joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415070
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x45df60]
xor edx, edx
cmp eax, edx
jne 0x415096
xor eax, eax
mov byte [eax + 0x45de60], al
inc eax
cmp eax, 0x100
jl 0x41507e
mov dword [0x45df60], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x45de60
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x415127
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4150fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4150c8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4151a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4151f3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4151da
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bb70
Capabilities:
Encode data using xor

Disassembly:
imul ebp, ebp
xor ebp, esi
and ah, 0xa8
mov eax, 0x87fcf453
imul esi, ebx, 0xa68492c1
dec bh
sbb dl, al
mov edx, edi
sbb ch, bl
sub ebp, 0xfffac058
test ebp, edi
movsx eax, dl
inc ebx
sub ebp, 0x5617a
jmp 0x41bba3
inc ebp
cmp ecx, ebp
jmp 0x41bbaf
mov ebp, edx
adc bl, 0xb1
movzx ebp, ah
call 0x41bc80
jb 0x41bbc4
inc ebx
or dl, 0xe6
inc edx
jmp 0x41bbcb
test esi, 0xe58fb5a
xor dl, 0x2f
cmp ch, dh
add eax, 0x7ee58c9f
lea ebx, [0xc919adb8]
dec ecx
test ch, ch
lea edx, [0x1761]
mov bl, 0x2c
mov bl, 0x9a
add eax, 0x26b205a2
sub edx, 0xd3f
mov ebx, 0x96c47df3
push edx
jmp 0x41bc0a
pop ebp
test edx, 0x80fb54bc
imul ecx, ebp
lea edi, [0x7e1cd2f8]
sub ebp, 0x758
lea ebx, [0xe517b517]
dec eax
lea esi, [ebp]
and eax, 0x21c000df
and ah, dl
sub esi, 0x5f
xchg edx, eax
imul eax, edx
mov eax, 0xd6ad3e64
mov bl, 0xd7
test bl, ch
mov bh, cl
sub esi, 0xb4723
mov ecx, 0x89504115
sub edi, ebp
add esi, 0xb4722
add ch, dl
mov bl, dl
imul ecx, eax, 0x5175ba13
imul edi, ebx
or ebx, esi
xor ebx, 0x917dd1df
test cl, bh
cmp esi, 0x91
add byte [eax], al
ja 0x41bc39
dec ecx
mov ah, al
movzx ecx, ax
lea ecx, [0x236bac3a]
lea eax, [0xf327821c]
xor edi, 0xd3ad
mov ebp, 0xc6514566
pop edx
mov cl, 0xe7
test bh, 0xc8
mov al, 0x55
imul eax, eax
xchg ebx, eax
mov bh, 0x58
imul esi, ecx, 0x16f5c529
inc esi
test al, 0x39
test ebx, 0x47dfd7bb
mov ebp, 0x4fcbd
mov edi, 0xf7c708e2
movzx ebx, ah
mov eax, edx
add ebp, 0xede
sub cl, ch
xor ch, cl
sub al, 0xf8
add edx, ebp
xor esi, 0x7c5a9393
sub edx, 0x670
mov al, 0x43
dec ebx
or ebx, 0xe64763fc
lea ebp, [0x3f4d9e29]
imul esi, ebx
test dl, 0xe3
movsx eax, bx
test ebp, 0xa991ec5
jno 0x41bd0e
and ch, 6
mov ebx, eax
mov ebp, 0x9244ddb6
sbb ch, dh
lea eax, [0x36449f7d]
add esi, ebx
push edx
jbe 0x41bd2a
Function at 0x42ce10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x437524
call fcn.0041e6b4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0043514b
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x42ce4f
call fcn.0043514b
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42ce5d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42ce6b
or eax, 0xffffffff
jmp 0x42cf53
mov ecx, esi
call fcn.0042cd86
mov dword [ebp - 0x14], eax
call fcn.0042dc2a
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x42cea2
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42cea2
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0042dbde
push dword [ebp - 0x14]
call fcn.0042d710
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0042cb1e
cmp eax, edi
je 0x42cf15
test byte [esi + 0x24], 0x10
je 0x42cee3
push 4
mov ecx, esi
pop ebx
call fcn.0042ff76
test ah, 1
je 0x42cedb
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0042f91b
cmp dword [esi + 0x1c], edi
je 0x42cf15
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0043005e
jmp 0x42cf15
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x42cf29
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x42cf42
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x42cf42
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0042cdc0
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42e0db
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42e113
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042c1a9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042c181
jmp 0x42e11f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x42f7c9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42f80b
call fcn.0043514b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42f80b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42f802
xor eax, eax
jmp 0x42f813
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042f819
pop edi
pop esi
pop ebx
ret 4

Function at 0x43567b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4356a9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4356c7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004355e1
jmp 0x4356c7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4356c7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004355e1
test edi, edi
mov eax, edi
jne 0x4356b1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x417e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x210]
push ecx
call edi
push str.system.ini
lea edx, [esp + 0xc]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea edx, [esp + 8]
push edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x417f2d
push str.install.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417f2d
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret

Function at 0x419581
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0043a99f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4195cc
push 0x80004005
call fcn.00418351
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0043a99f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4195fc
push 0x80004005
call fcn.00418351
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0043a99f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419629
push 0x80004005
call fcn.00418351
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.00418d81
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.00418d81
fldz

Function at 0x424477
Capabilities:
Encode data using xor

Disassembly:
jb 0x4244ed
dec ebp
aas
jge 0x424493
inc ebx
into
mov dl, 0xd4
retf
aam 0xcb
and dword [esp + edx*2], eax
xlatb
dec edi
sub al, 0x7a
inc eax
mov edx, 0xe34c5ab0
std
out 0x23, al
arpl word [ebx], si
lodsd eax, dword [esi]
lcall 0x9bb4, 0x47d4718f
xor ebp, dword [ebp - 0x2b8e7066]
inc edi
mov ah, 0x9b
mov fs, word [edi - 0x41fe1569]
add eax, 0xb38611d4
xor eax, 0xb7934c6d
xchg edx, eax
adc al, 0xd2
pop ecx
loop 0x424480
not cl
iretd
nop
fild qword [edx]
cld
invalid

Function at 0x426b24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebp, 0x12906734
and al, 0xff
Function at 0x430811
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00451c2f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43085c
push 0x80004005
call fcn.0042f5e1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00451c2f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43088c
push 0x80004005
call fcn.0042f5e1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00451c2f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4308b9
push 0x80004005
call fcn.0042f5e1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.00430011
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.00430011
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431251
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call fcn.00451c2f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4312ab
push 0x80004005
call fcn.0042f5e1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.00451c2f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4312de
push 0x80004005
call fcn.0042f5e1
mov edx, dword [eax]
Function at 0x447651
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00468a6f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x44769c
push 0x80004005
call fcn.00446421
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00468a6f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4476cc
push 0x80004005
call fcn.00446421
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00468a6f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4476f9
push 0x80004005
call fcn.00446421
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
and byte [edx + 0x79], ch
Function at 0x45e531
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0047f94f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e57c
push 0x80004005
call fcn.0045d301
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0047f94f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e5ac
push 0x80004005
call fcn.0045d301
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0047f94f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e5d9
push 0x80004005
call fcn.0045d301
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0045dd31
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0045dd31
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475731
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00496b4f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x47577c
push 0x80004005
call fcn.00474501
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00496b4f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4757ac
push 0x80004005
call fcn.00474501
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00496b4f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4757d9
push 0x80004005
call fcn.00474501
invalid
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
Function at 0x47ca01
Capabilities:
Encode data using xor

Disassembly:
and eax, dword [edi]
add byte [edx - 0xd], dl
push ss
call 0x9a4a15
push es
scasd eax, dword es:[edi]
dec ebp
sar edi, 1
dec eax
aas
out 0xd0, eax
add eax, 0xafd198
movsd dword es:[edi], dword [esi]
dec eax
xchg byte [esi + esi*4 - 0x277e8f58], ah
xor eax, 0xf971077
aaa
loopne 0x47ca41
pushal
test dword [eax], edi
pop ecx
xchg ecx, eax
stc
add byte [eax + 0x6b], 0xc2
mov edi, esi
stosd dword es:[edi], eax
mov dh, 0xcb
pop ss
shr dword [esi - 0x8225800], 1
mov esi, 0xae11d89f
clc
adc dword [edi], esp
mov bh, 0x56
mov byte [ecx], 0x51
push ecx
test eax, esi
xor ah, byte [edx]
add edi, edx
sbb esp, edx
jg 0x47ca8d
sbb al, bh
insd dword es:[edi], dx
cmp dh, 0xf
adc eax, 0x304d30a4
test dword [ecx], edx
emms
test eax, 0x20085671
add dword [edi], 0x63
mov al, byte [0xf74bf5c5]
cwde
rol dword [esi - 0x1a4de417], 1
adc al, 0x5c
ror bl, 0x16
adc al, 0xf7
inc ebx
cmpsd dword [esi], dword es:[edi]
js 0x47ca4e
xor ah, byte [edi - 0x1785d46f]
dec esp
iretd

Function at 0x489f5d
Capabilities:
Encode data using xor

Disassembly:
and edi, dword [ecx]
and al, 9
jae 0x489fdd
into
adc al, 0xe0
push 0xffffffffffffffd5
cld
pop es
retf 0xfb5f
mov esi, 0x9ff6f0ff
mov fs, word [eax - 0x52ee6bfd]
pop edi
scasb al, byte es:[edi]
xlatb
jb 0x489ff4
sub dword [edi + 0x5c], 0xffffffe2
imul esi, dword [0x876d7474], 0xffffff93
outsb dx, byte [esi]
sub ebx, dword [ebp - 0x1333af05]
insb byte es:[edi], dx
outsb dx, byte [esi]
mov ebp, 0x32f67f2b
loope 0x48a045
mov dword [ebx], edi
invalid
push ebx
jbe 0x489f9d
mov bh, 0xb0
sub eax, 0x987a353b
xor dword [ebp + 0x438d1851], eax
jno 0x48a002
xor eax, 0x8531987a
push ecx
sbb byte [ebp + 0x1271f343], cl
ja 0x48a057
mov dword [ebp + 0x47], esi
inc edi
adc esp, esi
mov byte [edx + 0x1da3b104], dh
inc edi
outsb dx, byte [esi]
out 0x65, eax
insd dword es:[edi], dx
or eax, 0x5557cae5
lcall 0x687, 0xe08e487f
dec eax
mov fs, eax
xchg dword [esi], eax
adc dl, byte [edi - 0x61]
xchg byte [eax - 0x31], ch
loop 0x489fe4
stosd dword es:[edi], eax
mov dh, 0xed
dec eax
mov byte [0xc381185], al
in eax, dx
or al, 0xed
jno 0x48a00a
fidivr dword [edx - 0x1f]
mov esi, 0x148f75f5
in eax, dx
jae 0x48a081
push ebx
xor edi, dword [edi]
movsd dword es:[edi], dword [esi]
cli
jne 0x48a01f
invalid
ret
je 0x48a02d
das
pushfd
xor al, 0xab
sbb ah, byte [esi + 0x13]
movsb byte es:[edi], byte [esi]
mov ebp, 0x6dc7c5fa
movsd dword es:[edi], dword [esi]
jbe 0x48a05b
clc
mov byte [0x67ba8775], al
or ebx, dword [esi + 0x67]
jbe 0x48a0ce
jle 0x48a0d7
test byte [ebx - 0x14], ah
in eax, dx
arpl word [ebx + 0x29], bx
je 0x48a08d
mov al, byte [0xe4c06c1]
push es
dec esp
push cs
and byte [esi - 0xc], ch
ret
not byte [ebx + 0x26d022e]
sbb ebx, esp
iretd
push edx
sar byte [0x94b22663], 1
jnp 0x48a087
push ebx
pop eax
adc al, 0xc8
test eax, 0xd598f9e1
lock and byte ss:[eax], bh
nop
mov gs, esp
jmp 0x97387c2
Function at 0x497cff
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xd1a0f1e9
inc ecx
cld
bound esi, qword [ecx - 0x6eff7a32]
xchg ecx, eax
in al, dx
push 0xffffffffffffffa0
sbb eax, 0x19653f81
mov bl, 0xbd
scasd eax, dword es:[edi]
cwde
and dh, byte [edi]
pushal
cmp bh, 0x6d
jl 0x497d59
sub eax, 0x484d7f27
ja 0x497d0b
fistp qword [ebp + 0x75]
pushal
xchg byte [0xd8cd3b87], cl
and bh, byte [esi + eax + 0xc743090]
adc al, 0x6f
invalid
push esi
sub eax, 0x6dbecd7e
mov cl, 0x2c
pop ebx
pop edx
rcl al, 1
xor esp, eax
push cs
jge 0x497d8b
and dword [edi + 0x6e], esi
pushal
or ecx, eax
mov ebp, 0x3cd6d07e
mov ecx, 0x2dffd98a
xchg ebp, eax
aaa
mov edi, 0xb321c51c
ror dword [ebp + esi - 0x14], 1
dec ebx
lodsb al, byte [esi]
mov ebp, 0x31749175
xchg ecx, eax
je 0x497dbf
pushfd
fld qword [ecx - 0x1fae80f]
inc esp
xchg ecx, eax
sar byte [eax], cl
movsd dword es:[edi], dword [esi]
lea eax, [esp + edx*8 + 0x68]
add byte [edx - 0x2350ca38], dh
xchg esi, eax
cld
mov eax, dword [0x2500d580]
mov dword [ebx - 0x5e], eax
mov ah, 0x25
shr ebx, 0xa0
rol byte [edi - 0x25829332], 1
popfd
and al, 0x8e
xor byte [ecx - 0x4f], dh
sbb dl, byte [ecx + 0x7c]
arpl word [esi + ebx*8], si
out 0x43, al
jle 0x497dd6
shr dword [0xad9cc842], 1
and dword [ebx - 0xc], ebx
or byte [edi + 6], 0xe1
popal
stc
sub bh, byte [edx + esi - 0x5d]
rcl byte [ebx - 0x11b012e8], cl
pop edx
fld qword [ecx + 0x11267fd]
dec edx
and byte [ebx + 0x3651b296], al
in al, dx
sbb al, 0x9b
push ss
inc edi
mov eax, 0xa1cd39bd
mov esi, 0xf9717c95
ror dword [ebx - 4], 1
nop
mov ah, 0xfc
test al, 0xdb
xor al, byte [eax]
adc byte [eax], ah
xor ebx, dword [ecx]
mov eax, 0xa093df3e
rcl edi, cl
clc
invalid

Function at 0x499ea7
Capabilities:
Encode data using xor

Disassembly:
invalid
adc dword [ebp - 0x7a], edx
push esi
inc esp
mov ebx, 0x83cc9749
inc esi
stc
mov eax, dword [0x8e9ac814]
mov bh, 0xca
adc byte [esi - 0x71], ch
dec esp
dec eax
sar cl, cl
sbb ebx, dword [eax + 0x49744ed6]
dec ecx
xchg edi, eax
int3
dec ecx
or dl, cl
ja 0x499df4
mov edi, 0x842493c7
cmp al, 0xbe
clc
push 0x71
mov ecx, 0x27bc4437
adc cl, byte [ebp - 0x6a]
push edi
xor ebx, dword [edi + 0x63]
mov cl, 0x99
popfd
add ecx, dword [ecx - 0x4a]
cmpsb byte [esi], byte es:[edi]
aaa
test al, 0x30
sahf
loop 0x499e4d
xchg esp, esp
mov al, 0x37
and eax, 0x3ec966fa
enter 0xffffffffffff9556, 0xffffffffffffffa6
inc ebx
pop esp
jmp 0x499e53
add ecx, edi
sal byte [esi - 0xd], 1
push cs
mov gs, word gs:[edi]
std
leave
or cl, bl
xchg edi, eax
jecxz 0x499e6d
jo 0x499f02
push ss
dec esp
push ebx
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x4a3f21
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c533f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f6c
push 0x80004005
call fcn.004a2cf1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c533f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f9c
push 0x80004005
call fcn.004a2cf1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c533f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3fc9
push 0x80004005
call fcn.004a2cf1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a3721
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a3721
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret