joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dbf0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x412600
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x43999c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [ebp - 0x20], 0x43999c
mov esi, dword [edi]
test esi, esi
jne 0x40dc95
mov ebx, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40dcb1
mov esi, eax
test ebx, ebx
je 0x40dc8d
push 4
push 0xc
call fcn.00406000
add esp, 8
test eax, eax
je 0x40dd59
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x4399c4]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x4399c4], ecx
jne 0x40dc80
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x40dcce
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x42ec44
push 0x2e
push str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESlibrary_std_src_syswindows_thread_local_key.rs
call fcn.0042c900
add esp, 0xc
ud2
lea eax, [ebp - 0x68]
mov dword [ebp - 0x50], 0x42e388
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x68], 0x42e568
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x42d808
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0x41abb0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x3c], 1
push eax
push ecx
call fcn.0040ae20
add esp, 8
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call fcn.00407b20
mov ecx, 7
int 0x29
ud2
push 4
push 0xc
call fcn.0042c860
add esp, 8
ud2
Function at 0x40fde0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x43902c]
test eax, eax
je 0x40fdf9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x40fe12
jmp 0x40fe21
push 0x43902c
call fcn.0040dbf0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x40fe21
cmp dword [eax], 1
mov edi, eax
jne 0x40fe21
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x43902c]
test eax, eax
je 0x40fe40
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40fe58
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x40fe1c
jmp 0x40fe95
push 0x43902c
call fcn.0040dbf0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40fe35
push 4
push 0xc
call fcn.00406000
add esp, 8
test eax, eax
je 0x40fecc
mov dword [eax], 0
mov dword [eax + 8], 0x43902c
mov esi, eax
mov eax, dword [0x43902c]
test eax, eax
jne 0x40fe8d
push 0x43902c
call fcn.0040dbf0
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x40fe1c
test ecx, ecx
je 0x40fe1c
lock dec dword [ecx]
jne 0x40fe1c
call fcn.00408e60
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.0042c860
add esp, 8
ud2
Function at 0x410660
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x410675
test eax, eax
jne 0x41078d
mov ebp, dword [0x4399c4]
test ebp, ebp
je 0x41078d
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
jmp 0x410697
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x4106b8
push dword [ebp + 4]
call edi
test eax, eax
je 0x410690
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x410690
test bl, 1
je 0x41078d
mov ebp, dword [0x4399c4]
test ebp, ebp
je 0x41078d
xor ebx, ebx
jmp 0x4106e7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x410708
push dword [ebp + 4]
call edi
test eax, eax
je 0x4106e0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x4106e0
test bl, 1
je 0x41078d
mov ebp, dword [0x4399c4]
test ebp, ebp
je 0x41078d
xor ebx, ebx
jmp 0x410727
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x410748
push dword [ebp + 4]
call edi
test eax, eax
je 0x410720
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x410720
test bl, 1
je 0x41078d
mov ebp, dword [0x4399c4]
test ebp, ebp
je 0x41078d
xor ebx, ebx
jmp 0x410767
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x410788
push dword [ebp + 4]
call edi
test eax, eax
je 0x410760
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x410760
test bl, 1
jne 0x410799
mov al, byte [0x435a00]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebp, dword [0x4399c4]
jmp 0x4107a4
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41078d
push dword [ebp + 4]
call edi
test eax, eax
je 0x4107a1
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
jmp 0x4107a1
Function at 0x411890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x439038]
test eax, eax
je 0x4118a9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4118c2
jmp 0x4118d1
push 0x439038
call fcn.0040dbf0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4118d1
cmp dword [eax], 1
mov edi, eax
jne 0x4118d1
add edi, 4
mov eax, edi
pop esi
pop edi
ret
mov eax, dword [0x439038]
test eax, eax
je 0x4118f0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x411908
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x4118cc
jmp 0x411945
push 0x439038
call fcn.0040dbf0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4118e5
push 4
push 0x10
call fcn.00406000
add esp, 8
test eax, eax
je 0x411983
mov dword [eax], 0
mov dword [eax + 0xc], 0x439038
mov esi, eax
mov eax, dword [0x439038]
test eax, eax
jne 0x41193d
push 0x439038
call fcn.0040dbf0
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x4118cc
test ecx, ecx
je 0x4118cc
lock dec dword [ecx]
jne 0x4118cc
call fcn.00408e20
mov eax, edi
pop esi
pop edi
ret
push 4
push 0x10
call fcn.0042c860
add esp, 8
ud2

Function at 0x4119a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x439040]
test eax, eax
je 0x4119b8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x4119d1
jmp 0x4119dc
push 0x439040
call fcn.0040dbf0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4119dc
cmp dword [eax], 1
mov esi, eax
je 0x411a5d
mov eax, dword [0x439040]
test eax, eax
je 0x4119fb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x411a13
xor esi, esi
cmp eax, 1
je 0x411a60
mov esi, eax
jmp 0x411a50
push 0x439040
call fcn.0040dbf0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4119f0
push 4
push 0xc
call fcn.00406000
add esp, 8
test eax, eax
je 0x411a64
mov dword [eax], 0
mov dword [eax + 8], 0x439040
mov esi, eax
mov eax, dword [0x439040]
test eax, eax
jne 0x411a48
push 0x439040
call fcn.0040dbf0
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
push 4
push 0xc
call fcn.0042c860
add esp, 8
ud2
Function at 0x41cb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41cb68
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x41cb60
cmp ebp, ebx
jb 0x41cbe2
cmp ebp, dword [esp + 0x1c]
ja 0x41cbf3
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x41cb62
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x41cb50
jmp 0x41cbbf
ja 0x41cb68
cmp edx, edi
mov ebx, ebp
jne 0x41cb25
mov edx, dword [esp + 0x24]
test edx, edx
je 0x41cbc3
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x41cba0
mov esi, edi
sub ecx, ebx
jns 0x41cbb7
jmp 0x41cbc5
cmp edi, edx
je 0x41cbcc
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x41cbc5
xor al, 1
cmp esi, edx
jne 0x41cb80
jmp 0x41cbc5
xor eax, eax
jmp 0x41cbc5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4303c8
push 0x2b
push 0x42fcca
call fcn.0042c900
add esp, 0xc
ud2
push 0x4303b8
push ebp
push ebx
call fcn.0042cb20
add esp, 0xc
ud2
push 0x4303b8
push dword [esp + 0x20]
push ebp
call fcn.0042cac0
add esp, 0xc
ud2
Function at 0x4250a6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x425143
push ebx
push esi
call fcn.0042506f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00424fb8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4250f0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425142
push edi
push eax
call fcn.00425ca6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x425110
call fcn.00423be1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425141
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00424fb8
add esp, 0x20
test eax, eax
jne 0x42512f
push edi
call fcn.00423be1
jmp 0x425137
push ebx
call fcn.00423be1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x426429
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x432bb8
push 0x432bb0
push str.FlsAlloc
push 0x1e
call fcn.004262ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42645d
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d1a4]
call esi
jmp 0x426463
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4264a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x432bc8
push 0x432bc0
push str.FlsGetValue
push 0x20
call fcn.004262ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4264de
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d1a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40526c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x42bfe8], 0x44
push eax
xor eax, eax
push 0x42bfe8
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4052a7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x405331
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004055e0
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405365
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42ebe8], eax
jmp 0x4054f9
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405383
test eax, eax
je 0x4054a4
test byte [ebp + 0xc], 2
je 0x4054a4
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nslA5AF.tmp
push edi
push esi
call fcn.00405a0c
test ebx, ebx
je 0x4053a0
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4053a6
push edi
call fcn.00405546
cmp byte [edi], 0
jne 0x4053b4
cmp byte [str.C:UsersADMINI1AppDataLocalTemp_nslA5AF.tmp], 0x5c
jne 0x4053bf
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40549a
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.0040552a
cmp byte [eax], 0
je 0x405405
cmp byte [ebp - 0x18], 0
je 0x405405
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40541b
mov al, byte [esi + 1]
test al, al
je 0x405479
cmp al, 0x2e
jne 0x40541b
cmp byte [esi + 2], 0
je 0x405479
push esi
push ebx
call fcn.00405a0c
test byte [ebp - 0x148], 0x10
je 0x405440
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405479
push dword [ebp + 0xc]
push edi
call fcn.00405331
jmp 0x405479
push edi
call fcn.004056c4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405471
test byte [ebp + 0xc], 4
je 0x405469
push edi
push 0xfffffffffffffff1
call fcn.00404daa
push 0
push edi
call fcn.0040575a
jmp 0x405479
inc dword [0x42ebe8]
jmp 0x405479
push edi
push 0xfffffffffffffff2
call fcn.00404daa
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4054a4
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054f9
cmp dword [ebp - 8], esi
jne 0x4054b9
inc dword [0x42ebe8]
jmp 0x4054f9
push edi
call fcn.00405d07
test eax, eax
je 0x4054f9
push edi
call fcn.004054ff
push edi
call fcn.004056c4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054f1
test byte [ebp + 0xc], 4
je 0x4054b1
push edi
push 0xfffffffffffffff1
call fcn.00404daa
push esi
push edi
call fcn.0040575a
jmp 0x4054f9
push edi
push 0xffffffffffffffe5
call fcn.00404daa
pop edi
pop esi
leave
ret 8
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x14f70b46
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2faa2c78
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4a69c7
Capabilities:
Encode data using xor

Disassembly:
push 0x2ee4
jne 0x4a69de
add dword [esp], 0x431995
add dword [esp], 0x721c3
jmp 0x4a69d8
ret
sub esp, 0x18
mov dword [esp + 0x14], 0x5de2e6c8
mov dword [esp + 0x10], 0x2004b
mov dword [esp + 0xc], ebp
mov ebp, 0x4a69ac
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebp
xor ebp, ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
xor ebp, eax
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0x4a6a04
cmp ebp, 0xd31
je 0x4a6a21
int3
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0xc]
add esp, 0x18
add dword [esp], 0x46d4df
add dword [esp], 0x366c3
jmp 0x4a6a36
ret

Function at 0x4b13c3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x53aaec72
mov dword [esp + 0x18], 0x20056
mov dword [esp + 0x14], edi
mov edi, 0x4b1390
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edi
xor edi, edi
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
xor edi, ecx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b1402
cmp edi, 0x3f58
je 0x4b141f
int3
mov ecx, dword [esp + 0x10]
add ebx, edi
mov edi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0x910004c2
jmp 0x4b1433
ret 4

Function at 0x4b31b3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x80
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x20
mov dword [esp + 0x1c], 0x7b98e449
mov dword [esp + 0x18], 0x2005b
mov dword [esp + 0x14], esi
mov esi, 0x4b3180
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], esi
xor esi, esi
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
xor esi, ebx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b31f3
cmp esi, 0x249d
je 0x4b3210
int3
mov ebx, dword [esp + 0x10]
add ebp, esi
mov esi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebp
mov dword [esp + 4], 0x5b0004c2
jmp 0x4b3224
ret 4

Function at 0x4b411c
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
sub esp, 0x24
mov dword [esp + 0x20], 0xc78bc75e
mov dword [esp + 0x1c], 0x20042
mov dword [esp + 0x18], esi
mov esi, 0x4b40ec
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], esi
xor esi, esi
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
xor esi, ecx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x4b415c
cmp esi, 0x368
je 0x4b4179
int3
mov ecx, dword [esp + 0x14]
add ebp, esi
mov esi, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], ebp
mov dword [esp + 4], 0xe40004c2
jmp 0x4b418d
ret 4
Function at 0x4b4e9f
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x14
mov dword [esp + 0x10], 0x18d7ebeb
mov dword [esp + 0xc], 0x20071
mov dword [esp + 8], ebp
mov ebp, 0x4b4e6c
mov dword [esp + 4], edi
mov dword [esp + 0x10], ebp
xor ebp, ebp
mov edi, dword [esp + 0x10]
mov edi, dword [edi]
xor ebp, edi
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4b4ede
cmp ebp, 0x1588
je 0x4b4efb
int3
mov edi, dword [esp + 4]
add ebx, ebp
mov ebp, dword [esp + 8]
add esp, 0x14
xchg dword [esp], ebx
mov dword [esp + 4], 0x5c0004c2
jmp 0x4b4f0f
ret 4

Function at 0x4b6a0f
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7d
push dword [esp]
sub dword [esp], 0x7b
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x20
mov dword [esp + 0x1c], 0x17bb61cf
mov dword [esp + 0x18], 0x20069
mov dword [esp + 0x14], eax
mov eax, 0x4b69dc
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
xor eax, ecx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b6a4e
cmp eax, 0xddd
je 0x4b6a6a
int3
mov ecx, dword [esp + 0x10]
add edi, eax
mov eax, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edi
mov dword [esp + 4], 0x4c0004c2
jmp 0x4b6a7e
ret 4

Function at 0x4b70fe
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x14
mov dword [esp + 0x10], 0x335e7a9d
mov dword [esp + 0xc], 0x20031
mov dword [esp + 8], eax
mov eax, 0x4b70cc
mov dword [esp + 4], ecx
mov dword [esp + 0x10], eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
xor eax, ecx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4b713d
cmp eax, 0x1818
je 0x4b7159
int3
mov ecx, dword [esp + 4]
add edx, eax
mov eax, dword [esp + 8]
add esp, 0x14
xchg dword [esp], edx
mov dword [esp + 4], 0x80004c2
jmp 0x4b716d
ret 4

Function at 0x4b7744
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x14
mov dword [esp + 0x10], 0x3c16fe9d
mov dword [esp + 0xc], 0x2003f
mov dword [esp + 8], ebp
mov ebp, 0x4b7714
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebp
xor ebp, ebp
mov esi, dword [esp + 0x10]
mov esi, dword [esi]
xor ebp, esi
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4b7783
cmp ebp, 0x31a3
je 0x4b77a0
int3
mov esi, dword [esp + 4]
add eax, ebp
mov ebp, dword [esp + 8]
add esp, 0x14
xchg dword [esp], eax
mov dword [esp + 4], 0x570004c2
jmp 0x4b77b4
ret 4
Function at 0x4b8487
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], 0x6fd591a6
mov dword [esp + 0x14], 0x2004d
mov dword [esp + 0x10], edi
mov edi, 0x4b8454
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], edi
xor edi, edi
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
xor edi, ebp
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x4b84c6
cmp edi, 0x3fdd
je 0x4b84e4
int3
mov ebp, dword [esp + 0xc]
add ebx, edi
mov edi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ebx
mov dword [esp + 4], 0x790004c2
jmp 0x4b84f8
ret 4

Function at 0x4b891b
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7e
push dword [esp]
sub dword [esp], 0x7c
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x14
mov dword [esp + 0x10], 0xe2bd171a
mov dword [esp + 0xc], 0x20058
mov dword [esp + 8], ecx
mov ecx, 0x4b88e8
mov dword [esp + 4], ebx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov ebx, dword [esp + 0x10]
mov ebx, dword [ebx]
xor ecx, ebx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4b895a
cmp ecx, 0x1c2
je 0x4b8977
int3
mov ebx, dword [esp + 4]
add eax, ecx
mov ecx, dword [esp + 8]
add esp, 0x14
xchg dword [esp], eax
mov dword [esp + 4], 0x960004c2
jmp 0x4b898b
ret 4

Function at 0x4b8a10
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x80
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x24
mov dword [esp + 0x20], 0xc4bbd43b
mov dword [esp + 0x1c], 0x2005c
mov dword [esp + 0x18], edi
mov edi, 0x4b89e0
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edi
xor edi, edi
mov esi, dword [esp + 0x20]
mov esi, dword [esi]
xor edi, esi
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x4b8a4f
cmp edi, 0x29a8
je 0x4b8a6c
int3
mov esi, dword [esp + 0x14]
add edx, edi
mov edi, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edx
mov dword [esp + 4], 0xec0004c2
jmp 0x4b8a80
ret 4

Function at 0x4b8b53
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x7f
push dword [esp]
sub dword [esp], 0x7d
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
sub esp, 0x14
mov dword [esp + 0x10], 0x50890c99
mov dword [esp + 0xc], 0x20044
mov dword [esp + 8], esi
mov esi, 0x4b8b20
mov dword [esp + 4], ebx
mov dword [esp + 0x10], esi
xor esi, esi
mov ebx, dword [esp + 0x10]
mov ebx, dword [ebx]
xor esi, ebx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0x4b8b92
cmp esi, 0x880
je 0x4b8baf
int3
mov ebx, dword [esp + 4]
add edi, esi
mov esi, dword [esp + 8]
add esp, 0x14
xchg dword [esp], edi
mov dword [esp + 4], 0x290004c2
jmp 0x4b8bc3
ret 4