joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f0e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x45d03c]
test eax, eax
je 0x41f173
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41f106
cmp dword [eax + 4], 0
je 0x41f106
add eax, 8
pop esi
ret
mov eax, dword [0x45d03c]
test eax, eax
je 0x41f182
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41f16f
mov esi, eax
test eax, eax
jne 0x41f158
movzx eax, byte [0x45daa8]
mov ecx, 0x10
call fcn.0040c6b0
test eax, eax
je 0x41f19a
mov dword [eax], 0x45d03c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45d03c]
test eax, eax
je 0x41f18e
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x45d03c
call fcn.00447650
jmp 0x41f0ef
mov ecx, 0x45d03c
call fcn.00447650
jmp 0x41f110
mov ecx, 0x45d03c
call fcn.00447650
jmp 0x41f150
mov ecx, 4
mov edx, 0x10
call fcn.00446940
ud2
Function at 0x420ff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4377d0
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x421080
jmp 0x42106e
jbe 0x42110c
cmp esi, 0x201
jae 0x421080
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x4210bb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x4210ac
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.004478e0
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4210db
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x421144
cmp esi, edi
jne 0x421060
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42117f
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x42106e
jmp 0x421080
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x42119f
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.00421840
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x421157
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42116b
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.0040c6e0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x4537b8
call fcn.00446be0
add esp, 4
jmp 0x4211ae
mov ecx, esi
push 0x4537a8
call fcn.00446b70
add esp, 4
ud2
Function at 0x4293e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45d06c]
test eax, eax
je 0x429493
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42940c
cmp dword [eax + 4], 0
mov edi, eax
je 0x42940c
add edi, 8
jmp 0x42948e
mov eax, dword [0x45d06c]
test eax, eax
je 0x4294a2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42948c
mov esi, eax
test eax, eax
jne 0x429462
movzx eax, byte [0x45daa8]
mov ecx, 0xc
call fcn.0040c6b0
test eax, eax
je 0x4294bd
mov dword [eax], 0x45d06c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45d06c]
test eax, eax
je 0x4294b1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x42948e
test ecx, ecx
je 0x42948e
lock dec dword [ecx]
jne 0x42948e
call fcn.004294d0
jmp 0x42948e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45d06c
call fcn.00447650
jmp 0x4293f0
mov ecx, 0x45d06c
call fcn.00447650
jmp 0x42941a
mov ecx, 0x45d06c
call fcn.00447650
jmp 0x42945a
mov ecx, 4
mov edx, 0xc
call fcn.00446940
ud2
Function at 0x42ffa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0041f950
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x430005
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.0042fee0
mov edi, dword [esp]
test edi, edi
je 0x430014
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430029
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x430021
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.0041fb00
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x430021
mov ecx, edi
mov edx, 2
call fcn.0040c6e0
jmp 0x430021
Function at 0x432230
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.00437dd0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x437a30
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.00439590
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x429dc0
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x432384
mov ebx, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x4322ba
cmp dword [ebp - 0x2c], 0
jne 0x432395
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x432395
cmp esi, 0x1000
ja 0x4323d1
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x4323b7
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x429dc0
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x43238c
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x432330
cmp dword [ebp - 0x2c], 0
jne 0x432392
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x4322f0
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x429dc0
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x4322ba
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x432395
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x453298
call fcn.00446d80
add esp, 4
jmp 0x4323ec
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x453298
call fcn.00446b70
add esp, 4
ud2
Function at 0x4324c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x437a50
lea eax, [esi + 0x40]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x432524
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edx, esi
lea ecx, [esi + 8]
mov dword [esi + 0x20], 0x4533a8
mov dword [esi + 0x24], 1
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 0x48], 0
mov dword [esi + 8], edx
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x20]
mov edx, 0x4533d4
mov dword [esi + 0xc], fcn.004256a0
mov dword [esi + 0x2c], 1
call fcn.00446a60
ud2
Function at 0x4366f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
mov ebx, edx
mov edx, dword [ebp + 4]
mov edi, dword [ebp + 8]
mov eax, edx
sub eax, edi
jb 0x4367a2
mov esi, ecx
mov ecx, dword [ebp]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
add ecx, edi
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x436750
push 0xffffffffffffffff
push ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, 0xc0000011
je 0x436768
cmp eax, 0x103
je 0x4367b3
test eax, eax
js 0x436783
mov ecx, dword [esp + 8]
add ecx, edi
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
cmp eax, ecx
cmova ecx, eax
mov dword [ebp + 0xc], ecx
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
mov edi, eax
call fcn.00420230
cmp al, 0xb
je 0x436778
mov dword [esi], 0
mov dword [esi + 4], edi
jmp 0x43677b
mov ecx, edi
push 0x451194
call fcn.00446a90
add esp, 4
ud2
mov eax, esp
mov dword [esp + 0x1c], 0x453060
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d590
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d6c0
mov ecx, 7
int 0x29
ud2

Function at 0x436820
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0041f950
add esp, 4
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x436884
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.00426900
add esp, 4
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x436880
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x43688b
mov byte [esi], 4
test ebx, ebx
jne 0x43689b
jmp 0x4368a7
mov eax, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], eax
jmp 0x4368a7
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x4368a7
mov ecx, edi
mov edx, 2
call fcn.0040c6e0
add esp, 0x18
pop esi
pop edi
pop ebx
ret

Function at 0x438439
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x438478
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438478
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438478
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x438478
cmp dword [ecx + 0x74], 0xe
jbe 0x438478
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43fdc3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43fe60
push ebx
push esi
call fcn.0043fd8c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043fd20
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43fe0d
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43fe5f
push edi
push eax
call fcn.004409e3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43fe2d
call fcn.0043e881
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43fe5e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043fd20
add esp, 0x20
test eax, eax
jne 0x43fe4c
push edi
call fcn.0043e881
jmp 0x43fe54
push ebx
call fcn.0043e881
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x441160
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x456038
push 0x456030
push str.FlsAlloc
push 0x1f
call fcn.0044101f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x441194
push dword [ebp + 8]
mov ecx, esi
call dword [0x4481e8]
call esi
jmp 0x44119a
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4411de
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x456048
push 0x456040
push str.FlsGetValue
push 0x21
call fcn.0044101f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x441215
push dword [ebp + 8]
mov ecx, esi
call dword [0x4481e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x44121d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x456050
push 0x456048
push str.FlsSetValue
push 0x22
call fcn.0044101f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x441257
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4481e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x4466b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4466dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4466dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x447650
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4476c1
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4476fc
cmp dword [esp + 4], 0
je 0x4476e3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x447711
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x45da5c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x45da5c], esi
jne 0x4476a0
mov byte [0x45da58], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x4476f3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x447754
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x4476e7
mov edi, dword [esp]
jmp 0x4476f3
mov edi, dword [esi]
jmp 0x4476f2
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00447790
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x4536c8
mov dword [esp + 8], 0x453690
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x453e80
mov dword [esp + 0x14], 0
call fcn.00446a60
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x453690
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x453e80
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004477d0
ud2
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x423de5
Capabilities:
Encode data using xor

Disassembly:
fucomi st(5)
out dx, al
pop edx
mov ebx, 0xcfaf93bd
sar dword [edi + 0x5ab79907], 0x9b
wait
cmp al, 0x40
sti
in al, 8
sub al, 0xd8
push edi
inc di
inc edi
xor ah, byte [eax - 0x453e0385]
leave
loope 0x423dff
push esp
and al, 0xa4
fcom dword [ecx + 0x15ba2a6]
push 0x46
cdq
loop 0x423df5
fstp xword [ecx]
out 2, al
invalid

Function at 0x43a982
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x43a9ae
pop edi
xor eax, 0xf96c807f
Function at 0x454c31
Capabilities:
Encode data using xor

Disassembly:
salc
or eax, 0xaf7de2ff
lds ebp, [esi]
cmp al, dl
dec eax
inc ecx
pmaxsw mm7, qword [ebp - 0x63]
xchg edi, eax
mov dword [0x55b4f39d], eax
sbb byte [esi], cl
push cs
shr byte [edx - 0x7f], 0x74
jo 0x454ca7
invalid
loope 0x454c49
pop esp
rcl byte [ecx + 0x598df79b], cl
daa
sbb ah, dl
sahf
xchg ecx, eax
cmp al, 2
ja 0x454ca8
and dword [ebp - 0x3013a98a], edi
invalid
push 0xffffffffffffffc4
push cs
cmpsd dword [esi], dword es:[edi]
pop esp
pop esi
mov dword [eax + 0x49], esp
rcl byte [ebx + 0x4d], cl
je 0x454c51
test eax, 0xed50d1b3
mov bl, 0xd1
push eax
in eax, dx
test eax, 0xc9a10101
fadd dword [0x333124dc]
pop edi
shl dword [ecx - 0x47da2e70], cl
xchg byte [edi + 0x59fdd875], bl
jne 0x454c9a
std
pop ecx
add byte [ecx + 0x5a809900], dl
test byte [ebx + edx*2 + 0x1c], bh
dec ebp
sbb byte [edi - 0x5aaeaa28], ah
cmp al, 0xd8
cdq
mov al, byte [0x468d5c4c]
inc eax
and cl, byte [0xa1002808]
cmp byte [ecx], bl
leave
lea esp, [ebp - 0x67]
jnp 0x454d44
test al, 0x54
mov al, byte [0x23c128cf]
pop ecx
dec ebx
sbb byte [eax + 0x4d], ah
std
leave
cmp al, 0x8c
test ecx, 0xe7cd79c4
in eax, dx
cmpsd dword [esi], dword es:[edi]
stc
neg byte [eax + 0x61bac218]
mov bh, 0x66
salc
mov ah, 0x17
xor ecx, dword [eax]
lcall 0x42f6, 0xfc3d60d2
popal
jne 0x454cc0
or ah, byte [edi + 0x323a971d]
add al, 0xa9
xor al, byte [ecx + ebp*4]
cmp dl, dh
les eax, [esi + 0x1adc4b4]
jp 0x454d21
xor eax, 0x4421e1e
inc edx
dec esp
sbb esp, dword [edi + 0x29fea320]
mov ecx, 0xea24cadf
stc
xchg dword [ebx + esi + 0xc], ebx
stc
or al, 0xf9
xor al, 0x28
sub esp, dword [ebx - 0x11a4eea1]
mov al, 0xd8
les ebp, [edx]
adc esi, dword fs:[esi + esi*2 + 0x6a]
or byte [edx], bl
sbb byte [edi + 0x43f3ee1b], cl
add esp, dword [ebx*8 - 0x10eb52fb]
fistp word [ecx]
inc esi
dec edi
test dword [ebp + 0x5954fe5b], edx
add edi, dword [0xf440578d]
sub dword [eax], 0x2b85bb08
wait
insd dword es:[edi], dx
cli
lodsd eax, dword [esi]
and al, 0xcd
sub byte [esi], 0x2a
imul byte [ecx - 0x44]
shr dword [eax - 0x38], 1
mov esp, 0xde83f95a
pushfd
fist dword [ebx + 0x42]
cmp byte [eax], cl
in al, dx
pushal
xchg ebx, eax
aad 0xd3
loope 0x454d3b
sbb dword [edi + 0x6a], ebx
mov ebp, 0x867b7dc5
retf 0x592c

Function at 0x4686c2
Capabilities:
Encode data using xor

Disassembly:
out dx, al
inc esi
inc ecx
out 2, eax
insb byte es:[edi], dx
cmp al, 0xdb
enter 0x30fa, 0x65
invalid

Function at 0x4762c4
Capabilities:
Authenticate hmac

Disassembly:
push esi
cmpsd dword [esi], dword es:[edi]
add dword [ebp + 0x6c70846], ecx
or cl, bh
add byte [eax], al
push eax
call dword [0x19c968c]
mov ecx, esi
pop esi
jmp 0x592a35
aad 0x81
cmc
cmp al, 0x36
dec dword [ebp - 0x7f]
cmc
out 0xd4, eax
outsd dx, dword [esi]
jnp 0x592a3a
aad 0x81
cmc
jnp 0x592a52
jmp 0x592a8c
and al, 0x8b
and al, 0x24
and al, 0x5c
Function at 0x496775
Capabilities:
Encode data using xor

Disassembly:
fild word [ebx + 0xe880e44]
mov dh, 0xe
cwde
add ebp, ebx
fmul st(6), st(0)
add dh, ch
and al, al
shl byte [eax], 0x8c
lcall 0xba3e, 0x33aecd8f
push 0xffffffffffffffb4
outsb dx, byte [esi]
in eax, dx
scasb al, byte es:[edi]
xor edi, dword [esi]
mov edx, 0xed6eb46a
invalid
sal bh, 1
pop ss
adc dh, cl
sub eax, 0x31d17721
mov ah, 0xb2
jo 0x496714
jno 0x4967b9
fdiv qword [ebx - 0x13]
jae 0x49675c
pop edi
sbb eax, 0x901e631
cli
out 0xf3, eax
lodsd eax, dword [esi]
test eax, 0x5efb3d19
mov dword [0x4e6a5b1], eax
fmul qword [esi]
sub al, 0xa1
aas
jne 0x49672b
mov byte [edi + 0x5c], ah
in eax, dx
test al, 0xf0
and eax, 0x32940e75
add dword [edx + 0x7d], esp
sub al, 0xa8
sar byte ds:[ecx], 1
movsb byte es:[edi], byte [esi]
jecxz 0x49676d
sbb eax, 0xf99271bc
xor eax, ebx
push esp
pop ss
in eax, dx
cmpsb byte [esi], byte es:[edi]
mov edx, dword [edi - 0x75]
cmpsb byte [esi], byte es:[edi]
lcall 0x5819, 0x3fa56955
mov dword [eax], ebx
leave
adc al, byte [eax - 0x63]
iretd

Function at 0x4a02d3
Capabilities:
Encode data using xor

Disassembly:
test dword [esi + eax], 0x71498831
stc
push esp
mov edx, 0xcd27d8b4
loope 0x4a035d
pop eax
movsb byte es:[edi], byte [esi]
fdivrp st(0)
inc ecx
invalid
mov ecx, 0x7203e088
lcall 0x336e, 0x84ac92da
jno 0x4a038a
outsb dx, byte [esi]
xor esi, dword [ecx + 0x29]
and al, 0x50
mov ch, 0x5a
inc edx
or ebp, edx
mov edi, 0xd42dc689
outsb dx, byte [esi]
lahf
clc
bound ebx, qword [edi + 1]
sti
enter 0xffffffffffff905e, 0x35
pop ebp
insb byte es:[edi], dx
inc esp
pushfd
shufps xmm7, xmm5, 0xfc
sbb byte [ecx - 0x4337758], dh
push 0x1797ec69
xchg edi, eax
pop ss
mov ah, 0x8e
cmp dword [ecx - 0x2e675966], edx
popfd
in eax, dx
xor al, 0xed
mov al, 0xc7
mov al, 0xc7
push ebx
or ch, byte [edi - 0x71]
mov al, byte [0x8cb9a466]
in eax, dx
pushfd
std
push edi
mov word [ebx], cs
cmp dword [eax + 0x7e45dbc1], ebp
mov byte [edi - 0x5f1e66fa], 0x55
leave
ja 0x4a0353
shl dword [ecx], 1
in al, dx
fdivr dword fs:[edi + 0x6e]
mov ebx, 0x6168cdb
outsd dx, dword [esi]
mov byte [edi], dh
sbb cl, bh
cmp ecx, esp
jae 0x4a0399
pop ebp
cld
ret 0xcbcd