joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4287f5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f9c], 1
jne 0x42884a
or dword [0x4a3f9c], 1
mov dword [0x4a2fc4], 0xe4b2fddc
mov dword [0x4a2fc8], 0xfbe1e0f7
mov dword [0x4a2fcc], 0xfbb2fcfd
mov dword [0x4a2fd0], 0xb2fdf4fc
mov dword [0x4a2fd4], 0xfbf3e4f3
mov dword [0x4a2fd8], 0xfef0f3fe
mov word [0x4a2fdc], 0x92f7
xor eax, eax
mov cl, byte [eax + 0x4a2fc4]
xor cl, 0x92
mov byte [eax + 0x4a37a4], cl
inc eax
cmp eax, 0x1a
jb 0x42884c
mov eax, 0x4a37a4
ret

Function at 0x428867
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f98], 1
jne 0x4288cd
or dword [0x4a3f98], 1
mov dword [0x4a2fe0], 0xf3e4fcdb
mov dword [0x4a2fe4], 0xb2f6fbfe
mov dword [0x4a2fe8], 0xe1e0f7e4
mov dword [0x4a2fec], 0xb2fcfdfb
mov dword [0x4a2ff0], 0xfdf4fcfb
mov dword [0x4a2ff4], 0xf5fbe1b2
mov dword [0x4a2ff8], 0xe7e6f3fc
mov word [0x4a2ffc], 0xf7e0
mov byte [0x4a2ffe], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a2fe0]
xor cl, 0x92
mov byte [eax + 0x4a37c0], cl
inc eax
cmp eax, 0x1f
jb 0x4288cf
mov eax, 0x4a37c0
ret

Function at 0x428a66
Capabilities:
Create directory

Disassembly:
push 0x80
mov eax, 0x470990
call fcn.00455d47
mov edi, ecx
push edi
lea esi, [ebp - 0x2c]
call fcn.0041a27f
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
jb 0x428a8e
mov eax, dword [edi]
jmp 0x428a90
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x428afd
lea eax, [ebp - 0x48]
push eax
call fcn.004280cc
mov byte [ebp - 4], 1
mov dword [esp], 0x481e10
push eax
lea eax, [ebp - 0x80]
call fcn.004042b8
lea ecx, [ebp - 0x64]
push edi
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00404332
add esp, 0x10
mov ebx, eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00403b5c
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.00403c49
push 1
lea esi, [ebp - 0x80]
call fcn.00403c49
push 1
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00403c49
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x428b09
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x428b4a
cmp eax, 0x50
je 0x428b4a
cmp eax, 0xb7
je 0x428b4a
push eax
lea ecx, [ebp - 0x48]
call fcn.0042783a
pop ecx
lea esi, [ebp - 0x8c]
mov byte [ebp - 4], 4
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00403c49
call fcn.00455dca
ret

Function at 0x428c17
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f94], 1
jne 0x428c7d
or dword [0x4a3f94], 1
mov dword [0x4a3000], 0xfefbf3d4
mov dword [0x4a3004], 0xe6b2f6f7
mov dword [0x4a3008], 0xf7f5b2fd
mov dword [0x4a300c], 0xf7e6b2e6
mov dword [0x4a3010], 0xf4b2e2ff
mov dword [0x4a3014], 0xf7f6fefd
mov dword [0x4a3018], 0xf3e2b2e0
mov word [0x4a301c], 0xfae6
mov byte [0x4a301e], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3000]
xor cl, 0x92
mov byte [eax + 0x4a37e0], cl
inc eax
cmp eax, 0x1f
jb 0x428c7f
mov eax, 0x4a37e0
ret
Function at 0x428c9a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x428ca8
mov eax, dword [eax]
push eax
push 0x482080
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x428ce1
call fcn.00428ce3
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.0044c67b
push 0x4915dc
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], vtable.std::runtime_error.0
call fcn.004554bb
leave
ret

Function at 0x428ce3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f90], 1
jne 0x428d53
or dword [0x4a3f90], 1
mov dword [0x4a3020], 0xfefbf3d4
mov dword [0x4a3024], 0xe6b2f6f7
mov dword [0x4a3028], 0xf7e1b2fd
mov dword [0x4a302c], 0xfcf7b2e6
mov dword [0x4a3030], 0xfde0fbe4
mov dword [0x4a3034], 0xfcf7fffc
mov dword [0x4a3038], 0xf3e4b2e6
mov dword [0x4a303c], 0xf0f3fbe0
mov word [0x4a3040], 0xf7fe
mov byte [0x4a3042], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3020]
xor cl, 0x92
mov byte [eax + 0x4a3800], cl
inc eax
cmp eax, 0x23
jb 0x428d55
mov eax, 0x4a3800
ret

Function at 0x428d70
Capabilities:
Get common file path

Disassembly:
push 0x254
mov eax, 0x47030f
call fcn.00455d47
xor edi, edi
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x254], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jge 0x428de2
push eax
lea ecx, [ebp - 0x234]
call fcn.0042783a
pop ecx
push eax
mov dword [ebp - 4], edi
call fcn.00428df6
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0040c222
add esp, 0xc
lea esi, [ebp - 0x260]
mov byte [ebp - 4], 1
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
lea eax, [ebp - 0x218]
push eax
call fcn.00409092
mov eax, esi
call fcn.00455dca
ret

Function at 0x428df6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f8c], 1
jne 0x428e48
or dword [0x4a3f8c], 1
mov dword [0x4a3044], 0xd4e6f7d5
mov dword [0x4a3048], 0xf7f6fefd
mov dword [0x4a304c], 0xe6f3c2e0
mov dword [0x4a3050], 0xf3f4b2fa
mov dword [0x4a3054], 0xf6f7fefb
mov word [0x4a3058], 0xb2a8
mov byte [0x4a305a], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3044]
xor cl, 0x92
mov byte [eax + 0x4a3824], cl
inc eax
cmp eax, 0x17
jb 0x428e4a
mov eax, 0x4a3824
ret
Function at 0x428e65
Capabilities:
Query environment variable

Disassembly:
push 8
mov eax, 0x4702de
call fcn.00455cde
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
push edi
call fcn.0041a27f
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], 1
jb 0x428e98
mov eax, dword [edi]
jmp 0x428e9a
mov eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push eax
call esi
cmp eax, ebx
jbe 0x428eeb
lea ebx, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044c10b
cmp dword [edi + 0x14], 8
pop ecx
mov dword [ebp - 0x10], eax
jb 0x428ece
mov edi, dword [edi]
push ebx
push eax
push edi
call esi
test eax, eax
je 0x428ee2
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0040a27b
push dword [ebp - 0x10]
call fcn.0044e277
pop ecx
mov eax, dword [ebp + 8]
call fcn.00455db6
ret

Function at 0x429133
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f88], 1
mov edx, 0x9f92
jne 0x4291ca
or dword [0x4a3f88], 1
lea ecx, [edx + 0x25]
mov eax, ecx
mov word [0x4a305c], ax
add eax, 0xb
mov word [0x4a305e], ax
push esi
lea eax, [edx + 0x4e]
mov esi, eax
add eax, 0x13
mov word [0x4a3068], ax
lea eax, [edx + 0x6d]
mov word [0x4a306a], ax
add eax, 0xffffffc6
mov word [0x4a306c], ax
lea eax, [edx + 0x12]
mov word [0x4a3060], si
add esi, 0x1d
mov word [0x4a306e], ax
add eax, 2
mov word [0x4a3070], ax
lea eax, [edx + 0xf]
mov word [0x4a3072], ax
mov eax, edx
mov word [0x4a3062], si
mov dword [0x4a3064], 0x9fe09ff5
mov dword [0x4a3074], 0x9fb79fa0
mov word [0x4a3078], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4a305c]
add eax, 2
mov word [eax + 0x4a383a], cx
cmp eax, 0x1e
jb 0x4291cc
mov eax, 0x4a383c
ret

Function at 0x4291ea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f84], 1
mov ecx, 0x9f92
jne 0x42922b
or dword [0x4a3f84], 1
lea eax, [ecx + 0x57]
mov word [0x4a307c], ax
add eax, 0xfffffff9
mov word [0x4a307e], ax
lea eax, [ecx + 0x62]
mov word [0x4a3080], ax
add eax, 0xfffffffb
mov word [0x4a3082], ax
mov eax, ecx
mov word [0x4a3084], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a307c]
add eax, 2
mov word [eax + 0x4a385a], dx
cmp eax, 0xa
jb 0x42922d
mov eax, 0x4a385c
ret

Function at 0x42924b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f80], 1
mov ecx, 0x9f92
jne 0x42929e
or dword [0x4a3f80], 1
lea eax, [ecx + 0x57]
mov word [0x4a3088], ax
add eax, 0xfffffff9
mov word [0x4a308a], ax
lea eax, [ecx + 0x62]
mov word [0x4a308c], ax
add eax, 0xffffffad
mov word [0x4a308e], ax
lea eax, [ecx + 0xe]
mov word [0x4a3090], ax
add eax, 0x4f
mov word [0x4a3092], ax
mov eax, ecx
mov word [0x4a3094], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a3088]
add eax, 2
mov word [eax + 0x4a3866], dx
cmp eax, 0xe
jb 0x4292a0
mov eax, 0x4a3868
ret
Function at 0x4292be
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f7c], 1
mov ecx, 0x9f92
jne 0x429311
or dword [0x4a3f7c], 1
lea eax, [ecx + 0x57]
mov word [0x4a3098], ax
add eax, 0xfffffff9
mov word [0x4a309a], ax
lea eax, [ecx + 0x62]
mov word [0x4a309c], ax
add eax, 0xffffffb0
mov word [0x4a309e], ax
lea eax, [ecx + 0x14]
mov word [0x4a30a0], ax
add eax, 0x49
mov word [0x4a30a2], ax
mov eax, ecx
mov word [0x4a30a4], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a3098]
add eax, 2
mov word [eax + 0x4a3876], dx
cmp eax, 0xe
jb 0x429313
mov eax, 0x4a3878
ret

Function at 0x429331
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f78], 1
mov ecx, 0x9f92
jne 0x429372
or dword [0x4a3f78], 1
lea eax, [ecx + 0x57]
mov word [0x4a30a8], ax
add eax, 0xfffffff9
mov word [0x4a30aa], ax
lea eax, [ecx + 0x62]
mov word [0x4a30ac], ax
add eax, 0xfffffffb
mov word [0x4a30ae], ax
mov eax, ecx
mov word [0x4a30b0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a30a8]
add eax, 2
mov word [eax + 0x4a3886], dx
cmp eax, 0xa
jb 0x429374
mov eax, 0x4a3888
ret

Function at 0x429392
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f74], 1
mov ecx, 0x9f92
jne 0x4293e5
or dword [0x4a3f74], 1
lea eax, [ecx + 0x57]
mov word [0x4a30b4], ax
add eax, 0xfffffff9
mov word [0x4a30b6], ax
lea eax, [ecx + 0x62]
mov word [0x4a30b8], ax
add eax, 0xffffffad
mov word [0x4a30ba], ax
lea eax, [ecx + 0xe]
mov word [0x4a30bc], ax
add eax, 0x4f
mov word [0x4a30be], ax
mov eax, ecx
mov word [0x4a30c0], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a30b4]
add eax, 2
mov word [eax + 0x4a3892], dx
cmp eax, 0xe
jb 0x4293e7
mov eax, 0x4a3894
ret
Function at 0x4294df
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f70], 1
mov ecx, 0x9f92
jne 0x429724
or dword [0x4a3f70], 1
lea eax, [ecx + 0x10]
mov word [0x4a30c8], ax
inc eax
mov word [0x4a30ca], ax
lea eax, [ecx + 0xe]
mov word [0x4a30cc], ax
inc eax
mov word [0x4a30ce], ax
lea eax, [ecx + 0x14]
mov word [0x4a30d0], ax
inc eax
mov word [0x4a30d2], ax
lea eax, [ecx + 0x12]
mov word [0x4a30d4], ax
inc eax
mov word [0x4a30d6], ax
lea eax, [ecx + 0x18]
mov word [0x4a30d8], ax
inc eax
mov word [0x4a30da], ax
lea eax, [ecx + 0x41]
mov word [0x4a30dc], ax
add eax, 0xfffffffd
mov word [0x4a30de], ax
lea eax, [ecx + 0x3f]
mov word [0x4a30e0], ax
add eax, 5
mov word [0x4a30e2], ax
lea eax, [ecx + 0x45]
mov word [0x4a30e4], ax
add eax, 0xfffffffd
mov word [0x4a30e6], ax
lea eax, [ecx + 0x43]
mov word [0x4a30e8], ax
add eax, 5
mov word [0x4a30ea], ax
lea eax, [ecx + 0x49]
mov word [0x4a30ec], ax
add eax, 0xfffffffd
mov word [0x4a30ee], ax
lea eax, [ecx + 0x47]
mov word [0x4a30f0], ax
add eax, 5
mov word [0x4a30f2], ax
lea eax, [ecx + 0x4d]
mov word [0x4a30f4], ax
add eax, 0xfffffffd
mov word [0x4a30f6], ax
lea eax, [ecx + 0x4b]
mov word [0x4a30f8], ax
add eax, 0xffffffe5
mov word [0x4a30fa], ax
lea eax, [ecx + 0x31]
mov word [0x4a30fc], ax
add eax, 0xfffffffd
mov word [0x4a30fe], ax
lea eax, [ecx + 0x2f]
mov word [0x4a3100], ax
add eax, 5
mov word [0x4a3102], ax
lea eax, [ecx + 0x35]
mov word [0x4a3104], ax
add eax, 0xfffffffd
mov word [0x4a3106], ax
lea eax, [ecx + 0x33]
mov word [0x4a3108], ax
add eax, 5
mov word [0x4a310a], ax
lea eax, [ecx + 0x39]
mov word [0x4a310c], ax
add eax, 0xfffffffd
mov word [0x4a310e], ax
lea eax, [ecx + 0x61]
mov word [0x4a3110], ax
add eax, 0xfffffffd
mov word [0x4a3112], ax
lea eax, [ecx + 0x5f]
mov word [0x4a3114], ax
add eax, 5
mov word [0x4a3116], ax
lea eax, [ecx + 0x65]
mov word [0x4a3118], ax
add eax, 0xfffffffd
mov word [0x4a311a], ax
lea eax, [ecx + 0x63]
mov word [0x4a311c], ax
add eax, 5
mov word [0x4a311e], ax
lea eax, [ecx + 0x69]
mov word [0x4a3120], ax
add eax, 0xfffffffd
mov word [0x4a3122], ax
lea eax, [ecx + 0x67]
mov word [0x4a3124], ax
add eax, 5
mov word [0x4a3126], ax
lea eax, [ecx + 0x6d]
mov word [0x4a3128], ax
add eax, 0xfffffffd
mov word [0x4a312a], ax
lea eax, [ecx + 0x6b]
mov word [0x4a312c], ax
add eax, 0xffffffe5
mov word [0x4a312e], ax
lea eax, [ecx + 0x51]
mov word [0x4a3130], ax
add eax, 0xfffffffd
mov word [0x4a3132], ax
lea eax, [ecx + 0x4f]
mov word [0x4a3134], ax
add eax, 5
mov word [0x4a3136], ax
lea eax, [ecx + 0x55]
mov word [0x4a3138], ax
add eax, 0xfffffffd
mov word [0x4a313a], ax
lea eax, [ecx + 0x53]
mov word [0x4a313c], ax
add eax, 5
mov word [0x4a313e], ax
lea eax, [ecx + 0x59]
mov word [0x4a3140], ax
add eax, 0xfffffffd
mov word [0x4a3142], ax
mov eax, ecx
mov word [0x4a3144], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x4a30c8]
add eax, 2
mov word [eax + 0x4a38a6], dx
cmp eax, 0x7e
jb 0x429726
mov eax, 0x4a38a8
ret
Function at 0x429c8c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f6c], 1
jne 0x429cf3
or dword [0x4a3f6c], 1
mov dword [0x4a3148], 0xe8cde8ff
mov dword [0x4a314c], 0xe0cde2fb
mov dword [0x4a3150], 0xf7f6f3f7
mov dword [0x4a3154], 0xfcfbcde0
mov dword [0x4a3158], 0xf4cde6fb
mov dword [0x4a315c], 0xbaf7fefb
mov dword [0x4a3160], 0xf3f4b2bb
mov dword [0x4a3164], 0xf6f7fefb
mov byte [0x4a3168], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3148]
xor cl, 0x92
mov byte [eax + 0x4a3928], cl
inc eax
cmp eax, 0x21
jb 0x429cf5
mov eax, 0x4a3928
ret

Function at 0x429d10
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f68], 1
jne 0x429d77
or dword [0x4a3f68], 1
mov dword [0x4a316c], 0xe8cde8ff
mov dword [0x4a3170], 0xe0cde2fb
mov dword [0x4a3174], 0xf7f6f3f7
mov dword [0x4a3178], 0xfbf4cde0
mov dword [0x4a317c], 0xe1cdf7fe
mov dword [0x4a3180], 0xbae6f3e6
mov dword [0x4a3184], 0xf3f4b2bb
mov dword [0x4a3188], 0xf6f7fefb
mov byte [0x4a318c], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a316c]
xor cl, 0x92
mov byte [eax + 0x4a394c], cl
inc eax
cmp eax, 0x21
jb 0x429d79
mov eax, 0x4a394c
ret

Function at 0x429d94
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f64], 1
jne 0x429e12
or dword [0x4a3f64], 1
mov dword [0x4a3190], 0xe8cde8ff
mov dword [0x4a3194], 0xe0cde2fb
mov dword [0x4a3198], 0xf7f6f3f7
mov dword [0x4a319c], 0xeaf7cde0
mov dword [0x4a31a0], 0xf1f3e0e6
mov dword [0x4a31a4], 0xfbf4cde6
mov dword [0x4a31a8], 0xe6cdf7fe
mov dword [0x4a31ac], 0xf7facdfd
mov dword [0x4a31b0], 0xbbbae2f3
mov dword [0x4a31b4], 0xfbf3f4b2
mov dword [0x4a31b8], 0x92f6f7fe
xor eax, eax
mov cl, byte [eax + 0x4a3190]
xor cl, 0x92
mov byte [eax + 0x4a3970], cl
inc eax
cmp eax, 0x2c
jb 0x429e14
mov eax, 0x4a3970
ret

Function at 0x429e2f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f60], 1
jne 0x429e99
or dword [0x4a3f60], 1
mov dword [0x4a31bc], 0xfefbf3d4
mov dword [0x4a31c0], 0xe6b2f6f7
mov dword [0x4a31c4], 0xe0f1b2fd
mov dword [0x4a31c8], 0xf7e6f3f7
mov dword [0x4a31cc], 0xe1f7f6b2
mov dword [0x4a31d0], 0xf3fcfbe6
mov dword [0x4a31d4], 0xfcfdfbe6
mov dword [0x4a31d8], 0xe6f3e2b2
mov dword [0x4a31dc], 0x92b2a8fa
xor eax, eax
mov cl, byte [eax + 0x4a31bc]
xor cl, 0x92
mov byte [eax + 0x4a399c], cl
inc eax
cmp eax, 0x24
jb 0x429e9b
mov eax, 0x4a399c
ret

Function at 0x429eb6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f5c], 1
jne 0x429f1c
or dword [0x4a3f5c], 1
mov dword [0x4a31e0], 0xfefbf3d4
mov dword [0x4a31e4], 0xe6b2f6f7
mov dword [0x4a31e8], 0xe0f1b2fd
mov dword [0x4a31ec], 0xf7e6f3f7
mov dword [0x4a31f0], 0xe6e7fdb2
mov dword [0x4a31f4], 0xb2e6e7e2
mov dword [0x4a31f8], 0xf7fefbf4
mov word [0x4a31fc], 0xb2a8
mov byte [0x4a31fe], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a31e0]
xor cl, 0x92
mov byte [eax + 0x4a39c0], cl
inc eax
cmp eax, 0x1f
jb 0x429f1e
mov eax, 0x4a39c0
ret
Function at 0x429f53
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f58], 1
jne 0x429f91
or dword [0x4a3f58], 1
mov dword [0x4a3200], 0xfdc5e1db
mov dword [0x4a3204], 0xc2a6a4e5
mov dword [0x4a3208], 0xf7f1fde0
mov word [0x4a320c], 0xe1e1
mov byte [0x4a320e], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3200]
xor cl, 0x92
mov byte [eax + 0x4a39e0], cl
inc eax
cmp eax, 0xf
jb 0x429f93
mov eax, 0x4a39e0
ret

Function at 0x429fae
Capabilities:
Get token membership

Disassembly:
push 0x9c
mov eax, 0x47029d
call fcn.00455d47
xor ebx, ebx
lea eax, [ebp - 0x8c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
pop esi
push esi
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x42a033
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042783a
pop ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0042a0ac
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040c222
add esp, 0xc
lea esi, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x8c]
test eax, eax
jne 0x42a095
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0042783a
pop ecx
push eax
mov dword [ebp - 4], esi
call fcn.0042a132
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040c222
add esp, 0xc
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 3
call fcn.00404e30
push 0x4915dc
mov eax, esi
jmp 0x42a02d
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 0x90], ebx
setne al
call fcn.00455dca
ret

Function at 0x42a0ac
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f54], 1
jne 0x42a115
or dword [0x4a3f54], 1
mov dword [0x4a3210], 0xfdfefed3
mov dword [0x4a3214], 0xf7e6f3f1
mov dword [0x4a3218], 0xdbf6fcd3
mov dword [0x4a321c], 0xfbe6fbfc
mov dword [0x4a3220], 0xe8fbfef3
mov dword [0x4a3224], 0xf6fbc1f7
mov dword [0x4a3228], 0xfbf3f4b2
mov dword [0x4a322c], 0xa8f6f7fe
mov word [0x4a3230], 0x92b2
xor eax, eax
mov cl, byte [eax + 0x4a3210]
xor cl, 0x92
mov byte [eax + 0x4a39f0], cl
inc eax
cmp eax, 0x22
jb 0x42a117
mov eax, 0x4a39f0
ret

Function at 0x42a132
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f50], 1
jne 0x42a191
or dword [0x4a3f50], 1
mov dword [0x4a3234], 0xf1f7fad1
mov dword [0x4a3238], 0xf9fdc6f9
mov dword [0x4a323c], 0xf7dffcf7
mov dword [0x4a3240], 0xe0f7f0ff
mov dword [0x4a3244], 0xe2fbfae1
mov dword [0x4a3248], 0xfbf3f4b2
mov dword [0x4a324c], 0xa8f6f7fe
mov word [0x4a3250], 0x92b2
xor eax, eax
mov cl, byte [eax + 0x4a3234]
xor cl, 0x92
mov byte [eax + 0x4a3a14], cl
inc eax
cmp eax, 0x1e
jb 0x42a193
mov eax, 0x4a3a14
ret
Function at 0x42a1ae
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x499520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x114
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x170], ebx
call fcn.0044fbd0
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x1a
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x16c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x42a2e5
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
call edi
test eax, eax
je 0x42a2e4
cmp dword [ebp - 0x164], ebx
jne 0x42a2e4
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42a2e4
cmp dword [ebp - 0x158], 6
jb 0x42a2e4
lea eax, [ebp - 0x160]
push eax
push 1
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42a2ab
call esi
cmp eax, 0x3f0
jne 0x42a2e4
lea eax, [ebp - 0x160]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42a2e4
lea eax, [ebp - 0x170]
push eax
push 4
lea eax, [ebp - 0x168]
push eax
push 0x13
push dword [ebp - 0x160]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x42a2d1
call esi
jmp 0x42a2e4
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x168]
call edi
pop edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x160], ebx
je 0x42a2fb
push dword [ebp - 0x160]
call esi
cmp dword [ebp - 0x168], ebx
je 0x42a30b
push dword [ebp - 0x168]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x164], ebx
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.0044c4ce
leave
ret

Function at 0x42a37f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f4c], 1
jne 0x42a404
or dword [0x4a3f4c], 1
mov dword [0x4a3254], 0xfcfcf3d1
mov dword [0x4a3258], 0xe3b2e6fd
mov dword [0x4a325c], 0xebe0f7e7
mov dword [0x4a3260], 0xa4b2f3b2
mov dword [0x4a3264], 0xfbf0b2a6
mov dword [0x4a3268], 0xfbe4b2e6
mov dword [0x4a326c], 0xfdb2e5f7
mov dword [0x4a3270], 0xa0a1b2fc
mov dword [0x4a3274], 0xe6fbf0b2
mov dword [0x4a3278], 0xfcfbe5b2
mov dword [0x4a327c], 0xe1e5fdf6
mov byte [0x4a3280], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3254]
xor cl, 0x92
mov byte [eax + 0x4a3a34], cl
inc eax
cmp eax, 0x2d
jb 0x42a406
mov eax, 0x4a3a34
ret
Function at 0x42a421
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f48], 1
jne 0x42a4d1
or dword [0x4a3f48], 1
push ebx
push esi
mov eax, 0x9fda
mov word [0x4a3284], ax
dec eax
mov word [0x4a3286], ax
push edi
mov edi, 0x9fd7
mov eax, edi
mov word [0x4a3288], ax
add eax, 0xfffffff4
mov word [0x4a328a], ax
lea esi, [edi - 0xa]
mov eax, esi
mov word [0x4a328c], ax
lea edx, [edi + 7]
mov eax, edx
mov word [0x4a328e], ax
dec eax
mov word [0x4a3290], ax
lea ecx, [edi - 6]
mov eax, ecx
mov word [0x4a3292], ax
add eax, 2
mov ebx, eax
lea eax, [edi + 4]
pop edi
mov word [0x4a32a2], ax
add eax, 0xffffffb7
pop esi
mov word [0x4a3294], bx
mov dword [0x4a3296], 0x9fcd9fde
mov dword [0x4a329a], 0x9fd39fdf
mov dword [0x4a329e], 0x9fda9fd1
mov dword [0x4a32a4], 0x9fd79fdc
mov word [0x4a32a8], ax
pop ebx
xor eax, eax
mov ecx, 0x9f92
xor cx, word [eax + 0x4a3284]
add eax, 2
mov word [eax + 0x4a3a62], cx
cmp eax, 0x26
jb 0x42a4d3
mov eax, 0x4a3a64
ret

Function at 0x42a4f4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f44], 1
jne 0x42a5a3
or dword [0x4a3f44], 1
mov eax, 0x9fda
mov word [0x4a32ac], ax
dec eax
mov word [0x4a32ae], ax
mov ecx, 0x9fd7
push ebx
mov eax, ecx
mov word [0x4a32b0], ax
add eax, 0xfffffff4
push esi
mov word [0x4a32b2], ax
lea esi, [ecx - 0xa]
mov eax, esi
mov word [0x4a32b4], ax
add eax, 4
mov word [0x4a32b6], ax
lea edx, [ecx - 0x10]
mov eax, edx
mov word [0x4a32b8], ax
add eax, 0xfffffff9
mov ebx, eax
mov word [0x4a32ba], bx
mov word [0x4a32bc], bx
mov ebx, ecx
mov word [0x4a32be], bx
add ebx, 5
mov word [0x4a32cc], ax
lea eax, [ecx - 0x45]
pop esi
mov word [0x4a32c0], bx
mov dword [0x4a32c2], 0x9fcd9fc6
mov word [0x4a32c6], dx
mov dword [0x4a32c8], 0x9fd79fc1
mov word [0x4a32ce], ax
pop ebx
xor eax, eax
mov ecx, 0x9f92
xor cx, word [eax + 0x4a32ac]
add eax, 2
mov word [eax + 0x4a3a8a], cx
cmp eax, 0x24
jb 0x42a5a5
mov eax, 0x4a3a8c
ret

Function at 0x42a5c6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3f40], 1
mov edx, 0x9f92
jne 0x42a638
or dword [0x4a3f40], 1
lea eax, [edx + 0x48]
mov word [0x4a32d0], ax
dec eax
mov word [0x4a32d2], ax
lea ecx, [edx + 0x45]
mov eax, ecx
mov word [0x4a32d4], ax
add eax, 0xfffffff4
mov word [0x4a32d6], ax
lea eax, [edx + 0x3b]
mov word [0x4a32d8], ax
add eax, 0xfffffffa
mov word [0x4a32da], ax
lea eax, [edx + 0x2f]
push esi
mov esi, eax
mov eax, edx
mov word [0x4a32dc], si
mov word [0x4a32de], cx
mov dword [0x4a32e0], 0x9fc19fc0
mov word [0x4a32e4], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x4a32d0]
add eax, 2
mov word [eax + 0x4a3aae], cx
cmp eax, 0x16
jb 0x42a63a
mov eax, 0x4a3ab0
ret