joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e3560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x2e3589
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x2edf2c]
test eax, eax
jne 0x2e35ad
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0x522321a7
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2edf2c], eax
call eax
mov edi, eax
mov eax, dword [0x2edaf8]
test eax, eax
jne 0x2e35d5
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0xb27f9f0b
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2edaf8], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x2e3655
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x2e364a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x2e3610
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x2e3660
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x2e368a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x2edf2c]
test eax, eax
jne 0x2e36ae
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0x522321a7
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2edf2c], eax
call eax
mov edi, eax
mov eax, dword [0x2edaf8]
test eax, eax
jne 0x2e36d6
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0xb27f9f0b
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2edaf8], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x2e3742
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x2e373a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x2e3710
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x2e3c50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0xd417
xor dword [esp + 4], 0xfe7518b6
add dword [esp + 4], 0xffff66fd
xor dword [esp + 4], 0xfe75339e
mov dword [esp], 0xc20a
or dword [esp], 0xac700
shr dword [esp], 2
or dword [esp], 0x597d730f
xor dword [esp], 0x360881cc
or dword [esp], 0x27d50529
add dword [esp], 0xfc7f
xor dword [esp], 0x6ff873ac
push ebx
mov dword [esp + 4], 0x7ffe
mov ebx, ecx
shl dword [esp + 4], 9
xor dword [esp + 4], 0xfffc10
cmp byte [ebx], 0
je 0x2e3d5e
push esi
push edi
jmp 0x2e3cd0
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0xc20a
or dword [esp + 0xc], 0xac700
shr dword [esp + 0xc], 2
or dword [esp + 0xc], 0x597d730f
xor dword [esp + 0xc], 0x360881cc
or dword [esp + 0xc], 0x27d50529
add dword [esp + 0xc], 0xfc7f
xor dword [esp + 0xc], 0x6ff873ac
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x7ffe
shl dword [esp + 0xc], 9
xor dword [esp + 0xc], 0xfffc10
shl esi, cl
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x2e3cd0
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x2e3ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x2e3efc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.002e3c50
xor eax, 0x1616ce02
cmp eax, dword [esp + 0x10]
je 0x2e3f06
inc esi
cmp esi, dword [edi + 0x18]
jb 0x2e3ee0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x2e3f34
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x2e3f34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x2e40b0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x2e40d6
cmp al, 0x2e
je 0x2e40d3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x2e40c3
jmp 0x2e40d6
mov byte [edx], 0
mov eax, dword [0x2ede6c]
test eax, eax
jne 0x2e40fa
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0xe12e7135
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2ede6c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x2e4141
mov eax, dword [0x2eddcc]
test eax, eax
jne 0x2e412b
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0xc93d75ee
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2eddcc], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x2e4141
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.002e3c50
xor eax, 0x1616ce02
mov ecx, edi
mov edx, eax
call fcn.002e3ea0
pop edi
pop esi
add esp, 0x104
ret
Function at 0x2e3f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx]
cmp ebx, ecx
je 0x2e409a
mov edx, dword [ebx + 0x30]
mov dword [esp + 0x14], 0xd417
xor dword [esp + 0x14], 0xfe7518b6
add dword [esp + 0x14], 0xffff66fd
xor dword [esp + 0x14], 0xfe75339e
mov dword [esp + 0x10], 0xc20a
or dword [esp + 0x10], 0xac700
shr dword [esp + 0x10], 2
or dword [esp + 0x10], 0x597d730f
xor dword [esp + 0x10], 0x360881cc
or dword [esp + 0x10], 0x27d50529
add dword [esp + 0x10], 0xfc7f
xor dword [esp + 0x10], 0x6ff873ac
mov dword [esp + 0x10], 0x7ffe
shl dword [esp + 0x10], 9
xor dword [esp + 0x10], 0xfffc10
cmp word [edx], 0
je 0x2e4081
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], 0xc20a
or dword [esp + 0x10], 0xac700
shr dword [esp + 0x10], 2
or dword [esp + 0x10], 0x597d730f
xor dword [esp + 0x10], 0x360881cc
or dword [esp + 0x10], 0x27d50529
add dword [esp + 0x10], 0xfc7f
xor dword [esp + 0x10], 0x6ff873ac
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 0x7ffe
shl dword [esp + 0x10], 9
xor dword [esp + 0x10], 0xfffc10
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edi, dword [esp + 0x14]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x2e4060
cmp eax, 0x5a
ja 0x2e4060
add eax, 0x20
mov dword [esp + 0x14], eax
add edx, 2
add dword [esp + 0x14], esi
add dword [esp + 0x14], edi
sub dword [esp + 0x14], ebp
cmp word [edx], 0
jne 0x2e3fe4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor eax, 0x36f387d6
cmp eax, dword [esp + 0x1c]
je 0x2e40a4
mov ebx, dword [ebx]
cmp ebx, ecx
jne 0x2e3f65
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x2e4370
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x2e450e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x2e450e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x2e450e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x2e450e
mov eax, dword [0x2ee0a8]
test eax, eax
jne 0x2e43db
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0x2fc76848
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2ee0a8], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x2e4505
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x2ee2b4]
test eax, eax
jne 0x2e443b
mov ecx, 0xe4dda7c2
call fcn.002e3f40
mov edx, 0x2bab1175
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2ee2b4], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x2e44be
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x2ee2b4]
test eax, eax
jne 0x2e44a6
mov ecx, 0xe4dda7c2
call fcn.002e3f40
mov edx, 0x2bab1175
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2ee2b4], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x2e4465
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.002e4640
mov edx, edi
mov ecx, ebx
call fcn.002e4550
pop esi
test eax, eax
jne 0x2e4505
mov eax, dword [0x2ee134]
test eax, eax
jne 0x2e44f9
mov ecx, 0xb98d61a4
call fcn.002e3f40
mov edx, 0xece41155
mov ecx, eax
call fcn.002e3ea0
mov dword [0x2ee134], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x75b9b1
Capabilities:
Set environment variable

Disassembly:
mov dword [esi + 0x44], ebx
jmp 0x64998a
push 0x457aa0
jmp 0x68f897
push str.DNGTrialState
jmp 0x72ffef
jle 0x72fff5
cmp ebp, ebx
jmp 0x732127
jne 0x64998a
mov dword [esi + 0x28], ebx
mov dword [esi + 0x40], ebx
jmp 0x5c6ad7
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x62a336
nop
jmp 0x6a512a
jb 0x6f89a6
xor ebp, ebp
jmp 0x6f89a6
xor eax, 0x752c323e
jmp 0x6b79a6
push str.DNGTrialState
jmp 0x642db8
jmp fcn.0043940d
call fcn.005c8c64
je 0x6f89a6
mov ebx, dword [esi + 0x30]
test ebp, esi
push 0
add edi, 1
call fcn.0043d75c
add esp, 4
cmp bl, 0x85
cmp eax, ebx
jmp 0x667d46
xor ebx, ebx
cmp edi, ebx
jmp 0x5efbfa
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp ebp, ebx
jmp 0x62a330
je 0x5da7a8
push 0x45f3a0
jmp 0x5dbfab
lea eax, [eax + ecx*2 - 0x83fe422]
mov dword [esp + ecx*2], 0x2890ee80
imul ecx, edx
jae 0x6759d0
mov eax, 0x7d958e82
mov dx, word [eax + edi - 0x7d958e82]
lea ecx, [eax*4 - 0x26f756c9]
mov cl, byte [edi + eax - 0x7d958e80]
inc eax
lea edi, [eax + edi - 0x7d958e81]
not eax
shr dx, cl
mov word [edi], dx
mov ecx, eax
movzx edx, cx
mov eax, dword [ebp + edx*8 - 0x38be0]
lea ebp, [ebp + edx - 0x7178]
and cx, cx
xor eax, ebx
call fcn.007098ec

Function at 0x438c7e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
pop eax
mov esi, ecx
or ecx, ecx
add ecx, 0x7ea53e32
call fcn.00438cbb
sub ecx, 0x7446cdef
xor dword [edi], eax
sub ecx, 0x26abe4ed
and ecx, ecx
inc edi
mov ecx, ecx
cmp edi, ebx
jne fcn.00438c7e
add ecx, ecx
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6cc80ccd
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x68c06135
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4030e0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x200c
call fcn.0040a5b0
mov eax, dword [0x450b14]
mov ecx, dword [0x450a88]
shr eax, 3
test eax, eax
jbe 0x403212
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403130
cmp dword [0x450b14], 0x959
jne 0x4031f4
push 0
lea eax, [esp + 0x420]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0xc20]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1820]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402b44
push 0x402b54
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00402f30
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403130
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
Function at 0x3832c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x383300
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x38dbf8]
test eax, eax
jne 0x383324
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0x704a030e
mov ecx, eax
call fcn.00383e30
mov dword [0x38dbf8], eax
call eax
mov ebx, eax
mov eax, dword [0x38dd60]
test eax, eax
jne 0x38334c
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0x9016bda2
mov ecx, eax
call fcn.00383e30
mov dword [0x38dd60], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x383402
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x3833f2
cmp ebx, 8
jb 0x3833d7
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x383396
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x3833d7
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x3833b0
cmp edx, ebx
jae 0x3833f2
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x3833e0
mov edx, dword [esp + 0x18]
test edx, edx
je 0x383400
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x383470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x383499
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x38dbf8]
test eax, eax
jne 0x3834bd
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0x704a030e
mov ecx, eax
call fcn.00383e30
mov dword [0x38dbf8], eax
call eax
mov edi, eax
mov eax, dword [0x38dd60]
test eax, eax
jne 0x3834e5
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0x9016bda2
mov ecx, eax
call fcn.00383e30
mov dword [0x38dd60], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x383565
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x38355a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x383520
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x383570
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x38359a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x38dbf8]
test eax, eax
jne 0x3835be
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0x704a030e
mov ecx, eax
call fcn.00383e30
mov dword [0x38dbf8], eax
call eax
mov edi, eax
mov eax, dword [0x38dd60]
test eax, eax
jne 0x3835e6
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0x9016bda2
mov ecx, eax
call fcn.00383e30
mov dword [0x38dd60], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x383652
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x38364a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x383620
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x383b50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0x18e
add dword [esp + 4], 0x8fd9
shl dword [esp + 4], 0xf
add dword [esp + 4], 0xa98
xor dword [esp + 4], 0x48b38a98
mov dword [esp], 0x9208
imul eax, dword [esp], 0x75
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
shr dword [esp + 4], 0xb
or dword [esp + 4], 0x128383aa
imul eax, dword [esp + 4], 0x35
mov dword [esp + 4], eax
add dword [esp + 4], 0xffff3c94
imul eax, dword [esp + 4], 0x6f
mov dword [esp + 4], eax
xor dword [esp + 4], 0x74ad7137
mov dword [esp + 4], 0xeadf
shl dword [esp + 4], 9
shl dword [esp + 4], 0xd
imul eax, dword [esp + 4], 0x5d
mov dword [esp + 4], eax
add dword [esp + 4], 0xd479
imul eax, dword [esp + 4], 0x13
mov dword [esp + 4], eax
xor dword [esp + 4], 0x4e4fc4eb
cmp byte [ebx], 0
je 0x383cb0
push esi
push edi
jmp 0x383c00
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0x9208
imul eax, dword [esp + 0xc], 0x75
mov dword [esp + 0xc], eax
shr dword [esp + 0xc], 0xb
or dword [esp + 0xc], 0x128383aa
imul eax, dword [esp + 0xc], 0x35
mov dword [esp + 0xc], eax
add dword [esp + 0xc], 0xffff3c94
imul eax, dword [esp + 0xc], 0x6f
mov dword [esp + 0xc], eax
xor dword [esp + 0xc], 0x74ad7137
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0xeadf
shl dword [esp + 0xc], 9
shl dword [esp + 0xc], 0xd
imul eax, dword [esp + 0xc], 0x5d
shl esi, cl
mov dword [esp + 0xc], eax
add dword [esp + 0xc], 0xd479
imul eax, dword [esp + 0xc], 0x13
mov dword [esp + 0xc], eax
xor dword [esp + 0xc], 0x4e4fc4eb
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x383c00
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret
Function at 0x383e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x383e8c
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00383b50
xor eax, 0x347fecab
cmp eax, dword [esp + 0x10]
je 0x383e96
inc esi
cmp esi, dword [edi + 0x18]
jb 0x383e70
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x383ec4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x383ec4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x384090
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x3840b6
cmp al, 0x2e
je 0x3840b3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x3840a3
jmp 0x3840b6
mov byte [edx], 0
mov eax, dword [0x38db14]
test eax, eax
jne 0x3840da
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0xc347539c
mov ecx, eax
call fcn.00383e30
mov dword [0x38db14], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x384121
mov eax, dword [0x38dcb4]
test eax, eax
jne 0x38410b
mov ecx, 0xa028f2a0
call fcn.00383ed0
mov edx, 0xeb545747
mov ecx, eax
call fcn.00383e30
mov dword [0x38dcb4], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x384121
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00383b50
xor eax, 0x347fecab
mov ecx, edi
mov edx, eax
call fcn.00383e30
pop edi
pop esi
add esp, 0x104
ret