joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af454
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x4af4e5
movzx ebx, byte [ebx + 0x545d14]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x545c14]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x545c14]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x545d14]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jl 0x4af53f
movzx ebx, byte [ebx + 0x545d14]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x545d14]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x545c14]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x545c14]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x545c14]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x545c14]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x556e88]
movzx ecx, byte [ecx + 0x545d14]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x545c14]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x557288]
movzx eax, byte [eax + 0x545c14]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x545d14]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x557688]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x545d14]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x545d14]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x557a88]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4af5fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
movzx ecx, cl
imul ecx, ecx, 0x1010101
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
mov esi, dword [edx + ebx*4 + 4]
xor esi, ecx
mov dword [eax + ebx*4 + 4], esi
mov esi, dword [edx + ebx*4 + 8]
xor esi, ecx
mov dword [eax + ebx*4 + 8], esi
mov esi, dword [edx + ebx*4 + 0xc]
xor esi, ecx
mov dword [eax + ebx*4 + 0xc], esi
add ebx, 4
cmp ebx, 0x40
jl 0x4af609
pop esi
pop ebx
ret
Function at 0x4b04e4
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0x1c], pe_nt_image_headers32
mov esi, 0x545c14
mov ebx, 0x556e88
movzx edi, byte [esi]
mov dword [ebp - 8], edi
mov eax, edi
call fcn.004af334
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.004af348
mov dword [ebp - 0x18], eax
movzx edi, byte [esi + 0x100]
mov dword [ebp - 4], edi
mov eax, edi
call fcn.004af334
mov dword [ebp - 0xc], eax
mov eax, edi
call fcn.004af348
mov dword [ebp - 0x14], eax
mov eax, edi
mov edx, dword [ebp - 0xc]
shl edx, 8
or eax, edx
mov edx, dword [ebp - 0x14]
shl edx, 0x10
or eax, edx
mov edx, dword [ebp - 0x14]
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [ebp - 0x10]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [ebp - 8]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
shl ecx, 8
or edx, ecx
shl edi, 0x10
or edx, edi
mov ecx, dword [ebp - 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [ebp - 0x10]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [ebp - 0x1c]
jne 0x4b04fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b2e70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4b2ec9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040571c
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4b2eb1
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4b2eb3
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2ed0
lea eax, [ebp - 4]
call fcn.0040528c
ret

Function at 0x4b2ed8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4b2f3c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp - 4]
call fcn.0040571c
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040af5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2f43
lea eax, [ebp - 4]
call fcn.0040528c
ret
Function at 0x4b35d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4b36cc
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.004b2d58
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b0ebc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b42a4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004b0e5c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b431c
lea eax, [ebx + 0x50]
call fcn.0040528c
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b36d3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004052b0
ret
Function at 0x4b36dc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4b37e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.004b2d58
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4b37ab
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b0ebc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b42a4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004b0e5c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b431c
jmp 0x4b37bd
xor edx, edx
mov eax, ebx
call fcn.004b42a4
xor edx, edx
mov eax, ebx
call fcn.004b431c
lea eax, [ebx + 0x50]
call fcn.0040528c
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b37ef
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004052b0
ret
Function at 0x4b74bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b762d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b7608
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00405474
lea eax, [ebp - 0x118]
mov edx, 0x4b7644
call fcn.00405558
mov eax, dword [ebp - 0x118]
call fcn.0040571c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4b757a
lea eax, [ebp - 0x111]
call fcn.0040ad1c
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040537c
jmp 0x4b7581
mov eax, esi
call fcn.0040528c
cmp bl, 0x61
jae 0x4b75a2
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040eda0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004052e0
jmp 0x4b75bc
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040ed0c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004052e0
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4b7650
call fcn.0040b44c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004052e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b760f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4bb595
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x4bcdfa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x4bcea8
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x4bce39
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.004bb675
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.004bb274
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4bce64
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.004bb595
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.004bb5d9
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x4bcec3
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004bb5d9
add esp, 0xc
pop ecx
pop ebp
ret

Function at 0x4bcec6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x4bcee7
push dword [ebp + 0x10]
push 0
push 0
call fcn.004bcdfa
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.004bb675
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x4bceff
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.004bb595
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.004bb5d9
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.004bb5d9
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.004bb675
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x4bcf86
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x4bcf6b
mov esp, ebp
pop ebp
ret
Function at 0x4be42c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.004bcd48
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004bcd5f
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.004bb288
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004bcdfa
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x4be5c0
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.004bb274
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.004bb288
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x4be57a
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.004bcdfa
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.004bcec6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x4be53d
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.004bb288
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x4be50d
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x4be5a3
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x4be5b1
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x4be58d
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x4be4a9
mov esp, ebp
pop ebp
ret

Function at 0x4c3db0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004c4014
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004c4014
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c3e28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x110]
cmp byte [eax + 0x4c], 0
jne 0x4c3e5f
mov edi, ecx
dec edi
test edi, edi
jl 0x4c3e70
inc edi
mov eax, esi
call fcn.004c3e0c
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.004c3db0
inc ebx
dec edi
jne 0x4c3e46
jmp 0x4c3e70
lea eax, [esi + 0x3bc]
push eax
push ecx
push ebx
call fcn.004bba08
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4c3f08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4c3f7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c3e78
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004c3e0c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004c3db0
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4c3f48
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3f85
lea eax, [ebp - 4]
call fcn.0040528c
ret
Function at 0x4c4d54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c4f43
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c4eff
mov eax, dword [ebp - 4]
call fcn.004c6608
cmp ebx, eax
jge 0x4c4eff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004b2404
mov edx, dword [0x4b2fe8]
call fcn.00404518
mov esi, eax
mov eax, esi
call fcn.004b4204
test al, al
je 0x4c4ef5
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4c4dd6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4c4ee8
xor eax, eax
push ebp
push 0x4c4ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c52b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041d414
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004059ac
mov eax, dword [ebp - 8]
call fcn.0040577c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c50d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4f2d
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c4ee0
mov eax, dword [ebp - 4]
call fcn.004c5340
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.004052e0
jmp 0x4c4f2d
mov eax, dword [ebp - 8]
call fcn.0040528c
jmp 0x4c4f2d
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a3a0
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x417ce0]
call fcn.0040dedc
call fcn.00404bdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4f4a
lea eax, [ebp - 0x54]
call fcn.0040528c
ret
Function at 0x4cec40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4ced18
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.0040a5d0
test al, al
je 0x4ced02
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.0040a3b4
mov ebx, eax
test ebx, ebx
je 0x4ced02
mov ecx, 2
xor edx, edx
mov eax, ebx
call fcn.0040a464
test eax, eax
jns 0x4cec9c
add eax, 3
sar eax, 2
mov esi, eax
add esi, esi
add esi, esi
mov eax, esi
call fcn.00402f90
mov dword [ebp - 8], eax
mov edi, dword [ebp - 8]
mov eax, edi
xor ecx, ecx
mov edx, esi
call fcn.00403b20
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0040a464
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.0040a40c
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
xor ebx, ebx
mov edx, esi
test edx, edx
jns 0x4cece7
add edx, 3
sar edx, 2
dec edx
test edx, edx
jl 0x4cecf8
inc edx
xor ebx, dword [eax]
add eax, 4
dec edx
jne 0x4cecf0
mov eax, dword [ebp - 8]
call fcn.00402fac
mov esi, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ced1f
lea eax, [ebp - 4]
call fcn.0040528c
ret

Function at 0x4d1234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4d12c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040528c
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d1270
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test bx, bx
jbe 0x4d12aa
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
movzx edx, word [ebp - 6]
xor dx, 0xf
call fcn.00405474
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405558
inc edi
dec bx
jne 0x4d127b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d12cf
lea eax, [ebp - 0xc]
call fcn.0040528c
lea eax, [ebp - 4]
call fcn.0040528c
ret

Function at 0x4d173c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4d17c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b20
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040571c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d17ac
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d17c9
lea eax, [ebp - 4]
call fcn.0040528c
ret