joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440c2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 0x1c], edi
lea ebx, [edx - 1]
mov dword [ebp - 0x18], ebx
sar ebx, 1
cmp edi, ebx
jge 0x440d0e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
lea esi, [eax + eax]
add ecx, 0x138
mov eax, dword [ebp - 0xc]
imul edx, esi, 0x90
movsd xmm2, qword [eax + 8]
movsd xmm1, qword [eax]
add ecx, edx
call fcn.0042d983
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movd xmm3, dword [edx + ecx + 0x190]
add ecx, 0xa8
movsd xmm2, qword [eax + 8]
add ecx, edx
movsd xmm1, qword [eax]
cvtdq2pd xmm3, xmm3
mulsd xmm0, xmm3
movsd qword [ebp - 0x14], xmm0
call fcn.0042d983
mov ecx, dword [ebp - 8]
xor eax, eax
movd xmm1, dword [edx + ecx + 0x100]
cvtdq2pd xmm1, xmm1
mulsd xmm0, xmm1
movsd xmm1, qword [ebp - 0x14]
comisd xmm1, xmm0
seta al
imul edi, edi, 0x90
xor eax, 1
inc eax
add eax, esi
imul esi, eax, 0x90
add edi, ecx
mov dword [ebp - 0x10], eax
add esi, ecx
mov ecx, edi
push esi
call fcn.00403a94
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00441c7e
mov eax, dword [ebp - 0x10]
mov edi, eax
mov ecx, dword [ebp - 8]
cmp eax, ebx
jl 0x440c58
mov edx, dword [ebp + 8]
cmp eax, ebx
jne 0x440d44
test dl, 1
jne 0x440d44
imul esi, edx, 0x90
imul edi, edi, 0x90
add esi, 0xffffff70
add esi, ecx
add edi, ecx
push esi
mov ecx, edi
call fcn.00403a94
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00441c7e
mov edi, dword [ebp - 0x18]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov edx, edi
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call fcn.004428f8
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x441fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 8], edi
lea ebx, [edx - 1]
mov dword [ebp - 0xc], ebx
sar ebx, 1
cmp edi, ebx
jge 0x442020
lea esi, [eax + eax]
lea eax, [esi + 2]
shl eax, 4
add ecx, eax
lea eax, [ecx - 0x10]
push eax
push ecx
call fcn.00438ceb
mov ecx, dword [ebp - 4]
inc esi
movzx eax, al
xor eax, 1
shl edi, 4
add eax, esi
add edi, ecx
mov esi, eax
shl esi, 4
add esi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, eax
cmp eax, ebx
jl 0x441fe6
mov edx, dword [ebp + 8]
cmp eax, ebx
jne 0x44203d
test dl, 1
jne 0x44203d
shl edi, 4
lea esi, [ecx - 0x10]
shl edx, 4
add esi, edx
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], edi
jge 0x44206e
push dword [ebp + 0xc]
lea ebx, [edi - 1]
sar ebx, 1
mov esi, ebx
shl esi, 4
add esi, ecx
push esi
call fcn.00438ceb
mov ecx, dword [ebp - 4]
test al, al
je 0x44206e
shl edi, 4
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ebx
cmp dword [ebp - 8], ebx
jl 0x442042
mov esi, dword [ebp + 0xc]
shl edi, 4
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44228d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 4], edi
lea ecx, [edx - 1]
sar ecx, 1
mov dword [ebp - 8], ecx
cmp edi, ecx
jge 0x4422e6
lea esi, [eax + eax]
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.00442268
movzx eax, al
xor eax, 1
imul edi, edi, 0x18
inc eax
add eax, esi
imul esi, eax, 0x18
push 6
add edi, ebx
pop ecx
add esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
mov edi, eax
cmp eax, ecx
jl 0x4422ad
mov edx, dword [ebp + 8]
cmp eax, ecx
jne 0x442304
test dl, 1
jne 0x442304
imul eax, edx, 0x18
lea esi, [ebx - 0x18]
imul edi, edi, 0x18
push 6
pop ecx
add esi, eax
add edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [edx - 1]
cmp dword [ebp - 4], edi
jge 0x442337
push dword [ebp + 0xc]
lea eax, [edi - 1]
sar eax, 1
imul esi, eax, 0x18
mov dword [ebp + 8], eax
add esi, ebx
push esi
call fcn.00442268
test al, al
je 0x442337
mov eax, dword [ebp + 8]
imul edi, edi, 0x18
push 6
pop ecx
add edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
cmp dword [ebp - 4], eax
jl 0x442309
mov esi, dword [ebp + 0xc]
imul edi, edi, 0x18
push 6
pop ecx
add edi, ebx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x442558
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
lea eax, [ecx - 1]
mov esi, edi
mov dword [ebp - 0xc], eax
sar eax, 1
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x4425c5
lea esi, [edx + edx]
lea ecx, [esi + 2]
shl ecx, 4
add ecx, ebx
lea eax, [ecx - 0x10]
push eax
push ecx
call fcn.004424f3
movzx edx, al
add edi, edi
xor edx, 1
inc edx
add edx, esi
mov ecx, edx
add ecx, ecx
mov eax, dword [ebx + ecx*8]
mov dword [ebx + edi*8], eax
mov eax, dword [ebx + ecx*8 + 4]
mov dword [ebx + edi*8 + 4], eax
mov eax, dword [ebx + ecx*8 + 8]
mov dword [ebx + edi*8 + 8], eax
mov edi, edx
mov eax, dword [ebp - 8]
cmp edx, eax
jl 0x44257c
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 4]
cmp edx, eax
jne 0x4425ec
test cl, 1
jne 0x4425ec
add ecx, ecx
add edi, edi
mov eax, dword [ebx + ecx*8 - 0x10]
mov dword [ebx + edi*8], eax
mov eax, dword [ebx + ecx*8 - 0xc]
mov dword [ebx + edi*8 + 4], eax
mov eax, dword [ebx + ecx*8 - 8]
mov dword [ebx + edi*8 + 8], eax
mov edi, dword [ebp - 0xc]
cmp esi, edi
jge 0x44262b
push dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
mov eax, esi
shl eax, 4
add eax, ebx
push eax
mov dword [ebp + 8], eax
call fcn.004424f3
test al, al
je 0x44262b
mov ecx, dword [ebp + 8]
add edi, edi
mov eax, dword [ecx]
mov dword [ebx + edi*8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + edi*8 + 4], eax
mov eax, dword [ecx + 8]
mov dword [ebx + edi*8 + 8], eax
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x4425f0
mov ecx, dword [ebp + 0xc]
add edi, edi
mov eax, dword [ecx]
mov dword [ebx + edi*8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + edi*8 + 4], eax
mov eax, dword [ecx + 8]
mov dword [ebx + edi*8 + 8], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4426f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 8], edi
lea ebx, [edx - 1]
mov dword [ebp - 0xc], ebx
sar ebx, 1
cmp edi, ebx
jge 0x442751
lea esi, [eax + eax]
lea eax, [esi + 2]
shl eax, 4
add ecx, eax
lea eax, [ecx - 0x10]
push eax
push ecx
call fcn.004426d2
mov ecx, dword [ebp - 4]
inc esi
movzx eax, al
xor eax, 1
shl edi, 4
add eax, esi
add edi, ecx
mov esi, eax
shl esi, 4
add esi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, eax
cmp eax, ebx
jl 0x442717
mov edx, dword [ebp + 8]
cmp eax, ebx
jne 0x44276e
test dl, 1
jne 0x44276e
shl edi, 4
lea esi, [ecx - 0x10]
shl edx, 4
add esi, edx
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], edi
jge 0x44279f
push dword [ebp + 0xc]
lea ebx, [edi - 1]
sar ebx, 1
mov esi, ebx
shl esi, 4
add esi, ecx
push esi
call fcn.004426d2
mov ecx, dword [ebp - 4]
test al, al
je 0x44279f
shl edi, 4
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ebx
cmp dword [ebp - 8], ebx
jl 0x442773
mov esi, dword [ebp + 0xc]
shl edi, 4
add edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446a76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov ebx, dword [edi + 0x2c]
mov ecx, dword [edi + 0x74]
mov dword [ebp - 0x10], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, ecx
mov dword [ebp - 0xc], esi
cmp dword [edi + 0x6c], eax
jb 0x446b1e
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004c2cb0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
sub dword [ebp - 4], 1
mov word [edi], cx
jne 0x446acd
mov edi, dword [ebp - 8]
mov ecx, ebx
mov dword [ebp - 4], ecx
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x446afa
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x446bd8
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, esi
mov dword [ebp - 0xc], edx
cmovbe esi, eax
test esi, esi
je 0x446b91
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x446b5f
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push esi
call fcn.0044899b
jmp 0x446b77
cmp eax, 2
jne 0x446b7b
mov edx, dword [ebx]
test edx, edx
jne 0x446b6e
xor eax, eax
jmp 0x446b78
mov ecx, dword [ebx + 0x30]
push esi
call fcn.00448be0
pop ecx
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push dword [ebp - 0xc]
call fcn.004c2cb0
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov dword [edi + 0x74], ecx
cmp ecx, 3
jb 0x446bc0
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [ebp - 0xc]
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp ecx, 0x106
jae 0x446bd8
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x446bd8
mov ebx, dword [ebp - 0x10]
jmp 0x446a8d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451d54
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x58fb49
call fcn.0058e54c
sub esp, 0x30
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 0xf
pop ebx
push 0xd
mov edi, ecx
mov dword [ebp - 0x10], ebx
push str.relative_path
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x24], 0
mov esi, edx
call fcn.00403fdc
and dword [ebp - 4], 0
lea edx, [ebp - 0x24]
push esi
mov ecx, edi
call fcn.0045398d
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00403f6b
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x24]
push 0x10
push str.relative_path_64
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x24], 0
call fcn.00403fdc
lea eax, [esi + 0x18]
mov dword [ebp - 4], 1
push eax
lea edx, [ebp - 0x24]
mov ecx, edi
call fcn.0045398d
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00403f6b
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
push 0x10
push str.launch_arguments
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x3c], 0
call fcn.00403fdc
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 2
push ecx
lea edx, [ebp - 0x3c]
mov ecx, edi
call fcn.004541c6
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.00403f6b
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4567ea
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
mov eax, 0x592a24
call fcn.0058e54c
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.004563aa
push dword [ebp + 8]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
lea edi, [esi + 0x10]
mov word [esi + 0xc], bx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.004040d9
mov eax, dword [ebp + 8]
add edi, 0x18
mov byte [ebp - 4], 1
add eax, 0x18
mov dword [ebp - 0x1c], edi
mov ecx, edi
push eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.004040d9
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x18]
add eax, 0x30
mov byte [ebp - 4], 2
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004040d9
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x30]
add eax, 0x48
mov byte [ebp - 4], 3
push eax
call fcn.00456895
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x460434
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5909da
call fcn.0058e54c
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 0x10]
mov dword [edi], vtable.Agent::InstallProgressInfo.0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0043a9b1
mov dword [esi], eax
xorps xmm0, xmm0
mov dword [edi + 0x28], ebx
mov eax, edi
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], 0xf
mov byte [edi + 0x40], bl
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov word [edi + 0x64], bx
mov byte [edi + 0x66], bl
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x46143a
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x5936a9
call fcn.0058e54c
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
xorps xmm0, xmm0
mov eax, dword [esi + 0xa4]
mov dword [esi + 0xe0], ebx
mov dword [esi + 0x20], 5
mov dword [eax + 8], 0x3e8
mov eax, dword [esi + 0xa4]
mov dword [eax + 0x30], ebx
mov eax, dword [esi + 0xa4]
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
mov eax, dword [esi + 0xa4]
movsd qword [eax + 0x18], xmm0
mov eax, dword [esi + 0xa4]
movsd qword [eax + 0x20], xmm0
mov eax, dword [esi + 0xa4]
mov dword [eax + 0x28], ebx
mov eax, dword [esi + 0xa4]
mov dword [eax + 0x2c], ebx
mov eax, dword [esi + 0xa4]
mov byte [eax + 0x65], bl
mov eax, dword [esi + 0xa4]
mov byte [eax + 0x66], bl
lea eax, [ebp - 0x20]
mov ecx, dword [esi + 0x98]
push eax
call fcn.0045e870
mov dword [ebp - 4], ebx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
lea ecx, [ebp - 0x20]
cmp byte [eax], bl
sete al
or dword [ebp - 4], 0xffffffff
mov byte [esi + 0xe4], al
call fcn.00410ea1
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0xd8], bl
call dword [eax + 0x5c]
mov ecx, dword [esi + 0x68]
push eax
lea eax, [esi + 0x70]
push eax
call fcn.00463a65
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x461f1c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59391f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebx + 0x18]
mov al, byte [esi]
mov byte [ebx], al
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov al, byte [esi + 2]
mov byte [ebx + 2], al
mov al, byte [esi + 3]
mov byte [ebx + 3], al
mov al, byte [esi + 4]
mov byte [ebx + 4], al
mov al, byte [esi + 5]
mov byte [ebx + 5], al
mov al, byte [esi + 6]
mov byte [ebx + 6], al
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
lea eax, [esi + 0x18]
movsd xmm0, qword [esi + 0x10]
push eax
movsd qword [ebx + 0x10], xmm0
call fcn.00403a94
mov eax, dword [esi + 0x30]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x30], eax
lea eax, [esi + 0x34]
push eax
call fcn.00403a94
lea eax, [esi + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
call fcn.00403a94
mov al, byte [esi + 0x64]
lea ecx, [ebx + 0x68]
mov byte [ebx + 0x64], al
lea eax, [esi + 0x68]
push eax
call fcn.00403a94
lea eax, [esi + 0x80]
push eax
lea ecx, [ebx + 0x80]
call fcn.00455251
lea eax, [esi + 0x8c]
push eax
lea ecx, [ebx + 0x8c]
call fcn.00455251
lea edi, [ebx + 0x98]
and dword [ebp - 4], 0
lea eax, [esi + 0x98]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x462028
mov byte [ebp - 4], 1
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.0045341a
mov eax, dword [edi]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
and dword [edi + 4], 0
mov ecx, dword [edi]
mov eax, dword [edx]
mov esi, dword [ebp + 8]
mov dword [edi], eax
mov dword [edx], ecx
mov ecx, dword [edi + 4]
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov dword [edx + 4], ecx
lea eax, [esi + 0xa0]
push eax
lea ecx, [ebx + 0xa0]
call fcn.00403a94
mov eax, dword [esi + 0xb8]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0xb8], eax
mov ecx, edi
mov eax, dword [esi + 0xbc]
add esi, 0xc0
push esi
mov dword [ebx + 0xbc], eax
call fcn.00403a94
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00455251
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov al, byte [ecx + 0xe4]
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0xe4], al
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4680ae
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
push edi
xor edi, edi
cmp edx, dword [ebp + 0xc]
cmova esi, eax
test esi, esi
je 0x4680de
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x4680c9
jmp 0x4680e0
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8
Function at 0x4718c7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x5948d7
call fcn.0058e54c
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
xor eax, eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], eax
mov dword [ebx], vtable.bna::analytics::SinkMP.0
mov word [ebx + 4], 1
mov byte [ebx + 6], al
mov dword [ebx + 8], eax
call fcn.00471a00
xor ecx, ecx
mov dword [ebx + 0x10c], ecx
push 0xf
pop eax
mov dword [ebx + 0x110], eax
mov byte [ebx + 0xfc], cl
mov dword [ebx + 0x124], ecx
mov dword [ebx + 0x128], eax
mov byte [ebx + 0x114], cl
mov dword [ebx + 0x13c], ecx
mov dword [ebx + 0x140], eax
mov byte [ebx + 0x12c], cl
or dword [ebx + 0x144], 0xffffffff
lea edi, [ebx + 0x148]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
mov byte [edi], cl
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], eax
mov byte [edi + 0x18], cl
mov dword [edi + 0x40], ecx
mov dword [edi + 0x44], eax
mov byte [edi + 0x30], cl
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], eax
mov byte [edi + 0x48], cl
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x1bc], eax
mov byte [ebx + 0x1a8], cl
lea ecx, [ebx + 0x1c0]
mov byte [ebp - 4], 4
call fcn.004722f6
lea ecx, [ebx + 0x1e0]
mov byte [ebp - 4], 5
call fcn.004722f6
push 0x6013e4
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 6
call fcn.00408c84
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x24]
push esi
call fcn.00408c84
lea eax, [esi + 0x30]
push eax
lea ecx, [ebx + 0x6c]
call fcn.00408c84
lea eax, [esi + 0x18]
mov ecx, edi
push eax
call fcn.00408c84
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x474909
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x474919
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x474926
mov ecx, dword [ecx]
push ebx
push esi
xor edx, edx
mov esi, eax
sub esi, ecx
xor ebx, ebx
cmp ecx, eax
push edi
cmova esi, ebx
mov edi, edx
test esi, esi
je 0x474962
movsx eax, byte [ecx]
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edx
rol eax, 0xd
imul edx, eax, 5
sub edx, 0x19ab949c
inc ecx
inc edi
cmp edi, esi
jne 0x47493c
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret 4
Function at 0x47d3c5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
lea ecx, [eax - 1]
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
sar ecx, 1
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], ecx
cmp edi, ecx
jge 0x47d425
add esi, esi
lea ecx, [esi + 2]
shl ecx, 5
add ecx, ebx
lea eax, [ecx - 0x20]
push eax
push ecx
call fcn.0047d33b
movzx eax, al
xor eax, 1
shl edi, 5
inc eax
add esi, eax
mov eax, esi
shl eax, 5
lea ecx, [ebx + edi]
add eax, ebx
push eax
call fcn.0047d1cb
mov ecx, dword [ebp - 8]
mov edi, esi
cmp esi, ecx
jl 0x47d3e9
mov eax, dword [ebp + 8]
cmp esi, ecx
jne 0x47d444
test al, 1
jne 0x47d444
shl eax, 5
shl edi, 5
add eax, 0xffffffe0
add eax, ebx
push eax
lea ecx, [ebx + edi]
call fcn.0047d1cb
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x47d47a
push dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
mov eax, esi
shl eax, 5
add eax, ebx
push eax
mov dword [ebp + 8], eax
call fcn.0047d33b
test al, al
je 0x47d47a
push dword [ebp + 8]
shl edi, 5
lea ecx, [ebx + edi]
call fcn.0047d1cb
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x47d449
push dword [ebp + 0xc]
shl edi, 5
lea ecx, [ebx + edi]
call fcn.0047d1cb
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47ddf7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x47de1e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403b86
jmp 0x47ded3
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x47de40
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x47de42
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x47dec7
jg 0x47de57
test esi, esi
je 0x47dec7
test ecx, ecx
jl 0x47dea0
jg 0x47de61
test eax, eax
je 0x47dea0
cmp edi, ecx
jg 0x47de75
jl 0x47de6b
cmp esi, eax
jae 0x47de75
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004c2cb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x47dea3
mov edx, dword [ebp + 8]
test edi, edi
jl 0x47dec7
jg 0x47dead
test esi, esi
je 0x47dec7
cmp dword [ebx + 0x4c], 0
je 0x47dec7
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.004d67f9
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc