joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421690
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
sub esp, 0x2c
mov eax, dword [0x53de10]
xor eax, esp
mov dword [esp + 0x24], eax
xor eax, eax
push ebx
push esi
mov esi, edx
test esi, esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ebx, ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
je 0x421700
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x4216fc
test ecx, ecx
jne 0x4216fc
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x421750
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x4216fc
test ecx, ecx
je 0x421750
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0x10]
push edx
push edi
mov word [esp + 0x1a], ax
call dword [sym.imp.WS2_32.dll_bind]
mov esi, eax
test esi, esi
jge 0x421777
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push esi
push ebx
push edi
push str.ERROR_on_binding_fd__d_to_port__d___d__d__n
mov esi, 1
call fcn.004214d0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004b883d
add esp, 0x2c
ret
push esi
push str.Unable_to_find_interface__s_n
mov esi, 1
call fcn.004214d0
add esp, 8
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004b883d
add esp, 0x2c
ret
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x4217c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004bb356
add esp, 4
push eax
push str.getsockname:__s_n
mov esi, 2
call fcn.004214d0
add esp, 8
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004b883d
add esp, 0x2c
ret
mov edx, dword [esp + 0x1e]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x2c]
movzx ebx, ax
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004b883d
add esp, 0x2c
ret
Function at 0x422160
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
cmp dword [ebx + 0x168], 0
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_setsockopt]
push esi
mov esi, 1
mov dword [esp + 0xc], esi
je 0x4221d2
push 4
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
mov dword [esp + 0x1c], esi
call ebp
test eax, eax
jl 0x4221f9
mov ecx, dword [ebx + 0x168]
mov edx, dword [ebx + 0x170]
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0xc
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x98000004
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x4221f9
push 0x531f30
mov dword [esp + 0xc], esi
call dword [sym.imp.WS2_32.dll_getprotobyname]
test eax, eax
jne 0x422201
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.getprotobyname___failed_with_error__d_n
call fcn.004214d0
add esp, 8
mov eax, esi
pop esi
pop ebp
add esp, 0x18
ret
movsx eax, word [eax + 8]
push 4
lea edx, [esp + 0xc]
push edx
push esi
push eax
push edi
call ebp
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret

Function at 0x422230
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x53de10]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42226f
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004b883d
add esp, 0x1a0
ret
push eax
push str.WSAStartup_failed_with_error:__d_n
mov esi, 1
call fcn.004214d0
mov ecx, dword [esp + 0x1a4]
add esp, 8
mov eax, esi
pop esi
xor ecx, esp
call fcn.004b883d
add esp, 0x1a0
ret
Function at 0x425790
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [edi + 0xfc]
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0xc]
test ebx, ebx
push ebp
push esi
mov esi, dword [eax]
jne 0x4257ac
mov ebx, 0x1000
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + 0x38]
sub ebx, ecx
cmp ebx, eax
jbe 0x4257ba
mov ebx, eax
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
cmp ebx, eax
jbe 0x4257c7
mov ebx, eax
cmp ebx, 1
jbe 0x4258d8
mov edx, dword [edi + 0x28]
sub ebx, 1
test byte [edi + 0xdc], 4
lea eax, [edx + ecx + 0x10]
je 0x425802
push ebx
push esi
push eax
call fcn.004bbfd0
mov eax, dword [esp + 0x20]
add dword [eax], ebx
add dword [edi + 0x3c], ebx
sub dword [edi + 0x38], ebx
add esp, 0xc
sub dword [ebp], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
movzx ebp, byte [edi + 0xd2]
mov ecx, ebp
and ecx, 3
movzx edx, byte [ecx + edi + 0x40]
lea ecx, [ebp + 1]
and ecx, 3
mov byte [esp + 0xc], dl
movzx edx, byte [ecx + edi + 0x40]
lea ecx, [ebp - 2]
add ebp, 0xffffffff
and ecx, 3
and ebp, 3
mov byte [esp + 0xd], dl
movzx edx, byte [ecx + edi + 0x40]
mov cl, byte [edi + ebp + 0x40]
mov ebp, ebx
shr ebp, 2
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], cl
je 0x425895
lea ebx, [ebx]
movzx edx, byte [esi]
xor dl, byte [esp + 0xc]
add esi, 1
mov byte [eax], dl
movzx ecx, byte [esi]
xor cl, byte [esp + 0xd]
add eax, 1
mov byte [eax], cl
movzx edx, byte [esi + 1]
xor dl, byte [esp + 0xe]
add esi, 1
add eax, 1
mov byte [eax], dl
movzx ecx, byte [esi + 1]
xor cl, byte [esp + 0xf]
add esi, 1
add eax, 1
sub ebp, 1
mov byte [eax], cl
add eax, 1
add esi, 1
test ebp, ebp
jne 0x425850
mov ecx, ebx
xor ebp, ebp
and ecx, 3
jle 0x4258b5
mov edi, edi
mov dl, byte [esp + ebp + 0xc]
xor dl, byte [esi]
add ebp, 1
mov byte [eax], dl
add eax, 1
add esi, 1
cmp ebp, ecx
jl 0x4258a0
mov al, byte [edi + 0xd2]
mov ebp, dword [esp + 0x18]
add al, bl
and al, 3
mov byte [edi + 0xd2], al
mov eax, dword [esp + 0x14]
add dword [eax], ebx
add dword [edi + 0x3c], ebx
sub dword [edi + 0x38], ebx
sub dword [ebp], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4260f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [edi + 0x13c]
push esi
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jl 0x426128
cmp dword [edi + 0xec], 0
je 0x426124
mov ecx, dword [edi + 0xec]
cdq
add dword [ecx + 0x138], eax
adc dword [ecx + 0x13c], edx
mov eax, esi
pop esi
ret
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x426163
call esi
cmp eax, 0x2733
je 0x426163
call esi
cmp eax, 0x2714
je 0x426163
call esi
push eax
push str.error_on_reading_from_skt_:__d_n
mov esi, 4
call fcn.004214d0
add esp, 8
or eax, 0xffffffff
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x426980
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x12c]
test eax, eax
jne 0x4269df
push eax
mov eax, dword [esi + 0x13c]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x426a1b
push edi
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x4269c5
call edi
cmp eax, 0x2733
je 0x4269c5
call edi
cmp eax, 0x2714
je 0x4269c5
or eax, 0xffffffff
pop edi
ret
call edi
cmp eax, 0x2733
jne 0x4269d8
or dword [esi + 0x160], 0x100000
mov eax, 0xfffffffe
pop edi
ret
push ecx
push edx
push eax
call fcn.00497fe0
add esp, 0xc
test eax, eax
jg 0x426a1b
mov ecx, dword [esi + 0x12c]
push eax
push ecx
call fcn.0049a0d0
add esp, 8
cmp eax, 2
je 0x426a16
cmp eax, 3
je 0x426a0c
or eax, 0xffffffff
ret
or dword [esi + 0x160], 0x100000
mov eax, 0xfffffffe
ret
Function at 0x427490
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ecx, ecx
test ebp, ebp
push esi
push edi
mov dword [esp + 0x14], ecx
je 0x427577
mov dword [esp + 0x10], 4
xor edi, edi
xor ecx, ecx
test ebp, ebp
je 0x4274ca
mov bl, byte [eax]
add eax, 1
add edi, 1
mov byte [esp + ecx + 0x1c], bl
sub ebp, 1
jmp 0x4274cf
mov byte [esp + ecx + 0x1c], 0
add ecx, 1
cmp ecx, 3
jl 0x4274b5
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x20]
jge 0x42758d
movzx ecx, byte [esp + 0x1c]
mov esi, ecx
shr esi, 2
movzx ebx, byte [esi + 0x52f3b8]
movzx esi, byte [esp + 0x1d]
mov byte [edx], bl
and ecx, 3
mov ebx, esi
shr ebx, 4
shl ecx, 4
or ebx, ecx
mov cl, byte [ebx + 0x52f3b8]
mov bl, byte [esp + 0x1e]
add edx, 1
mov byte [edx], cl
add edx, 1
cmp edi, 1
jle 0x427539
and esi, 0xf
movzx ecx, bl
add esi, esi
shr ecx, 6
add esi, esi
or ecx, esi
movsx ecx, byte [ecx + 0x52f3b8]
jmp 0x42753e
mov ecx, 0x3d
mov byte [edx], cl
add edx, 1
cmp edi, 2
jle 0x427554
and ebx, 0x3f
movsx ecx, byte [ebx + 0x52f3b8]
jmp 0x427559
mov ecx, 0x3d
mov byte [edx], cl
mov ecx, 4
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
add edx, 1
test ebp, ebp
jne 0x4274b1
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 1]
cmp eax, dword [esp + 0x20]
jge 0x42758d
pop edi
pop esi
pop ebp
mov byte [edx], 0
mov eax, ecx
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x42b620
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x70
mov eax, dword [0x53de10]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
push 0x68
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.004bbbe0
mov ecx, dword [esp + 0x88]
push ecx
push esi
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
mov dword [esp + 0x2c], 0xc3d2e1f0
call fcn.0042b4d0
add esp, 0x14
mov eax, esi
call fcn.0042b580
mov ecx, dword [esp + 0x74]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004b883d
add esp, 0x70
ret

Function at 0x434ce0
Capabilities:
Enumerate pe sections

Disassembly:
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x434d16
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x434cfd
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x434d0e
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x434d18
inc edi
add eax, 0x28
cmp edi, esi
jb 0x434cf3
xor eax, eax
pop edi
pop esi
ret

Function at 0x435090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.00434cab
push eax
push esi
push dword [ebp + 8]
call fcn.00434c60
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59

Function at 0x4350f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00434cab
push eax
push esi
push dword [ebp + 8]
call fcn.00434c60
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00434c9b
or ch, byte [edx + ecx*4 + 0x17]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
invalid
inc ebp
invalid
Function at 0x435b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00434c9b
xchg esi, eax
and ah, bh
rol byte [eax - 0x22f5b], cl
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00434c79
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
invalid
invalid
xchg esp, eax
cld
Function at 0x438810
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004bbbb0
mov eax, dword [0x53de10]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x438875
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x438875
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004ba53b
add eax, 0x40
push eax
call fcn.004bc80a
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b883d
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004bb923
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x438908
call fcn.004386d0
test eax, eax
jle 0x438908
push esi
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4388f2
push 0
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b883d
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b883d
add esp, 0x108
ret

Function at 0x438970
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x438996
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
add eax, 1
or cl, dl
sub edi, 1
jne 0x438986
pop esi
movzx eax, cl
pop edi
ret
Function at 0x467700
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.004bbbb0
mov eax, dword [0x53de10]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
push edi
mov edi, dword [esp + 0x9c]
je 0x467775
cmp ebx, dword [esi]
je 0x46776c
test edi, edi
je 0x467752
cmp dword [esp + 0xa0], eax
jge 0x46776c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004b883d
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x46777b
mov ebx, dword [esi]
test ebx, ebx
je 0x467752
test edi, edi
push ebp
je 0x46784d
push ebx
call fcn.00449350
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x4677ab
push str.j____int_sizeof_ctx__key_
push 0x6a
push str..cryptohmachmac.c
call fcn.00438940
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x467805
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.00448930
add esp, 0xc
test eax, eax
je 0x467908
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.00448ae0
add esp, 0xc
test eax, eax
je 0x467908
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.00448af0
add esp, 0xc
test eax, eax
je 0x467908
jmp 0x46782a
cmp eax, 0x80
ja 0x467908
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.004bbfd0
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x467855
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.004bbbe0
add esp, 0xc
jmp 0x467855
test eax, eax
je 0x4678f4
xor eax, eax
jmp 0x467860
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x467860
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.00448930
add esp, 0xc
test eax, eax
je 0x467908
push ebx
call fcn.00449350
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00448ae0
add esp, 0x10
test eax, eax
je 0x467908
xor eax, eax
jmp 0x4678b0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x4678b0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.00448930
add esp, 0xc
test eax, eax
je 0x467908
push ebx
call fcn.00449350
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00448ae0
add esp, 0x10
test eax, eax
je 0x467908
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.00448c80
add esp, 8
test eax, eax
jne 0x46790c
xor eax, eax
jmp 0x467911
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b883d
add esp, 0x88
ret
Function at 0x469689
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.004bbbb0
mov eax, dword [0x53de10]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
test eax, eax
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
jbe 0x46981c
push ebx
add eax, 0xffffffff
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
add eax, 1
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
xor eax, eax
mov ah, byte [esi + 1]
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
movzx edx, byte [esi + 1]
or ebx, eax
add esi, 1
movzx eax, byte [esi + 1]
shl ecx, 0x10
add esi, 1
or ebx, ecx
xor ecx, ecx
mov ch, byte [esi + 1]
add esi, 1
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 1]
or eax, ecx
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 1
mov byte [edi], dl
mov byte [ebp], al
call fcn.004760b0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.00476130
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004e6bc0
push ebp
call fcn.004760b0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.00476130
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004e6bc0
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
add eax, 1
shr edx, 8
add esp, 0x30
mov byte [eax], dl
add eax, 1
add eax, 1
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
add eax, 1
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
add eax, 1
add eax, 1
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
add eax, 1
mov byte [eax], cl
mov edx, ecx
shr edx, 8
add eax, 1
mov byte [eax], dl
mov edx, ecx
add eax, 1
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x4696a7
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.004b883d
add esp, 0xa0
ret
Function at 0x48adc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x48add9
mov esi, edi
mov edi, eax
jmp 0x48addb
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x48adeb
mov eax, ebx
jmp 0x48adf5
push eax
push ebx
call fcn.00441c80
add esp, 8
test eax, eax
jne 0x48adfd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x48ae1b
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x48ae04
cmp eax, dword [esi + 4]
jge 0x48ae32
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x48ae20
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x48ae55
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x48ae52
sub eax, 1
test eax, eax
jg 0x48ae42
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4b883d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x53de10]
jne 0x4b8847
repz ret
jmp fcn.004c133c