joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467718
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x4dc16c
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x46779d
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x4677f2
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
xor cl, byte [esi]
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
and ebx, 0xff
mov bl, byte [edi + ebx]
mov byte [esp + 4], bl
and ecx, 0xff
and eax, 0xff
shl eax, 8
or ecx, eax
xor eax, eax
mov al, dl
shl eax, 0x10
or ecx, eax
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
or ecx, eax
mov eax, ecx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x468a28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov bp, 0x10
mov esi, dword [esp]
mov eax, dword [esi]
xor dword [ebx], eax
mov edx, dword [ebx]
mov eax, dword [esp]
call fcn.004689d4
xor dword [edi], eax
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
add esi, 4
dec bp
jne 0x468a3b
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x40]
xor dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x44]
xor dword [ebx], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x468a7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov bp, 0xfff0
mov esi, dword [esp]
add esi, 0x44
mov eax, dword [esi]
xor dword [ebx], eax
mov edx, dword [ebx]
mov eax, dword [esp]
call fcn.004689d4
xor dword [edi], eax
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
sub esi, 4
inc bp
jne 0x468a92
mov eax, dword [ebx]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 4]
xor dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax]
xor dword [ebx], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x468ad0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, 4
mov ecx, 0x4dc5d4
mov eax, dword [esp]
add eax, 0x48
mov dword [esp + 0x10], eax
mov ebx, pe_nt_image_headers32
mov eax, ecx
mov edx, dword [esp + 0x10]
mov esi, dword [eax]
mov dword [edx], esi
add edx, 4
add eax, 4
dec ebx
jne 0x468afd
add dword [esp + 0x10], 0x400
add ecx, 0x400
dec edi
jne 0x468af2
xor ebx, ebx
mov edi, 0x12
mov dword [esp + 0x14], 0x4dc58c
mov eax, dword [esp]
mov dword [esp + 0x18], eax
xor ebp, ebp
mov esi, 4
shl ebp, 8
mov eax, dword [esp + 4]
movzx eax, byte [eax + ebx]
or ebp, eax
inc ebx
mov eax, dword [esp + 4]
call fcn.0040540c
cmp ebx, eax
jl 0x468b55
xor ebx, ebx
dec esi
jne 0x468b38
mov eax, dword [esp + 0x14]
xor ebp, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [eax], ebp
add dword [esp + 0x18], 4
add dword [esp + 0x14], 4
dec edi
jne 0x468b31
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor edi, edi
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.00468a28
mov eax, dword [esp]
mov edx, dword [esp + 8]
mov dword [eax + edi*4], edx
mov eax, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [eax + edi*4 + 4], edx
add edi, 2
cmp edi, 0x12
jl 0x468b7f
mov edi, 4
mov esi, dword [esp]
xor ebx, ebx
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, dword [esp]
call fcn.00468a28
mov eax, dword [esp + 8]
mov dword [esi + ebx*4 + 0x48], eax
mov eax, dword [esp + 0xc]
mov dword [esi + ebx*4 + 0x4c], eax
add ebx, 2
cmp ebx, 0x100
jl 0x468bb6
add esi, 0x400
dec edi
jne 0x468bb4
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x468f40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dl, byte [eax + 1]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x468fb9
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
mov esi, edx
and esi, 0xff
mov cl, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov bl, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov bl, byte [ebx + esi]
and ecx, 0xff
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x468f69
mov cl, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x468fcc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dl, byte [eax + 1]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x469045
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
inc edx
mov esi, edx
and esi, 0xff
mov cl, byte [eax + esi + 2]
add byte [ebp - 0xd], cl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov bl, byte [eax + ebx + 2]
push ebx
pop ebx
mov byte [eax + esi + 2], bl
xor ebx, ebx
mov bl, byte [ebp - 0xd]
mov byte [eax + ebx + 2], cl
add cl, byte [eax + esi + 2]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov bl, byte [ebx + esi]
and ecx, 0xff
xor bl, byte [eax + ecx + 2]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov byte [ecx + esi], bl
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x468ff5
mov cl, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [eax + 1], dl
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4695b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x4695d9
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x46971f
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x469605
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x46971f
test eax, eax
jbe 0x4696a6
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x469636
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, edi
call fcn.00402c74
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x4696a6
lea edx, [ebx + eax + 0x88]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.00402c74
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x88]
mov eax, dword [eax]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x8c]
mov eax, dword [eax]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.00469248
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x4696fc
mov eax, dword [esi]
lea edx, [ebx + 0x80]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x84]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.00469248
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x80], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x4696ab
test edi, edi
jbe 0x469715
lea edx, [ebx + 0x88]
mov eax, esi
mov ecx, edi
call fcn.00402c74
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x469728
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x46974d
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x469896
mov eax, dword [ebx + 0x90]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x469779
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x469896
test eax, eax
jbe 0x46981b
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4697ab
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c74
add dword [ebx + 0x90], edi
xor edi, edi
jmp 0x46981b
lea edx, [ebx + eax + 0x88]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402c74
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x8c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x88]
call fcn.004693d0
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
xor eax, eax
mov dword [ebx + 0x90], eax
cmp edi, 8
jb 0x469872
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004693d0
lea eax, [ebx + 0x80]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x84]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x84], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x469820
test edi, edi
jbe 0x46988c
lea edx, [ebx + 0x88]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c74
mov dword [ebx + 0x90], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x469b9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4dd74c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4dd74c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4dd74c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4dd74c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4dd6d0]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x469bc7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x469c94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4dd74c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4dd74c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4dd74c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4dd74c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4dd6d0]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x469ccf
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x469db0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4dd74c]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4dd74c]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4dd74c]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4dd74c]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4dd6d0]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4dd74c]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4dd74c]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4dd74c]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4dd74c]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x469dfb
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x488318
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x488321
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48888d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0xc], 0
sete byte [ebp - 0x4d]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00458834
mov eax, dword [ebp - 0x14]
call fcn.004045c4
test eax, eax
jne 0x488373
mov dword [ebp - 0x10], 0x1f0b
jmp 0x488865
mov dl, 1
mov eax, dword [0x45c9f8]
call fcn.0045d3f4
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x488608
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x38]
mov byte [eax + 4], 0x30
mov dl, 1
mov eax, dword [ebp - 0x38]
call fcn.0045dae4
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.0045db88
mov esi, eax
mov byte [esi + 4], 0x30
xor edx, edx
mov eax, esi
call fcn.0045dae4
mov edx, eax
mov eax, esi
call fcn.0045db88
mov ebx, eax
mov byte [ebx + 4], 6
mov edx, dword [0x4e0b1c]
mov eax, ebx
call fcn.0045cde4
mov dl, 1
mov eax, esi
call fcn.0045dae4
mov edx, eax
mov eax, esi
call fcn.0045db88
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov byte [eax + 4], 0xa0
mov dl, 1
mov eax, esi
call fcn.0045dae4
mov edx, eax
mov eax, esi
call fcn.0045db88
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x479da4]
call fcn.00479e04
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x4884e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.00479f0c
mov ecx, 0x4888a8
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.00479eb8
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.00479ee0
push eax
push 0x4888bc
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x30]
mov edx, ebx
shr edx, 0x18
and edx, 0xff
call fcn.004044ec
push dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
mov edx, ebx
shr edx, 0x10
and edx, 0xff
call fcn.004044ec
push dword [ebp - 0x5c]
lea eax, [ebp - 0x60]
mov edx, ebx
shr edx, 8
and edx, 0xff
call fcn.004044ec
push dword [ebp - 0x60]
lea eax, [ebp - 0x64]
mov edx, ebx
and edx, 0xff
call fcn.004044ec
push dword [ebp - 0x64]
lea eax, [ebp - 0x54]
mov edx, 5
call fcn.00404684
mov edx, dword [ebp - 0x54]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov cl, 0x31
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
call fcn.00479fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4884eb
mov eax, dword [ebp - 0x4c]
call fcn.004034ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488894
lea eax, [ebp - 0x68]
mov edx, 6
call fcn.00404328
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00404328
ret
Function at 0x4a96ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp + 8]
test eax, eax
jns 0x4a9707
add eax, 3
sar eax, 2
dec eax
mov esi, eax
test esi, esi
jb 0x4a9761
inc esi
xor ebx, ebx
push 0
push 0
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a7b48
push edx
push eax
mov edx, ebx
shl edx, 2
mov eax, dword [edi + 0x1c]
call fcn.004a95ac
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [edi + 0x20]
mov edx, ebx
call fcn.004a7adc
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004a9670
pop ecx
xor ecx, eax
mov edx, ebx
shl edx, 2
mov eax, dword [ebp - 8]
call fcn.004a7bc4
inc ebx
dec esi
jne 0x4a9714
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b6b9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
call fcn.0040540c
cmp eax, 0x10
je 0x4b6bc5
mov ecx, 0x4b6c5c
mov dl, 1
mov eax, dword [0x4076a4]
call fcn.0040bf84
call fcn.00403c74
xor ebx, ebx
lea eax, [esi + 0x40]
xor edx, edx
mov dl, bl
add edx, edx
movzx edx, byte [edi + edx + 1]
shl edx, 8
xor ecx, ecx
mov cl, bl
add ecx, ecx
movzx ecx, byte [edi + ecx]
or edx, ecx
mov dword [eax], edx
inc ebx
add eax, 4
cmp bl, 8
jne 0x4b6bca
mov byte [esi + 0x60], 0
mov eax, esi
call fcn.004b6aec
mov bl, 4
mov eax, esi
call fcn.004b6294
mov eax, esi
call fcn.004b639c
dec bl
jne 0x4b6bfc
xor ebx, ebx
lea eax, [esi + 0x20]
xor edx, edx
mov dl, bl
add edx, 4
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ebx
add eax, 4
cmp bl, 8
jne 0x4b6c13
mov bl, 8
mov eax, esi
mov edx, dword [eax]
mov dword [eax + 0x61], edx
mov edx, dword [eax + 0x20]
mov dword [eax + 0x81], edx
add eax, 4
dec bl
jne 0x4b6c2f
mov al, byte [esi + 0x60]
mov byte [esi + 0xc1], al
pop edi
pop esi
pop ebx
ret

Function at 0x4c47d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffffa0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045b134
mov bx, 0x19
lea esi, [esp + 8]
mov eax, pe_nt_image_headers32
call fcn.0045b210
mov byte [esi], al
inc esi
dec bx
jne 0x4c47e9
lea ecx, [esp + 0x35]
lea eax, [esp + 8]
mov edx, 0x19
call fcn.004506a0
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov al, byte [eax + 0x18]
inc eax
mov byte [esp + 0x20], al
lea ecx, [esp + 0x49]
lea eax, [esp + 8]
mov edx, 0x19
call fcn.004506a0
xor ebx, ebx
lea eax, [esp + 0x21]
movzx edx, bx
lea ecx, [esp + 0x35]
mov cl, byte [ecx + edx]
lea esi, [esp + 0x49]
xor cl, byte [esi + edx]
mov byte [eax], cl
inc ebx
inc eax
cmp bx, 0x14
jne 0x4c4833
or byte [esp + 0x21], 0x80
or byte [esp + 0x34], 1
lea edx, [esp + 0x21]
mov eax, dword [esp]
mov ecx, 0x14
call fcn.004583ac
mov edx, dword [esp + 4]
mov edx, dword [edx]
lea eax, [esp + 8]
mov ecx, 0x19
call fcn.00402c74
add esp, 0x60
pop esi
pop ebx
ret