joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b0a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x49f3fe
call fcn.0049b470
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x4a7728
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00402e23
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00402e23
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.0042a8e1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x42bc43
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x49f48d
call fcn.0049b470
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
call fcn.004027c3
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004027c3
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004027c3
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004027c3
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42de41
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x49f76e
call fcn.0049b470
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 1
call fcn.00439ce4
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0042de83
push dword [esi + 0xc]
call fcn.00401dd1
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x42e183
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x49f822
call fcn.0049b470
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0xc]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
call fcn.00402f3b
and dword [ebp - 4], 0
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.0042e38e
mov eax, dword [edi + 0x24]
add edi, 0x30
mov dword [esi + 0x24], eax
mov al, byte [edi - 8]
mov byte [esi + 0x28], al
mov al, byte [edi - 7]
mov byte [esi + 0x29], al
mov eax, dword [edi - 4]
push edi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [esi + 0x2c], eax
call fcn.0042e2f6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42e1fe
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x49f855
call fcn.0049b470
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00428d7c
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040281f
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0040281f
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0040281f
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0040281f
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x43503a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x49fffd
call fcn.0049b470
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.00402f3b
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00402f3b
mov eax, dword [edi + 0x28]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402f3b
lea eax, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00402f3b
mov al, byte [edi + 0x48]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x48], al
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov al, byte [edi + 0x4a]
mov byte [esi + 0x4a], al
mov al, byte [edi + 0x4b]
mov byte [esi + 0x4b], al
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov al, byte [edi + 0x4d]
mov byte [esi + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x439ee3
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x4a0686
call fcn.0049b470
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4a8730
mov dword [esi + 4], 0x4a6d54
mov dword [esi + 8], 0x4a6d88
mov dword [esi + 0xc], 0x4a7818
mov dword [esi + 0x10], 0x4a871c
mov dword [esi + 0x14], 0x4a870c
mov dword [esi + 0x18], 0x4a6d78
mov dword [esi + 0x1c], 0x4a6d68
mov dword [esi + 0x20], 0x4a8704
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.00402e23
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.00402e23
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 6
call fcn.00402e23
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
or dword [esi + 0xa8], 0xffffffff
mov byte [ebp - 4], 8
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xac], ebx
mov byte [esi + 0xb0], bl
mov byte [esi + 0xb1], bl
mov byte [esi + 0xb2], bl
mov byte [esi + 0xb3], bl
mov byte [esi + 0xb4], bl
mov byte [esi + 0xb5], bl
mov byte [esi + 0xb6], bl
mov byte [esi + 0xb7], bl
mov dword [esi + 0xb8], ebx
mov dword [esi], 0x4a86d8
mov dword [esi + 4], 0x4a86c4
mov dword [esi + 8], 0x4a86ac
mov dword [esi + 0xc], 0x4a8690
mov dword [esi + 0x10], 0x4a867c
mov dword [esi + 0x14], 0x4a866c
mov dword [esi + 0x18], 0x4a865c
mov dword [esi + 0x1c], 0x4a864c
mov dword [esi + 0x20], 0x4a8644
call fcn.0041bbd3
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x447135
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4a186b
call fcn.0049b470
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.00402e23
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44b23c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a1d58
call fcn.0049b470
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00457929
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.00453e80
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.00453e80
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.00453e80
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.00453e80
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00453e80
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.00453e80
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00453e80
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.00453e80
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44fea0
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x44fefc
cmp word [ecx], 0x5a4d
jne 0x44fefc
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x44fefc
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x44fefc
test al, 7
jne 0x44fefc
add eax, ecx
cmp dword [eax], 0x4550
jne 0x44fefc
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x44ff16
sub ecx, 0x74
je 0x44ff0f
dec ecx
dec ecx
je 0x44ff0f
dec ecx
dec ecx
je 0x44ff08
sub ecx, 0x3c
je 0x44ff01
sub ecx, 0x8464
je 0x44ff16
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x44ff1b
mov ecx, 0x3030701
jmp 0x44ff1b
mov ecx, 0x3030501
jmp 0x44ff1b
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x44fefc
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x44ff35
cmp eax, 0x20b
jne 0x44fefc
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x44fefe

Function at 0x453a28
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4a2373
call fcn.0049b470
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00453c6e
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00453d47
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.00402f3b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x454351
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x454370
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x45435f
pop edi
cmp esi, 4
jb 0x45437a
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x45438b
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x454397
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x4543a1
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x460a09
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x4a31d7
call fcn.0049b470
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.0040281f
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.00460a8c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x469331
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4a3730
call fcn.0049b470
sub esp, 0x14
mov ax, word [ebp + 8]
push esi
mov esi, ecx
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0x14], 2
mov byte [ebp - 0x12], dl
mov word [esi + 2], 0x63
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.004693a2
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x30]
push eax
call fcn.00465ee9
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x50]
push eax
call fcn.00465ee9
push dword [ebp - 0x1c]
call fcn.00401dd1
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46ffd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.0046f680
push 0x41
mov ecx, esi
call fcn.0046f680
push 0x59
mov ecx, esi
call fcn.0046f680
push 0x26
mov ecx, esi
call fcn.0046f680
push 0x53
mov ecx, esi
call fcn.0046f680
push 0x59
mov ecx, esi
call fcn.0046f680
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x470060
test cl, cl
jbe 0x47005c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x4bba44]
xor eax, edi
dec ecx
jne 0x470046
xor edi, edi
jmp 0x47008f
cmp bl, cl
jne 0x470067
inc edi
jmp 0x470072
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x4bba44]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x47001e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.0046f6c0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0046f7e0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x4702a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.004700d0
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a8], bl
je 0x47031c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x184]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.00493710
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x470359
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x180
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x47032e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.00470430
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a8], bl
je 0x470419
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x1a4]
inc ebp
cmp ebp, eax
jne 0x4703a4
xor ebp, ebp
cmp dword [edi + 0x1bc], ebx
je 0x4703f5
lea ecx, [edi + 0x148]
call fcn.0040e430
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1bc]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x184]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.00493830
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x47e360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x47e39e
mov ecx, ebx
call fcn.0049a2b0
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.0049a9b0
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.0049aa40
jmp 0x47e3b6
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x47e3bf
mov ecx, ebx
call fcn.0049a2b0
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.0049a9b0
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x47e3ed
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.0049a2b0
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.0049a9b0
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x47e460
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x14
lea edx, [esp + 0x18]
call fcn.0049ab20
lea ecx, [edi + 0x80]
push 0x14
lea edx, [esp + 0x98]
call fcn.0049ab20
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jbe 0x47e53a
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
lea edx, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0049ab80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x80]
call fcn.0049ab80
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor ebp, ecx
mov ecx, dword [esp + 0x60]
xor eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x24]
xor edx, ecx
dec eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], eax
jne 0x47e4cf
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 8
Function at 0x47eb30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0049acd0
mov ebp, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049a9b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049a9b0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x47ebcb
push str.SystemFunction036
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47ebc4
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call eax
test al, al
je 0x47ebc4
push 0x20
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x20]
mov ebp, 0x64
call fcn.0049a9b0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x47ebef
push 8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.0049a9b0
call ebx
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0049a9b0
mov edi, 0x64
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0049b2f0
lea ecx, [esp + 0x1c]
call fcn.0049acd0
push 0x20
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.0049a9b0
dec edi
jne 0x47ec09
dec ebp
jne 0x47ebd1
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0049b2f0
mov byte [esi + 0x20], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret

Function at 0x47f430
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xc0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x47f461
lea ecx, [esp + 0x4c]
call fcn.0049a2b0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.0049a9b0
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xd0]
call fcn.0049aa40
pop edi
pop esi
pop ebx
add esp, 0xc0
ret 4