joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402476
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x8fc044]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x4024f1
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x40250b
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.00402535
add esp, 8
test al, al
je 0x40251b
mov eax, dword [esi]
test eax, eax
je 0x402531
push 0xa
push 0
push eax
call fcn.00715582
add esp, 0xc
cmp eax, 1
jmp 0x40250f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00703eaa
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00402535
cmp dword [ebp - 0x14], 1
sete al
movzx eax, al
mov dword [ebx], eax
mov bl, 1
jmp 0x40251d
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00703eaa
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x402512

Function at 0x402535
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x8fc044]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.007051b0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push esi
push ebx
push 2
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x4025ac
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.00401db8
mov ecx, edi
call fcn.00401f46
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00703eaa
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x40461b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4045b6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00404180
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x404584
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4046d4
call fcn.004045c8
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x404673
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00404180
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40462c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4046d4
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00404180
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4046cf
jmp 0x4046d4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x404740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x404824
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4047bf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004042e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40478d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4048dd
call fcn.004047d1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x40487c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00404410
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x404835
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4048dd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00404410
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4048d8
jmp 0x4048dd
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4062a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4062be
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x406300
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40631e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret
Function at 0x406360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x406382
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x4063e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x406402
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x406460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40648a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x4064f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40651a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x406580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4065df
Function at 0x406660
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4066bf
Function at 0x408d40
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x409260
test edx, edx
je 0x409260
call fcn.00408d57
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4092a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00408d40
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x409311
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4092d6
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x409c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x409ca4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x409c7c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x409c84
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.00409ca9
Function at 0x444d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x444e6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x444dfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00444540
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x444dc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x444f33
call fcn.00444e0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x444eca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00444960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x444e7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x444f33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00444960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x444f2e
jmp 0x444f33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x477ec0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73f700
push eax
mov eax, 0x1458
mov dword fs:[0], esp
call fcn.00702be0
push esi
push edi
mov esi, dword [ebp + 0x20]
xor eax, eax
mov word [ebp - 0x1464], ax
mov byte [ebp - 0x464], al
mov dword [ebp - 4], 0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], eax
call fcn.0047a190
xor ecx, ecx
mov dword [ebp - 0x64], 3
add esp, 4
mov edi, eax
cmp byte [esi + 8], cl
mov eax, 8
cmovne ecx, eax
mov dword [ebp - 0x60], ecx
mov ecx, 1
lock xadd dword [0x908864], ecx
inc ecx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x54], ecx
test eax, eax
je 0x477f4b
cmp word [eax], 0
mov dword [ebp - 0x50], eax
jne 0x477f52
mov dword [ebp - 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x4c], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x9087b0]
mov dword [ebp - 0x38], edi
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x34], xmm0
test eax, eax
je 0x477fa5
call eax
mov dword [ebp - 0x18], eax
jmp 0x477fac
mov dword [ebp - 0x18], 0
mov eax, dword [0x9087a8]
test eax, eax
je 0x477fc7
push 0x400
lea ecx, [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x64]
push ecx
call eax
mov eax, dword [0x9087ac]
test eax, eax
je 0x477fd6
lea ecx, [ebp - 0x64]
push ecx
call eax
mov eax, dword [0x9087e4]
test eax, eax
je 0x477fe5
lea ecx, [ebp - 0x64]
push ecx
call eax
cmp dword [ebp - 0x5c], 0
jl 0x478002
push 0x8000ffff
mov dword [ebp - 0x5c], 0x8000ffff
call fcn.00479b00
add esp, 4
mov dword [ebp - 0x58], eax
cmp byte [0x90878c], 0
jne 0x47802b
mov eax, dword [0x908788]
test eax, eax
je 0x47801b
call eax
movzx eax, al
jmp 0x478027
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
test eax, eax
je 0x478034
cmp byte [section..data], 0
jne 0x478052
mov eax, dword [0x908784]
test eax, eax
je 0x4780a5
cmp byte [0x90879c], 0
jne 0x4780a5
push 0
push 0
lea ecx, [ebp - 0x64]
push ecx
call eax
jmp 0x4780a5
mov eax, dword [0x908784]
test eax, eax
je 0x478076
cmp byte [0x90879c], 0
jne 0x478076
push 0x800
lea ecx, [ebp - 0x1464]
push ecx
lea ecx, [ebp - 0x64]
push ecx
call eax
cmp word [ebp - 0x1464], 0
jne 0x478098
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1464]
push 0x800
push eax
call fcn.00479210
add esp, 0xc
lea eax, [ebp - 0x1464]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x908794], 0
je 0x4780b9
mov eax, dword [0x9087b8]
test eax, eax
je 0x4780b9
call eax
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0047b6c0
int3
Function at 0x484750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73fa7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.006ede9c
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x4847db
push eax
push esi
call fcn.006ee482
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.006ee1da
int3

Function at 0x489650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x489663
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x489681
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x489670
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x493250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov eax, 0x2aaaaaab
mov dword [ebp - 0x24], edi
mov ecx, dword [edi + 4]
mov edx, ecx
mov ebx, dword [edi]
sub edx, ebx
imul edx
mov dword [ebp - 0xc], ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
shr eax, 2
cmp dword [edi + 0xc], eax
jb 0x493294
mov ecx, edi
call fcn.00499530
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0xc], ebx
sub ecx, ebx
mov dword [ebp - 0x1c], 0
mov eax, 0x2aaaaaab
xor esi, esi
imul ecx
mov eax, dword [ebp + 8]
sar edx, 1
mov ecx, edx
dec edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [eax]
mov dword [ebp - 8], edx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp + 8], edx
lea ebx, [eax + edx]
cmp eax, ebx
je 0x4932f3
mov edx, eax
nop dword [eax]
mov ecx, esi
mov eax, esi
shr eax, 2
shl ecx, 6
add ecx, eax
movsx eax, byte [edx]
add eax, 0x9e3779b9
inc edx
add eax, ecx
xor esi, eax
cmp edx, ebx
jne 0x4932d0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x10]
and esi, ecx
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
nop dword [eax]
mov edi, dword [ebp - 0xc]
lea eax, [esi + esi*2]
lea eax, [edi + eax*4]
mov edi, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x10]
jne 0x493345
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push edi
call fcn.004959f0
add esp, 0xc
test eax, eax
je 0x49337a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp eax, edx
jne 0x493360
push edx
push dword [ebp - 8]
push edi
call fcn.004959f0
add esp, 0xc
test eax, eax
je 0x49339a
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
inc esi
add esi, ebx
inc ebx
and esi, ecx
cmp ebx, ecx
jbe 0x493310
pop edi
xor eax, eax
pop esi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x24]
pop ebx
inc dword [ecx + 0xc]
add eax, 8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x14]
pop edi
pop esi
add eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x494b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x494b6b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x494b54
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret