joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007dd4e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x1007deb1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.KERNEL32.dll_lstrlenW
mov edx, eax
cmp byte [ebp - 1], 0
je 0x1007dd9b
mov eax, edx
sub eax, 2
cmp eax, 1
jl 0x1007dd9b
cmp word [ebx + eax*2], 0x5c
jne 0x1007dd96
mov word [ebx + eax*2], 0
mov edx, eax
jmp 0x1007dd9b
dec eax
test eax, eax
jne 0x1007dd85
test edx, edx
jle 0x1007ddb4
cmp word [ebx + edx*2 - 2], 0x5c
je 0x1007ddb4
mov word [ebx + edx*2], 0x5c
mov word [ebx + edx*2 + 2], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
jne 0x1007ddf2
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.10073f86
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.10073f86
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
pop ecx
call fcn.100666d6
jmp 0x1007de2e
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.1006662e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov dl, 1
call fcn.10073fda
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, ebx
call fcn.10073f86
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
pop ecx
call fcn.100666d6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
call fcn.1006668a
cmp eax, 6
jle 0x1007de7c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp byte [eax + 2], 0x3a
je 0x1007de69
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp byte [eax], 0x5c
jne 0x1007de7c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp byte [eax + 2], 0x5c
jne 0x1007de7c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x1007de80
xor ebx, ebx
jmp 0x1007de82
mov bl, 1
test bl, bl
je 0x1007de96
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1007deb8
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.1006645a
ret
Function at 0x1007dec2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
push ebp
xor edx, edx
xor eax, eax
call fcn.1007dd4e
pop ecx
test al, al
jne 0x1007df7d
push 0x104
lea eax, [ebp - 0x212]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea eax, [ebp - 0x212]
mov dl, 1
call fcn.1007dd4e
pop ecx
test al, al
jne 0x1007df7d
push 0x104
lea eax, [ebp - 0x212]
push eax
mov eax, dword [0x1009c658]
push eax
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea eax, [ebp - 0x212]
mov dl, 1
call fcn.1007dd4e
pop ecx
test al, al
jne 0x1007df7d
lea eax, [ebp - 0x212]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryW
push ebp
lea eax, [ebp - 0x212]
xor edx, edx
call fcn.1007dd4e
pop ecx
test al, al
jne 0x1007df7d
push 0x104
lea eax, [ebp - 0x212]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push ebp
lea eax, [ebp - 0x212]
xor edx, edx
call fcn.1007dd4e
pop ecx
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1007ea56
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
je 0x1007eaed
push 2
lea ecx, [ebp - 2]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1007e9a2
test al, al
je 0x1007eaed
cmp word [ebp - 2], 0x5a4d
jne 0x1007eaed
push 4
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1007e9a2
test al, al
je 0x1007eaed
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1007e9a2
test al, al
je 0x1007eaed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax], 0x4550
jne 0x1007eaed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test byte [eax + 0x17], 0x20
je 0x1007eaf1
xor eax, eax
jmp 0x1007eaf3
mov al, 1
test al, al
je 0x1007eb10
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
movzx ecx, word [ebp - 2]
add edx, ecx
add edx, 0x78
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [ecx], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x1007f1ba
Capabilities:
Get number of processors

Disassembly:
mov eax, dword gs:[0x60]
mov edx, dword gs:[0x64]
ret
Function at 0x10080d8a
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 1
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.1007f9de
mov ebx, eax
test bl, bl
je 0x10080de4
test esi, 4
jne 0x10080def
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_ResumeThread
jmp 0x10080def
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1008362a
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor eax, eax
mov dword [ebp - 0x154], eax
xor eax, eax
push ebp
push 0x100836d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x154]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.1006662e
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
xor ecx, ecx
call fcn.100818ae
mov ebx, eax
test bl, bl
je 0x100836bd
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x100836a5
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x148]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100836dd
lea eax, [ebp - 0x154]
call fcn.10066436
ret
Function at 0x10083962
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x10083b4c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x1009bd0c], 0
jne 0x10083b31
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x10083b2a
xor eax, eax
push ebp
push 0x10083b23
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x10083b0c
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x10083b06
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x1009ad40]
call fcn.10069b16
mov eax, dword [ebp - 0x24]
call fcn.1006688a
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x10083a3a
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x1009ad44]
call fcn.10069b16
mov eax, dword [ebp - 0x28]
call fcn.1006688a
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x10083a6d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x1009ad48]
call fcn.10069b16
mov eax, dword [ebp - 0x2c]
call fcn.1006688a
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x10083aa0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x10083af2
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x10083abd
cmp eax, dword [ebp - 0x10]
je 0x10083aee
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x10083ad2
cmp eax, dword [ebp - 0x18]
je 0x10083aee
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x10083ae7
cmp eax, dword [ebp - 0x20]
je 0x10083aee
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x10083aaa
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10083b2a
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x1009bd0c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10083b53
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.1006645a
ret
Function at 0x4018eb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40192a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40192a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40192a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40192a
cmp dword [ecx + 0x74], 0xe
jbe 0x40192a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x137d82c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x137d836
pushal
call 0x137d83c
pop ebp
sub ebp, 0x10
sub ebp, 0xf7d82c
jmp 0x137d852
mov eax, 0xf7d82c
add eax, ebp
add eax, 0x4c
mov ecx, 0x582
mov edx, 0x2b45814
xor byte [eax], dl
inc eax
dec ecx
jne 0x137d869
jmp 0x137d87c
lahf
fstp dword [edi + 0x1414289d]
adc al, 0x95
aad 0xec
adc al, 0x14
adc al, 0x17
fldcw word [ebx + edx - 0x51ebebec]
adc al, 0x14
adc al, 0xae
cmp al, 0x14
adc al, 0x14
jecxz 0x137d88e
pop ss
fcomp qword [edi + 0x14141895]
adc al, 0x17
rol dword [esp + eax*2 + 0x7c], 1
dec eax
cld
or byte [esp + edi*2], dl
invalid
Function at 0x40f197
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a16b
mov dword [ebp - 0x14], eax
cmp dword [0x4308bc], esi
jne 0x40f28a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f217
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f36a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f36a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f36a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4308bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4308c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4308c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4308cc], eax
test eax, eax
je 0x40f287
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4308c8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2af
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2a2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push 4
pop eax
jmp 0x40f36c
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push dword [0x4308bc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2a9
mov eax, dword [0x4308c8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f322
cmp dword [0x4308cc], edi
je 0x40f322
push eax
call ebx
push dword [0x4308cc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f322
test eax, eax
je 0x40f322
call ecx
test eax, eax
je 0x40f317
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f317
test byte [ebp - 8], 1
jne 0x40f322
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f352
mov eax, dword [0x4308c0]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
call eax
mov esi, eax
test esi, esi
je 0x40f34f
mov eax, dword [0x4308c4]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4308bc]
call ebx
test eax, eax
je 0x40f36a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f36c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040482b
mov esp, ebp
pop ebp
ret
Function at 0x403310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x403350
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x40dea8]
test eax, eax
jne 0x403374
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0x97f883e
mov ecx, eax
call fcn.00403e80
mov dword [0x40dea8], eax
call eax
mov ebx, eax
mov eax, dword [0x40dcec]
test eax, eax
jne 0x40339c
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0xe9233692
mov ecx, eax
call fcn.00403e80
mov dword [0x40dcec], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x403452
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x403442
cmp ebx, 8
jb 0x403427
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x4033e6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x403427
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x403400
cmp edx, ebx
jae 0x403442
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x403430
mov edx, dword [esp + 0x18]
test edx, edx
je 0x403450
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4034c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x4034e9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40dea8]
test eax, eax
jne 0x40350d
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0x97f883e
mov ecx, eax
call fcn.00403e80
mov dword [0x40dea8], eax
call eax
mov edi, eax
mov eax, dword [0x40dcec]
test eax, eax
jne 0x403535
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0xe9233692
mov ecx, eax
call fcn.00403e80
mov dword [0x40dcec], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4035b5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x4035aa
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x403570
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4035c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x4035ea
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40dea8]
test eax, eax
jne 0x40360e
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0x97f883e
mov ecx, eax
call fcn.00403e80
mov dword [0x40dea8], eax
call eax
mov edi, eax
mov eax, dword [0x40dcec]
test eax, eax
jne 0x403636
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0xe9233692
mov ecx, eax
call fcn.00403e80
mov dword [0x40dcec], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x4036a2
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x40369a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x403670
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x403ba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0x9c4e
add dword [esp + 4], 0x4464
shr dword [esp + 4], 1
add dword [esp + 4], 0xffff87db
add dword [esp + 4], 0xffff18d7
add dword [esp + 4], 0xffff529c
add dword [esp + 4], 0xffff507b
or dword [esp + 4], 0x3b9f69dc
xor dword [esp + 4], 0xfffffdfe
mov dword [esp], 0x31f8
imul eax, dword [esp], 0x75
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
xor dword [esp + 4], 0x67893507
xor dword [esp + 4], 0x679fe359
mov dword [esp + 4], 0x4955
xor dword [esp + 4], 0xa8908194
shr dword [esp + 4], 8
add dword [esp + 4], 0xffffdf1d
add dword [esp + 4], 0xfffff42f
or dword [esp + 4], 0x2e6e862
add dword [esp + 4], 0xa6c2
xor dword [esp + 4], 0xe36c9a70
xor dword [esp + 4], 0xe1830958
cmp byte [ebx], 0
je 0x403d02
push esi
push edi
lea esp, [esp]
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0x31f8
imul eax, dword [esp + 0xc], 0x75
mov dword [esp + 0xc], eax
xor dword [esp + 0xc], 0x67893507
xor dword [esp + 0xc], 0x679fe359
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x4955
xor dword [esp + 0xc], 0xa8908194
shr dword [esp + 0xc], 8
add dword [esp + 0xc], 0xffffdf1d
add dword [esp + 0xc], 0xfffff42f
or dword [esp + 0xc], 0x2e6e862
add dword [esp + 0xc], 0xa6c2
xor dword [esp + 0xc], 0xe36c9a70
xor dword [esp + 0xc], 0xe1830958
shl esi, cl
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x403c60
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x403e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x403edc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00403ba0
xor eax, 0x4d4a679b
cmp eax, dword [esp + 0x10]
je 0x403ee6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x403ec0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x403f14
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x403f14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x4040e0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x404106
cmp al, 0x2e
je 0x404103
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x4040f3
jmp 0x404106
mov byte [edx], 0
mov eax, dword [0x40e15c]
test eax, eax
jne 0x40412a
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0xba72d8ac
mov ecx, eax
call fcn.00403e80
mov dword [0x40e15c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x404171
mov eax, dword [0x40dbfc]
test eax, eax
jne 0x40415b
mov ecx, 0xbb398380
call fcn.00403f20
mov edx, 0x9261dc77
mov ecx, eax
call fcn.00403e80
mov dword [0x40dbfc], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x404171
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00403ba0
xor eax, 0x4d4a679b
mov ecx, edi
mov edx, eax
call fcn.00403e80
pop edi
pop esi
add esp, 0x104
ret