joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov ebp, ebp
nop
sub esp, 4
mov dword [esp], 0x1f6718f5
mov dword [esp - 0x18], 0x2b3d3a78
add dword [esp], 0x1e03ec94
add dword [esp], 0x284b0c18
xor dword [esp], 0x6e677ea7
mov dword [esp - 0xc], ecx
add dword [esp], 0x4bee236a
sub dword [esp], 0xdadf5e8
sub dword [esp], 0x4a119c88
nop
mov dword [esp - 0x34], 0x38c45c0a
sub esp, 4
mov dword [esp], 0x2d7405fe
add dword [esp], 0x8ea999
mov dword [esp - 0x1c], 0x327361c8
sub dword [esp], 0x1cd0f53d
xor dword [esp], 0xa474066
xor dword [esp], 0x529e0204
add dword [esp], 0x16bc6904
mov dword [esp - 0x2c], 0x34f2f5af
sub dword [esp], 0x60a5613c
nop
mov dword [esp - 4], 0x2feb14a2
sub dword [esp - 4], 0x1abbe32e
mov esi, esi
add dword [esp - 4], 0x2f5320ac
sub dword [esp - 4], 0x440f516e
sub dword [esp - 4], 0x7300b2
sub esp, 4
mov dword [esp - 0xc], esi
push eax
mov eax, dword [0x4c0ce0]
xor eax, dword [0x4c0968]
mov dword [esp - 0x20], 0x2713959e
call eax
test eax, eax
je 0x43bcd3
lea eax, [ebp - 0x1c]
mov edx, edx
push eax
mov eax, dword [0x4c0cf0]
xor eax, dword [0x4c0968]
mov ebx, ebx
call eax
lea eax, [ebp - 0x1c]
push eax
mov dword [esp - 0xc], 0xed15541
mov eax, dword [0x4c0cf8]
xor eax, dword [0x4c0968]
call eax
nop
xchg edi, edi
sub esp, 4
mov dword [esp], 0x1e9cd1dd
xor dword [esp], 0x3fd4ea6a
add dword [esp], 0x15a8d527
xchg ebx, ebx
xor dword [esp], 0x7caa2343
xor dword [esp], 0x4a5b339d
nop
mov dword [esp - 4], 0x7d0b28d7
xchg ebp, ebp
sub dword [esp - 4], 0x3e8ef762
xor dword [esp - 4], 0x38fe50a2
xor dword [esp - 4], 0x517f4106
xchg edi, edi
sub dword [esp - 4], 0x57fd20d1
sub esp, 4
nop
xchg esp, esp
mov dword [esp - 4], 0x5f24809c
xor dword [esp - 4], 0x78f0fd52
xor dword [esp - 4], 0x167cf832
xor dword [esp - 4], 0x5d5a507b
xchg ebp, ebp
xor dword [esp - 4], 0x1072d77c
xor dword [esp - 4], 0x3ba55b2f
xor dword [esp - 4], 0x472559d4
sub esp, 4
mov esp, esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x4c0ce0]
xor eax, dword [0x4c0968]
xchg edx, edx
call eax
test eax, eax
jne 0x43bbe9
mov dword [esp - 0x24], edi
mov esp, ebp
pop ebp
ret
Function at 0x43bce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [esp - 0x10], 0x27a24cfa
nop
mov dword [esp - 4], 0x34c8e2d9
add dword [esp - 4], 0xaf7b539
xor dword [esp - 4], 0x555f451d
mov dword [esp - 0x20], 0x16560981
xor dword [esp - 4], 0x6a8718d0
add dword [esp - 4], 0xcb08830
add dword [esp - 4], 0x192520c
xor dword [esp - 4], 0xe5ba02b
mov ebx, ebx
sub esp, 4
nop
sub esp, 4
mov dword [esp], 0x3803945b
mov dword [esp - 0x24], 0x370b1f70
add dword [esp], 0x2091abd1
sub dword [esp], 0x2b28d91c
xor dword [esp], 0x40d356e4
add dword [esp], 0xaa2026e
xchg edx, edx
xor dword [esp], 0x78613462
lea eax, [esi + 0x20]
mov dword [esi + 0x10], 0x4edecf0
xchg ebp, ebp
add dword [esi + 0x10], 0x477c89da
add dword [esi + 0x10], 0x32f7d2fd
sub dword [esi + 0x10], 0x48e3b113
sub dword [esi + 0x10], 0x367e98b3
mov dword [esp - 0x34], 0xb528587
push eax
mov word [esi + 0xa4], 0x6c0a
xor word [esi + 0xa4], 0x6e43
add word [esi + 0xa4], 0x1cf4
mov esp, esp
xor word [esi + 0xa4], 0x4332
sub word [esi + 0xa4], 0xb51
sub word [esi + 0xa4], 0x4e9c
mov esi, esi
xor word [esi + 0xa4], 0x323
call fcn.00491110
mov ecx, dword [esi + 0xc8]
mov dword [esp - 0x30], 0x6457ad7f
add esp, 0xc
test ecx, ecx
je 0x43be38
mov eax, dword [ecx]
xchg esp, esp
nop
sub esp, 4
mov dword [esp], 0x36554317
xor dword [esp], 0x26f45478
mov dword [esp - 0x2c], ecx
add dword [esp], 0x6cde1633
xor dword [esp], 0x75e7ff15
xor dword [esp], 0x4be5f134
sub dword [esp], 0x437d2382
mov dword [esp - 0x1c], 0x6885947c
call dword [eax + 8]
nop
sub esp, 4
mov dword [esp - 0x44], ebp
mov dword [esp], 0x65c8b2e0
sub dword [esp], 0xdebab7a
sub dword [esp], 0x2d86cde5
sub dword [esp], 0x739615e
mov edx, edx
xor dword [esp], 0x7557a801
sub dword [esp], 0x564b701a
call fcn.00490c50
add esp, 4
mov dword [esp - 0x28], edi
test eax, eax
je 0x43be9d
mov dword [eax], 0x4010b4
mov dword [esp - 0x2c], 0x5803221f
mov ecx, 0x4c0970
mov dword [esi + 0xc8], eax
pop esi
xchg edx, edx
jmp fcn.00483970
xor eax, eax
mov ecx, 0x4c0970
mov ecx, ecx
mov dword [esi + 0xc8], eax
pop esi
jmp fcn.00483970
Function at 0x43e360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [esp - 0x2c], 0x285c5f64
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0xc]
mov dword [esp - 0x18], edx
lea eax, [edi + 0x18]
push eax
call fcn.00405a10
mov dword [esp - 0xc], 0x59601a93
mov esi, dword [eax]
or eax, 0xffffffff
mov dword [ebp - 4], eax
xchg ecx, ecx
cmp byte [esi], 0
je 0x43e3e0
nop
mov ecx, ecx
sub esp, 4
mov dword [esp], 0x3cc58af8
sub dword [esp], 0x49e48fe
xchg ebp, ebp
sub dword [esp], 0xcca330a
xor dword [esp], 0x60be3405
sub dword [esp], 0x4be33af4
push esi
mov dword [esp - 0x18], 0x73055b7e
lea ecx, [ebp - 4]
call fcn.00485de0
inc esi
mov esi, esi
cmp byte [esi], 0
jne 0x43e399
mov eax, dword [ebp - 4]
mov esi, dword [edi + 0x30]
mov dword [esp - 0x40], ecx
not eax
xor esi, 0x56cb
shl esi, 0x10
or esi, dword [edi + 0x20]
mov dword [esp - 0x30], ebp
xor esi, eax
cmp byte [ebp - 8], 0
je 0x43e40e
push dword [ebp - 0xc]
mov edx, edx
call fcn.00490c60
add esp, 4
pop edi
mov eax, esi
xchg edx, edx
pop esi
mov esp, ebp
pop ebp
xchg esp, esp
ret

Function at 0x43e420
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
mov dword [esp - 0x18], esi
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ecx, ecx
mov ebp, esp
sub esp, 0x38
mov eax, ecx
mov ecx, dword [ebx + 8]
mov dword [esp - 0x28], 0x69db3c68
push esi
push edi
mov dword [ebp - 0x14], eax
xor esi, esi
mov edi, edi
mov edi, dword [eax + 0x34]
mov eax, dword [eax + 0x28]
xor edi, 0x5d3156cb
xor eax, 0x5d3156cb
mov dword [esp - 0xc], 0x31aca11b
mov dword [ebp - 4], esi
push esi
add edi, edi
xchg edx, edx
cvtsi2ss xmm0, eax
movss dword [ebp - 0xc], xmm0
call fcn.00485d50
mov ebx, ebx
movzx ecx, ax
test ax, ax
je 0x43e502
mov dword [esp - 0x14], edx
fld dword [ebp - 0xc]
fst qword [ebp - 0x10]
movzx eax, cx
mov ecx, dword [ebp - 0x14]
xchg ecx, ecx
shl eax, 4
add eax, dword [ecx + 0x38]
movups xmm0, xmmword [eax]
mov dword [esp - 0x20], esi
xorps xmm0, xmmword [0x4c55d0]
movaps xmmword [ebp - 0x30], xmm0
fld dword [ebp - 0x28]
fsub dword [ebp - 0x30]
mov dword [esp - 0x1c], 0x33f6a29c
fmulp st(1)
call fcn.00491f30
mov ecx, dword [ebx + 8]
sub eax, edi
mov dword [esp - 0x3c], esp
add esi, eax
mov eax, dword [ebp - 4]
inc eax
mov dword [esp - 0x34], edi
push eax
mov dword [ebp - 4], eax
call fcn.00485d50
mov dword [esp - 0x24], esi
fld qword [ebp - 0x10]
movzx ecx, ax
test cx, cx
mov dword [esp - 0x10], 0x6f171c1e
jne 0x43e498
fstp st(0)
pop edi
xchg esp, esp
mov eax, esi
pop esi
mov esp, ebp
pop ebp
mov dword [esp - 0x24], esi
mov esp, ebx
pop ebx
ret 4
Function at 0x43e6d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
mov esi, esi
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
xchg edi, edi
mov ebp, esp
sub esp, 0x28
mov eax, dword [ecx + 0x34]
xchg esp, esp
xor eax, 0x5d3156cb
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x28]
mov dword [esp - 0x40], 0x41d85d55
xor eax, 0x5d3156cb
push esi
mov esi, dword [ebx + 8]
mov dword [esp - 0x24], ebx
push edi
cvtsi2ss xmm0, eax
xor edi, edi
mov ebp, ebp
movzx eax, word [esi]
movss dword [ebp - 4], xmm0
test ax, ax
je 0x43e781
xchg edi, edi
mov ecx, dword [ecx + 0x38]
fld dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov dword [esp - 0x34], ebx
movzx eax, ax
add eax, eax
movups xmm0, xmmword [ecx + eax*8]
xorps xmm0, xmmword [0x4c55d0]
mov esi, esi
movaps xmmword [ebp - 0x20], xmm0
fld dword [ebp - 0x18]
fsub dword [ebp - 0x20]
mov dword [esp - 0x30], 0x45ad0b79
fmul st(1)
call fcn.00491f30
sub eax, dword [ebp - 8]
lea esi, [esi + 2]
mov ebx, ebx
movzx ecx, word [esi]
add edi, eax
mov eax, ecx
xchg esi, esi
test cx, cx
mov ecx, dword [ebp - 0xc]
jne 0x43e739
fstp st(0)
mov esp, esp
mov eax, edi
pop edi
pop esi
mov dword [esp - 0x20], 0x2ed8019c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
mov esi, esi
ret 4
Function at 0x45fd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [esp - 0x34], ebx
push edi
mov edi, ecx
cmp dword [edi + 0xc4], 0
je 0x45fe6c
mov dword [esp - 0x18], esi
push esi
lea eax, [ebp - 8]
push eax
xchg ecx, ecx
call fcn.0045e370
mov eax, dword [ebp - 8]
mov ecx, 0xab383fd
sub ecx, 0x8e246ff
xchg edi, edi
xor ecx, 0x2e6017ae
xor ecx, 0x4b52c609
sub ecx, 0x43657d52
xchg esi, esi
xor ecx, 0x795e4d19
xor ecx, 0x58203dbe
cdq
mov dword [esp - 0x24], ebp
idiv dword [edi + 0xc4]
cmp eax, ecx
cmovl ecx, eax
mov dword [esp - 0x34], 0x44030caf
xor esi, esi
mov dword [ebp - 8], ecx
mov ecx, dword [edi + 0xc4]
test ecx, ecx
mov dword [esp - 0x2c], ecx
je 0x45fe5c
mov edx, dword [edi + 0xc0]
push ebx
mov edx, edx
lea ebx, [edx + ecx*4]
cmp edx, ebx
je 0x45fe5b
lea ecx, [ecx]
mov ecx, ecx
mov ecx, dword [edx]
mov eax, esi
xor eax, 0x5d3156cb
xchg ecx, ecx
add edx, 4
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], 0x4026d819
mov edi, edi
add dword [ecx + 0x1c], 0x2e4e199
sub dword [ecx + 0x1c], 0x2ae69564
sub dword [ecx + 0x1c], 0x135810bc
add dword [ecx + 0x1c], 0x58644339
mov dword [esp - 0x1c], 0x5bc3ce60
mov eax, dword [ebp - 8]
xor eax, 0x5d3156cb
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 4]
xchg ebp, ebp
xor eax, 0x5d3156cb
mov dword [ecx + 0x24], eax
add esi, dword [ebp - 8]
cmp edx, ebx
mov dword [esp - 0x34], edx
jne 0x45fdfa
pop ebx
mov ecx, edi
mov dword [esp - 0x30], 0x2dea5320
call fcn.00441ff0
pop esi
pop edi
mov dword [esp - 0x2c], esi
mov esp, ebp
pop ebp
ret
Function at 0x4768d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x10], ecx
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
mov ebp, ebp
push esi
xor esi, esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [esp - 0x30], 0x565cdc53
push edi
movzx eax, word [ecx + 0x14]
add eax, 0x18
mov dword [esp - 0x38], ebx
add eax, ecx
movzx ecx, word [ecx + 6]
mov ebx, ecx
cmp si, cx
mov dword [esp - 0x24], ecx
jae 0x47694c
mov edi, dword [ebp + 0xc]
lea esp, [esp]
mov ecx, dword [eax + 8]
mov dword [esp - 0x14], 0x5f10007e
test ecx, ecx
jne 0x476928
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
mov dword [esp - 0x24], 0x69c52bef
cmp edi, esi
jb 0x47693f
add ecx, esi
cmp edi, ecx
mov esi, esi
jb 0x476959
inc edx
add eax, 0x28
mov dword [esp - 0x28], edx
cmp dx, bx
jb 0x476916
pop edi
mov dword [esp - 0x28], ebp
pop esi
xor eax, eax
pop ebx
pop ebp
mov ebx, ebx
ret
test eax, eax
je 0x47694c
mov eax, dword [eax + 0x14]
mov edx, edx
sub eax, esi
add eax, dword [ebp + 8]
add eax, edi
mov dword [esp - 0x44], edi
pop edi
pop esi
pop ebx
mov ebp, ebp
pop ebp
ret
Function at 0x476980
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xchg ecx, ecx
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov edx, edx
push esi
push edi
movzx eax, word [ebx]
xor eax, 0x1d6a61f8
mov dword [esp - 0x34], 0x68bad69e
cmp eax, 0x1d6a3bb5
jne 0x476abc
mov ecx, dword [ebx + 0x3c]
mov ecx, ecx
mov eax, dword [ecx + ebx]
xor eax, 0x1d6a61f8
cmp eax, 0x1d6a24a8
mov dword [esp - 0x24], 0x489e5d1d
jne 0x476abc
push dword [ecx + ebx + 0x78]
push ebx
mov ebp, ebp
call fcn.004768d0
mov esi, eax
mov dword [ebp - 8], esi
push dword [esi + 0x20]
mov dword [esp - 0x30], ebp
push ebx
call fcn.004768d0
push dword [esi + 0x24]
mov dword [ebp - 4], eax
mov dword [esp - 0x1c], ebx
push ebx
call fcn.004768d0
push dword [esi + 0x1c]
mov dword [ebp - 0xc], eax
xchg ebx, ebx
push ebx
call fcn.004768d0
xor edi, edi
mov dword [esp - 0x18], edi
mov dword [ebp - 0x10], eax
add esp, 0x20
cmp dword [esi + 0x18], edi
mov dword [esp - 0x10], esi
jbe 0x476abc
mov eax, dword [ebp - 4]
push dword [eax + edi*4]
push ebx
mov edx, edx
call fcn.004768d0
mov esi, eax
or ecx, 0xffffffff
mov dword [esp - 0x10], 0x2360f726
add esp, 8
mov dword [ebp + 8], ecx
cmp byte [esi], 0
je 0x476aa2
xchg esp, esp
mov edi, edi
nop
mov dword [esp - 4], 0x7629d980
mov dword [esp - 0x2c], ebp
xor dword [esp - 4], 0x52a1dee1
add dword [esp - 4], 0x21d0232f
xor dword [esp - 4], 0x73341c65
add dword [esp - 4], 0x138e5959
mov dword [esp - 0x40], 0x4ac02b27
sub dword [esp - 4], 0x48fa904d
sub esp, 4
push esi
lea ecx, [ebp + 8]
mov dword [esp - 0x38], ecx
call fcn.00485de0
inc esi
cmp byte [esi], 0
xchg ecx, ecx
jne 0x476a4a
mov ecx, dword [ebp + 8]
not ecx
xchg esp, esp
cmp ecx, dword [ebp + 0xc]
je 0x476acf
mov eax, dword [ebp - 8]
inc edi
mov dword [esp - 0x20], ebp
cmp edi, dword [eax + 0x18]
jb 0x476a20
pop edi
xchg ecx, ecx
pop esi
xor eax, eax
pop ebx
mov dword [esp - 0x10], 0x3c7b6803
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
push dword [ecx + eax*4]
mov dword [esp - 0x3c], esp
push ebx
call fcn.004768d0
add esp, 8
xchg ecx, ecx
pop edi
pop esi
pop ebx
xchg ebp, ebp
mov esp, ebp
pop ebp
ret
Function at 0x477270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x214]
mov edx, edx
nop
mov dword [esp - 4], 0x156f7a4a
xor dword [esp - 4], 0x534e855d
sub dword [esp - 4], 0x44f03b56
mov esp, esp
xor dword [esp - 4], 0x256959f
add dword [esp - 4], 0xb8b96ba
xor dword [esp - 4], 0x5aa1d6ee
mov dword [esp - 0x18], 0x37e22b27
sub dword [esp - 4], 0x545339ee
sub esp, 4
nop
sub esp, 4
mov dword [esp - 0x24], ebp
mov dword [esp], 0x1786bb02
add dword [esp], 0x320ff5df
sub dword [esp], 0x3cb2f82c
xchg ecx, ecx
add dword [esp], 0x40ac5543
sub dword [esp], 0x4d900df8
push eax
mov dword [esp - 0x14], 0x1d330828
call fcn.00491110
mov eax, dword fs:[0x30]
add esp, 0xc
xchg ebp, ebp
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
mov edx, edx
je 0x4774e1
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4774e1
mov dword [esp - 0x28], 0x55b5ce9c
sub esp, 4
mov dword [esp], 0x12728630
add dword [esp], 0x62e5db8d
xchg ebp, ebp
xor dword [esp], 0x78f178d8
xor dword [esp], 0x6efb045e
sub dword [esp], 0x43cfc46c
mov dword [esp - 0x20], 0x7c9d1617
xor dword [esp], 0x121f19af
sub dword [esp], 0xd9d405d
push eax
lea eax, [ebp - 0x214]
mov dword [esp - 0x44], 0x16b11dee
nop
mov dword [esp - 4], 0x4980bc6e
xor dword [esp - 4], 0x459e2696
add dword [esp - 4], 0x4831bb3c
mov edx, edx
sub dword [esp - 4], 0x2783a7e0
add dword [esp - 4], 0x523fc941
sub dword [esp - 4], 0x3e292cb1
mov ebp, ebp
sub dword [esp - 4], 0x40e349e0
sub esp, 4
push eax
call fcn.004916c0
xchg ebp, ebp
lea eax, [ebp - 0x214]
nop
sub esp, 4
mov edi, edi
mov dword [esp], 0x67b4d07f
add dword [esp], 0x17b5fb94
sub dword [esp], 0x730f22a9
add dword [esp], 0x6b137fb9
mov dword [esp - 0x38], 0x5445a2a9
sub dword [esp], 0x5cc4038d
add dword [esp], 0x19897830
xor dword [esp], 0x34349d9a
xchg ebx, ebx
push eax
call fcn.00491790
add esp, 0x18
mov dword [esp - 0x2c], esi
test eax, eax
je 0x4774e1
push dword [ebp + 8]
xor ecx, ecx
mov dword [esp - 0x30], 0x513f53db
mov word [eax], cx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x4c0988]
mov dword [esp - 0x30], 0x6bd03b86
xor eax, dword [0x4c0968]
call eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x2eb22ffa
mov dword [esp - 0x18], 0x211760eb
add dword [ebp - 4], 0x16e518db
sub dword [ebp - 4], 0x3659b849
add dword [ebp - 4], 0xd7b3dfa
mov edi, edi
add dword [ebp - 4], 0x5cc671d4
xor dword [ebp - 4], 0x797f405a
push eax
xchg edx, edx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
mov dword [esp - 0x2c], 0x65d51151
push eax
lea eax, [ebp - 0x214]
push eax
mov esp, esp
mov eax, dword [0x4c0978]
xor eax, dword [0x4c0968]
call eax
xchg ebx, ebx
test eax, eax
jns 0x4774d2
push eax
mov eax, dword [0x4c09c8]
mov edx, edx
xor eax, dword [0x4c0968]
call eax
push eax
mov eax, dword [0x4c0b38]
mov esp, esp
xor eax, dword [0x4c0968]
call eax
mov eax, dword [ebp - 4]
mov dword [esp - 0x2c], 0x3c85e14d
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
mov dword [esp - 0x44], ebp
ret
Function at 0x4774f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
xchg ecx, ecx
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov edi, edi
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1a95c995
sub dword [ebp - 0x20], 0x13d61199
mov ebx, ebx
xor dword [ebp - 0x20], 0x405b115b
add dword [ebp - 0x20], 0x1f386976
sub dword [ebp - 0x20], 0x661d1005
xchg ecx, ecx
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], 0x47af1a1e
mov dword [esp - 0x20], 0x490d8bc6
sub dword [ebp - 0x1c], 0x412a1209
add dword [ebp - 0x1c], 0x3b6c3654
xor dword [ebp - 0x1c], 0xbac425b
mov edx, edx
xor dword [ebp - 0x1c], 0x6615eb37
xor dword [ebp - 0x1c], 0x2c489705
push eax
mov ebp, ebp
mov dword [ebp - 0x14], 0x59fbb734
sub dword [ebp - 0x14], 0x417b7c77
xor dword [ebp - 0x14], 0x776b8cb1
sub dword [ebp - 0x14], 0x3fa5079a
mov dword [esp - 0xc], 0x16d425eb
sub dword [ebp - 0x14], 0x3046ae72
mov dword [ebp - 0x18], 0x6e411550
sub dword [ebp - 0x18], 0x50092b07
xor dword [ebp - 0x18], 0x3bffe34c
mov esp, esp
add dword [ebp - 0x18], 0x19f0fcfa
sub dword [ebp - 0x18], 0x3fb905ff
mov dword [ebp - 0x10], 0x1515ebc
add dword [ebp - 0x10], 0x846776c
xchg ebp, ebp
add dword [ebp - 0x10], 0x28f277e4
sub dword [ebp - 0x10], 0x13bfebc3
add dword [ebp - 0x10], 0x2cfc1ca3
xchg edx, edx
sub dword [ebp - 0x10], 0x4bc67eec
mov dword [ebp - 0xc], 0x5c467d2f
sub dword [ebp - 0xc], 0x4d5c47d1
mov dword [esp - 0x2c], 0x7c700b79
add dword [ebp - 0xc], 0x5e1b8a3b
sub dword [ebp - 0xc], 0xc8e11b6
xor dword [ebp - 0xc], 0x5f3f640c
mov dword [esp - 0x34], 0x196e040
add dword [ebp - 0xc], 0x51b33c
sub dword [ebp - 0xc], 0x3f9a7d2b
mov dword [ebp - 8], 0x1be522ef
xor dword [ebp - 8], 0x428b2622
mov dword [esp - 0x34], 0x43133773
sub dword [ebp - 8], 0x316136db
add dword [ebp - 8], 0x5179674
add dword [ebp - 8], 0xe32c9e4
sub dword [ebp - 8], 0xa2cf89f
mov dword [esp - 0x30], 0x6ca897b3
sub dword [ebp - 8], 0x312a35ab
mov dword [ebp + 8], 0x27716928
add dword [ebp + 8], 0x52b90432
sub dword [ebp + 8], 0x4310f630
xchg edi, edi
xor dword [ebp + 8], 0x48d05de8
sub dword [ebp + 8], 0x2c5b14e6
xor dword [ebp + 8], 0x536e15dc
xchg edx, edx
call fcn.004712a0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
mov dword [esp - 0x20], 0x52ca8819
je 0x4776b0
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [esp - 0x1c], 0x227b5231
mov esp, ebp
pop ebp
ret
Function at 0x4776c0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x4c095c]
xchg ebx, ebx
test edi, edi
je 0x4777b1
mov ecx, dword [edi + 4]
mov dword [esp - 0x28], 0x5e5d8725
test ecx, ecx
je 0x477718
push ebx
xchg edi, edi
push esi
mov esi, dword [edi]
lea ebx, [esi + ecx*4]
xchg ebp, ebp
cmp esi, ebx
je 0x477714
lea ecx, [ecx]
mov eax, dword [0x4c0980]
xchg ebp, ebp
push dword [esi]
xor eax, dword [0x4c0968]
call eax
add esi, 4
mov dword [esp - 0x30], edx
cmp esi, ebx
jne 0x4776f2
mov edi, dword [0x4c095c]
pop esi
xchg esi, esi
pop ebx
test edi, edi
je 0x4777a7
mov eax, dword [edi]
mov dword [esp - 0x24], ebx
test eax, eax
je 0x477757
push eax
call fcn.00490c60
mov dword [esp - 0x40], edi
add esp, 4
mov dword [edi], 0x17efc772
sub dword [edi], 0x15be1959
xchg ebp, ebp
add dword [edi], 0x3035da20
xor dword [edi], 0x2baa1495
xor dword [edi], 0x19cd9cac
nop
mov dword [esp - 0x34], 0x309b347a
sub esp, 4
mov dword [esp], 0x54a29da2
xor dword [esp], 0x462108a1
xchg esp, esp
add dword [esp], 0x6a0edef3
xor dword [esp], 0x5e58b07
xor dword [esp], 0x56c2ecde
mov dword [esp - 0x1c], ebx
xor dword [esp], 0x10cd7812
sub dword [esp], 0x3f786c2d
push edi
call fcn.00490c70
mov dword [esp - 0x1c], ebp
add esp, 8
mov dword [0x4c095c], 0
pop edi
xchg esp, esp
ret
Function at 0x47a200
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
mov edx, ecx
mov dword [ebp - 4], edx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
test ebx, ebx
jne 0x47a244
cmp byte [edx + 5], bl
jne 0x47a23f
mov eax, edi
cmp esi, edi
jb 0x47a23b
mov eax, esi
mov ecx, edi
sub eax, ecx
mov ecx, 0x7ffff000
cmp ecx, eax
sbb ebx, ebx
and ebx, 5
add ebx, 5
jmp 0x47a244
mov ecx, esi
jmp 0x47a228
mov ebx, 5
cmp byte [edx + 5], 0
jne 0x47a2a4
cmp ebx, 5
je 0x47a27f
mov eax, ebx
cmp ebx, 0xa
jne 0x47a39b
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea esi, [edx + 6]
add esi, ecx
mov word [ecx + edx], 0x25ff
mov dword [ecx + edx + 2], esi
mov ecx, dword [ebp + 0x18]
add ecx, edi
pop edi
mov dword [esi], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x10]
sub edi, esi
mov eax, dword [ebp + 0x18]
sub edi, ecx
mov edx, dword [ebp + 0xc]
add eax, 0xfffffffb
add eax, edi
pop edi
pop esi
mov dword [edx + ecx + 1], eax
mov eax, ebx
mov byte [edx + ecx], 0xe9
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0x18]
call eax
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47a2c4
mov edx, dword [eax + 0x3c]
add edx, eax
cmp dword [edx], 0x4550
je 0x47a2c6
xor edx, edx
movzx ecx, word [edx + 0x14]
movzx eax, word [edx + 6]
add ecx, 0x18
mov edi, dword [ebp + 0x10]
add ecx, edx
add edi, esi
mov dword [ebp + 0x1c], eax
xor edx, edx
xor esi, esi
cmp dx, ax
jae 0x47a304
test edi, edi
je 0x47a2fb
mov edx, dword [ecx + 0x14]
cmp edi, edx
jb 0x47a2fb
mov eax, dword [ecx + 0x10]
add eax, edx
cmp edi, eax
jb 0x47a306
mov eax, dword [ebp + 0x1c]
inc esi
add ecx, 0x28
cmp si, ax
jb 0x47a2e4
xor ecx, ecx
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 0x14]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x1c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
call eax
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47a336
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
je 0x47a338
xor esi, esi
movzx edx, word [esi + 0x14]
xor ecx, ecx
movzx eax, word [esi + 6]
add edx, 0x18
mov edi, dword [ebp + 0x14]
add edx, esi
add edi, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp + 8], eax
cmp si, ax
jae 0x47a377
test edi, edi
je 0x47a36e
mov esi, dword [edx + 0x14]
cmp edi, esi
jb 0x47a36e
mov eax, dword [edx + 0x10]
add eax, esi
cmp edi, eax
jb 0x47a379
mov eax, dword [ebp + 8]
inc ecx
add edx, 0x28
cmp cx, ax
jb 0x47a357
xor edx, edx
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 0x14]
add ecx, dword [ebp + 0x14]
add ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0x1c]
sub ecx, 5
mov byte [eax + edx], 0xe9
mov dword [eax + edx + 1], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x484cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, ecx
mov esi, ecx
push edi
cmp dword [esi + 4], 2
mov dword [esp - 0x24], 0x37ed6ff6
jbe 0x484cd4
push dword [esi]
call fcn.00490c60
add esp, 4
xchg edx, edx
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [ecx + 2]
mov dword [esp - 0x10], ebp
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484ce0
xchg edx, edx
sub ecx, edx
mov edx, esi
sar ecx, 1
mov dword [esi + 4], ecx
mov dword [esp - 0x20], 0xc9840e0
cmp ecx, 2
jbe 0x484d7e
lea eax, [ecx + 1]
mov ecx, 0x513d1909
mov ebx, ebx
add ecx, 0x19b3b0d8
sub ecx, 0x11e83b1a
sub ecx, 0x498c1b66
mov dword [esp - 0x14], 0x4ffdfad
add ecx, 0x14e38324
add ecx, 0x25d5d591
sub ecx, 0x4a35cc14
mul ecx
mov dword [esp - 0x30], ecx
pushf
mov ecx, 0x62ef7cda
sub ecx, 0x1085e539
sub ecx, 0x4075395d
xchg ebp, ebp
xor ecx, 0x7cd444c7
add ecx, 0x9b9ac25
add ecx, 0x89263957
popf
mov esi, esi
cmovb eax, ecx
push eax
call fcn.00490c90
mov edx, eax
mov dword [esp - 0x18], edi
add esp, 4
mov dword [esi], edx
xor edi, edi
cmp dword [esi + 4], edi
mov dword [esp - 0xc], 0x24ac91ba
jbe 0x484de4
sub ebx, edx
mov ecx, edi
mov dword [esp - 0x10], esi
lea edx, [edx + 2]
and ecx, 3
mov eax, 0x48fe0653
mov dword [esp - 0x14], 0x2eae8e7f
sub eax, 0x139e1afa
sub eax, 0x24122c8e
xor eax, 0x2f0f1ef5
xor eax, 0x1ac177fd
xchg ebx, ebx
sub eax, 0x323e659
xor eax, 0x5af5b59b
shl ecx, 3
mov ebx, ebx
inc edi
sar eax, cl
cbw
xchg ecx, ecx
xor ax, word [edx + ebx - 2]
mov word [edx - 2], ax
cmp edi, dword [esi + 4]
xchg ebx, ebx
jb 0x484d8f
pop edi
mov eax, esi
mov edi, edi
pop esi
pop ebx
pop ebp
ret 4