joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b49d8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
lea eax, [ebp - 0x69]
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
lea ecx, [ebp - 0x88]
push eax
push dword [edi + 4]
mov dword [ebp - 4], ebx
call fcn.00452b40
mov byte [ebp - 4], 1
xor esi, esi
cmp esi, dword [edi + 4]
jae 0x459901
push 8
call fcn.0048aa51
add esp, 4
test eax, eax
je 0x459892
mov dword [eax], edi
mov dword [eax + 4], 0x45be20
jmp 0x459894
xor eax, eax
mov dword [ebp - 0x70], eax
or ebx, 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x4514d0
push 0
push 0
call fcn.00494008
mov edx, eax
add esp, 0x18
mov dword [ebp - 0x78], edx
test edx, edx
je 0x459b23
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x70], 0
mov byte [ebp - 4], 1
cmp dword [ecx + esi*8 + 4], 0
jne 0x459b1e
mov eax, dword [ebp - 0x74]
xorps xmm0, xmm0
movlpd qword [ebp - 0x78], xmm0
mov dword [ecx + esi*8], edx
mov dword [ecx + esi*8 + 4], eax
cmp dword [ebp - 0x74], 0
jne 0x459b1e
inc esi
jmp 0x459870
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp - 0x84]
nop dword [eax]
cmp esi, edi
je 0x45994d
cmp dword [esi + 4], 0
je 0x459b31
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 4], eax
je 0x459b38
push 0
push dword [esi + 4]
push dword [esi]
call fcn.00473e6e
add esp, 0xc
test eax, eax
jne 0x459b3f
mov dword [esi], eax
mov dword [esi + 4], eax
add esi, 8
jmp 0x459910
lea ecx, [ebp - 0x88]
call fcn.0045a790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048af00
mov esp, ebp
pop ebp
ret
call fcn.00492fea
push 6
mov dword [ebp - 0x74], 0
call fcn.0047460a
push 1
call fcn.0047460a
push 5
call fcn.0047460a
push 2
call fcn.0047460a
int3

Function at 0x45ab30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x19
jb 0x45ab34
pop esi
mov byte [ecx + 0x1d], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45ab60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x37
jb 0x45ab64
pop esi
mov byte [ecx + 0x3b], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45ab90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x28
jb 0x45ab94
pop esi
mov byte [ecx + 0x2c], 0
lea eax, [ecx + 4]
pop ebx
ret
Function at 0x45abc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x3d
jb 0x45abc4
pop esi
mov byte [ecx + 0x41], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45abf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x2d
jb 0x45abf4
pop esi
mov byte [ecx + 0x31], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45ac20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x24
jb 0x45ac24
pop esi
mov byte [ecx + 0x28], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45acd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov esi, 0x1b
nop dword [eax + eax]
mov bl, byte [edx]
lea edx, [edx + 1]
mov eax, dword [ecx]
xor al, bl
mov byte [edx - 1], al
sub esi, 1
jne 0x45ace0
pop edi
pop esi
mov byte [ecx + 0x1f], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45ad60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov esi, 8
nop dword [eax + eax]
mov bl, byte [edx]
lea edx, [edx + 1]
mov eax, dword [ecx]
xor al, bl
mov byte [edx - 1], al
sub esi, 1
jne 0x45ad70
pop edi
pop esi
mov byte [ecx + 0xc], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x45adf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov eax, 0x1e
nop dword [eax + eax]
movzx esi, word [edx]
lea edx, [edx + 2]
mov edi, dword [ecx]
xor edi, esi
mov word [edx - 2], di
sub eax, 1
jne 0x45ae00
pop edi
pop esi
mov word [ecx + 0x40], ax
lea eax, [ecx + 4]
pop ebx
ret
Function at 0x4637c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b56bc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e1654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x463874
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [edi + 0x60], al
push 9
mov byte [ebp - 4], 5
mov byte [edi + 0x68], 9
call fcn.00463fd0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0046a500
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4638b8
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30

Function at 0x465a70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x22
jb 0x465a74
pop esi
mov byte [ecx + 0x26], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x465aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x2a
jb 0x465aa4
pop esi
mov byte [ecx + 0x2e], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x465ad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov esi, 0x25
nop dword [eax + eax]
mov bl, byte [edx]
lea edx, [edx + 1]
mov eax, dword [ecx]
xor al, bl
mov byte [edx - 1], al
sub esi, 1
jne 0x465ae0
pop edi
pop esi
mov byte [ecx + 0x29], 0
lea eax, [ecx + 4]
pop ebx
ret
Function at 0x470490
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4704fb
mov edx, dword [ebp + 0x10]
mov edi, edx
mov esi, dword [ebp + 0x14]
mov ecx, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
shrd edi, esi, 0x1e
shr esi, 0x1e
mov eax, edi
or eax, esi
mov eax, dword [ebp + 0xc]
je 0x4704e5
nop dword [eax + eax]
push eax
push 0x40000000
add edi, 0xffffffff
push ebx
adc esi, 0xffffffff
call ecx
test eax, eax
je 0x4704fb
mov ecx, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, edi
or eax, esi
mov eax, dword [ebp + 0xc]
jne 0x4704c0
mov edx, dword [ebp + 0x10]
push eax
and edx, 0x3fffffff
push edx
push ebx
call ecx
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x470cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push esi
lea eax, [ecx + 0x44]
xor ebx, ebx
lea esi, [edx + 0x44]
push edi
mov edi, dword [ebp + 0xc]
cmp edx, eax
ja 0x470ccf
cmp esi, ecx
jae 0x470d1c
lea eax, [edi + 0x44]
cmp edx, eax
ja 0x470cda
cmp esi, edi
jae 0x470d1c
movups xmm0, xmmword [ecx]
mov ebx, 0x10
movups xmm1, xmmword [edi]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [edx], xmm1
movups xmm1, xmmword [edi + 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [edx + 0x10], xmm1
movups xmm1, xmmword [edi + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [edx + 0x20], xmm1
movups xmm1, xmmword [edi + 0x30]
pxor xmm1, xmm0
movups xmmword [edx + 0x30], xmm1
mov esi, 0x12
lea eax, [ecx + ebx*4]
sub edi, ecx
sub edx, ecx
sub esi, ebx
nop word [eax + eax]
mov ecx, dword [edi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edx + eax - 4], ecx
sub esi, 1
jne 0x470d30
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x471220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
movups xmm0, xmmword [edx]
push edi
mov edi, dword [ebp + 0x10]
movups xmmword [ebp - 0x4c], xmm0
movups xmm0, xmmword [edx + 0x10]
test byte [edi], 1
movups xmmword [ebp - 0x3c], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [ebp - 0x2c], xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [ebp - 0x1c], xmm0
movq xmm0, qword [edx + 0x40]
movq qword [ebp - 0xc], xmm0
je 0x471286
mov ecx, esi
sub edx, esi
mov edi, 0x12
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edi, 1
jne 0x471273
mov edi, dword [ebp + 0x10]
jmp 0x47129d
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmmword [esi + 0x30], xmm0
movq qword [esi + 0x40], xmm0
mov ebx, 1
mov edx, 0x11
nop word [eax + eax]
mov eax, dword [ebp + edx*4 - 0x4c]
mov ecx, dword [ebp + edx*4 - 0x50]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [ebp + edx*4 - 0x4c], ecx
dec edx
test edx, edx
jg 0x4712b0
shl dword [ebp - 0x4c], 1
test dword [ebp - 8], 0x8000000
je 0x471334
movups xmm0, xmmword [ebp - 0x4c]
xor eax, eax
movups xmm1, xmmword [0x4bbf30]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [ebp - 0x4c], xmm1
movups xmm1, xmmword [0x4bbf40]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x3c], xmm1
movups xmm1, xmmword [0x4bbf50]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x1c]
movups xmmword [ebp - 0x2c], xmm1
movups xmm1, xmmword [0x4bbf60]
pxor xmm1, xmm0
movups xmmword [ebp - 0x1c], xmm1
mov ecx, dword [eax + 0x4bbf70]
xor dword [ebp + eax - 0xc], ecx
add eax, 4
cmp eax, 8
jl 0x471322
mov eax, ebx
mov ecx, ebx
shr eax, 5
and ecx, 0x1f
mov eax, dword [edi + eax*4]
shr eax, cl
test al, 1
je 0x4713d1
lea eax, [esi + 0x44]
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x4c]
cmp ecx, eax
ja 0x471363
lea eax, [ebp - 8]
cmp eax, esi
jae 0x4713a8
movups xmm1, xmmword [esi]
mov eax, 0x10
movups xmm0, xmmword [ebp - 0x4c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [esi], xmm1
movups xmm1, xmmword [esi + 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [esi + 0x10], xmm1
movups xmm1, xmmword [esi + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x1c]
movups xmmword [esi + 0x20], xmm1
movups xmm1, xmmword [esi + 0x30]
pxor xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
jmp 0x4713ab
mov eax, dword [ebp - 0x50]
lea edi, [ebp - 0x4c]
mov edx, 0x12
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, eax
nop word [eax + eax]
mov eax, dword [edi + ecx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edx, 1
jne 0x4713c0
mov edi, dword [ebp + 0x10]
inc ebx
cmp ebx, 0x23b
jl 0x4712a2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048af00
mov esp, ebp
pop ebp
ret
Function at 0x472f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b659e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov esi, dword [ecx]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
mov byte [ebp - 0x25], 0
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
jne 0x4730f7
mov eax, 0x1043
lea ecx, [eax - 0x36]
lea edx, [eax - 0x27]
nop word [eax + eax]
mov dword [ebp - 0x24], 0x106e
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov eax, 0x1017
mov word [ebp - 0x1c], cx
mov word [ebp - 0x1a], dx
mov word [ebp - 0x18], ax
mov eax, 0x101e
mov word [ebp - 0x16], ax
mov eax, 0x101a
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
xor edx, edx
mov ax, word [ebp - 0x20]
nop
movzx eax, word [ebp + edx*2 - 0x20]
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov word [ebp + edx*2 - 0x20], cx
inc edx
cmp edx, 7
jb 0x473030
xor eax, eax
lea ecx, [ebp - 0x20]
mov word [ebp - 0x12], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473051
mov eax, dword [esi + 0x20]
sub ecx, edx
sar ecx, 1
lea edx, [esi + 0x10]
cmp dword [esi + 0x24], 8
jb 0x47306f
mov edx, dword [esi + 0x10]
cmp eax, ecx
jne 0x4730a6
push eax
lea eax, [ebp - 0x20]
push eax
push edx
call fcn.0041ef30
add esp, 0xc
test eax, eax
jne 0x4730a6
mov eax, dword [edi + 4]
lea ecx, [esi + 0x28]
push ecx
cmp eax, dword [edi + 8]
je 0x47309e
mov ecx, eax
call fcn.00416c70
add dword [edi + 4], 0x18
jmp 0x4730a6
push eax
mov ecx, edi
call fcn.00402020
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4730cc
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4730c8
cmp esi, dword [eax + 8]
jne 0x4730c8
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4730b8
mov esi, eax
jmp 0x4730e2
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4730e2
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4730d6
cmp byte [esi + 0xd], 0
mov eax, 0x1043
lea ecx, [eax - 0x36]
lea edx, [eax - 0x27]
je 0x472ff0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048af00
mov esp, ebp
pop ebp
ret 4
Function at 0x473120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b65dd
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4e3744]
test eax, eax
je 0x47316a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048af00
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x40], 0x35
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x3c], 0x76
mov byte [ebp - 0x3b], 0x5a
mov byte [ebp - 0x3a], 0x58
mov byte [ebp - 0x39], 0x58
mov byte [ebp - 0x38], 0x54
mov byte [ebp - 0x37], 0x5b
mov byte [ebp - 0x36], 0x51
mov byte [ebp - 0x35], 0x15
mov byte [ebp - 0x34], 0x59
mov byte [ebp - 0x33], 0x5c
mov byte [ebp - 0x32], 0x5b
mov byte [ebp - 0x31], 0x50
mov byte [ebp - 0x30], 0x15
mov byte [ebp - 0x2f], 0x5c
mov byte [ebp - 0x2e], 0x5b
mov byte [ebp - 0x2d], 0x46
mov byte [ebp - 0x2c], 0x41
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x5b
mov byte [ebp - 0x29], 0x56
mov byte [ebp - 0x28], 0x50
mov byte [ebp - 0x27], 0x15
mov byte [ebp - 0x26], 0x5c
mov byte [ebp - 0x25], 0x46
mov byte [ebp - 0x24], 0x15
mov byte [ebp - 0x23], 0x5b
mov byte [ebp - 0x22], 0x5a
mov byte [ebp - 0x21], 0x41
mov byte [ebp - 0x20], 0x15
mov byte [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1e], 0x5b
mov byte [ebp - 0x1d], 0x5c
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x19], 0x59
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x50
mov byte [ebp - 0x15], 0x51
mov al, byte [ebp - 0x3c]
mov byte [ebp - 0x14], 0
call fcn.00473740
push eax
lea ecx, [ebp - 0x58]
call fcn.00416c30
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x64]
call fcn.0043f0e0
push 0x4dde44
lea eax, [ebp - 0x64]
push eax
call fcn.0048c287
int3
Function at 0x473250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b661d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], 0x1058
mov eax, dword [ebp - 0x30]
xor eax, 0x70
mov esi, dword [ebp + 8]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x4c], esi
xor eax, 0x61
mov word [ebp - 0x2a], ax
mov eax, dword [ebp - 0x30]
add eax, 2
xor eax, 0x74
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x30]
add eax, 3
xor eax, 0x68
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x30]
add eax, 4
xor eax, 0x54
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x30]
add eax, 5
xor eax, 0x6f
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x30]
add eax, 6
xor eax, 0x42
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x30]
add eax, 7
xor eax, 0x69
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x30]
add eax, 8
xor eax, 0x6e
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x30]
add eax, 9
xor eax, 0x61
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x30]
add eax, 0xa
xor eax, 0x72
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x30]
add eax, 0xb
xor eax, 0x79
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
xor edx, edx
mov ax, word [ebp - 0x2c]
nop dword [eax]
mov ax, word [ebp + edx*2 - 0x2c]
mov ecx, dword [ebp - 0x30]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [ebp + edx*2 - 0x2c], cx
inc edx
cmp edx, 0xc
jb 0x473330
xor eax, eax
mov dword [ebp - 0x34], 7
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov word [ebp - 0x14], ax
lea edx, [ecx + 2]
mov dword [ebp - 0x38], eax
mov word [ebp - 0x48], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473367
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.0041ea60
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.00473770
mov ecx, esi
mov eax, dword [eax]
add eax, 0x28
push eax
call fcn.00416c70
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x4733dc
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4733d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4733fb
push edx
push ecx
call fcn.0048aa81
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048af00
mov esp, ebp
pop ebp
ret 4
call fcn.0048f71f
int3
Function at 0x473520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x4b52
mov eax, 0x4b7f
mov word [ebp - 0xc], ax
mov eax, 0x4b24
mov word [ebp - 0xa], ax
xor eax, eax
push ebx
mov word [ebp - 8], ax
mov ax, word [ebp - 0xc]
push esi
push edi
mov esi, ecx
xor eax, eax
nop word [eax + eax]
movzx ecx, word [ebp + eax*2 - 0xc]
mov edx, dword [ebp - 0x10]
xor edx, ecx
mov word [ebp + eax*2 - 0xc], dx
inc eax
cmp eax, 2
jb 0x473560
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0xc]
mov word [ebp - 8], ax
mov dword [ebp - 0x28], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x18], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473590
sub ecx, edx
lea eax, [ebp - 0xc]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ea60
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00473770
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov edi, dword [eax]
cmp edi, esi
setne bl
cmp edx, 8
jb 0x4735fa
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4735f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x473617
push edx
push ecx
call fcn.0048aa81
add esp, 8
cmp edi, esi
jne 0x473604
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048af00
mov esp, ebp
pop ebp
ret
call fcn.0048f71f
int3

Function at 0x473620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x4131
mov eax, dword [ebp - 0x10]
xor eax, 0x2d
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x10]
inc eax
xor eax, 0x6c
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
mov ax, word [ebp - 0xc]
push ebx
push esi
mov esi, ecx
xor eax, eax
nop dword [eax]
mov cx, word [ebp + eax*2 - 0xc]
mov edx, dword [ebp - 0x10]
add edx, eax
movzx ecx, cx
xor edx, ecx
mov word [ebp + eax*2 - 0xc], dx
inc eax
cmp eax, 2
jb 0x473660
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0xc]
mov word [ebp - 8], ax
mov dword [ebp - 0x28], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x18], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473693
sub ecx, edx
lea eax, [ebp - 0xc]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ea60
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00473770
mov edx, dword [ebp - 0x14]
mov eax, dword [eax]
cmp eax, dword [esi]
setne bl
cmp edx, 8
jb 0x4736fb
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4736f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47370d
push edx
push ecx
call fcn.0048aa81
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0048af00
mov esp, ebp
pop ebp
ret
call fcn.0048f71f
int3