joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa73250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa87808
push 0xa77288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xa73329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xa73329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00a761d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xa73329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xa73329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xa7332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00a73351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa73d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa73d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xa73d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa73d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xa73d94
push eax
push esi
call fcn.00a7620b
add esp, 8
pop esi
ret 0x10

Function at 0xa73da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa73e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xa73e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xa8c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a75dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xa73dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xa73e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa73ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xa73eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xa8c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a75dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xa73eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xa73e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xa74000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xa74131
push esi
call fcn.00a77145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00a66080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xa74131
push 0
push ebp
call fcn.00a663a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00a66260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xa7408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00a662f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xa74121
push 0xa8c918
push edi
call fcn.00a753f0
push eax
push ebx
push esi
call fcn.00a73f60
push 0xa8c8f8
push edi
call fcn.00a753f0
push eax
push ebx
push esi
call fcn.00a73f60
push 0xa8c8d8
push edi
call fcn.00a753f0
push eax
push ebx
push esi
call fcn.00a73f60
push 0xa8c8c0
push edi
call fcn.00a753f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00a73f60
push 0xa8c8a0
push edi
call fcn.00a753f0
push eax
push ebx
push esi
call fcn.00a73f60
push 0xa8c888
push edi
call fcn.00a753f0
push eax
push ebx
push esi
call fcn.00a73f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xa751b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a75140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a75140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a75140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a75140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa75bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa75c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa8787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa75c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa75c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401a9c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x51016c
call fcn.004e26a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov byte [ecx + 0xc], 1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x14], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x15], 0
mov edx, dword [ebp + 8]
mov byte [edx + 0x16], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x17], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 2
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x24], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x28], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x2c], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x30], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x40], ecx
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4682f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4682fe
ret

Function at 0x4c3dbc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4c3e4c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4c3e4c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4c3dff
test edx, 3
jne 0x4c3dee
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4c3df9
jmp 0x4c3dff
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4c3dff
cmp dword [ecx - 8], 1
je 0x4c3e09
mov edx, ebx
or edx, 3
call fcn.004d5750
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4c3e1b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004d4fbc
Function at 0x4c3e58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4c3ee8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4c3ee8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4c3e9b
test edx, 3
jne 0x4c3e8a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4c3e95
jmp 0x4c3e9b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4c3e9b
cmp dword [ecx - 8], 1
je 0x4c3ea5
mov edx, ebx
or edx, 3
call fcn.004d5750
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4c3eb7
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004d4fbc

Function at 0x4d9470
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x52c514
call fcn.004e26a4
mov word [ebp - 0x18], 0xc
mov edx, 0x52c9d4
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004dde64
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4d94bd
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004dc690
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4d94c0
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dec5c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x52d8ec
call fcn.004e26a4
mov word [ebp - 0x18], 0xc
mov edx, 0x52dc5c
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004dde64
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4deca9
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004dc690
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4decac
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f0610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4f0642
cmp dword [ebp + 0x10], 0
je 0x4f0642
xor esi, esi
mov ebx, eax
cmp esi, dword [ebp + 0x10]
jge 0x4f0642
push edi
call fcn.004f0648
pop ecx
mov al, byte [edi + 4]
xor byte [ebx], al
inc esi
inc ebx
cmp esi, dword [ebp + 0x10]
jl 0x4f062f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f0690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push eax
call fcn.004e2314
pop ecx
mov dword [ebp - 4], eax
xor edi, edi
cmp dword [ebp - 4], 0
jle 0x4f06bc
mov edi, dword [ebp - 4]
add edi, edi
add edi, 2
mov eax, dword [ebp + 0x14]
push eax
push esi
push ebx
call fcn.004f0610
mov word [esi], di
add esp, 0xc
mov edx, dword [ebx]
mov dword [ebx + 4], edx
xor ecx, ecx
lea eax, [esi + 2]
mov dword [ebp - 8], ecx
mov esi, eax
mov dword [ebp - 0xc], 2
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
mov edi, edx
jge 0x4f0712
push ebx
call fcn.004f0648
pop ecx
mov dl, byte [edi]
xor dl, byte [ebx + 4]
mov byte [esi], dl
inc edi
inc dword [ebp - 8]
inc esi
inc dword [ebp - 0xc]
inc esi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jl 0x4f06f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f15e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004f168c
add esp, 0x10
test al, al
je 0x4f160c
mov al, 1
jmp 0x4f167a
mov edx, dword [ebp + 8]
lea esi, [ebp + 0x14]
lea edi, [edx + 4]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
dec edx
je 0x4f1626
jmp 0x4f1678
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x14], eax
xor edx, edx
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
xor dword [ecx + 0x14], edx
inc dword [ebp - 4]
add dword [ebp - 8], 4
cmp dword [ebp - 4], 4
jl 0x4f1639
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x14]
sar edx, 0x10
xor dword [ecx + 0x14], edx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f17c4
add esp, 0xc
mov al, 1
jmp 0x4f167a
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
pop ebp
ret
Function at 0x4f1708
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 4]
add dword [ebp - 0x18], 4
cmp dword [ebp - 4], 4
jl 0x4f171b
cmp dword [ebp + 0xc], 0
je 0x4f17bd
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0
je 0x4f17bd
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 0x1c], ecx
jmp 0x4f17ae
mov eax, dword [ebp - 0x1c]
movsx edx, byte [eax]
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
and eax, 0xfe000000
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x20]
shl dword [edx], 7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
xor dword [eax], ecx
mov edx, dword [ebp - 0x10]
sar edx, 0x19
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
cmp dword [ebp - 0x14], 4
jl 0x4f1766
mov ecx, dword [ebp - 0x10]
sar ecx, 0x13
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
xor dword [eax], edx
inc dword [ebp - 8]
inc dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e2314
pop ecx
cmp eax, dword [ebp - 8]
jg 0x4f1750
mov esp, ebp
pop ebp
ret

Function at 0x4f17c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jge 0x4f1802
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f1808
add esp, 8
mov edx, dword [ebp - 8]
xor byte [edx], al
inc dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jl 0x4f17df
pop ecx
pop ecx
pop ebp
ret
Function at 0x4f89dc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4f8a0a
mov eax, ebx
call fcn.004f9490
cmp dword [ebx + 0x40], 0
je 0x4f8a03
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4f8a7b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4f8a6d
cmp dword [ebx + 8], 0
je 0x4f8a2c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4f8a3e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f8a6d
cmp dword [ebx + 8], 0
je 0x4f8a1f
cmp eax, 3
je 0x4f8a51
dec eax
jne 0x4f8a1f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4f8a1f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4f8a1f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4f8a99
cmp dword [ebx + 0x14], 0xcc
je 0x4f8a99
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f8aa4
pop ebx
ret

Function at 0x5dfd1c
Capabilities:
Encode data using base64

Disassembly:
jmp loc.0062b917
mov dword [esp], eax
pop eax
mov dword [ebp - 0x1c], eax
push ecx
push 0xf6a9be0c
jmp 0x5df766

Function at 0x5e411d
Capabilities:
Encode data using base64

Disassembly:
add eax, 0x403f9a
xchg dword [esp], eax
jmp loc.006225d6
xchg dword [esp], ebx
pop ebx
mov dword [esp], eax
push 0x8bce7c4
pop eax
xor eax, 0xbb9f60e3
and eax, 0x486d023f
jmp 0x5e079a

Function at 0x5e9bc0
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp], ecx
pop ecx
mov eax, 0x5f63d8
call fcn.005f4d67
cmp dword [0x61d08c], 0
jne 0x61408a
jmp loc.005f1f6f

Function at 0x5ec636
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
je 0x5ed631
jmp fcn.00605975
push 0x62c60e
jmp fcn.0060ad7d

Function at 0x5f0b86
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
jmp 0x5f5111
jmp 0x5f7d8e
push ecx
mov esp, ebp
pop ebp
mov eax, dword [0x5e6248]
or eax, eax
jne 0x5fb2ce
push ebx
jmp 0x5f0c3e
push 0xf65c6430
pop ebx
add ebx, dword [0x400202]
and ebx, dword [0x400204]
add ebx, 0x61eea2
xchg dword [esp], ebx
jmp 0x5e366e
rol eax, 0x12
push eax
ret

Function at 0x5f300e
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ecx
pop ecx
add eax, 0x509311db
mov eax, dword [eax]
or eax, eax
jne 0x5ea701
jmp 0x60bbf5
je 0x61fa0d
jmp 0x617485
push 0x820b5467
jns 0x5e5a96
jmp 0x61fa0d
mov eax, 0x80f02d07
call fcn.005ea64d
rol eax, 1
xor eax, 0xa633659b
push ebx
jmp 0x626450
jmp 0x5df645

Function at 0x5fd600
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edi
pop edi
add edx, ebp
add edx, 0xedd5b5c4
mov dword [edx], eax
jmp 0x604b71
jmp 0x610dfa
pop edx
mov eax, dword [ebp - 0x10]
push eax
mov edx, eax
jmp 0x611efa
call fcn.0060f0d8
call fcn.005f57df
or edx, ebp
xchg dword [ebx], esi
jmp fcn.005fc3b5