joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4c1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, 0x5dc9
mov word [ebp - 0x4c], ax
add eax, 0x2a
mov word [ebp - 0x4a], ax
mov eax, 0x5daf
mov word [ebp - 0x48], ax
add eax, 0x50
mov word [ebp - 0x46], ax
mov eax, 0x5d8d
lea ebx, [eax + 0x55]
mov word [ebp - 0x44], ax
mov eax, ebx
mov word [ebp - 0x42], ax
add eax, 0xffffffa3
mov word [ebp - 0x40], ax
lea eax, [ebx + 0x15]
mov word [ebp - 0x3e], ax
lea edi, [ebx - 0x4c]
mov eax, edi
mov word [ebp - 0x3c], ax
add eax, 0x65
mov word [ebp - 0x3a], ax
lea eax, [ebx - 7]
mov word [ebp - 0x38], ax
lea esi, [ebx - 0x45]
mov eax, esi
mov word [ebp - 0x36], ax
lea edx, [ebx + 0x12]
mov eax, edx
mov word [ebp - 0x34], ax
add eax, 0xffffffa4
mov word [ebp - 0x32], ax
lea eax, [ebx + 0x1b]
mov word [ebp - 0x30], ax
add eax, 0xffffff91
mov word [ebp - 0x2e], ax
lea eax, [ebx - 0x10]
mov word [ebp - 0x2c], ax
add eax, 0xffffffc9
mov word [ebp - 0x2a], ax
lea eax, [ebx + 0x13]
mov ecx, eax
mov word [ebp - 0x28], cx
add ecx, 0xffffff8c
mov word [ebp - 0x26], cx
lea ecx, [ebx + 2]
mov word [ebp - 0x24], cx
add ecx, 0x14
mov word [ebp - 0x20], cx
lea ecx, [ebx + 7]
mov word [ebp - 0x1c], cx
add ecx, 0xffffffe0
mov word [ebp - 0x1a], cx
lea ecx, [ebx - 0x56]
mov word [ebp - 0x18], cx
add ecx, 0xfffffff8
mov word [ebp - 0x14], cx
lea ecx, [ebx + 6]
mov word [ebp - 0x12], cx
add ecx, 0xffffff9f
mov word [ebp - 0xe], ax
push 0x22
add eax, 0xffffff9b
mov word [ebp - 0x10], cx
pop ecx
mov word [ebp - 0xc], ax
lea eax, [ebx - 0x24]
mov word [ebp - 0x22], di
pop edi
mov word [ebp - 0x1e], si
mov word [ebp - 8], ax
xor eax, eax
pop esi
mov word [ebp - 0xa], bx
mov word [ebp - 0x16], dx
mov word [ebp - 6], ax
pop ebx
mov dx, word [ebp + ecx*2 - 0x4e]
lea eax, [ebp + ecx*2 - 0x4c]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c4d28
mov eax, 0x5d8a
xor word [ebp - 0x4c], ax
mov eax, dword [ebp - 4]
test dword [eax + 0x24], 0x20050
jne 0x4c4d63
add eax, 0x18
push eax
lea eax, [ebp - 0x4c]
push 0x61f138
push eax
call fcn.004cb690
add esp, 0xc
leave
ret
Function at 0x4c54ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push 0xf6dce566
call fcn.004cf30d
push 0xf472eb24
mov dword [ebp - 0x14], eax
call fcn.004cf30d
mov dword [ebp - 0x10], eax
mov eax, 0x7786
mov word [ebp - 0xc], ax
add eax, 0x22
mov word [ebp - 0xa], ax
mov eax, 0x77cc
mov word [ebp - 8], ax
add eax, 0xffffffe1
pop ecx
pop ecx
mov word [ebp - 6], ax
mov eax, 0x77d9
mov ecx, eax
push 5
mov word [ebp - 4], cx
mov word [ebp - 2], ax
pop ecx
mov dx, word [ebp + ecx*2 - 0xe]
lea eax, [ebp + ecx*2 - 0xc]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c5502
mov eax, 0x77b7
xor word [ebp - 0xc], ax
mov eax, 0xe8
mov word [ebp - 0x2c], ax
add eax, 0xffffffb4
mov word [ebp - 0x2a], ax
mov eax, 0xfd
mov word [ebp - 0x28], ax
add eax, 0xffffff8c
mov word [ebp - 0x26], ax
mov eax, 0xfc
mov word [ebp - 0x24], ax
add eax, 0xffffff93
mov word [ebp - 0x22], ax
mov eax, 0xa1
mov word [ebp - 0x20], ax
add eax, 0x24
mov word [ebp - 0x1e], ax
mov eax, 0xa4
mov word [ebp - 0x1c], ax
add eax, 0x2c
mov ecx, eax
push 0xa
mov word [ebp - 0x1a], cx
mov word [ebp - 0x18], ax
pop ecx
mov dx, word [ebp + ecx*2 - 0x2e]
lea eax, [ebp + ecx*2 - 0x2c]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c5575
push esi
push edi
mov eax, 0x9b
xor word [ebp - 0x2c], ax
mov edi, 0x61f138
push edi
lea esi, [eax + 0x69]
push esi
lea eax, [ebp - 0x234]
push eax
call fcn.004c4d65
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x234]
push eax
call fcn.004c4d98
push edi
push esi
lea eax, [ebp - 0x43c]
push eax
call fcn.004c4d65
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x43c]
push eax
call fcn.004c4d98
push 0
mov edi, 0x80
push edi
push 2
push 0
push 1
mov esi, 0x1f01ff
push esi
lea eax, [ebp - 0x234]
push eax
call dword [ebp - 0x14]
push eax
call dword [ebp - 0x10]
push 0
push edi
push 2
push 0
push 1
push esi
lea eax, [ebp - 0x43c]
push eax
call dword [ebp - 0x14]
push eax
call dword [ebp - 0x10]
pop edi
pop esi
leave
ret
Function at 0x4c5d53
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0x6590
call fcn.004b4117
mov esi, eax
xor edi, edi
jmp 0x4c5d84
mov eax, edi
inc edi
cmp eax, 0x186a0
jg 0x4c5d8e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.004c4837
pop ecx
call fcn.004c62c0
test eax, eax
je 0x4c5d6c
push 0x39e51281
call fcn.004cf30d
mov edi, eax
mov dword [esp], 0x764afe17
call fcn.004cf30d
mov esi, eax
mov eax, 0x165c
mov word [ebp - 0x30], ax
add eax, 0xffffffd8
mov word [ebp - 0x2e], ax
mov eax, 0x1658
mov word [ebp - 0x2c], ax
pop ecx
lea ecx, [eax - 0x29]
mov eax, ecx
mov word [ebp - 0x2a], ax
add eax, 0x1f
mov word [ebp - 0x28], ax
lea eax, [ecx + 0xf]
mov word [ebp - 0x26], ax
add eax, 0x19
mov word [ebp - 0x24], ax
lea eax, [ecx + 0x4a]
mov word [ebp - 0x22], ax
add eax, 0xffffffa4
mov edx, eax
mov word [ebp - 0x20], dx
lea edx, [ecx + 0x42]
mov word [ebp - 0x1e], dx
mov edx, eax
push 0xb
mov word [ebp - 0x1c], dx
mov word [ebp - 0x1a], ax
pop edx
mov bx, word [ebp + edx*2 - 0x32]
lea eax, [ebp + edx*2 - 0x30]
xor word [eax], bx
dec edx
test edx, edx
jg 0x4c5e04
xor word [ebp - 0x30], cx
mov eax, 0x5e3
mov word [ebp - 0x18], ax
add eax, 0xffffffa8
mov word [ebp - 0x16], ax
mov eax, 0x5ee
mov ecx, eax
mov word [ebp - 0x10], ax
add eax, 0xffffffef
mov word [ebp - 0xe], ax
mov eax, 0x5ef
mov word [ebp - 0x14], cx
add ecx, 0xffffff94
mov word [ebp - 0xc], ax
add eax, 0xffffffd2
mov word [ebp - 0x12], cx
mov word [ebp - 0xa], ax
mov eax, 0x5a5
mov ecx, eax
mov word [ebp - 8], cx
add ecx, 0x24
mov word [ebp - 6], cx
mov ecx, eax
push 0xb
mov word [ebp - 4], cx
mov word [ebp - 2], ax
pop ecx
mov dx, word [ebp + ecx*2 - 0x1a]
lea eax, [ebp + ecx*2 - 0x18]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c5e75
mov eax, 0x590
xor word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
call esi
test eax, eax
jne 0x4c5e9f
lea eax, [ebp - 0x18]
push eax
call edi
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
jne 0x4c5eaf
lea eax, [ebp - 0x30]
push eax
call edi
push 0x28
call fcn.004b4117
mov esi, eax
pop ecx
test esi, esi
je 0x4c5ec8
push 0xa
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
jmp 0x4c5eca
xor esi, esi
mov ecx, esi
call fcn.004c4a9b
mov ecx, esi
call fcn.004c4bc5
mov ecx, esi
call fcn.004c5a2e
mov ecx, esi
call fcn.004c489b
mov ecx, esi
call fcn.004c5615
mov ecx, esi
call fcn.004c5aed
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.004c4c1a
mov ecx, esi
call fcn.004c4bf6
int3
Function at 0x4c62c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, str._qHq_q_vqnq
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
movsd dword es:[edi], dword [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x1a]
lea eax, [ebp + ecx*2 - 0x18]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c62df
mov eax, 0x715b
xor word [ebp - 0x18], ax
push 0xbbcb830e
call fcn.004cf30d
mov esi, eax
mov dword [esp], 0x4a7be33f
call fcn.004cf30d
push 0xf472eb24
mov edi, eax
call fcn.004cf30d
push 0x5b800be3
mov dword [ebp - 8], eax
call fcn.004cf30d
add esp, 0xc
push 0
push 2
mov ebx, eax
mov dword [ebp - 0x244], 0x22c
call esi
mov esi, eax
test esi, esi
je 0x4c6380
lea eax, [ebp - 0x244]
push eax
push esi
call edi
jmp 0x4c6378
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004c5f64
pop ecx
pop ecx
test eax, eax
jne 0x4c636e
mov dword [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
push esi
call ebx
test eax, eax
jne 0x4c6351
push esi
call dword [ebp - 8]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c7447
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4dc71a
call fcn.004db7bc
sub esp, 0x88
push ebx
push esi
push edi
lea esi, [ebp - 0x94]
call fcn.004cbeed
mov esi, eax
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push ebx
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x40]
lea ecx, [ebp - 0x30]
call fcn.004cdbb0
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.004cdbd0
test eax, eax
jne 0x4c74a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004cdbc0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
push 0x10
pop ecx
mov esi, str._HJHHCH_HTHtHHH
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
push 0x1f
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x86]
lea eax, [ebp + ecx*2 - 0x84]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x4c74c7
mov eax, 0x485c
xor word [ebp - 0x84], ax
mov eax, dword [0x4ee178]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4ee17c]
push 2
mov dword [ebp - 0x18], eax
pop ecx
mov dx, word [ebp + ecx*2 - 0x1e]
lea eax, [ebp + ecx*2 - 0x1c]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x4c74fd
mov eax, 0x2e07
xor word [ebp - 0x1c], ax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x20]
call fcn.004c7396
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004c7396
mov ecx, dword [esi]
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x4c7546
mov ecx, dword [ecx]
jmp 0x4c7548
xor ecx, ecx
mov eax, dword [eax]
cmp eax, ebx
je 0x4c7552
mov edx, dword [eax]
jmp 0x4c7554
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax]
lea edi, [ebp - 0x28]
push edi
push ebx
push 0x20
push ecx
push edx
push eax
call dword [esi + 0x50]
mov ecx, dword [ebp - 0x14]
mov edi, eax
cmp ecx, ebx
je 0x4c7577
call fcn.004c7409
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x4c7586
call fcn.004c7409
xor esi, esi
cmp edi, ebx
jl 0x4c75ba
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x28], ebx
je 0x4c75ba
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
add esi, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x4c7594
cmp esi, 0x30
jbe 0x4c75ba
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x30]
call fcn.004cdd50
call dword [ebp - 0x38]
mov bl, byte [ebp - 0xd]
jmp 0x4c748c
Function at 0x4c7ccc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
test eax, eax
jne 0x4c7ce7
mov eax, 0x80004005
leave
ret
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4c7cea
sub eax, edx
sar eax, 1
cmp eax, 0x40
ja 0x4c7ce0
push 0xfb9fd244
call fcn.004cf30d
pop ecx
mov dword [ebp - 8], eax
mov ecx, 0x208
lea eax, [ebp - 0x270]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4c7d16
push esi
push edi
push 0xe
pop ecx
mov esi, str._ra
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push 0x1b
movsw word es:[edi], word [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x6a]
lea eax, [ebp + ecx*2 - 0x68]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c7d31
mov eax, 0x7c48
xor word [ebp - 0x68], ax
lea eax, [ebp - 0x68]
push eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x270]
push eax
call fcn.004c4d65
push dword [ebp + 8]
lea eax, [ebp - 0x270]
push esi
push eax
call fcn.004c4d98
push 0x24
pop ecx
pop edi
mov edx, ecx
lea eax, [ebp - 0x2c]
pop esi
mov byte [eax], 0
inc eax
dec edx
jne 0x4c7d7b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x270]
push eax
mov dword [ebp - 0x2c], ecx
call dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
leave
ret
Function at 0x4c80a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
push 0xdcc68363
call fcn.004cf30d
push 0xf44abbdd
mov dword [ebp - 8], eax
call fcn.004cf30d
push 0xeb9bb51d
mov dword [ebp - 0x1c], eax
call fcn.004cf30d
push 0x9df954f8
mov dword [ebp - 0x18], eax
call fcn.004cf30d
push 0x85f935fa
mov dword [ebp - 0x14], eax
call fcn.004cf30d
push 0x8bd388ab
mov dword [ebp - 0x10], eax
call fcn.004cf30d
push 0x47a6a5c3
mov dword [ebp - 0x20], eax
call fcn.004cf30d
add esp, 0x1c
cmp dword [ebp + 8], 0
mov dword [ebp - 0xc], eax
jne 0x4c81b7
push 0x104
lea eax, [ebp - 0x244]
push eax
push 0x9cf899ae
call fcn.004cf30d
pop ecx
call eax
push 7
pop ecx
mov esi, str._e_e_e_eAe.ee9eKeee
lea edi, [ebp - 0x3c]
push 0xc
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dx, word [ebp + ecx*2 - 0x3e]
lea eax, [ebp + ecx*2 - 0x3c]
xor word [eax], dx
dec ecx
test ecx, ecx
jg 0x4c8148
and dword [0x61f55c], 0
push 4
mov eax, 0x1b1c
xor word [ebp - 0x3c], ax
push 0x3000
lea eax, [ebp - 4]
push eax
push 0
push 0x61f55c
push 0xffffffffffffffff
mov dword [ebp - 4], 0x400
call dword [ebp - 0x20]
test eax, eax
jl 0x4c8237
lea eax, [ebp - 0x244]
push eax
mov esi, 0x104
push esi
push dword [0x61f55c]
call fcn.004c4d65
lea eax, [ebp - 0x3c]
push eax
push esi
push dword [0x61f55c]
call fcn.004c4d98
call dword [ebp - 0x14]
cmp dword [ebp + 8], 0
je 0x4c81ce
mov edi, dword [0x61f550]
mov esi, dword [0x61f54c]
jmp 0x4c81ef
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x44]
mov dword [0x61f550], eax
mov eax, dword [0x61f55c]
push eax
mov dword [0x61f54c], ecx
mov esi, eax
call dword [ebp - 0xc]
mov edi, eax
mov eax, dword [ebx + 0x10]
push esi
add eax, 0x38
push eax
call dword [ebp - 8]
mov eax, dword [ebx + 0x10]
push edi
add eax, 0x40
push eax
call dword [ebp - 8]
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4c8228
push 0x8000
lea eax, [ebp - 4]
push eax
push 0x61f55c
push 0xffffffffffffffff
mov dword [ebp - 4], esi
call dword [ebp - 0x1c]
mov dword [0x61f55c], esi
call dword [ebp - 0x10]
push dword [ebp + 8]
push 0x4c7b04
push esi
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c8760
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x14]
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov esi, dword [ecx + 0x10]
mov edx, dword [ecx]
lea eax, [ecx - 8]
mov dword [ebp - 8], edx
test esi, esi
je 0x4c8816
mov eax, dword [esi + 0x3c]
mov edx, dword [eax + esi + 0x78]
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4c8816
mov ecx, dword [edx + esi + 0xc]
mov al, byte [ecx + esi]
add ecx, esi
mov dword [ebp - 4], 0
test al, al
je 0x4c87ce
mov edi, dword [ebp - 4]
ror edi, 0xf
cmp al, 0x61
movsx eax, al
jl 0x4c87c1
sub eax, 0x20
add edi, eax
mov al, byte [ecx + 1]
inc ecx
mov dword [ebp - 4], edi
test al, al
jne 0x4c87b1
mov ebx, dword [edx + esi + 0x20]
mov eax, dword [edx + esi + 0x18]
add ebx, esi
xor edi, edi
mov dword [ebp - 0xc], eax
test eax, eax
jbe 0x4c8816
mov ecx, dword [ebx + edi*4]
mov al, byte [ecx + esi]
add ecx, esi
xor edx, edx
test al, al
je 0x4c8806
nop
ror edx, 0xf
cmp al, 0x61
movsx eax, al
jl 0x4c87fd
sub eax, 0x20
inc ecx
add edx, eax
mov al, byte [ecx]
test al, al
jne 0x4c87f0
mov ecx, dword [ebp - 4]
add edx, ecx
cmp dword [ebp + 8], edx
je 0x4c8826
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x4c87e1
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
je 0x4c8847
mov ecx, dword [ebp - 8]
jmp 0x4c8778
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + esi + 0x24]
lea edx, [ecx + edi*2]
movzx ecx, word [edx + esi]
mov edx, dword [eax + esi + 0x1c]
lea eax, [edx + ecx*4]
mov eax, dword [eax + esi]
pop edi
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c8bf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
mov esi, dword [eax + 0x3c]
add esi, eax
movzx eax, word [esi + 6]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
lea ecx, [eax + 0x28]
cmp ecx, dword [esi + 0x54]
ja 0x4c8d58
movzx edx, word [esi + 0x14]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
push 0
push 0
push ebx
add edx, eax
mov eax, dword [ebp + 0x10]
lea edi, [edx + esi + 0x18]
push edi
push ebx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [edi + ebx], 0
mov ebx, dword [ebp + 0x18]
mov ecx, dword [esi + 0x38]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0x4c8c54
mov eax, ebx
jmp 0x4c8c58
inc eax
imul eax, ecx
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x3c]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0x4c8c6c
mov eax, ebx
jmp 0x4c8c70
inc eax
imul eax, ecx
mov dword [edi + 0x10], eax
movzx eax, word [esi + 6]
movzx edx, word [esi + 0x14]
add edx, esi
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*8 - 0x10]
mov ecx, dword [eax + 0x14]
add ecx, dword [eax + 0x10]
mov dword [edi + 0x14], ecx
mov ecx, dword [eax + 0xc]
add ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x38]
mov dword [ebp - 4], edx
xor edx, edx
mov eax, ecx
div dword [ebp - 4]
test edx, edx
je 0x4c8cab
lea ecx, [eax + 1]
imul ecx, dword [ebp - 4]
mov dword [edi + 0xc], ecx
mov dword [edi + 0x24], 0x40000040
inc word [esi + 6]
mov ecx, dword [esi + 0x38]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0x4c8cca
mov eax, ebx
jmp 0x4c8cce
inc eax
imul eax, ecx
add dword [esi + 0x50], eax
mov esi, dword [esi + 0x3c]
xor edx, edx
mov eax, ebx
div esi
test edx, edx
jne 0x4c8ce2
mov edi, ebx
jmp 0x4c8ce8
lea edi, [eax + 1]
imul edi, esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, edi
push eax
call fcn.004b4117
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
push ecx
push edx
add ecx, edi
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.004b37f8
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004db7db
add esp, 4
xor ebx, ebx
test edi, edi
jbe 0x4c8d36
call fcn.004db7ed
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
add ecx, ebx
inc ebx
mov byte [ecx + edx], al
cmp ebx, edi
jb 0x4c8d22
mov eax, dword [esi]
push edi
mov edi, dword [ebp - 4]
add eax, edi
push 0xcc
push eax
call fcn.004b3f30
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
add esp, 0xc
mov dword [ecx], edi
add dword [esi], edx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cba2f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
inc eax
mov cl, byte [esi]
xor byte [eax + esi], cl
inc eax
cmp eax, 0xd
jb 0x4cba3b
xor ebx, ebx
cmp dword [esi + 5], ebx
jbe 0x4cba62
push 0xfffffffffffffff3
pop ecx
lea eax, [esi + 0xd]
sub ecx, esi
mov dl, byte [esi]
xor byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, dword [esi + 5]
jb 0x4cba55
push dword [esi + 5]
lea edi, [esi + 0xd]
push edi
push dword [esi + 9]
call fcn.004cf8c3
add esp, 0xc
test al, al
jne 0x4cba7f
xor al, al
jmp 0x4cbb6e
mov esi, dword [esi + 1]
sub esi, ebx
je 0x4cbb73
dec esi
je 0x4cbb4b
dec esi
je 0x4cbaf0
dec esi
jne 0x4cba78
push dword [edi + 4]
call fcn.004b4117
mov ebx, eax
push ebx
push edi
call dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
add esp, 0xc
test al, al
jne 0x4cbab2
and dword [edi], esi
push dword [ebx + 4]
call fcn.004b4117
mov esi, dword [ebp + 0xc]
push eax
push ebx
mov dword [esi], eax
call dword [ebp + 0x18]
add esp, 0xc
test al, al
jne 0x4cbae2
push dword [esi]
call fcn.004b3716
push ebx
call fcn.004b3716
and dword [edi], 0
and dword [esi], 0
pop ecx
pop ecx
jmp 0x4cba78
mov eax, dword [ebx + 4]
mov dword [edi], eax
push ebx
call fcn.004b3716
pop ecx
jmp 0x4cbb6c
push dword [edi]
call fcn.004b4117
mov esi, eax
push esi
push edi
call dword [ebp + 0x18]
add esp, 0xc
test al, al
jne 0x4cbb16
push esi
call fcn.004b3716
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [eax], ebx
jmp 0x4cba78
push dword [esi + 4]
call fcn.004b4117
mov edi, dword [ebp + 0xc]
push eax
push esi
mov dword [edi], eax
call dword [ebp + 0x14]
add esp, 0xc
push esi
test al, al
jne 0x4cbb41
call fcn.004b3716
push dword [edi]
call fcn.004b3716
pop ecx
mov dword [edi], ebx
jmp 0x4cbb0b
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x4cbae8
push dword [edi + 4]
call fcn.004b4117
mov esi, dword [ebp + 0xc]
push eax
push edi
mov dword [esi], eax
call dword [ebp + 0x18]
add esp, 0xc
test al, al
je 0x4cbb8c
mov ecx, dword [ebp + 0x10]
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 4]
call fcn.004b4117
mov esi, dword [ebp + 0xc]
push eax
push edi
mov dword [esi], eax
call dword [ebp + 0x14]
add esp, 0xc
test al, al
je 0x4cbb64
push dword [esi]
call fcn.004b3716
mov eax, dword [ebp + 0x10]
mov dword [esi], ebx
mov dword [eax], ebx
xor al, al
pop ecx
jmp 0x4cbb6e

Function at 0x4cbdee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [eax]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jle 0x4cbe3a
push esi
inc bl
movzx ebx, bl
mov edx, dword [eax + ebx*4 + 8]
add cl, dl
movzx ecx, cl
lea esi, [eax + ecx*4 + 8]
mov dword [ebp + 8], ecx
mov ecx, dword [esi]
mov dword [eax + ebx*4 + 8], ecx
add cl, dl
mov dword [esi], edx
mov esi, dword [ebp + 0xc]
movzx ecx, cl
mov cl, byte [eax + ecx*4 + 8]
add esi, edi
xor byte [esi], cl
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x4cbe03
pop esi
pop edi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
pop ebp
ret
Function at 0x4cc1a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, 0x387
mov ecx, eax
mov word [ebp - 0x14], ax
add eax, 0x43
mov word [ebp - 0x12], ax
push ebx
mov eax, 0x3ad
mov word [ebp - 0x10], ax
add eax, 0x13
mov word [ebp - 0x18], cx
add ecx, 0x70
push esi
mov word [ebp - 0xe], ax
mov eax, 0x3b4
push edi
mov word [ebp - 0x16], cx
mov ecx, eax
push 7
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], ax
pop ecx
xor ebx, ebx
mov dx, word [ebp + ecx*2 - 0x1a]
lea eax, [ebp + ecx*2 - 0x18]
xor word [eax], dx
dec ecx
cmp ecx, ebx
jg 0x4cc1ef
mov eax, 0x3c6
xor word [ebp - 0x18], ax
mov eax, 0x1a8a
mov word [ebp - 0x28], ax
add eax, 0x61
mov word [ebp - 0x26], ax
mov eax, 0x1a98
mov word [ebp - 0x24], ax
add eax, 0x41
mov word [ebp - 0x22], ax
mov eax, 0x1aac
lea ecx, [eax + 0x2c]
mov word [ebp - 0x20], ax
mov eax, ecx
mov word [ebp - 0x1e], ax
add eax, 0xffffffdf
mov edx, eax
push 7
mov word [ebp - 0x1c], dx
mov word [ebp - 0x1a], ax
pop edx
mov si, word [ebp + edx*2 - 0x2a]
lea eax, [ebp + edx*2 - 0x28]
xor word [eax], si
dec edx
cmp edx, ebx
jg 0x4cc24b
xor word [ebp - 0x28], cx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
push 0x1c
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
pop ecx
lea eax, [ebp - 0x44]
mov byte [eax], bl
inc eax
dec ecx
jne 0x4cc276
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push ebx
call fcn.004cf9a8
add esp, 0x10
test eax, eax
je 0x4cc29a
xor al, al
jmp 0x4cc32e
lea eax, [ebp - 4]
push eax
mov esi, 0x80000020
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call fcn.004cfa3b
mov edi, dword [ebp + 0x10]
add esp, 0x10
push dword [ebp + 0xc]
mov ebx, 0x659001c
test eax, eax
jne 0x4cc2d3
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.004b4d50
add esp, 0xc
jmp 0x4cc2f6
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.004b4d50
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004cfa3b
add esp, 0x1c
test eax, eax
jne 0x4cc311
test byte [edi + 0xc], 1
lea eax, [ebp - 4]
push eax
je 0x4cc30b
push ebx
call fcn.004cf30d
pop ecx
call eax
jmp 0x4cc311
call fcn.004cf8df
pop ecx
test byte [edi + 0xc], 1
lea eax, [ebp - 8]
push eax
je 0x4cc326
push ebx
call fcn.004cf30d
pop ecx
call eax
jmp 0x4cc32c
call fcn.004cf8df
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret