Function at 0x467291
Capabilities:
Encode data using xor

Disassembly:
daa
xor al, 0x77
pushfd
in eax, dx
sbb ebp, dword [ebx - 0x3ad65897]
mov eax, 0x7b9116ca
adc al, 0xa
sbb dl, byte [esp + ecx*2 + 0x5b]
shr dword [ebx], 1
mov eax, dword [0x4a647b0]
xchg byte [eax], al
inc ecx
xchg esp, eax
sub dh, dl
mov al, 0x88
jnp 0x4672b2
cli
xchg dword [ecx + esi - 0x4a], ebx
bound ebx, qword [ecx + ebx]
imul edx, ecx, 0xf5215e2b
std
sbb dword [edx + 0x4c], eax
add bh, cl
ja 0x46722c
insb byte es:[edi], dx
mov bh, 0xdb
pop ebp
mov eax, 0x7b98cb0b
rol ah, 1
inc edi
and al, 0x2d
adc esp, ecx
pop ds
or al, 0xdf
invalid
jbe 0x467258
aas
invalid
push ebp
mov al, byte [0x91dcf22]
fld xword [ecx]
mov bh, 0xfc
movsb byte es:[edi], byte [esi]
sbb al, 0xf
mov edx, dword [ebp + 0x78]
push 0xffffffffffffffac
arpl word [ecx + 0x5b4fc46b], sp
loopne 0x4672b5
iretd
cmc
mov ebp, 0x92b2b3c7
test eax, 0x88e7919a
test al, 0x73
and al, 0x4a
dec ebx
push esp
mov ebx, 0x2924ac54
test ch, bh
aaa
invalid

Function at 0x47613d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476df5
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047629d
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x476287
test ebx, ebx
jl 0x47622b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c5a1
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47624c
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47623e
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477c0d
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477c0d
add esp, 8
mov ebx, 0x80070057
jmp 0x47622b