joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc2f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x4dc4ad
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x4dc426
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x4dc426
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x4dc40d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4dc40d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.004dd560
mov ebp, eax
test ebp, ebp
je 0x4dc405
push ebp
mov ecx, esi
call fcn.004de990
test eax, eax
je 0x4dc405
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x4dc405
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4dc3c6
xor eax, eax
jmp 0x4dc3ce
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.004df360
inc ebx
xor ebp, ebp
jmp 0x4dc357
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x4dc330
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.004dd870
test eax, eax
pop ebx
je 0x4dc4ad
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.004dd560
mov edi, eax
cmp edi, ebp
je 0x4dc4ad
push edi
mov ecx, esi
call fcn.004de990
test eax, eax
je 0x4dc4ad
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.004ddab0
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.004ddb20
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.004df360
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x4e6990
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x543b67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x12e58cc
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.005302fe
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.005302fe
mov edi, dword [0x546670]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x12e58b8
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x5465b8]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x546060]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004e74b0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret

Function at 0x4fc1ad
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x543ea8
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x40]
test edx, edx
setne bl
inc ebx
test eax, eax
je 0x4fc1c3
or bh, 0x80
lea ecx, [esp + 0xc]
call fcn.00502110
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], 0
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.005023d0
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
call fcn.004fc230
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x12e92e0
call fcn.00502310
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x507830
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x13a2570]
xor edx, edx
cmp eax, edx
jne 0x507856
xor eax, eax
mov byte [eax + 0x13a2470], al
inc eax
cmp eax, 0x100
jl 0x50783e
mov dword [0x13a2570], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x13a2470
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5078e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5078ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x507888
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5078f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x507943
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x50792a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50e300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5443ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0050ec20
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x12ea4bc
call fcn.00531e91
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x50e393
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00531e91
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x50e38c
push 0
mov ecx, eax
call fcn.00505470
mov dword [esi + 0xc], eax
jmp 0x50e395
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x50e395
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40afed
Capabilities:
Encode data using xor

Disassembly:
call fcn.0041fe29
push 4
push dword [esi + 0xc]
call 0x41cdfde2
cld
cmp dword [eax], ebx
xor esp, dword [eax]
push esi
call 0x9f4ffde2
rcr byte [ecx - 0x7d], 0x7d
adc byte [ebx + 0x76ffe8cf], cl
sbb al, 0xc0
jne 0x40aff5
test edi, edi
push eax
call 0x737a5609
or byte [esi + 0x7f], dh
push edi
mov eax, dword [ebx + 4]

Function at 0x41fe50
Capabilities:
Enumerate pe sections

Disassembly:
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
xor eax, eax
pop esi
pop ebp
ret

Function at 0x424f15
Capabilities:
Encode data using xor

Disassembly:
shr eax, 0xba
invalid
mov ecx, dword [ebx + 0x6a0474e5]
or al, 0x68
loopne 0x424ea2
and byte [ecx - 0x18], bl
xor edi, dword [ebx + 0x65838b00]
in al, 0
inc edx
add al, ch
push esi
loopne 0x424f16
inc dword [ebx + 0x4d00fc65]
add byte [ebx + 0xc681fe1], al
pop es
invalid

Function at 0x4696e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fe6e
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420e83
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x46973c
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x469733
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x471fbf
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d06e0], 1
jne 0x471fcd
call fcn.004720a9
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x472005
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
sub dword [0x4d06e0], 1
jne 0x472018
call fcn.004720a9
mov eax, dword [0x4d2ff4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4d2ff4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x47205b
fadd qword [0x4c81c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4c8190]
leave
ret
Function at 0x472069
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4d2630], ecx
inc esi
mov edx, esi
mov eax, dword [edx*4 + 0x4d262c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x4d2630], eax
inc edx
cmp edx, 0x270
jl 0x472075
mov dword [0x4d06e0], esi
mov dword [0x4d2ff0], esi
pop esi
ret

Function at 0x4720a9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x4720cc
push 0
call fcn.0042e54b
pop ecx
mov ecx, eax
call fcn.00472069
mov dword [0x4d06e0], 0x270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x4720e1
mov eax, dword [esi]
mov dword [ebp - 4], 0x1bd9018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x47211b
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4bcaa0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
invalid
xchg edx, eax
dec ebx
invalid
mov eax, 1
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4bc070
or ecx, 0xffffffff
push dword [ebx]
ror byte [ebp - 0xdf2dbac], 0xae
Function at 0x424b1b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
outsb dx, byte [esi]
invalid
adc ebx, dword [esi]
push edx
mov dl, 0xe
mov ch, byte [esi + 0x2c]
xchg byte [ecx], bl
call dword [esi - 0x73efb308]
je 0x424a5f
leave
out dx, eax
sub eax, 0x9c206d
lds esp, [edi]
jne 0x424b50
or eax, 0x4477c99b
mov word [esi - 0x57d92224], gs
retf 0xf4e7
clc
insb byte es:[edi], dx
cmp al, 0xed
xchg dword [esi], esp
or bl, ch
and eax, 0x332f2c37
dec esp
inc ebx
jmp 0x424b48
mov eax, 0x829e48dc
wait
in eax, dx
shr dword [esi + 0x1c], 1
das
inc esp
pushfd
wait
adc byte [ebx], ch
loope 0x424ab9
add al, 0x79
mov ecx, ebx
push esp
movsb byte es:[edi], byte [esi]
ror byte [edx + 0x27478f83], 1
jne 0x424ac3
xchg bl, cl
inc eax
fcmovbe st(0), st(0)
sub al, 0xe
cmp byte [ebx - 0x38], cl
xor eax, 0x53927ccc
xchg edx, eax
push ebx
xchg esp, eax
jns 0x424b04
inc eax
wait
or dl, byte [edx]
out dx, al
adc ch, dh
xlatb
mov edx, 0xdbc5ce7
popal
push 0xffffffffffffff98
Function at 0x43a45e
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
sbb al, 0x1d
mov al, 0x2f
pushfd
bsf ebp, dword [edi]
pushfd
dec edi
cld
outsd dx, dword [esi]
push edx
dec ecx
adc ch, byte [edi + 0xd324310]
push esp
mov esi, dword [eax - 0x67]
invalid
Function at 0x4480fb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004482ee
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00452e43
xor ebx, ebx
cmp eax, ebx
jne 0x4482a9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004482ee
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0044fb22
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004a1417
add esp, 0x10
test eax, eax
jne 0x4481c4
push esi
call fcn.004457ad
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4481c4
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4481af
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4481c4
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4481bd
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00454356
cmp byte [esp + 0x13], bl
je 0x4481f4
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0044832b
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x448264
push 0x14
call fcn.004a0684
cmp eax, ebx
pop ecx
je 0x44821e
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x448220
xor edi, edi
cmp edi, ebx
je 0x448264
push esi
push edi
call fcn.00447851
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00447919
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00447a42
add esp, 0x18
call fcn.004482ee
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00452510
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x44827b
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x44828d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4482d0
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4482d0
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00447919
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00447a42
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4698a3
Capabilities:
Encode data using xor

Disassembly:
invalid
sbb al, 0xb1
fisttp dword [ebp - 0x6215e199]
mov dl, 0
add dword [ecx + 0x52d54a86], edx
pop es
adc eax, 0xa312735
jb 0x469897
test al, 0xa6
stosd dword es:[edi], eax
stosb byte es:[edi], al
sbb eax, 0x230c2182
mov byte [edx - 0x18b5a850], cl
pop eax
popal
pushal
insb byte es:[edi], dx
fcmovu st(0), st(7)
dec edi
sub byte [esi], al
fisttp word [edi + 0x28]
push es
sbb al, 0xa
mov dl, 0xc8
in al, dx
je 0x469902
xor dh, dh
xor dh, dh
dec esi
xor al, 0xf8
ror dword [ecx - 0x63], 0x10
aas
cmp eax, 0x46870e2
frstor dword [ecx]
cmc
aam 0x39
jne 0x4698db
adc eax, 0xf391525
or al, 0x31
fiadd word [eax + 0x51]
and dword [edi], esi
sub dh, ah
push ebx
mov ebp, 0xc0d76415
adc dword [eax + 0x1569f24e], ebp
popal
dec edi
sbb byte [esp + edx*8 - 0x409c6d07], 0x1c
inc ebp
sub bh, byte [ecx]
adc eax, 0x11c0d764
test al, 0x4e
imul edx, dword [0x9c824f61], 0x6392f9d4
mov edi, 0x392a451c
aam 0xf9
xchg edx, eax
arpl word [edi + 0x392a451c], di
jb 0x469910
jo 0x4698d0
out 2, al
stosd dword es:[edi], eax
adc al, 0x13
hlt
Function at 0x495462
Capabilities:
Encode data using xor

Disassembly:
inc ebx
movsw word es:[edi], word [esi]
in al, 6
dec ebp
and ebp, eax
cmp ebp, dword [edx + esi*8]
mov al, 0x24
stosd dword es:[edi], eax
sub bh, byte [ecx + 0x2404e29a]
add al, 0x24
cmpsd dword [esi], dword es:[edi]
adc esp, dword [si - 0xd]
and dl, byte [ecx + 0x15]
stosb byte es:[edi], al
or dword [ebx - 0x6a3e7801], 0xe016e3a2
hlt
adc dword [ebp - 0x15079b3e], 0x729210ab
mov byte [0xe4c468c9], al
xchg edx, eax
and eax, 0xb3c7e162
invalid
mov bl, 0x95
aad 0xb5
or edx, dword [edx - 0x55]
and bl, byte [eax + 0x21]
int 0xb5
movsb byte es:[edi], byte [esi]
and esp, 0x2aa77c8b
push ebp
mov eax, dword [0xbc6a7cd3]
jl 0x49533a
sub dl, byte [ebp - 0x5f]
sar dword [edx + ebp*2 - 0x44], cl
mov cl, 0xc8
xor ah, byte [eax + 0x6e]
xchg edx, eax
xchg dword fs:[edi + 0x36ca3ed], ecx
xchg byte [0xa770f568], ah
pushfd
and ecx, dword [edi]
invalid
jg 0x5124df3e
cmp al, 0x1c
mov ah, ch
mov dword [0x323465f1], eax
int1
xor al, 0x32
cld
mov bh, 0x67
mov cl, 0xec
js 0x49534e
inc ebx
loope 0x4953bb
xor byte [eax], ah
out 0x31, al
daa
jbe 0x49536c
inc esi
dec ecx
bound ecx, qword [ebp - 0x54]
inc esp
jbe 0x4953e6
mov esp, 0xa5222226
pop eax
sbb al, 0x82
jnp 0x495391
and al, 0x16
dec edx
sahf
dec edx
cmp eax, ebp
pushfd
inc esp
aam 0xb3
movsb byte es:[edi], byte fs:[esi]
inc edx
xor al, 0x4c
js 0x4953b0
push edi
inc ecx
and dl, dl
add byte [esi + 0x67ecb645], 0xa4
add ch, byte [esi + 0x1d656b36]
aas
cmp dh, al
xor byte [edi + 0x12], dl
out dx, eax
jle fcn.00495462
xchg edx, eax
rcr byte [0xc63198d4], 1
in al, 0x27
in eax, dx
mov byte [0x6115d3b7], al
loopne 0x4953cd
mov bh, 0xd3
adc eax, 0x45ace061
inc ebp
loope 0x495408
xor dword [eax], edx
push es
aad 0x71
inc edi
adc byte [esi], ah
mov byte [esi - 0x52], dl
inc ebp
sub al, 0xeb
and edi, dword [eax - 0x2ac37a76]
push es
or ah, byte [eax - 0x2e]
mov al, byte [ebp - 0x736b99b4]
xchg esp, eax
invalid
mov ah, byte [esi + edx*2]
iretd
xchg byte [edi], cl
mov ah, 0xa3
xor byte es:[esi + 0x164a4c53], dl
scasd eax, dword es:[edi]
mov dl, 0x74
adc cl, byte [esp + 0x302400e5]
sub eax, 0x294a1603
mov dh, byte [ebp - 0x13aef125]
je 0x49541b
and al, 0xd7
xor dword [eax + ebp*8 - 0x1ca09b01], 0xffffffe9
mov eax, dword [esi + ebp*4 + 4]
mov dl, 0xeb
pop ecx
in eax, 0x32
loopne 0x495455
xchg esp, eax
lds esp, cs:[ebx + 0x42ac76b8]
mov dword [0x42ac76b8], eax
adc al, 0x64
add ah, dh
jmp 0x495490
Function at 0x4ae85d
Capabilities:
Encode data using xor

Disassembly:
inc ebx
xchg edx, eax
xor al, 0xb5
fldcw word [ecx + 5]
xor byte [edx], al
dec edx
loope 0x4ae80b
ret 0xa64b