword [0x4919b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffffd9
mov dword [ebp - 4], 0xffffffd4
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffd8
sub edi, ebx
mov esi, 0xffffffda
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffd0
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x407634
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x46
jae 0x407750
lea edx, [ebx + eax]
lea ecx, [eax - 0x2c]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x407742
mov byte [ebx + 0x47], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e17d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x498040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 7], 0
je 0x4077b2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x2c]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x4077a0
mov byte [esi + 7], 0
push ecx
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00412240
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4077d2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00415780
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40784b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407841
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407841
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004250be
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407940
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x4079b9
movups xmm4, xmmword [0x4919b0]
push ebx
mov esi, 0xffffffd7
mov ebx, 2
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + esi + 0x29]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + esi + 0x29], xmm3
add esi, 4
sub ebx, 1
jne 0x407960
pop ebx
mov byte [edi + 9], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edi + 8]
push eax
push edi
call fcn.00412240
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4079e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e17d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x498040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xa], 0
je 0x407a32
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x2c]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x407a20
mov byte [esi + 0xa], 0
push ecx
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00412240
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x407a52
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00415780
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x407acb
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407ac1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407ac1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004250be
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x32], 0
je 0x407c74
movaps xmm5, xmmword [0x491930]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x491cb0]
mov edx, 0xffffffdb
movups xmm4, xmmword [0x4919b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffffd9
mov dword [ebp - 4], 0xffffffd4
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffd8
sub edi, ebx
mov esi, 0xffffffda
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffd0
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x30
jb 0x407b54
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x31
jae 0x407c70
lea edx, [ebx + eax]
lea ecx, [eax - 0x2c]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x407c62
mov byte [ebx + 0x32], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x407f87
movups xmm4, xmmword [0x4919b0]
push ebx
mov ebx, 0xffffffd7
mov eax, 0xc
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx + 0x29]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx + 0x29], xmm3
add ebx, 4
cmp ebx, 0xffffffe3
jb 0x407f20
pop ebx
lea edx, [edi + eax]
lea ecx, [eax - 0x2c]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x407f75
mov byte [edi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edi + 0xf]
push eax
push edi
call fcn.00412240
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x407fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x44], 0
je 0x408134
movaps xmm5, xmmword [0x491930]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x491cb0]
mov edx, 0xffffffdb
movups xmm4, xmmword [0x4919b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffffd9
mov dword [ebp - 4], 0xffffffd4
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffd8
sub edi, ebx
mov esi, 0xffffffda
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffd0
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x408014
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x43
jae 0x408130
lea edx, [ebx + eax]
lea ecx, [eax - 0x2c]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x408122
mov byte [ebx + 0x44], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x136], 0
je 0x4082e9
movaps xmm5, xmmword [0x491930]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x491cb0]
mov edx, 0xffffffdb
movups xmm4, xmmword [0x4919b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffffd9
mov dword [ebp - 4], 0xffffffd4
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffd8
sub edi, ebx
mov esi, 0xffffffda
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffd0
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
nop word [eax + eax]
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x130
jb 0x4081c0
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x135
jae 0x4082e2
lea edx, [ebx + eax]
lea ecx, [eax - 0x2c]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x4082d2
mov byte [ebx + 0x136], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret