joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f634
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call fcn.00402928
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x46f719
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x4a2688
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x49b17c]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x46f67a
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x46f6e4
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x46f678
inc dword [esp]
dec dword [esp + 8]
jne 0x46f667
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x46f71b
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x473f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x4b25c4]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x4b25c4]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.00473f30
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.00473f30
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.00473f30
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.00473f30
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x473fae
movzx edx, word [ebx]
mov eax, edi
call fcn.00473f30
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x4b25c4]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.00473f30
mov word [ebp - 4], ax
mov ebx, dword [0x4b25c4]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4746d4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x4746f7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x47608c
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4760a2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x47609b
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x47612d
movzx ecx, byte [ecx + 0x4a57e4]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4a56e4]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4a56e4]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4a57e4]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x47618a
movzx ecx, byte [ecx + 0x4a57e4]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4a57e4]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4a56e4]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4a56e4]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x4a56e4]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4a57e4]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4a56e4]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4a57e4]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x4a56e4]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4a56e4]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4a57e4]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4a57e4]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x4a58e4]
xor edx, dword [ebx*4 + 0x4a5ce4]
xor edx, dword [eax*4 + 0x4a60e4]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x4a64e4]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x47638c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x47639c
pop esi
pop ebx
ret
Function at 0x4763b0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x4a56e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4a56e4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4a58e4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4763e1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x4a57e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4a56e4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4a5ce4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x476430
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x4a56e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4a57e4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4a60e4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x476483
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x4a57e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4a57e4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4a64e4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4764d6
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476508
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x4a57e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x14]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4a56e4]
xor esi, ecx
movzx esi, byte [esi + 0x4a56e4]
xor esi, edx
mov esi, dword [esi*4 + 0x4a58e4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x476542
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x4a57e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x13]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4a57e4]
xor esi, ecx
movzx esi, byte [esi + 0x4a56e4]
xor esi, edx
mov esi, dword [esi*4 + 0x4a5ce4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x400], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4765a1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x4a56e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x12]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4a56e4]
xor esi, ecx
movzx esi, byte [esi + 0x4a57e4]
xor esi, edx
mov esi, dword [esi*4 + 0x4a60e4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x800], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x476604
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x4a56e4
lea eax, [ebp - 0x100]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x11]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4a57e4]
xor esi, ecx
movzx esi, byte [esi + 0x4a57e4]
xor esi, edx
mov esi, dword [esi*4 + 0x4a64e4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0xc00], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x476667
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4766a0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, 0x4a56e4
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
lea edx, [ebx + 0x100]
lea eax, [ebp - 0x210]
call fcn.0047638c
mov eax, pe_nt_image_headers32
lea edx, [ebp - 0x210]
lea esi, [ebp - 0x110]
xor ecx, ecx
mov cl, byte [edx]
mov cl, byte [ebx + ecx + 0x100]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4766d9
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x110]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x14]
xor eax, eax
lea esi, [ebp - 0x110]
mov dword [ebp - 4], esi
mov esi, dword [ebp - 4]
movzx esi, byte [esi]
movzx esi, byte [ebx + esi]
xor esi, ecx
movzx esi, byte [ebx + esi]
xor esi, edx
mov esi, dword [esi*4 + 0x4a58e4]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4], esi
inc eax
inc dword [ebp - 4]
cmp eax, 0x100
jne 0x47671d
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
shr ecx, 8
mov edx, ebx
lea eax, [ebp - 0x210]
call fcn.0047638c
mov eax, pe_nt_image_headers32
lea edx, [ebp - 0x210]
lea esi, [ebp - 0x110]
xor ecx, ecx
mov cl, byte [edx]
mov cl, byte [ebx + ecx + 0x100]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x476771
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x110]
call fcn.0047638c
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x13]
xor eax, eax
lea esi, [ebp - 0x110]
mov dword [ebp - 8], esi
Function at 0x476eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.00402928
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call fcn.00402928
mov ebx, dword [0x4b22a8]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 8
mov dword [ebp - 0x24], 0x4a6ae4
lea ebx, [ebp - 0x1e]
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
call fcn.00476e78
pop ecx
mov byte [ebx], al
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x24]
lea esi, [eax + 1]
lea edi, [ebp - 0x15]
push ebp
xor edx, edx
mov dl, byte [edi]
xor eax, eax
mov al, byte [esi]
call fcn.00476e78
pop ecx
xor byte [ebx], al
inc edi
inc esi
dec byte [ebp - 0xe]
jne 0x476f2f
inc ebx
add dword [ebp - 0x24], 8
dec byte [ebp - 0xd]
jne 0x476f0e
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 7
lea eax, [ebp - 0x1d]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
shl edx, 8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
shr ecx, 0x18
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shl edx, 8
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edx
inc eax
dec byte [ebp - 0xd]
jne 0x476f6a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476fa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov eax, 0x4a6b24
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 5
mov ebx, dword [edx]
xor dword [ecx], ebx
mov ebx, dword [edx + 4]
xor dword [ecx + 4], ebx
add edx, 8
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x1800]
mov ebx, dword [ecx]
mov edi, ebx
shr edi, 0x17
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, ebx
shr edi, 0xf
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3000]
mov edi, ebx
add edi, edi
and edi, 0x1fe
xor esi, dword [eax + edi*4 + 0x3800]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 4]
shr esi, 0x17
and esi, 0x1fe
or esi, 1
mov esi, dword [eax + esi*4]
mov edi, dword [ecx + 4]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x800]
mov edi, dword [ecx + 4]
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1000]
mov edi, dword [ecx + 4]
add edi, edi
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x1800]
mov edi, dword [ecx]
shr edi, 0x17
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2000]
mov edi, dword [ecx]
shr edi, 0xf
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x2800]
mov edi, ebx
shr edi, 7
and edi, 0x1fe
or edi, 1
xor esi, dword [eax + edi*4 + 0x3000]
add ebx, ebx
and ebx, 0x1fe
or ebx, 1
xor esi, dword [eax + ebx*4 + 0x3800]
mov dword [ecx + 4], esi
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
dec dword [ebp - 0x10]
jne 0x476fc6
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
add edx, 8
mov eax, dword [ecx]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x4a68e4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x4a68e4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x4a68e4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x4a68e4]
xor ebx, eax
mov dword [ecx], ebx
mov eax, dword [ecx + 4]
mov ebx, eax
shr ebx, 0x18
and ebx, 0xff
movzx ebx, byte [ebx + 0x4a68e4]
shl ebx, 0x18
mov esi, eax
shr esi, 0x10
and esi, 0xff
movzx esi, byte [esi + 0x4a68e4]
shl esi, 0x10
xor ebx, esi
mov esi, eax
shr esi, 8
and esi, 0xff
movzx esi, byte [esi + 0x4a68e4]
shl esi, 8
xor ebx, esi
and eax, 0xff
movzx eax, byte [eax + 0x4a68e4]
xor ebx, eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
xor eax, dword [ecx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477c24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
jmp 0x477c36
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
cmp edx, dword [eax]
jne 0x477c32
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x477c8d
xor eax, eax
push ebp
push 0x477c86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477c8d
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x478ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov word [ebp - 6], 0xffff
xor eax, eax
push ebp
push 0x478b44
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
dec esi
test esi, esi
jl 0x478b3a
inc esi
xor ebx, ebx
mov eax, edi
add eax, ebx
mov cl, byte [eax]
mov eax, ebx
push ecx
mov ecx, 0xd
cdq
idiv ecx
pop ecx
mov eax, 0x478b64
mov al, byte [eax + edx]
xor cl, al
mov eax, edi
add eax, ebx
mov byte [eax], cl
mov dx, word [ebp - 6]
mov eax, ecx
call fcn.00478ab4
mov word [ebp - 6], ax
inc ebx
dec esi
jne 0x478b05
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x478b4e
mov ax, word [ebp - 6]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x478b98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov word [ebp - 6], 0xffff
xor eax, eax
push ebp
push 0x478c01
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, edx
dec edi
test edi, edi
jl 0x478bf7
inc edi
xor esi, esi
mov eax, dword [ebp - 4]
add eax, esi
mov bl, byte [eax]
mov dx, word [ebp - 6]
mov eax, ebx
call fcn.00478b74
mov word [ebp - 6], ax
mov eax, esi
mov ecx, 0xd
cdq
idiv ecx
mov eax, 0x478c20
mov al, byte [eax + edx]
xor bl, al
mov eax, dword [ebp - 4]
add eax, esi
mov byte [eax], bl
inc esi
dec edi
jne 0x478bc2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x478c0b
mov ax, word [ebp - 6]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x478c30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
or ecx, 0xffffffff
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jl 0x478c5f
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, ecx
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x4b132c]
shr ecx, 8
xor edx, ecx
mov ecx, edx
inc ebx
dec eax
jne 0x478c3f
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x479e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov dword [ebp - 4], eax
xor ebx, ebx
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 4]
add eax, 0x1fc8
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x479f6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fe0]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x479f01
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fe0]
mov edx, esi
call fcn.00415358
mov dword [ebp - 0x18], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0x18]
sub eax, dword [edx + 0x10]
cmp eax, 0x4e20
jbe 0x479e8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fe0]
mov edx, esi
call fcn.00415248
lea eax, [ebp - 0x18]
call fcn.0040e1cc
jmp 0x479ef7
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
cmp edx, dword [ebp - 0xc]
jne 0x479ef7
cmp eax, dword [ebp - 0x10]
jne 0x479ef7
mov bl, 1
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10], eax
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
call fcn.0045f45c
mov eax, dword [ebp - 0x18]
call fcn.0045f4c8
test al, al
je 0x479ef0
mov eax, edi
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x14]
call fcn.0040468c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fe0]
mov edx, esi
call fcn.00415248
lea eax, [ebp - 0x18]
call fcn.0040e1cc
mov byte [ebp - 0x11], 1
jmp 0x479f01
call fcn.0040407c
jmp 0x479f72
dec esi
cmp esi, 0xffffffff
jne 0x479e4d
test bl, bl
jne 0x479f4f
mov ecx, dword [ebp + 0xc]
mov dl, 1
mov eax, dword [0x45f2f0]
call fcn.0045f394
mov dword [ebp - 0x18], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
call fcn.0045f45c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1fe0]
mov edx, dword [ebp - 0x18]
call fcn.004151fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479f72
mov eax, dword [ebp - 4]
add eax, 0x1fc8
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
ret
mov al, byte [ebp - 0x11]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8