joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6a694ce9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x40753ab0
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58784888
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6ce946ef
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x51b43ed9
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1ba60150
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x414030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x44], 0x80b3835
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xchg ebp, ebp
mov eax, dword [ebx + 4]
push esi
lea esi, [ebx + 4]
mov dword [ebp - 0x10], ecx
mov dword [esp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 8], esi
push edi
inc eax
mov dword [esp - 0x30], esp
mov edi, 0x6f26f222
xor edi, 0x18d90872
sub edi, 0x70d51820
mov ebp, ebp
add edi, 0x5d947f85
sub edi, 0x64bf61b3
mul edi
seto cl
mov ebx, ebx
neg ecx
or ecx, eax
push ecx
call fcn.0048b720
mov dword [esp - 0x10], 0x174e64a
mov dword [ebp - 0xc], eax
add esp, 4
mov eax, dword [esi]
mov dword [esp - 0x24], 0x1c709cd4
mov dword [ebp + 8], eax
cmp eax, edi
jbe 0x4140b0
mov ebx, dword [ebx]
mov ebp, ebp
xor ecx, ecx
inc eax
mul edi
seto cl
mov edi, edi
neg ecx
or ecx, eax
push ecx
call fcn.0048b720
mov dword [esp - 0x40], 0x14f822b2
mov esi, eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esp - 0x34], 0x4dd903e5
xor edi, edi
mov dword [ebp - 4], esi
test eax, eax
je 0x414153
mov dword [esp - 0x28], esp
mov edx, esi
sub ebx, esi
mov esi, eax
lea esp, [esp]
mov dword [esp - 0x18], ecx
mov ecx, edi
lea edx, [edx + 2]
and ecx, 3
mov eax, 0x3aeed9c1
mov dword [esp - 0x10], ecx
xor eax, 0x32a6fa9a
add eax, 0x5d6a3737
sub eax, 0x8fe3112
mov dword [esp - 0x34], edi
sub eax, 0x2de08e37
add eax, 0x44aa88f7
shl ecx, 3
mov dword [esp - 0x2c], 0x7e35e3ba
inc edi
sar eax, cl
cbw
xor ax, word [ebx + edx - 2]
mov dword [esp - 0xc], ebp
mov word [edx - 2], ax
cmp edi, esi
jb 0x4140fa
mov esi, dword [ebp - 4]
mov dword [esp - 0x3c], edx
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
xor ecx, ecx
mov word [esi + eax*2], cx
xchg ecx, ecx
mov eax, dword [ebp - 8]
push esi
mov eax, dword [eax]
xchg esi, esi
inc eax
push eax
push edi
call fcn.0048c0a0
mov dword [esp - 0xc], 0x6ddba770
push esi
call fcn.0048b6f0
mov eax, dword [ebp - 0x10]
mov dword [esp - 0x14], edi
add esp, 0x10
mov dword [eax], edi
pop edi
pop esi
mov esp, esp
mov byte [eax + 4], 0x5d
sub byte [eax + 4], 0x15
add byte [eax + 4], 8
mov edi, edi
sub byte [eax + 4], 0x28
add byte [eax + 4], 7
add byte [eax + 4], 0x16
xchg ebp, ebp
xor byte [eax + 4], 0x44
pop ebx
mov esp, ebp
mov dword [esp - 0xc], 0x6a48b258
pop ebp
ret 4
Function at 0x4392c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [esp - 0x40], ebp
lea eax, [ebp - 0x1c]
nop
sub esp, 4
mov dword [esp], 0x6564c0fe
mov dword [esp - 0x10], 0x3f94d711
add dword [esp], 0x77ff80b
sub dword [esp], 0x3abcbb2
xor dword [esp], 0x6dc39841
xchg esp, esp
xor dword [esp], 0x4fb7516
nop
sub esp, 4
mov dword [esp], 0xe7484c9
mov dword [esp - 0x14], 0x3b8db2f7
add dword [esp], 0x43b01349
xor dword [esp], 0x6c08d277
sub dword [esp], 0x160bde80
mov dword [esp - 0x1c], 0x33975ac2
xor dword [esp], 0x28206be5
nop
sub esp, 4
mov dword [esp], 0x18e43e5a
xchg edi, edi
add dword [esp], 0x53a94b8e
add dword [esp], 0x23b6b9e
sub dword [esp], 0x49da9d2f
xor dword [esp], 0x24ee5857
mov dword [esp - 0x34], ecx
push eax
mov eax, dword [0x4bacc8]
xor eax, dword [0x4ba958]
xchg ebp, ebp
call eax
test eax, eax
je 0x439478
lea eax, [ebp - 0x1c]
mov dword [esp - 0x38], 0x3cc380bb
push eax
mov eax, dword [0x4bacd8]
xor eax, dword [0x4ba958]
call eax
mov dword [esp - 0x14], esi
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x4bace0]
xor eax, dword [0x4ba958]
mov dword [esp - 0x34], 0x4a6b174f
call eax
nop
sub esp, 4
mov dword [esp], 0x4f7be34f
mov ebp, ebp
add dword [esp], 0xa76bda8
add dword [esp], 0x6c98367
add dword [esp], 0xc31b319
xor dword [esp], 0x4dbc96fa
xchg esp, esp
xor dword [esp], 0x2151418d
nop
sub esp, 4
mov dword [esp], 0x1d384f6a
mov dword [esp - 0xc], ebx
xor dword [esp], 0x28116fa6
add dword [esp], 0x47f13436
sub dword [esp], 0x23f65333
sub dword [esp], 0x509ba7c
mov edx, edx
xor dword [esp], 0x7245fd44
xor dword [esp], 0x265fba17
nop
mov dword [esp - 4], 0x230ac397
mov dword [esp - 0x38], 0x60fa5b10
add dword [esp - 4], 0x1ce541e9
sub dword [esp - 4], 0x3dc3d1cd
add dword [esp - 4], 0x337a5671
sub dword [esp - 4], 0x35a68a24
mov dword [esp - 0x3c], 0x2ddbeb5a
sub esp, 4
lea eax, [ebp - 0x1c]
push eax
mov dword [esp - 0x40], ecx
mov eax, dword [0x4bacc8]
xor eax, dword [0x4ba958]
call eax
xchg edi, edi
test eax, eax
jne 0x43937a
mov esp, ebp
pop ebp
mov dword [esp - 0x14], 0x6d968cfb
ret
Function at 0x439490
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [esp - 0x24], edx
nop
mov dword [esp - 4], 0x6189abdd
add dword [esp - 4], 0x1878bdf
sub dword [esp - 4], 0x36da38c6
mov dword [esp - 0x2c], ebp
sub dword [esp - 4], 0x813e8f4
sub dword [esp - 4], 0x242315d2
sub esp, 4
mov edx, edx
nop
mov dword [esp - 4], 0x6171f0fa
sub dword [esp - 4], 0x4ee6a873
add dword [esp - 4], 0x3fbd26fb
mov dword [esp - 0x18], 0xd4dc655
sub dword [esp - 4], 0x31234a02
add dword [esp - 4], 0x41e13172
sub dword [esp - 4], 0x540e188d
mov dword [esp - 0x28], esi
xor dword [esp - 4], 0xef83e65
sub esp, 4
lea eax, [esi + 0x20]
mov dword [esi + 0x10], 0x42f0f9db
mov dword [esp - 0x14], ebp
sub dword [esi + 0x10], 0x373e7cf1
add dword [esi + 0x10], 0x2eae1517
sub dword [esi + 0x10], 0x115fa71c
add dword [esi + 0x10], 0xbbf10b1
mov dword [esp - 0x20], 0x45f7d449
xor dword [esi + 0x10], 0x34bffb97
push eax
mov word [esi + 0xa4], 0x71b
xchg esi, esi
xor word [esi + 0xa4], 0x3cb7
xor word [esi + 0xa4], 0x3a32
add word [esi + 0xa4], 0x5529
xchg esp, esp
sub word [esi + 0xa4], 0x55c6
call fcn.0048bba0
mov ecx, dword [esi + 0xc4]
add esp, 0xc
mov ebp, ebp
test ecx, ecx
je 0x4395ca
mov eax, dword [ecx]
mov dword [esp - 0x3c], 0x5c2d303f
nop
sub esp, 4
mov dword [esp], 0x1c69793d
add dword [esp], 0x3caabf18
mov esp, esp
xor dword [esp], 0x35fa1d83
sub dword [esp], 0x2ea4f0b5
sub dword [esp], 0x3e493520
call dword [eax + 8]
mov dword [esp - 0x10], ebx
nop
sub esp, 4
mov dword [esp], 0x4662fe2c
sub dword [esp], 0x25de7c20
mov dword [esp - 0x2c], 0x79de8c05
add dword [esp], 0x493e01f4
sub dword [esp], 0x9874e5a
sub dword [esp], 0x603b359e
call fcn.0048b6d0
xchg edi, edi
add esp, 4
test eax, eax
je 0x439622
mov edi, edi
mov dword [eax], 0x4010b4
mov ecx, 0x4ba960
mov dword [esi + 0xc4], eax
pop esi
mov esp, esp
jmp fcn.0047fb40
xor eax, eax
mov ecx, 0x4ba960
mov dword [esi + 0xc4], eax
mov ebp, ebp
pop esi
jmp fcn.0047fb40
Function at 0x43b970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [esp - 0x2c], 0x15a568f4
push esi
push edi
mov edi, ecx
mov ebp, ebp
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x18]
push eax
call fcn.00405770
mov dword [esp - 0x24], 0x67f484df
mov esi, dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
xchg edx, edx
cmp byte [esi], 0
je 0x43b9f6
nop
mov dword [esp - 0x28], 0x484fc7ab
sub esp, 4
mov dword [esp], 0x73b426d2
xor dword [esp], 0x1cab4886
sub dword [esp], 0x10b37a45
mov dword [esp - 0x38], ebx
sub dword [esp], 0xd2443b3
xor dword [esp], 0x5147b05d
push esi
lea ecx, [ebp - 4]
mov dword [esp - 0x18], 0x63185505
call fcn.00481c70
inc esi
cmp byte [esi], 0
mov ecx, ecx
jne 0x43b9a7
mov eax, dword [ebp - 4]
mov esi, dword [edi + 0x30]
mov esp, esp
not eax
xor esi, 0x2477
shl esi, 0x10
mov ebp, ebp
or esi, dword [edi + 0x20]
xor esi, eax
cmp byte [ebp - 8], 0
je 0x43ba20
xchg esp, esp
push dword [ebp - 0xc]
call fcn.0048b6f0
add esp, 4
pop edi
mov edi, edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
mov dword [esp - 0xc], 0x66f8e53b
ret

Function at 0x43ba40
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
mov esp, esp
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov dword [esp - 0x10], 0x111fb928
mov ebp, esp
sub esp, 0x28
mov eax, ecx
mov ecx, dword [ebx + 8]
mov ecx, ecx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [esp - 0xc], esp
xor esi, esi
mov edi, dword [eax + 0x34]
mov eax, dword [eax + 0x28]
mov dword [esp - 0x2c], 0x4594839e
xor edi, 0x4d682477
xor eax, 0x4d682477
mov dword [ebp - 4], esi
mov ecx, ecx
push esi
add edi, edi
cvtsi2ss xmm0, eax
movss dword [ebp - 8], xmm0
mov dword [esp - 0xc], esi
call fcn.00481bf0
movzx eax, ax
test ax, ax
je 0x43bb1f
mov dword [esp - 0x24], edx
fld dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, ax
shl eax, 4
mov dword [esp - 0x14], 0x1c9c2bdf
add eax, dword [ecx + 0x38]
movups xmm0, xmmword [eax]
xorps xmm0, xmmword [0x4bf5b0]
mov dword [esp - 0x18], 0x4e72320e
movaps xmmword [ebp - 0x20], xmm0
fld dword [ebp - 0x18]
fsub dword [ebp - 0x20]
fmulp st(1)
mov edx, edx
call fcn.0048c950
mov ecx, dword [ebx + 8]
sub eax, edi
add esi, eax
mov dword [esp - 0x1c], ecx
mov eax, dword [ebp - 4]
inc eax
push eax
mov dword [ebp - 4], eax
mov edx, edx
call fcn.00481bf0
fld dword [ebp - 8]
movzx eax, ax
mov dword [esp - 0x38], 0x6e793abe
test ax, ax
jne 0x43bab7
fstp st(0)
pop edi
mov dword [esp - 0xc], edi
mov eax, esi
pop esi
mov esp, ebp
mov edi, edi
pop ebp
mov esp, ebx
pop ebx
mov dword [esp - 0x14], ebp
ret 4
Function at 0x43bd00
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
mov dword [esp - 0x44], 0x16e46508
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov dword [esp - 0x3c], 0x9903689
mov ebp, esp
sub esp, 0x28
mov eax, dword [ecx + 0x34]
mov esi, esi
xor eax, 0x4d682477
add eax, eax
mov dword [ebp - 8], eax
mov esp, esp
mov eax, dword [ecx + 0x28]
xor eax, 0x4d682477
push esi
mov dword [esp - 0x18], 0x2923dc3f
mov esi, dword [ebx + 8]
push edi
cvtsi2ss xmm0, eax
xor edi, edi
mov dword [esp - 0x24], esi
movzx eax, word [esi]
movss dword [ebp - 4], xmm0
test ax, ax
je 0x43bdcb
mov dword [esp - 0x24], 0x6b02469
mov ecx, dword [ecx + 0x38]
fld dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov dword [esp - 0x28], ecx
movzx eax, ax
add eax, eax
movups xmm0, xmmword [ecx + eax*8]
xorps xmm0, xmmword [0x4bf5b0]
xchg ebp, ebp
movaps xmmword [ebp - 0x20], xmm0
fld dword [ebp - 0x18]
fsub dword [ebp - 0x20]
fmul st(1)
mov dword [esp - 0x1c], 0x385dab19
call fcn.0048c950
sub eax, dword [ebp - 8]
lea esi, [esi + 2]
mov esp, esp
movzx ecx, word [esi]
add edi, eax
mov eax, ecx
test cx, cx
mov dword [esp - 0x44], 0xc4349f5
mov ecx, dword [ebp - 0xc]
jne 0x43bd7b
fstp st(0)
mov dword [esp - 0x24], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
mov esp, esp
pop ebp
mov esp, ebx
pop ebx
mov dword [esp - 0xc], ebx
ret 4
Function at 0x45ce20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov dword [esp - 0x2c], 0x2ed3aa9c
mov edi, ecx
cmp dword [edi + 0xbc], 0
je 0x45cf54
xchg esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [esp - 0x18], 0x4ac35722
call fcn.0045b510
mov eax, dword [ebp - 8]
mov ecx, 0x5aeee490
sub ecx, 0x532cb054
mov esi, esi
add ecx, 0x1878c206
xor ecx, 0x58601b16
xor ecx, 0x785aedf4
cdq
mov dword [esp - 0x18], edi
idiv dword [edi + 0xbc]
cmp eax, ecx
cmovl ecx, eax
xor esi, esi
mov dword [esp - 0x2c], 0x41c79ca9
mov dword [ebp - 8], ecx
mov ecx, dword [edi + 0xbc]
test ecx, ecx
je 0x45cf48
mov dword [esp - 0x10], ebp
mov edx, dword [edi + 0xb8]
push ebx
lea ebx, [edx + ecx*4]
cmp edx, ebx
mov dword [esp - 0x20], 0x6e8ab8a8
je 0x45cf47
lea ecx, [ecx]
mov ecx, dword [edx]
mov ecx, ecx
mov eax, esi
xor eax, 0x4d682477
add edx, 4
mov ecx, ecx
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], 0x5dc9c23b
sub dword [ecx + 0x1c], 0x1457f200
sub dword [ecx + 0x1c], 0x2d99a308
mov dword [esp - 0x34], 0x5e8b8959
add dword [ecx + 0x1c], 0x588d4915
sub dword [ecx + 0x1c], 0x21599c1d
sub dword [ecx + 0x1c], 0x1e45f26
xchg esp, esp
xor dword [ecx + 0x1c], 0x1c4f5f72
mov eax, dword [ebp - 8]
xor eax, 0x4d682477
mov dword [esp - 0x14], 0x4f815ec0
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 4]
xor eax, 0x4d682477
mov dword [esp - 0x44], 0x17e8aced
mov dword [ecx + 0x24], eax
add esi, dword [ebp - 8]
cmp edx, ebx
mov dword [esp - 0x3c], 0x63afaa7f
jne 0x45cec0
pop ebx
mov ecx, edi
mov dword [esp - 0x1c], esi
call fcn.0043f580
pop esi
pop edi
mov esp, ebp
xchg esp, esp
pop ebp
ret
Function at 0x472df0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [esp - 0xc], 0xcbf2ad2
push ebx
push esi
push edi
mov edi, edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
xchg esi, esi
add eax, 0x18
add eax, ecx
xor ecx, ecx
mov ebp, ebp
cmp cx, bx
jae 0x472e5b
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov dword [esp - 0x1c], ebp
test ecx, ecx
jne 0x472e35
mov ecx, dword [eax + 0x10]
xchg edx, edx
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x472e46
mov dword [esp - 0x30], ecx
add ecx, esi
cmp edi, ecx
jb 0x472e64
inc edx
mov dword [esp - 0x1c], esp
add eax, 0x28
cmp dx, bx
jb 0x472e25
mov dword [esp - 0x30], 0x466f353c
pop edi
pop esi
xor eax, eax
mov esp, esp
pop ebx
pop ebp
ret
mov eax, dword [eax + 0x14]
sub eax, esi
mov dword [esp - 0x30], esp
add eax, dword [ebp + 8]
add eax, edi
pop edi
pop esi
xchg esi, esi
pop ebx
pop ebp
ret
Function at 0x472e80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [esp - 0xc], 0x6e3645fa
push ebx
mov ebx, dword [ebp + 8]
push esi
xchg ebp, ebp
push edi
movzx eax, word [ebx]
xor eax, 0x6fa836ea
mov dword [esp - 0x40], esp
cmp eax, 0x6fa86ca7
jne 0x472fcb
mov ecx, dword [ebx + 0x3c]
mov dword [esp - 0x44], edx
mov eax, dword [ecx + ebx]
xor eax, 0x6fa836ea
cmp eax, 0x6fa873ba
jne 0x472fcb
xchg edx, edx
push dword [ecx + ebx + 0x78]
push ebx
call fcn.00472df0
xchg esi, esi
mov esi, eax
mov dword [ebp - 8], esi
push dword [esi + 0x20]
mov dword [esp - 0x40], ebx
push ebx
call fcn.00472df0
push dword [esi + 0x24]
xchg ecx, ecx
mov dword [ebp - 4], eax
push ebx
call fcn.00472df0
push dword [esi + 0x1c]
mov dword [esp - 0x40], 0x7e02d85a
mov dword [ebp - 0xc], eax
push ebx
call fcn.00472df0
mov dword [esp - 0x20], edx
xor edi, edi
mov dword [ebp - 0x10], eax
add esp, 0x20
mov dword [esp - 0x3c], ebx
cmp dword [esi + 0x18], edi
jbe 0x472fcb
mov eax, dword [ebp - 4]
push dword [eax + edi*4]
mov dword [esp - 0x34], 0x39c63ad7
push ebx
call fcn.00472df0
mov esi, eax
or ecx, 0xffffffff
mov dword [esp - 0x34], 0x16e5698c
add esp, 8
mov dword [ebp + 8], ecx
cmp byte [esi], 0
je 0x472fa7
xchg ebp, ebp
mov edi, edi
nop
sub esp, 4
mov dword [esp - 0x2c], 0x77ebf073
mov dword [esp], 0x32a95550
xor dword [esp], 0x4ae4286c
sub dword [esp], 0x3bc91177
mov dword [esp - 0x34], 0x253a4690
xor dword [esp], 0x21080952
sub dword [esp], 0x1d8c6296
push esi
mov dword [esp - 0x10], 0x30237638
lea ecx, [ebp + 8]
call fcn.00481c70
inc esi
cmp byte [esi], 0
mov dword [esp - 0x10], edi
jne 0x472f52
mov ecx, dword [ebp + 8]
not ecx
mov dword [esp - 0x28], 0x1c7bffdf
cmp ecx, dword [ebp + 0xc]
je 0x472fda
mov eax, dword [ebp - 8]
inc edi
mov dword [esp - 0x1c], 0x754e58ce
cmp edi, dword [eax + 0x18]
jb 0x472f22
pop edi
mov ebx, ebx
pop esi
xor eax, eax
pop ebx
mov dword [esp - 0x18], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, edx
movzx eax, word [eax + edi*2]
push dword [ecx + eax*4]
push ebx
call fcn.00472df0
mov dword [esp - 0x1c], 0x35d9e35b
add esp, 8
pop edi
pop esi
mov edx, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x214]
mov ecx, ecx
nop
mov dword [esp - 4], 0x6083f2b8
add dword [esp - 4], 0x82d8013
xor dword [esp - 4], 0x759c5385
mov dword [esp - 0x14], ebp
sub dword [esp - 4], 0x870d141
xor dword [esp - 4], 0x14bc5205
sub esp, 4
mov dword [esp - 0x38], ecx
nop
sub esp, 4
mov dword [esp], 0x7b63f48b
sub dword [esp], 0x5eb28e47
mov dword [esp - 0x1c], 0x78a625e2
add dword [esp], 0x2b157cfd
add dword [esp], 0x22ba7618
xor dword [esp], 0x6a815959
mov ebx, ebx
push eax
call fcn.0048bba0
mov eax, dword fs:[0x30]
mov dword [esp - 0x14], esi
add esp, 0xc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
xchg edx, edx
mov eax, dword [eax]
test eax, eax
je 0x4739b5
mov dword [esp - 0x14], 0x6625c743
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4739b5
xchg edx, edx
sub esp, 4
mov dword [esp], 0x77adc2a3
sub dword [esp], 0x424daee8
sub dword [esp], 0x120dfcfe
xchg ecx, ecx
add dword [esp], 0x1da9278d
sub dword [esp], 0x287698a3
add dword [esp], 0x3ef0db4a
sub dword [esp], 0x57757fee
mov dword [esp - 0x30], edi
push eax
lea eax, [ebp - 0x214]
sub esp, 4
mov dword [esp], 0x2fa64187
xchg ebp, ebp
xor dword [esp], 0x6522052d
sub dword [esp], 0x17756886
sub dword [esp], 0x2bae8a34
xor dword [esp], 0x369ea282
mov ebx, ebx
add dword [esp], 0x2935040a
sub dword [esp], 0x5b33f678
push eax
call fcn.0048c140
mov dword [esp - 0x18], 0x46f80b20
lea eax, [ebp - 0x214]
nop
mov dword [esp - 4], 0xf2518a9
add dword [esp - 4], 0x28d1b809
xchg esp, esp
add dword [esp - 4], 0x3110e226
sub dword [esp - 4], 0x501ec7e7
xor dword [esp - 4], 0x18e8eaad
mov ecx, ecx
sub esp, 4
push eax
call fcn.0048c220
add esp, 0x18
xchg edx, edx
test eax, eax
je 0x4739b5
push dword [ebp + 8]
mov dword [esp - 0x44], 0x3c072e79
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xc]
xchg edi, edi
push eax
mov eax, dword [0x4ba978]
xor eax, dword [0x4ba958]
call eax
xchg edi, edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x2a455301
xor dword [ebp - 4], 0x62a0d483
xchg esp, esp
add dword [ebp - 4], 0x2330fb82
add dword [ebp - 4], 0x19bc00f
sub dword [ebp - 4], 0x6db24313
push eax
mov dword [esp - 0x24], 0x19e04ad0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
xchg ecx, ecx
lea eax, [ebp - 0x214]
push eax
mov eax, dword [0x4ba968]
xchg edi, edi
xor eax, dword [0x4ba958]
call eax
test eax, eax
xchg ebp, ebp
jns 0x4739ac
push eax
mov eax, dword [0x4ba9b8]
xchg edi, edi
xor eax, dword [0x4ba958]
call eax
push eax
mov eax, dword [0x4bab28]
xchg ebp, ebp
xor eax, dword [0x4ba958]
call eax
mov eax, dword [ebp - 4]
xchg ecx, ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
mov dword [esp - 0x14], 0x112a71ef
ret
Function at 0x473ba0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x4ba950]
test edi, edi
je 0x473c9b
xchg esp, esp
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x473c00
push ebx
mov dword [esp - 0x20], 0x2e5fa85e
push esi
mov esi, dword [edi]
lea ebx, [esi + ecx*4]
cmp esi, ebx
mov dword [esp - 0x10], 0x322009dd
je 0x473bfe
lea ecx, [ecx]
mov eax, dword [0x4ba970]
push dword [esi]
mov dword [esp - 0x10], 0x7f54fd76
xor eax, dword [0x4ba958]
call eax
add esi, 4
mov edx, edx
cmp esi, ebx
jne 0x473bd6
mov edi, dword [0x4ba950]
mov ecx, ecx
pop esi
pop ebx
test edi, edi
xchg esp, esp
je 0x473c8d
mov eax, dword [edi]
test eax, eax
je 0x473c45
mov dword [esp - 0xc], 0x3a220ccc
push eax
call fcn.0048b6f0
add esp, 4
mov dword [edi], 0x6c85448f
xchg edx, edx
sub dword [edi], 0x566f80d0
add dword [edi], 0x452937a5
xor dword [edi], 0x18c37bd4
mov dword [esp - 0x34], edx
sub dword [edi], 0x43fd80b0
nop
sub esp, 4
mov dword [esp], 0x1cbfb349
xchg edx, edx
xor dword [esp], 0x446225e9
sub dword [esp], 0xd10b655
sub dword [esp], 0x34e2136a
mov dword [esp - 0x20], edi
xor dword [esp], 0x4386ddeb
sub dword [esp], 0x487796a0
sub dword [esp], 0xcf47a5a
mov dword [esp - 0x10], esi
push edi
call fcn.0048b700
add esp, 8
mov dword [0x4ba950], 0
mov dword [esp - 0x28], esi
pop edi
ret