joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d064
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040d0e7
jae 0x40d072
xor ecx, ecx
call fcn.0040d0e7
jae 0x40d0a1
xor eax, eax
call fcn.0040d0e7
jae 0x40d0b1
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040d0e7
adc al, al
jae 0x40d093
jne 0x40d0dd
stosb byte es:[edi], al
jmp 0x40d075
call fcn.0040d0f3
sub ecx, ebx
jne 0x40d0ba
call fcn.0040d0f1
jmp 0x40d0d9
lodsb al, byte [esi]
shr eax, 1
je 0x40d103
adc ecx, ecx
jmp 0x40d0d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040d0f1
cmp eax, 0x7d00
jae 0x40d0d6
cmp ah, 5
jae 0x40d0d7
cmp eax, 0x7f
ja 0x40d0d8
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40d075
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40d430
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40d49f
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40d467
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40dda0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40de3f
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00405cb4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x452ece
call fcn.00405e2c
add esp, 0xc
test eax, eax
jne 0x40de3f
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x40de3c
mov ecx, dword [ebp + 0x10]
mov esi, 0x452efa
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405c78
add esp, 8
mov eax, 1
jmp 0x40de4a
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x40ddbf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401260
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov edx, ecx
dec ecx
test edx, edx
je 0x40129e
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x10]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xffff
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x6869d8]
xor ax, bx
inc ecx
dec esi
jne 0x401278
pop esi
pop ebx
ret

Function at 0x405570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40557b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x40567e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x654bec]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x654bec]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x654bec]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x654bec]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x654bec]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x654bec]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x654bec]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x654bec]
xor eax, edx
inc ecx
dec edi
jne 0x405596
pop edi
test esi, esi
je 0x4056a0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x654bec]
xor eax, edx
inc ecx
dec esi
jne 0x405682
pop esi
pop ebx
not eax
ret
Function at 0x40e900
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [ebp + 0x3b00]
mov eax, dword [edi + 0x18]
push eax
call fcn.004df770
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x10], ebx
je 0x40ea54
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
call fcn.0040d710
add esp, 8
test eax, eax
jne 0x40ea54
push esi
mov edx, dword [esp + 0x20]
push edx
push ebx
push ebp
call fcn.00410460
mov ecx, dword [edi + 0x14]
mov eax, 2
add esp, 0xc
cmp ecx, eax
mov dword [esp + 0x10], eax
jbe 0x40ea13
add ebx, 0x54
mov dword [esp + 0x1c], ebx
mov al, byte [ebx - 0x14]
cmp al, 0xe5
je 0x40e9f8
test al, al
je 0x40ea13
test byte [ebx - 9], 0x10
je 0x40e9a0
xor eax, eax
xor ecx, ecx
mov ax, word [ebx]
mov cx, word [ebx + 6]
shl eax, 0x10
or eax, ecx
push eax
push ebp
call fcn.0040e900
add esp, 8
jmp 0x40e9f8
xor esi, esi
xor edx, edx
mov si, word [ebx]
mov dx, word [ebx + 6]
shl esi, 0x10
or esi, edx
push esi
push ebp
call fcn.0040d710
add esp, 8
test eax, eax
jne 0x40e9f8
cmp esi, dword [edi + 0x90]
je 0x40e9f8
push esi
push ebp
call fcn.0040d780
mov ebx, eax
mov eax, dword [edi + 0x90]
push eax
push esi
push ebp
call fcn.0040d9f0
mov ecx, dword [edi + 0x28]
push ebx
inc ecx
push ebp
mov dword [edi + 0x28], ecx
mov esi, ebx
call fcn.0040d710
mov ebx, dword [esp + 0x38]
add esp, 0x1c
test eax, eax
je 0x40e9be
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x14]
inc eax
add ebx, 0x20
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ebx
jb 0x40e96b
mov ecx, dword [esp + 0x20]
push ecx
push ebp
call fcn.0040d780
mov edx, dword [edi + 0x90]
mov esi, eax
mov eax, dword [esp + 0x28]
push edx
push eax
push ebp
call fcn.0040d9f0
mov eax, dword [edi + 0x28]
push esi
inc eax
push ebp
mov dword [edi + 0x28], eax
mov dword [esp + 0x3c], esi
call fcn.0040d710
mov ebx, dword [esp + 0x30]
add esp, 0x1c
test eax, eax
je 0x40e941
pop esi
push ebx
call fcn.004df7a0
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4138f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [esi + 0x58]
and al, 1
push edi
neg al
sbb al, al
lea ebx, [esi + 0x3e]
and eax, 0xff
push eax
push ecx
push edx
push ebx
push ebp
call fcn.004139a0
mov edi, eax
xor eax, eax
add esp, 0x14
cmp edi, eax
jne 0x41394d
mov eax, dword [ebp]
xor ecx, ecx
push ebx
mov ax, word [eax + 6]
mov cl, ah
mov ch, al
mov word [esi + 0x4a], cx
call fcn.00413970
add esp, 4
mov word [esi + 0x4c], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov word [esi + 0x4c], ax
mov word [esi + 0x4a], ax
mov eax, dword [esi]
and al, 0xf9
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x419ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2c0]
push ebp
mov ebp, dword [esp + 0x2a4]
test ebp, ebp
push esi
je 0x41a0c8
test bl, 1
je 0x41a0c8
mov al, byte [esp + 0x2bf]
mov cl, byte [esp + 0x2aa]
shr al, 1
and al, 4
and cl, 4
xor al, cl
je 0x41a0c8
cmp word [0x68c8b0], 0x96fe
je 0x41a0c8
mov eax, dword [0x75e25c]
test eax, eax
jne 0x41a0c8
mov edx, ebx
and edx, 0x7ff
cmp edx, 0x121
jne 0x41a0c8
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0xa0]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x36edbd2e
mov dword [esp + 0x14], 0x73fabb0f
mov dword [esp + 0x18], 0x62fbbc1d
mov dword [esp + 0x1c], 0x72eda71f
mov dword [esp + 0x20], 0x64eda35a
mov dword [esp + 0x24], 0x78e7bc09
mov dword [esp + 0x28], 0x78e9b65a
mov dword [esp + 0x2c], 0x7ae6ba5a
mov dword [esp + 0x30], 0x64ebf503
mov dword [esp + 0x34], 0x73fcb41f
mov dword [esp + 0x38], 0x36faba5a
mov dword [esp + 0x3c], 0x62e1b11f
mov dword [esp + 0x40], 0x73e0a15a
mov dword [esp + 0x44], 0x7ae1b35a
mov dword [esp + 0x48], 0x7efff51f
mov dword [esp + 0x4c], 0x36e0b613
mov dword [esp + 0x50], 0x65edba1e
mov dword [esp + 0x54], 0x62e7bb5a
mov dword [esp + 0x58], 0x75f0b05a
mov dword [esp + 0x5c], 0x36ecb01f
mov dword [esp + 0x60], 0x36edbd0e
mov dword [esp + 0x64], 0x73f2bc09
mov dword [esp + 0x68], 0x36eeba5a
mov dword [esp + 0x6c], 0x5bb8e549
mov dword [esp + 0x70], 0x79dcf554
mov dword [esp + 0x74], 0x7beda75a
mov dword [esp + 0x78], 0x36eda315
mov dword [esp + 0x7c], 0x65e1bd0e
mov dword [esp + 0x80], 0x7be1b95a
mov dword [esp + 0x84], 0x62e9a113
mov dword [esp + 0x88], 0x3ae6ba13
mov dword [esp + 0x8c], 0x73e4a55a
mov dword [esp + 0x90], 0x36eda61b
mov dword [esp + 0x94], 0x7fefb008
mov dword [esp + 0x98], 0x64eda109
mov dword [esp + 0x9c], 0x1688d554
pop edi
mov ecx, dword [esp + eax + 0xc]
add eax, 4
xor ecx, 0x2a60df88
cmp eax, 0x90
mov dword [esp + eax + 0x98], ecx
jl 0x41a05f
mov edx, dword [0x7150f4]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa8]
push 0xffffffffffffffff
push eax
call fcn.0042d900
mov ecx, dword [0x7150f4]
push 0x10
push ecx
call fcn.004dd630
push 0
push 0
push 0x68c7e8
call fcn.004e04f0
or eax, 0x80000000
push 0
push eax
push 0x68c7e8
call fcn.004e0720
add esp, 0x34
mov esi, dword [esp + 0x2a0]
push esi
call fcn.00419d30
mov edx, dword [esp + 0x2c8]
mov eax, dword [esp + 0x2c4]
mov ecx, dword [esp + 0x2c0]
push ebx
push edx
mov edx, dword [esp + 0x2c4]
push eax
mov eax, dword [esp + 0x2c4]
push ecx
mov ecx, dword [esp + 0x2c4]
push edx
mov edx, dword [esp + 0x2c4]
push eax
mov eax, dword [esi + 0x142c]
push ecx
push edx
mov ecx, dword [eax]
mov edx, dword [0x71d108]
push ebp
push 1
push ecx
push 0
push edx
push esi
call fcn.0041e720
add esp, 0x3c
cmp eax, 1
pop esi
pop ebp
pop ebx
je 0x41a13e
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x71d108]
mov eax, dword [esp + 0x298]
inc edx
test eax, eax
mov dword [0x71d108], edx
je 0x41a172
mov eax, dword [eax + 4]
test eax, eax
je 0x41a172
push 0
push 0x800
call eax
add esp, 8
xor eax, eax
add esp, 0x290
ret
push 0
push 0x800
call fcn.004413e0
add esp, 8
xor eax, eax
add esp, 0x290
ret
Function at 0x4235f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2a0]
push esi
push edi
test ebx, ebx
je 0x42380c
mov eax, dword [esp + 0x2c8]
test al, 1
je 0x42380c
mov dl, byte [esp + 0x2b8]
mov cl, bl
shr cl, 2
and cl, 4
and dl, 4
xor cl, dl
je 0x42380c
cmp word [0x68d678], 0x62cc
je 0x42380c
mov ecx, dword [0x75e25c]
test ecx, ecx
jne 0x42380c
and eax, 0x3ff
cmp eax, 0x98
jne 0x42380c
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x9c]
mov dword [esp + 0xc], 0x8303b67d
mov dword [esp + 0x10], 0xc614b05c
mov dword [esp + 0x14], 0xd715b74e
mov dword [esp + 0x18], 0xc703ac4c
mov dword [esp + 0x1c], 0xd103a809
mov dword [esp + 0x20], 0xcd09b75a
mov dword [esp + 0x24], 0xcd07bd09
mov dword [esp + 0x28], 0xcf08b109
mov dword [esp + 0x2c], 0xd105fe50
mov dword [esp + 0x30], 0xc612bf4c
mov dword [esp + 0x34], 0x8314b109
mov dword [esp + 0x38], 0xd70fba4c
mov dword [esp + 0x3c], 0xc60eaa09
mov dword [esp + 0x40], 0xcf0fb809
mov dword [esp + 0x44], 0xcb11fe4c
mov dword [esp + 0x48], 0x830ebd40
mov dword [esp + 0x4c], 0xd003b14d
mov dword [esp + 0x50], 0xd709b009
mov dword [esp + 0x54], 0xc01ebb09
mov dword [esp + 0x58], 0x8302bb4c
mov dword [esp + 0x5c], 0x8303b65d
mov dword [esp + 0x60], 0xc61cb75a
mov dword [esp + 0x64], 0x8300b109
mov dword [esp + 0x68], 0xee56ee1a
mov dword [esp + 0x6c], 0xcc32fe07
mov dword [esp + 0x70], 0xce03ac09
mov dword [esp + 0x74], 0x8303a846
mov dword [esp + 0x78], 0xd00fb65d
mov dword [esp + 0x7c], 0xce0fb209
mov dword [esp + 0x80], 0xd707aa40
mov dword [esp + 0x84], 0x8f08b140
mov dword [esp + 0x88], 0xc60aae09
mov dword [esp + 0x8c], 0x8303ad48
mov dword [esp + 0x90], 0xca01bb5b
mov dword [esp + 0x94], 0xd103aa5a
mov dword [esp + 0x98], 0xa366de07
rep stosd dword es:[edi], eax
mov ecx, dword [esp + eax + 0xc]
add eax, 4
xor ecx, 0x2a60df88
cmp eax, 0x90
mov dword [esp + eax + 0x98], ecx
jl 0x4237a3
mov edx, dword [0x7150f4]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa8]
push 0xffffffffffffffff
push eax
call fcn.0042d900
mov ecx, dword [0x7150f4]
push 0x10
push ecx
call fcn.004dd630
push 0
push 0
push 0x68c7e8
call fcn.004e04f0
or eax, 0x80000000
push 0
push eax
push 0x68c7e8
call fcn.004e0720
add esp, 0x34
mov esi, dword [esp + 0x2a0]
push 0
lea edi, [esi + 0xad8]
push edi
push esi
call fcn.00418bd0
mov edx, dword [esp + 0x2d4]
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x2cc]
push edx
mov edx, dword [esp + 0x2cc]
push eax
mov eax, dword [esp + 0x2cc]
push ecx
mov ecx, dword [esp + 0x2cc]
push edx
mov edx, dword [esp + 0x2cc]
push eax
mov eax, dword [esp + 0x2cc]
push ecx
mov ecx, dword [0x71d108]
push edx
push eax
push ebx
push 1
push edi
push 0
push ecx
push esi
call fcn.0041e720
add esp, 0x44
cmp eax, 1
pop edi
pop esi
pop ebx
je 0x42388a
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x71d108]
mov eax, dword [esp + 0x298]
inc edx
test eax, eax
mov dword [0x71d108], edx
je 0x4238be
mov eax, dword [eax + 4]
test eax, eax
je 0x4238be
push 0
push 0x800
call eax
add esp, 8
xor eax, eax
add esp, 0x290
ret
push 0
push 0x800
call fcn.004413e0
add esp, 8
xor eax, eax
add esp, 0x290
ret
Function at 0x427f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov ecx, dword [edi + 0x3c80]
mov dword [esp + 4], eax
test ecx, ecx
jbe 0x428074
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov ecx, dword [edi + 0x3c84]
mov esi, dword [ecx + eax*4]
mov eax, dword [0x71d108]
mov edx, dword [esi + 0x14]
cmp edx, eax
jne 0x42805a
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esi + 0x24]
push edx
mov edx, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x54]
push ecx
mov ecx, dword [esi + 0x7c]
push edx
mov edx, dword [esi + 0x78]
push eax
mov eax, dword [esi + 0x70]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push eax
push esi
push ecx
push edi
call fcn.0042db10
mov eax, dword [edi + 0x2c8]
add esp, 0x48
test eax, eax
je 0x42805a
mov esi, dword [esi + 0xac]
test esi, esi
je 0x42805a
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
push ebp
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [0x71d108]
push edx
push eax
add esi, ecx
push edi
push esi
call fcn.0043ffd0
add esp, 0x30
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3c80]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x427fa5
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret

Function at 0x429d50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
mov edx, ecx
dec ecx
test edx, edx
jle 0x429d86
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5e8220]
xor eax, edx
inc ecx
dec esi
jne 0x429d66
pop esi
pop ebx
ret
Function at 0x42e4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax + 0xc]
push edi
mov edi, dword [esp + 0x3c]
test esi, esi
je 0x42e5c0
test byte [esi + 0xdd], 2
jne 0x42e5aa
mov eax, dword [0x7f2fa4]
test eax, eax
jne 0x42e5c0
mov edx, dword [esp + 0x40]
test ebx, ebx
je 0x42e54d
test dl, 1
je 0x42e54d
mov al, byte [esp + 0x30]
mov cl, bl
shr cl, 2
and cl, 8
and al, 8
xor cl, al
je 0x42e54d
cmp word [0x68d51a], 0xf807
je 0x42e54d
mov eax, dword [0x75e25c]
test eax, eax
jne 0x42e54d
cmp dl, 0x99
je 0x42e5b6
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, eax
or ebp, ecx
je 0x42e5aa
mov ebp, dword [esi + 0x14]
cmp ebp, dword [0x71d108]
jne 0x42e5aa
push edx
mov edx, dword [esp + 0x3c]
push edi
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esi + 0x78]
push ebx
push ecx
mov ecx, dword [esi + 0x7c]
push eax
mov eax, dword [esi + 0x54]
push eax
mov eax, dword [esi + 0x70]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x4c]
push eax
push esi
push ecx
push edx
call fcn.0042db10
add esp, 0x48
mov esi, dword [esi]
test esi, esi
jne 0x42e4fb
jmp 0x42e5c0
mov dword [0x7f2fa4], 3
mov eax, dword [esp + 0x18]
mov ebp, dword [eax + 0xc]
test ebp, ebp
je 0x42e69b
mov eax, dword [0x7f2fa4]
test eax, eax
jne 0x42e69b
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x42e681
mov ecx, dword [ebp + 0x40]
push 0x687ac0
push ecx
call fcn.00527225
add esp, 8
test eax, eax
je 0x42e681
mov edx, dword [ebp + 0x40]
push 0x687ab8
push edx
call fcn.00527225
add esp, 8
test eax, eax
je 0x42e681
mov eax, dword [esp + 0x40]
test ebx, ebx
je 0x42e64d
test al, 1
je 0x42e64d
mov dl, byte [esp + 0x30]
mov cl, bl
shr cl, 2
and cl, 8
and dl, 8
xor cl, dl
je 0x42e64d
cmp word [0x68d51a], 0xf807
je 0x42e64d
mov ecx, dword [0x75e25c]
test ecx, ecx
jne 0x42e64d
cmp al, 0x99
je 0x42e691
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x3c]
push edi
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ebx
push eax
push esi
push ecx
call fcn.0042e4e0
add esp, 0x30
mov ebp, dword [ebp]
test ebp, ebp
jne 0x42e5cf
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [0x7f2fa4], 3
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42f1f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2a0]
test ebx, ebx
je 0x42f406
mov eax, dword [esp + 0x2c0]
test al, 1
je 0x42f406
mov dl, byte [esp + 0x2b0]
mov cl, bl
shr cl, 1
and cl, 2
and dl, 2
xor cl, dl
je 0x42f406
cmp byte [0x68d518], 0x59
je 0x42f406
mov ecx, dword [0x75e25c]
test ecx, ecx
jne 0x42f406
and eax, 0xfff
cmp eax, 0x998
jne 0x42f406
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x59c94aba
mov dword [esp + 0xc], 0x1cde4c9b
mov dword [esp + 0x10], 0xddf4b89
mov dword [esp + 0x14], 0x1dc9508b
mov dword [esp + 0x18], 0xbc954ce
mov dword [esp + 0x1c], 0x17c34b9d
mov dword [esp + 0x20], 0x17cd41ce
mov dword [esp + 0x24], 0x15c24dce
mov dword [esp + 0x28], 0xbcf0297
mov dword [esp + 0x2c], 0x1cd8438b
mov dword [esp + 0x30], 0x59de4dce
mov dword [esp + 0x34], 0xdc5468b
mov dword [esp + 0x38], 0x1cc456ce
mov dword [esp + 0x3c], 0x15c544ce
mov dword [esp + 0x40], 0x11db028b
mov dword [esp + 0x44], 0x59c44187
mov dword [esp + 0x48], 0xac94d8a
mov dword [esp + 0x4c], 0xdc34cce
mov dword [esp + 0x50], 0x1ad447ce
mov dword [esp + 0x54], 0x59c8478b
mov dword [esp + 0x58], 0x59c94a9a
mov dword [esp + 0x5c], 0x1cd64b9d
mov dword [esp + 0x60], 0x59ca4dce
mov dword [esp + 0x64], 0x349c12dd
mov dword [esp + 0x68], 0x16f802c0
mov dword [esp + 0x6c], 0x14c950ce
mov dword [esp + 0x70], 0x59c95481
mov dword [esp + 0x74], 0xac54a9a
mov dword [esp + 0x78], 0x14c54ece
mov dword [esp + 0x7c], 0xdcd5687
mov dword [esp + 0x80], 0x55c24d87
mov dword [esp + 0x84], 0x1cc052ce
mov dword [esp + 0x88], 0x59c9518f
mov dword [esp + 0x8c], 0x10cb479c
mov dword [esp + 0x90], 0xbc9569d
mov dword [esp + 0x94], 0x79ac22c0
pop edi
mov ecx, dword [esp + eax + 4]
add eax, 4
xor ecx, 0x2a60df88
cmp eax, 0x90
mov dword [esp + eax + 0x90], ecx
jl 0x42f39d
mov edx, dword [0x7150f4]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa0]
push 0xffffffffffffffff
push eax
call fcn.0042d900
mov ecx, dword [0x7150f4]
push 0x10
push ecx
call fcn.004dd630
push 0
push 0
push 0x68c7e8
call fcn.004e04f0
or eax, 0x80000000
push 0
push eax
push 0x68c7e8
call fcn.004e0720
add esp, 0x34
mov edx, dword [esp + 0x2c0]
mov eax, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2b8]
push edx
mov edx, dword [esp + 0x2b8]
push eax
mov eax, dword [esp + 0x2b8]
push ecx
mov ecx, dword [esp + 0x2b8]
push edx
mov edx, dword [esp + 0x2b8]
push eax
mov eax, dword [esp + 0x2b8]
push ecx
push edx
mov edx, dword [0x71d108]
push eax
mov eax, dword [esp + 0x2b8]
push ebx
push 1
lea ecx, [eax + 0x2d8]
push ecx
push 0
push edx
push eax
call fcn.0041e720
add esp, 0x38
cmp eax, 1
pop ebx
je 0x42f479
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x71d108]
mov eax, dword [esp + 0x298]
inc edx
test eax, eax
mov dword [0x71d108], edx
je 0x42f4ad
mov eax, dword [eax + 4]
test eax, eax
je 0x42f4ad
push 0
push 0x800
call eax
add esp, 8
xor eax, eax
add esp, 0x290
ret
push 0
push 0x800
call fcn.004413e0
add esp, 8
xor eax, eax
add esp, 0x290
ret