joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d0c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x41d168
mov eax, dword [ebx + 0x1c]
shr eax, 3
push esi
cmp eax, ecx
jbe 0x41d210
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x41d167
mov eax, dword [edx + 4]
mov esi, edx
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push edi
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], edi
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.0041fff3
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x18]
je 0x41d16d
cmp esi, dword [ebp - 4]
jne 0x41d133
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x41d15e
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x41d181
mov dword [ecx], edx
mov eax, edx
jmp 0x41d184
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
cmp esi, edx
je 0x41d15e
nop dword [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.0041fff3
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x18]
je 0x41d1f2
cmp esi, dword [ebp - 4]
jne 0x41d1c0
mov eax, dword [ebp - 0x14]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, edx
jne 0x41d190
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx]
test eax, eax
je 0x41d235
mov esi, dword [eax]
push 0xc
push eax
call fcn.0041fff3
add esp, 8
mov eax, esi
test esi, esi
jne 0x41d222
mov eax, dword [ebx + 4]
mov dword [eax], eax
mov eax, dword [ebx + 4]
mov dword [eax + 4], eax
mov dword [ebx + 8], 0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.004127e0
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420ec3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420f02
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420f02
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420f02
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420f02
cmp dword [ecx + 0x74], 0xe
jbe 0x420f02
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43505d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44cb64
push 0x44cb5c
push str.FlsAlloc
push 0x1e
call fcn.00434e8a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x435091
push dword [ebp + 8]
mov ecx, esi
call dword [0x4471dc]
call esi
jmp 0x435097
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4350db
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44cb74
push 0x44cb6c
push str.FlsGetValue
push 0x20
call fcn.00434e8a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x435112
push dword [ebp + 8]
mov ecx, esi
call dword [0x4471dc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4398be
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439559

Function at 0x4398c9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004396e8

Function at 0x439d1f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00420460
mov eax, dword [0x456100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0042e7e2
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x439d61
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x439ebd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00443d10
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x458e60]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0043a145
mov ecx, dword [esi*4 + 0x458e60]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x439eb6
cmp eax, dword [edi + ecx + 0x24]
jne 0x439eb6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x439eb6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043a145
add esp, 0x14
test edx, edx
jl 0x439eb6
jg 0x439e2c
test eax, eax
jb 0x439eb6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x439eb6
jl 0x439e46
cmp dword [ebp - 0x1008], eax
ja 0x439eb6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x439e64
test ebx, ebx
je 0x439e9d
cmp ecx, edi
jae 0x439e9d
mov al, byte [ecx]
cmp al, 0xd
jne 0x439e7e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x439e8a
cmp byte [ecx + 1], 0xa
jne 0x439e8a
inc ecx
jmp 0x439e8a
movzx eax, al
movsx eax, byte [eax + 0x456a80]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x439e64
cmp edx, ebx
jne 0x439e64
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x439ebb
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00420452
leave
ret
Function at 0x43b597
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43b634
push ebx
push esi
call fcn.0043b560
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043a4be
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43b5e1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43b633
push edi
push eax
call fcn.004356f9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43b601
call fcn.00434a80
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43b632
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043a4be
add esp, 0x20
test eax, eax
jne 0x43b620
push edi
call fcn.00434a80
jmp 0x43b628
push ebx
call fcn.00434a80
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4403a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x458e60]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4403e3
cmp byte [ebx], 0xa
jne 0x4403e3
or byte [eax + edi + 0x28], 4
jmp 0x4403e8
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4404e6
mov al, byte [edx]
cmp al, 0x1a
je 0x4404c8
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x440417
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x44043c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x440446
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4403f9
jmp 0x4404e6
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4404c3
cmp dword [ebp - 0xc], 0
je 0x4404c3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x458e60]
test byte [eax + edi + 0x28], 0x48
je 0x44049d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x440488
mov byte [esi], dl
jmp 0x440499
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x458e60]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4404e6
cmp byte [ebp - 1], 0xa
jne 0x4404ac
cmp esi, ebx
jne 0x4404ac
mov byte [esi], 0xa
jmp 0x4404e5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0043a163
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4404e6
mov byte [esi], 0xd
jmp 0x4404e5
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x458e60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4404e2
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4404e6
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4404ef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x458e60]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x440532
cmp word [esi], dx
jne 0x440532
or byte [edi + eax + 0x28], 4
jmp 0x440537
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x440670
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x440650
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x440579
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4405af
cmp eax, edx
jae 0x4405bb
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x440551
jmp 0x440670
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44064c
cmp dword [ebp - 0x14], 0
je 0x44064c
mov eax, dword [ebx*4 + 0x458e60]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x440624
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x44066a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x458e60]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x458e60]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x458e60]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x44066d
pop ebx
cmp word [ebp - 4], bx
jne 0x440635
cmp esi, dword [ebp + 0xc]
jne 0x440635
mov word [esi], bx
jmp 0x44066d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0043a163
add esp, 0x10
cmp word [ebp - 4], bx
je 0x440670
push 0xd
jmp 0x440669
mov ecx, dword [ebx*4 + 0x458e60]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x440667
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x440670
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x442895
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00442811
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x442a0d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x442a0d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4429bc
jg 0x4428ee
test eax, eax
je 0x4429b2
push 1
push 0x1000
call fcn.00434b8c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x442914
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4429a9
push 0x8000
push ebx
call fcn.0042ef41
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x442940
jg 0x44293b
cmp ecx, 0x1000
jb 0x442940
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0043745c
add esp, 0x10
cmp eax, 0xffffffff
je 0x442985
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x44293b
jl 0x44296c
test ecx, ecx
jne 0x44292d
push dword [ebp - 0xc]
push ebx
call fcn.0042ef41
push esi
call fcn.00434a80
add esp, 0xc
xor edi, edi
jmp 0x442a1e
cmp byte [edi + 0x24], 0
je 0x44299c
cmp dword [edi + 0x20], 5
jne 0x44299c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4429a7
mov edi, dword [edi + 0x18]
jmp 0x4429a9
xor edi, edi
push esi
call fcn.00434a80
pop ecx
jmp 0x442a1e
test ecx, ecx
jg 0x44297e
jl 0x4429bc
test eax, eax
jae 0x44297e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043a163
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4429df
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x44297e
jmp 0x442a16
push ebx
call fcn.00438298
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x44297e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x442a1e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x442a1b
mov edi, dword [edi + 0x18]
jmp 0x442a1e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0043a163
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x443b10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x443b3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x443b3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4033e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x403420
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x40e3d8]
test eax, eax
jne 0x403444
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0x2788995d
mov ecx, eax
call fcn.00403e60
mov dword [0x40e3d8], eax
call eax
mov ebx, eax
mov eax, dword [0x40e664]
test eax, eax
jne 0x40346c
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0xc7d427f1
mov ecx, eax
call fcn.00403e60
mov dword [0x40e664], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x403522
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x403512
cmp ebx, 8
jb 0x4034f7
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x4034b6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x4034f7
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x4034d0
cmp edx, ebx
jae 0x403512
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x403500
mov edx, dword [esp + 0x18]
test edx, edx
je 0x403520
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x4035b9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40e3d8]
test eax, eax
jne 0x4035dd
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0x2788995d
mov ecx, eax
call fcn.00403e60
mov dword [0x40e3d8], eax
call eax
mov edi, eax
mov eax, dword [0x40e664]
test eax, eax
jne 0x403605
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0xc7d427f1
mov ecx, eax
call fcn.00403e60
mov dword [0x40e664], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x403685
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x40367a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x403640
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x403690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x4036ba
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40e3d8]
test eax, eax
jne 0x4036de
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0x2788995d
mov ecx, eax
call fcn.00403e60
mov dword [0x40e3d8], eax
call eax
mov edi, eax
mov eax, dword [0x40e664]
test eax, eax
jne 0x403706
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0xc7d427f1
mov ecx, eax
call fcn.00403e60
mov dword [0x40e664], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x403772
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x40376a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x403740
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x403c70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0x99a0
add dword [esp + 4], 0x7e22
mov eax, dword [esp + 4]
push ebx
mov ebx, ecx
lea eax, [eax + eax*8]
mov dword [esp + 8], eax
xor dword [esp + 8], 0x9d5d2
mov dword [esp + 4], 0xffb7
add dword [esp + 4], 0xffffc0e2
xor dword [esp + 4], 0xc09f
mov dword [esp + 4], 0x28c6
or dword [esp + 4], 0xecedb68f
add dword [esp + 4], 0xbdfb
shl dword [esp + 4], 0xb
xor dword [esp + 4], 0x73e65010
cmp byte [ebx], 0
je 0x403d55
push esi
push edi
lea ecx, [ecx]
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0xffb7
add dword [esp + 0xc], 0xffffc0e2
xor dword [esp + 0xc], 0xc09f
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x28c6
or dword [esp + 0xc], 0xecedb68f
add dword [esp + 0xc], 0xbdfb
shl dword [esp + 0xc], 0xb
xor dword [esp + 0xc], 0x73e65010
shl esi, cl
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x403ce0
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x403e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x403ebc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00403c70
xor eax, 0x63bd76f8
cmp eax, dword [esp + 0x10]
je 0x403ec6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x403ea0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x403ef4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x403ef4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x404050
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x404076
cmp al, 0x2e
je 0x404073
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x404063
jmp 0x404076
mov byte [edx], 0
mov eax, dword [0x40e414]
test eax, eax
jne 0x40409a
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0x9485c9cf
mov ecx, eax
call fcn.00403e60
mov dword [0x40e414], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4040e1
mov eax, dword [0x40e590]
test eax, eax
jne 0x4040cb
mov ecx, 0xb7762a69
call fcn.00403f00
mov edx, 0xbc96cd14
mov ecx, eax
call fcn.00403e60
mov dword [0x40e590], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4040e1
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00403c70
xor eax, 0x63bd76f8
mov ecx, edi
mov edx, eax
call fcn.00403e60
pop edi
pop esi
add esp, 0x104
ret