joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b1a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0048b27e
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.0048b2ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0048b27e
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call esi
test eax, eax
jne 0x48b245
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0048b27e
add esp, 0xc
xor eax, eax
jmp 0x48b27a
mov eax, dword [ebp - 0x98]
sub eax, ebx
je 0x48b277
dec eax
je 0x48b257
dec eax
je 0x48b269
jmp 0x48b241
cmp dword [ebp - 0xa0], ebx
jne 0x48b263
push 4
jmp 0x48b279
jbe 0x48b269
push 5
jmp 0x48b279
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x48b27a
push 3
pop eax
pop esi
pop ebx
leave
ret

Function at 0x48b2ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x4fa2c0], 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x48b30f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4fa2c0], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
mov eax, dword [0x4fa2c0]
add esp, 0xc
leave
ret

Function at 0x48b326
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
and byte [ebp - 2], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], 0x65
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6c
mov byte [ebp - 3], 0x41
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 6], 0x61
call fcn.0048b2ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
add esp, 0xc
test esi, esi
jne 0x48b3b4
push 1
pop eax
jmp 0x48b3bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x48b3c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.0048b2ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
add esp, 0xc
test esi, esi
jne 0x48b438
or eax, 0xffffffff
jmp 0x48b44c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x48b840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x72
call fcn.0048b2ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
add esp, 0xc
test esi, esi
jne 0x48b8b5
xor eax, eax
jmp 0x48b8b7
call esi
pop esi
leave
ret

Function at 0x48b8ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.0048b2ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
add esp, 0xc
test esi, esi
jne 0x48b95e
xor eax, eax
jmp 0x48b975
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x48b978
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.0048b2ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0048b27e
add esp, 0xc
test esi, esi
jne 0x48b9e9
xor eax, eax
jmp 0x48b9ee
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x48efe0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x48f0e0
push edi
xor al, al
lea edi, [ebp - 0x20]
mov ecx, 0x1c
rep stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x48f0df
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x48f0c7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x48f0c7
mov eax, dword [0x506830]
test eax, eax
jne 0x48f083
mov ecx, dword [0x4ff4e8]
push 0x400
push eax
push ecx
mov dword [0x506834], 0x100
call edi
mov dword [0x506830], eax
test eax, eax
je 0x48f0dc
jmp 0x48f0b5
mov ecx, dword [0x506834]
cmp dword [0x506838], ecx
jb 0x48f0b5
add ecx, ecx
lea edx, [ecx*4]
push edx
push eax
mov eax, dword [0x4ff4e8]
push 0
push eax
mov dword [0x506834], ecx
call esi
test eax, eax
je 0x48f0dc
mov dword [0x506830], eax
mov edx, dword [0x506838]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4], ecx
inc dword [0x506838]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x48f040
mov esi, dword [ebp - 0x24]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00490a21
mov esp, ebp
pop ebp
ret

Function at 0x48f100
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
call fcn.0048efe0
cmp dword [0x506830], 0
je 0x48f164
push edi
xor edi, edi
cmp dword [0x506838], edi
jbe 0x48f163
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
push esi
mov eax, dword [0x506830]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call ebx
mov esi, eax
test esi, esi
je 0x48f158
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
mov edx, esi
call fcn.0048ee70
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [0x506838]
jb 0x48f124
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x48f170
Capabilities:
Resume thread

Disassembly:
cmp dword [0x506830], 0
je 0x48f1e7
push esi
push edi
xor edi, edi
cmp dword [0x506838], edi
jbe 0x48f1bd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
lea esp, [esp]
mov eax, dword [0x506830]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call ebx
mov esi, eax
test esi, esi
je 0x48f1b3
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [0x506838]
jb 0x48f190
pop ebx
mov edx, dword [0x506830]
mov eax, dword [0x4ff4e8]
push edx
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov dword [0x506830], esi
mov dword [0x506834], esi
mov dword [0x506838], esi
pop esi
ret
Function at 0x48f1f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x506820]
push ebx
push esi
lea eax, [eax + eax*4]
test byte [ecx + eax*8 + 0x14], 1
lea esi, [ecx + eax*8]
push edi
mov edi, dword [esi]
mov ebx, 5
je 0x48f218
sub edi, ebx
mov ebx, 7
lea edx, [ebp - 4]
push edx
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x48f236
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
je 0x48f25d
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x48f27e
mov ecx, dword [esi]
mov byte [ecx], 0xeb
mov edx, dword [esi]
mov byte [edx + 1], 0xf9
jmp 0x48f27e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x48f278
mov cx, word [esi + 0x10]
mov word [edi + 4], cx
mov dl, byte [esi + 0x12]
mov byte [edi + 6], dl
jmp 0x48f27e
mov cl, byte [esi + 0x10]
mov byte [edi + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
and eax, 1
mov ecx, eax
and ecx, 0xfffffffd
lea edx, [eax + eax]
mov eax, dword [esi + 0x14]
or ecx, edx
add ecx, ecx
and eax, 0xfffffff9
or ecx, eax
pop edi
mov dword [esi + 0x14], ecx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48fed0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x506818]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x48ff10
jmp 0x48ff00
cmp dword [eax + 4], 0
jne 0x48ffb8
mov eax, dword [eax]
test eax, eax
jne 0x48ff00
and esi, 0xfffff000
push ebx
mov ebx, esi
lea esi, [ebx - 0x1000]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, ecx
jb 0x48ff50
lea ebx, [ebx]
push 0x40
push 0x3000
push 0x1000
push esi
call edi
test eax, eax
jne 0x48ff85
sub esi, 0x1000
cmp esi, dword [ebp - 8]
jae 0x48ff30
jmp 0x48ff54
test eax, eax
jne 0x48ff85
lea esi, [ebx + 0x1000]
cmp esi, dword [ebp - 4]
jae 0x48ffb6
nop
push 0x40
push 0x3000
push 0x1000
push esi
call edi
test eax, eax
jne 0x48ff85
add esi, 0x1000
cmp esi, dword [ebp - 4]
jb 0x48ff60
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [eax + 0x20]
mov edx, ecx
mov dword [eax + 4], 0
sub edx, eax
mov esi, dword [eax + 4]
mov dword [ecx], esi
mov dword [eax + 4], ecx
add edx, 0x20
add ecx, 0x20
cmp edx, 0x1000
jbe 0x48ff93
mov ecx, dword [0x506818]
mov dword [eax], ecx
mov dword [0x506818], eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x490a21
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fad60]
jne 0x490a2b
repz ret
jmp fcn.00497d12

Function at 0x492427
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x49244e
call fcn.004986a5
mov dword [eax], esi
call fcn.00498692
push 0x16
pop esi
mov dword [eax], esi
call fcn.00498607
mov eax, esi
jmp 0x4924a3
test dword [ebp + 0xc], 0xfffffff9
jne 0x492434
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49247b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004986b8
pop ecx
call fcn.00498692
mov eax, dword [eax]
jmp 0x4924a3
test al, 0x10
jne 0x4924a1
test al, 1
je 0x4924a1
test byte [ebp + 0xc], 2
je 0x4924a1
call fcn.004986a5
mov dword [eax], 5
call fcn.00498692
mov dword [eax], 0xd
jmp 0x492472
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4b7e70
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0049cff6
and dword [ebp - 0x14], 0
cmp dword [0x50038c], 0
mov dword [ebp - 0x18], eax
jne 0x4b7f23
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4b7fcb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e5f20
push ebx
call edi
test eax, eax
je 0x4b7fcb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x50038c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x500390], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x500394], eax
call edi
push eax
call esi
mov dword [0x50039c], eax
test eax, eax
je 0x4b7f23
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x500398], eax
mov eax, dword [0x500398]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4b7f7c
cmp dword [0x50039c], ecx
je 0x4b7f7c
push eax
call esi
push dword [0x50039c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4b7f7c
test ebx, ebx
je 0x4b7f7c
call edi
test eax, eax
je 0x4b7f73
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4b7f73
test byte [ebp - 8], 1
jne 0x4b7f7c
or dword [ebp + 0x10], 0x200000
jmp 0x4b7faf
mov eax, dword [0x500390]
cmp eax, dword [ebp - 0x18]
je 0x4b7faf
push eax
call esi
test eax, eax
je 0x4b7faf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4b7faf
mov eax, dword [0x500394]
cmp eax, dword [ebp - 0x18]
je 0x4b7faf
push eax
call esi
test eax, eax
je 0x4b7faf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x50038c]
call esi
test eax, eax
je 0x4b7fcb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4b7fcd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490a21
leave
ret
Function at 0x41cca8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41cd01
test eax, edx
je 0x41cd04
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41ccbf
movzx eax, word [eax]
sub eax, ecx
jmp 0x41cce6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41cce7
add ecx, 4
js 0x41ccd7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41cce4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41cce6
xor eax, eax
ret
test eax, eax
je 0x41cd10
test edx, edx
jne 0x41ccb0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x423dac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040716c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040aa28
mov edi, eax
cmp edi, 0x104
jbe 0x423d57
mov eax, edi
add eax, eax
call fcn.0040448c
mov esi, eax
jmp 0x423d59
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040aa28
push esi
call fcn.0040ca18
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x423d92
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x423d7c
mov eax, esp
cmp esi, eax
je 0x423d9f
mov eax, esi
call fcn.004044a8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x423dd8
cmp bl, 0
je 0x423dd4
cmp bl, 0x41
jl 0x423dcf
cmp bl, 0x5a
jg 0x423dcf
or bl, 0x20
xor al, bl
inc esi
jmp 0x423db3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x423d18
Function at 0x469ef0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x469ef6
ret

Function at 0x475540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4756fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x4756d9
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x4756d9
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x47550c]
call fcn.00408e14
add esp, 4
lea eax, [ebp - 4]
call fcn.0040a4e4
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x5e0cfc]
push eax
call fcn.00452e78
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408c4c
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00404aac
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x468830]
call fcn.00471ecc
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x4756b7
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.00473b48
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.004727ec
call fcn.0046cef0
push eax
call fcn.0040c940
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.00472b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4756d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475704
lea eax, [ebp - 8]
mov edx, dword [0x47550c]
call fcn.00408f38
lea eax, [ebp - 4]
call fcn.0040a4e4
ret
Function at 0x4a59c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4a5a22
test eax, edx
je 0x4a5a25
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4a59e0
movzx eax, word [eax]
sub eax, ecx
jmp 0x4a5a07
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4a5a08
add ecx, 4
js 0x4a59f8
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4a5a05
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4a5a07
xor eax, eax
ret
test eax, eax
je 0x4a5a31
test edx, edx
jne 0x4a59d1
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4acacd
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0048fe8d
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00493749
mov edi, eax
cmp edi, 0x104
jbe 0x4aca78
mov eax, edi
add eax, eax
call fcn.0048d1ad
mov esi, eax
jmp 0x4aca7a
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00493749
push esi
call fcn.00495739
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4acab3
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4aca9d
mov eax, esp
cmp esi, eax
je 0x4acac0
mov eax, esi
call fcn.0048d1c9
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4acaf9
cmp bl, 0
je 0x4acaf5
cmp bl, 0x41
jl 0x4acaf0
cmp bl, 0x5a
jg 0x4acaf0
or bl, 0x20
xor al, bl
inc esi
jmp 0x4acad4
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4aca39