joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x4010f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, 0x4028
mov edi, 0x33
test eax, eax
je 0x4011ea
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4011ea
cmp eax, edx
jae 0x4011ea
sub edx, eax
mov dword [ebp + 0xc], edx
lea edx, [edi - 0x33]
je 0x401148
mov ebx, dword [ebp + 0xc]
mov edi, eax
lea ecx, [ecx]
mov al, byte [edx + edi + 1]
sub al, 0x56
xor byte [edx + edi], al
inc edx
cmp edx, ebx
jb 0x401130
mov edi, 0x33
mov ebx, 0x4028
mov ecx, 0x5260
lea ecx, [ecx]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401150
mov ecx, 0x4da3
mov esi, 0x685f
nop
mov eax, 0x487ede05
imul esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401170
mov esi, 0x7045
jmp 0x401190
mov eax, 0x66666667
imul ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401190
mov eax, 0x56b1
mov edx, 0xe5
lea ecx, [ecx]
cmp edi, edx
cmovl edi, edx
dec eax
jne 0x4011b0
jmp 0x4011c0
mov eax, 0x939a85c5
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4011c0
mov eax, 0x83993053
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011d5
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4034f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x40354d
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x403500
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x401f70
Capabilities:
Encode data using xor

Disassembly:
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x700]
push eax
push dword [0x4067c0]
push 0xff
call fcn.0040417c
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x3a0]
push eax
call fcn.00402d56
lea eax, [ebp - 0x5f9]
push eax
invalid
invalid
invalid
invalid

Function at 0x40566c
Capabilities:
Enumerate pe sections

Disassembly:
dec eax
lea edx, [0xffff9d8d]
dec dword [eax - 0x73]
or al, 0x10
cmp dword [ecx], 0x4550

Function at 0x405678
Capabilities:
Enumerate pe sections

Disassembly:
cmp dword [eax + 0x45], edx
add byte [eax], al
jne fcn.004056de
mov eax, 0x20b

Function at 0x40567e
Capabilities:
Enumerate pe sections

Disassembly:
cmp dword [eax + 0x45], edx
add byte [eax], al
jne fcn.004056de
mov eax, 0x20b

Function at 0x40568a
Capabilities:
Enumerate pe sections

Disassembly:
dec esp
sub eax, edx
movzx eax, word [ecx + 0x14]
adc al, 0x48
lea edx, [ecx + 0x18]
dec eax

Function at 0x40439c
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040422d
mov ecx, 0x1e4
call 0x40439c
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40439f
mov ecx, 0xc595ca60
invalid
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419824
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00419398
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404c4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x419882
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41c684]
mov dl, 1
mov eax, dword [0x419290]
call fcn.0040971c
call fcn.0040420c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41988c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4198e4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x41c774]
mov dl, 1
mov eax, dword [0x419290]
call fcn.0040971c
call fcn.0040420c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004193c8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41a34c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a3bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.004082f4
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x41a3d0
call fcn.00404ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3c2
lea eax, [ebp - 0x104]
call fcn.004047ac
ret
Function at 0x437ce9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x437cf8
pop dword [ebp - 0x18]
mov eax, 0x298778e
sub eax, 0x254fa96
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xba05fff8
add dword [ebp - 0x28], 0x944c4553
mov dword [ebp - 0x24], 0x9822c20
sub dword [ebp - 0x24], 0xd74edfdb
mov dword [ebp - 0x20], 0x40d745bf
sub dword [ebp - 0x20], 0xf48b0191
mov dword [ebp - 0x1c], 0x64f88572
sub dword [ebp - 0x1c], 0x64f88572
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x6aa7db49
add dword [ebp - 0x28], 0x9ca8e0d
mov dword [ebp - 0x24], 0xa176dccf
sub dword [ebp - 0x24], 0x600a7b5a
mov dword [ebp - 0x20], 0x1a33f3dd
sub dword [ebp - 0x20], 0xb6c48771
mov dword [ebp - 0x1c], 0x8d7f1ee9
add dword [ebp - 0x1c], 0x7280e117
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x4d3fc2d6
add eax, 0xb305edaa
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x4d0a6
push 0
call eax
mov ecx, 0x839d5d8f
sub ecx, 0x839d16d8
xor edx, edx
add edx, eax
mov edi, 0x476000
add edi, dword [ebp - 0x18]
mov esi, 0xb3cba731
add esi, 0x60a979c0
xor dword [ebp - 0x10], edi
mov ebx, dword [edi]
mov dword [ebp - 4], 0x8f8b6956
sub ebx, esi
xor dword [ebp - 0x10], ecx
mov dword [edx], ebx
add dword [ebp - 4], 0xe6f7c4e1
add edx, 0x1b8655ab
sub edx, 0x1b8655a7
add edi, 0x7950c903
sub edi, 0x7950c8ff
loop 0x437e11
add eax, 0x6adefbfb
add eax, 0x952211b4
mov ebx, eax
add eax, 5
mov ecx, 0x1fca8adc
sub ecx, 0x1f8a8adc
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40b0df
Capabilities:
Encode data using xor

Disassembly:
call 0x40afdd
mov ecx, 0x1d7
call 0x40b0df
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40b0e2
mov eax, 0x50402c7
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x16294ee6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x60f15886
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4021a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb esi, 0x8d
rol eax, 0x97
inc eax
imul ebx
rol eax, 0x33
dec eax
bswap eax
and ebx, 0xc5
inc edi
add ebx, 0xb
dec esi
neg eax
neg ebx
neg esi
add edx, 0x2f
dec edi
rcr eax, 0xe0
inc esi
inc edx
imul edi
dec ebx
rcl ebx, 7
rol eax, 0x4e
or esi, 0xf
inc eax
imul eax
dec ebx
bswap edx
sbb edi, 0x36
mov esi, 0x65
dec esi
sbb esi, 0x72
neg edx
add eax, 9
not edx
inc esi
neg edx
add eax, 0x22
dec ebx
not ebx
bswap ebx
rcl edx, 0x2a
ror esi, 0xd4
or edi, 0xf5
and esi, 0xfb
and esi, 0x7d
not edx
neg esi
bswap edx
rol edx, 0xf
xor ecx, ecx
xor edi, edi
neg edi
imul esi
imul eax
imul edi
and edx, 0xb
neg esi
rcl eax, 0x73
not edi
add ebx, 0x35
sbb eax, 0xc5
not esi
add esi, 0xa8
rcr edx, 0x6c
mov ebx, 0x2b
not ebx
rcl eax, 0xa5
and edx, 0x69
neg esi
or eax, 0x68
rcl esi, 0x14
bswap edi
add eax, 0x67
rcl esi, 0xa1
imul eax
imul esi
bswap ebx
neg eax
neg edx
ror edx, 0x40
dec esi
ror edi, 0x3e
neg eax
sub esi, 0x97
rol ebx, 0xcb
mov edx, 0xbb
or edx, 0x56
sbb ebx, 0x34
imul ebx
inc esi
neg edi
mov eax, 0xd4
dec ebx
imul edi
rcl esi, 0x65
add edi, 2
imul esi
dec esi
inc ebx
neg ebx
or esi, 0x9c
mov ecx, dword [ebp + 0xc]
rcr esi, 0x4c
imul edx
and edi, 0x3e
dec edx
not ebx
rol esi, 0xc3
imul ebx
sub edx, 0xc8
dec esi
sbb eax, 0x1c
inc edx
imul edx
not esi
dec ebx
inc eax
bswap esi
inc esi
ror edx, 0x94
bswap esi
add ebx, 0x73
ror edx, 0x8b
bswap edi
not ebx
imul eax
rcl eax, 0x53
inc edx
imul eax
sub esi, 0xf8
sbb eax, 0x7b
sbb esi, 0x11
sub eax, 0x90
ror eax, 0x77
rcl esi, 0x2a
inc esi
mov edx, 0xb4
bswap esi
imul eax
inc ebx
sbb eax, 0x32
neg ebx
not esi
sbb eax, 0xab
rcl edi, 0x6c
bswap ebx
and edx, 0xce
neg edi
sbb edi, 0xc7
or edx, 0xb6
sub ebx, 0xa9
mov edx, 0x72
mov edi, dword [ebp + 8]
mov esi, esi
mov esi, eax
xor eax, esi
not byte [edi]
mov eax, ebx
mov eax, eax
mov eax, eax
xor esi, ebx
mov eax, eax
xor eax, eax
mov ebx, esi
xor esi, eax
xor esi, esi
add byte [edi], 0x54
mov eax, ebx
xor ebx, ebx
mov esi, ebx
mov ebx, ebx
mov ebx, ebx
xor ebx, esi
mov ebx, eax
xor eax, ebx
mov esi, ebx
sub byte [edi], 0x29
mov esi, esi
mov ebx, ebx
xor eax, esi
xor esi, ebx
mov esi, eax
mov eax, ebx
mov esi, esi
mov esi, ebx
mov esi, ebx
imul byte [edi]
inc edi
loop 0x402345
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a6fa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x447a90]
jne 0x40a704
repz ret
jmp fcn.00411c8d
Function at 0x41660c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410596
and dword [ebp - 4], 0
cmp dword [0x4495d0], 0
mov ebx, eax
jne 0x4166bd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41676e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41676e
push eax
call fcn.00410524
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4495d0], eax
call esi
push eax
call fcn.00410524
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4495d4], eax
call esi
push eax
call fcn.00410524
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4495d8], eax
call esi
push eax
call fcn.00410524
pop ecx
mov dword [0x4495e0], eax
test eax, eax
je 0x4166bd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410524
pop ecx
mov dword [0x4495dc], eax
mov eax, dword [0x4495dc]
cmp eax, ebx
je 0x416715
cmp dword [0x4495e0], ebx
je 0x416715
push eax
call fcn.0041059f
push dword [0x4495e0]
mov esi, eax
call fcn.0041059f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416715
test edi, edi
je 0x416715
call esi
test eax, eax
je 0x41670c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41670c
test byte [ebp - 0xc], 1
jne 0x416715
or dword [ebp + 0x10], 0x200000
jmp 0x41674e
mov eax, dword [0x4495d4]
cmp eax, ebx
je 0x41674e
push eax
call fcn.0041059f
pop ecx
test eax, eax
je 0x41674e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41674e
mov eax, dword [0x4495d8]
cmp eax, ebx
je 0x41674e
push eax
call fcn.0041059f
pop ecx
test eax, eax
je 0x41674e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4495d0]
call fcn.0041059f
pop ecx
test eax, eax
je 0x41676e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416770
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c000
Capabilities:
Encode data using xor

Disassembly:
aad 0x9f
test eax, 0x2a291a3e
sub dl, bh
aam 0xd3
mov dh, 0x25
mov ch, 0x27
jb 0x41c079
lcall 0xe22a, 0xea077972
sub ebx, dword [edx + 0x1b]
pushal
imul ecx, dword [ebx + 0x7f], 0x44a74033
pop es
xor edi, dword [ebx + esi]
aas
xor ecx, dword [edi + ebx*8 - 0x24]
imul ebp, dword [eax + 0x61], 0x5f1b3c33
imul ebx, dword [eax + 0x16], 0x4033eae0
cmpsd dword [esi], dword es:[edi]
pop ebx
sbb ebp, dword [edi + 0x1e]
sub ch, byte [edx]
sub ch, dl
imul esp, dword [edi - 0x4e], 0x2a4e67a9
sub ch, byte [edx]
xor edi, dword [ecx + ebp*2]
dec ebx
lea ebp, [ecx + 0x2a2a9b63]
sub ch, byte [ecx + 0x2a2a3544]
sub dh, byte [ebx]
dec esp
fcomp qword [ebx]
pop edi
xor ebx, dword [eax + 0x69]
dec edi
xor eax, 0x2a2a0572
sub ah, byte [edi + 0x1bdcd340]
pushal
imul edx, dword [edx + edi*2 + 0x69], 0x68a9684f
aas
sub ch, byte [edx]
test eax, 0x2a2a3f68
sub dh, byte [ebx]
push edx
cmpsd dword [esi], dword es:[edi]
pop esp
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
pushal
loopne 0x41c067
test eax, 0x2a2a2d48
sub ch, byte [ebx + 0x5a]
sub ch, byte [edx]
sub ah, byte [edi + 0x4ca9d14f]
push edx
sub ch, byte [edx]
sub ah, dl
xor edi, dword [ebx]
imul edi, dword [ebx + 0x2a], 0x2a
sub dh, byte [ebx]
push esp
fbstp tbyte [ebx]
push edi
cmpsd dword [esi], dword es:[edi]
push eax
imul edx, dword [esp + ecx*2 - 0x16], 0x693f33e4
push 0xffffffffffffffb5
sbb esp, dword [edx + 0x69]
dec ebx
test eax, 0xe68a7dc
fsubr qword [ecx + 0x2a2a825c]
sub ch, byte [ecx + 0x57]
or ebp, dword [ebx - 0x70]
sub ch, byte [edx]
sub ch, byte [ecx + 0x57]
aas
xor edx, dword [eax + 0x69]
push eax
wait
imul ebp, dword [edx - 0x49], 0x40a9e4e3
outsd dx, dword [esi]
sub ch, byte [edx]
sub dh, byte [edx + 0x30]
sub ch, byte [edx]
sub ch, al
test eax, 0x2a2a8664
sub ch, byte [ecx + 0x5b]
call 0xdc8c68de
xor edx, dword [edi + 0x33]
dec edi
out 0x33, eax
pop edx
in al, 0xa9
dec eax
cmp eax, 0x332a2a2a
push eax
ljmp 0x2a2a
Function at 0x406290
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4064ab
sub esp, 0x10
movzx eax, byte [0x813862]
test al, al
jne 0x406483
mov eax, dword [0x813ac0]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov edx, dword [esp + 0x18]
add eax, edx
mov ebx, dword [esp + 0x14]
jmp 0x406344
lea edx, [ebx + 4]
test byte [edx], al
lea edx, [ebx + 8]
test byte [edx], al
lea edx, [ebx + 0xc]
test byte [edx], al
mov edx, dword [ebx]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebx + 4]
xor edx, ebp
imul edx, edx, 0xc70f85e1
rol edx, 0xf
imul ebp, edx, 0x319bca41
mov edx, dword [ebx + 8]
xor edx, esi
imul edx, edx, 0x319bca41
rol edx, 0xf
imul esi, edx, 0x8b421a21
mov edx, dword [ebx + 0xc]
xor edx, edi
imul edx, edx, 0x8b421a21
rol edx, 0xf
imul edi, edx, 0xbce2d621
add ecx, 0xfffffff0
add ebx, 0x10
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
jae 0x4062d1
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x4063dd
cmp ecx, 4
jb 0x406447
je 0x406432
cmp ecx, 8
jbe 0x406406
cmp ecx, 0x10
jbe 0x406386
mov ebp, dword [0x813ac4]
imul ebp, edx
mov esi, dword [0x813ac8]
imul esi, edx
mov edi, dword [0x813acc]
imul edi, edx
jmp 0x406339
lea edx, [ebx + 4]
test byte [edx], al
mov edx, ebx
lea ebp, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov ebx, dword [edx]
xor eax, ebx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [edx + 4]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ebp]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor eax, dword [ecx]
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor ecx, eax
imul eax, ecx, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x20], eax
add esp, 0x10
ret
mov edx, ebx
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul edx, eax, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
xor edx, dword [ecx]
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4063dd
mov ecx, dword [ebx]
xor eax, ecx
imul ecx, eax, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4063dd
mov edx, ecx
shr ecx, 1
lea ebp, [ebx + ecx]
test byte [ebp], al
mov ebp, ebx
lea edx, [edx + ebx - 1]
movzx ebx, byte [ebp]
xor eax, ebx
movzx ecx, byte [ebp + ecx]
shl ecx, 8
xor ecx, eax
movzx edx, byte [edx]
shl edx, 0x10
xor edx, ecx
imul ecx, edx, 0xbce2d621
rol ecx, 0xf
imul eax, ecx, 0xc70f85e1
jmp 0x4063dd
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.0044b540
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
add esp, 0x10
ret
call fcn.0044a170
jmp fcn.00406290
Function at 0x409c40
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409e04
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x409de9
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0044b880
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x24]
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov ebx, ebp
add ebp, 1
mov ebp, 0
adc ebp, 0
test ebp, ebp
jne 0x409dfd
cmp ecx, 0x21
jae 0x409dfd
mov dword [esp + 0x10], esi
lea ebp, [0x7d77a0]
movsd xmm0, qword [ebp + ebx*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebp + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.00447150
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00447240
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
mulsd xmm2, qword [esp + 8]
movsd xmm1, qword [0x682f48]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x682fc0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x409dc4
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x683010]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x409c6d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
call fcn.00425910
ud2
call fcn.0044a170
jmp fcn.00409c40