Function at 0x7316ed00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
mov esi, ecx
mov ecx, dword [ebx + 0xcb8]
mov eax, dword [ebx + 0xcb0]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ecx
test cl, 3
je 0x7316ed39
nop word [eax + eax]
inc ecx
test cl, 3
jne 0x7316ed30
mov dword [esi + 0x24], ecx
mov eax, dword [esi + 0xc]
push ecx
call eax
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
jne 0x7316ed55
or dword [esi + 0x38], 2
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x1c]
push dword [esi + 0x18]
push eax
call fcn.73162411
xor edx, edx
add esp, 0xc
cmp dword [esi + 0x24], edx
jbe 0x7316ed81
nop dword [eax + eax]
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x28]
xor dword [ecx + edx], eax
add edx, 4
cmp edx, dword [esi + 0x24]
jb 0x7316ed70
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x7316ed90
xor edx, edx
jmp 0x7316eda0
cmp eax, 1
jne 0x7316ed99
mov edx, eax
jmp 0x7316eda0
cmp eax, 2
jne 0x7316edc4
mov edx, eax
lea eax, [esi + 0x30]
mov dword [edi], esi
push eax
mov ecx, ebx
call fcn.7316ec80
add esp, 4
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x7316edc4
or dword [esi + 0x38], 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x1c]
add ebx, dword [esi + 0x18]
mov dword [ebp - 4], eax
lea eax, [esi + 0x40]
push eax
mov eax, dword [esi]
push 0x40
push ecx
push ebx
mov dword [ebp + 0x10], ecx
call eax
test eax, eax
jne 0x7316edee
or dword [esi + 0x38], 1
xor bl, bl
jmp 0x7316ee08
push dword [ebp + 0x10]
mov dword [esi + 0x2c], ebx
push dword [ebp - 4]
push ebx
call fcn.73162411
mov eax, dword [esi + 0x2c]
push edi
call eax
add esp, 0x10
mov bl, al
test byte [esi + 0x34], 1
jne 0x7316ee22
xor ecx, ecx
cmp dword [esi + 0x30], ecx
jbe 0x7316ee22
mov eax, dword [esi + 0x2c]
mov byte [ecx + eax], 0
inc ecx
cmp ecx, dword [esi + 0x30]
jb 0x7316ee15
mov eax, dword [esi + 0x20]
test eax, eax
je 0x7316ee32
push eax
mov eax, dword [esi + 0x14]
call eax
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x73178fc0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x73178ffe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x73178ff6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x73179000
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x73178fe6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x731790d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x73179101
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x73179101
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x73179101
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret