joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f85c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4a4585
call fcn.004a0150
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0042f93a
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040278d
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0040278d
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0040278d
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0040278d
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4365cd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a4c9d
call fcn.004a0150
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.00402f5c
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00402f5c
mov eax, dword [edi + 0x28]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402f5c
lea eax, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00402f5c
mov al, byte [edi + 0x48]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x48], al
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov al, byte [edi + 0x4a]
mov byte [esi + 0x4a], al
mov al, byte [edi + 0x4b]
mov byte [esi + 0x4b], al
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov al, byte [edi + 0x4d]
mov byte [esi + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x43b6d0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x4a539a
call fcn.004a0150
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4ad890
mov dword [esi + 4], 0x4abea0
mov dword [esi + 8], 0x4abed4
mov dword [esi + 0xc], 0x4ac978
mov dword [esi + 0x10], 0x4ad87c
mov dword [esi + 0x14], 0x4ad86c
mov dword [esi + 0x18], 0x4abec4
mov dword [esi + 0x1c], 0x4abeb4
mov dword [esi + 0x20], 0x4ad864
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.00402e44
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.00402e44
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 6
call fcn.00402e44
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
or dword [esi + 0xa8], 0xffffffff
mov byte [ebp - 4], 8
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xac], ebx
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov byte [esi + 0xb2], bl
mov byte [esi + 0xb3], bl
mov byte [esi + 0xb4], bl
mov byte [esi + 0xb5], bl
mov byte [esi + 0xb6], bl
mov byte [esi + 0xb7], bl
mov byte [esi + 0xba], bl
mov byte [esi + 0xbb], bl
mov dword [esi + 0xc4], ebx
mov dword [esi], 0x4ad838
mov dword [esi + 4], 0x4ad824
mov dword [esi + 8], 0x4ad80c
mov dword [esi + 0xc], 0x4ad7f0
mov dword [esi + 0x10], 0x4ad7dc
mov dword [esi + 0x14], 0x4ad7cc
mov dword [esi + 0x18], 0x4ad7bc
mov dword [esi + 0x1c], 0x4ad7ac
mov dword [esi + 0x20], 0x4ad7a4
call fcn.0041cbee
mov byte [esi + 0x28], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x443585
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4a5be3
call fcn.004a0150
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00402e44
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0041d2ef
lea ecx, [esi + 0x30]
call fcn.00402e44
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x443ff2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
mov bl, dl
je 0x443f87
push dword [esi]
mov edi, dword [sym.imp.MSVCRT.dll_fputs]
push dword [0x4ae780]
call edi
pop ecx
pop ecx
mov ecx, esi
call fcn.00401ff8
test bl, bl
je 0x443f87
push dword [esi]
push dword [0x4ae784]
call edi
pop ecx
pop ecx
pop edi
call fcn.0044502a
add byte [eax], al
or eax, 0x586e19cc
inc eax
rol edi, 0x1d
mov ecx, 0x4688734c
not esi
sub ebx, ebp
call fcn.004849ae
not esi
cmp eax, 0x607fdf6f
ja 0x443fb1
mov ebx, ecx
dec edx
or ecx, 0x90ebc315
dec eax
xor edi, 0xec4ff9c1
not edi
xor ebx, 0xaa9b7607
mov ecx, 0x7faaa3a2
xor edx, 0x933f5403
add eax, 0xd6f06a87
not esi
mov dword [0x4c848e], edx
add esi, edi
or esi, dword [0x4c12de]
xor eax, 0xc63e2628
neg esi
or edx, dword [0x4c1754]
push esp
pop ss
dec esp
add byte [ebx], al
salc
ror eax, 8
dec ecx
jne 0x443fcc
mov ecx, 0x4f02493d
xchg edx, eax
not ebx
mov edx, esi
not esi
call fcn.00437fce
and edi, 0xf589f998
neg ebx
call fcn.004552a8
not ebx
rol dword [ecx + 0x6c7d9cc2], cl
clc
add dword [0x4c86f5], edx
shr esi, 7
inc esi
sub ebx, edx
cmp esp, 0xf80b2119
jae 0x44403b
dec edx
sub esi, 0xb362667
or esi, ecx
dec ecx
jne 0x444004
mov edi, eax
mov ecx, eax
invalid
out dx, al
Function at 0x448e51
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4a657f
call fcn.004a0150
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.00402e44
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44d23e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a6a74
call fcn.004a0150
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0044d43a
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.00419635
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.00419635
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.00419635
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.00419635
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00419635
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.00419635
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00419635
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.00419635
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4521d5
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x452231
cmp word [ecx], 0x5a4d
jne 0x452231
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x452231
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x452231
test al, 7
jne 0x452231
add eax, ecx
cmp dword [eax], 0x4550
jne 0x452231
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x45224b
sub ecx, 0x74
je 0x452244
dec ecx
dec ecx
je 0x452244
dec ecx
dec ecx
je 0x45223d
sub ecx, 0x3c
je 0x452236
sub ecx, 0x8464
je 0x45224b
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x452250
mov ecx, 0x3030701
jmp 0x452250
mov ecx, 0x3030501
jmp 0x452250
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x452231
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x45226a
cmp eax, 0x20b
jne 0x452231
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x452233

Function at 0x456029
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a70c7
call fcn.004a0150
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0045620f
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004562c4
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.00402f5c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x456889
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x4568a8
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x456897
pop edi
cmp esi, 4
jb 0x4568b2
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x4568c3
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x4568cf
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x4568d9
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x45c3c2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4a7744
call fcn.004a0150
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x30]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov al, byte [esi + 0x18]
mov byte [ebx + 0x18], al
mov al, byte [esi + 0x19]
mov byte [ebx + 0x19], al
mov al, byte [esi + 0x1a]
mov byte [ebx + 0x1a], al
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call fcn.0040278d
and dword [ebp - 4], 0
lea eax, [esi + 0x3c]
push eax
lea ecx, [ebx + 0x3c]
call fcn.0040278d
lea eax, [esi + 0x48]
lea ecx, [ebx + 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.0040278d
lea eax, [esi + 0x54]
lea ecx, [ebx + 0x54]
push eax
mov byte [ebp - 4], 2
call fcn.0040278d
mov eax, dword [esi + 0x60]
push 0xc
mov dword [ebx + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
add eax, 0x98
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x98]
mov byte [ebp - 4], 3
call fcn.0045c4a8
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x465466
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x4a80cb
call fcn.004a0150
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.0040278d
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.004654e9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46def7
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4a8608
call fcn.004a0150
sub esp, 0x14
mov ax, word [ebp + 8]
push esi
mov esi, ecx
mov word [ebp - 0x10], ax
xor eax, eax
push edi
mov word [ebp - 0x14], 2
mov byte [ebp - 0x12], dl
mov word [esi + 2], 0x63
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.0046df7c
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.00446666
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.004656be
add esi, 0x50
mov ecx, esi
call fcn.00446666
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.004656be
push dword [ebp - 0x1c]
call fcn.00401de4
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x474cd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.00474380
push 0x41
mov ecx, esi
call fcn.00474380
push 0x59
mov ecx, esi
call fcn.00474380
push 0x26
mov ecx, esi
call fcn.00474380
push 0x53
mov ecx, esi
call fcn.00474380
push 0x59
mov ecx, esi
call fcn.00474380
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x474d60
test cl, cl
jbe 0x474d5c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x4c1a64]
xor eax, edi
dec ecx
jne 0x474d46
xor edi, edi
jmp 0x474d8f
cmp bl, cl
jne 0x474d67
inc edi
jmp 0x474d72
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x4c1a64]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x474d1e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.004743c0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.004744e0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x474fa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.00474dd0
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a8], bl
je 0x47501c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x184]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.004983f0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x475059
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x180
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x47502e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.00475130
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a8], bl
je 0x475119
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x1a4]
inc ebp
cmp ebp, eax
jne 0x4750a4
xor ebp, ebp
cmp dword [edi + 0x1bc], ebx
je 0x4750f5
lea ecx, [edi + 0x148]
call fcn.0040e9eb
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1bc]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x184]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.00498510
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x483060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x48309e
mov ecx, ebx
call fcn.0049ef90
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.0049f690
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.0049f720
jmp 0x4830b6
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x4830bf
mov ecx, ebx
call fcn.0049ef90
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.0049f690
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x4830ed
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.0049ef90
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.0049f690
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x483160
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x14
lea edx, [esp + 0x18]
call fcn.0049f800
lea ecx, [edi + 0x80]
push 0x14
lea edx, [esp + 0x98]
call fcn.0049f800
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jbe 0x48323a
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
lea edx, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0049f860
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x80]
call fcn.0049f860
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor ebp, ecx
mov ecx, dword [esp + 0x60]
xor eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x24]
xor edx, ecx
dec eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], eax
jne 0x4831cf
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 8
Function at 0x483830
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0049f9b0
mov ebp, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049f690
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049f690
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4838cb
push str.SystemFunction036
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4838c4
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call eax
test al, al
je 0x4838c4
push 0x20
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x20]
mov ebp, 0x64
call fcn.0049f690
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4838ef
push 8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.0049f690
call ebx
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049f690
mov edi, 0x64
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0049ffd0
lea ecx, [esp + 0x1c]
call fcn.0049f9b0
push 0x20
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.0049f690
dec edi
jne 0x483909
dec ebp
jne 0x4838d1
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0049ffd0
mov byte [esi + 0x20], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret

Function at 0x484120
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xc0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x484151
lea ecx, [esp + 0x4c]
call fcn.0049ef90
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.0049f690
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xd0]
call fcn.0049f720
pop edi
pop esi
pop ebx
add esp, 0xc0
ret 4