joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473580
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ebx
push edi
xor edi, edi
mov dword [esi], edi
and ebp, 3
je 0x4735a7
call fcn.004741b0
test eax, eax
je 0x4735a7
or dword [esi], ebp
mov edi, 1
test bl, 1
je 0x4735e6
call fcn.0049b660
cmp eax, 1
je 0x4735de
call fcn.0049b490
cmp eax, 1
je 0x4735de
call fcn.0049b580
cmp eax, 1
je 0x4735de
call fcn.0049b3a0
cmp eax, 1
je 0x4735de
call fcn.0049b750
cmp eax, 1
jne 0x4735e6
or dword [esi], 1
mov edi, 1
test bl, 2
je 0x47361b
call fcn.0049b960
cmp eax, 1
je 0x473613
call fcn.0049b8d0
cmp eax, 1
je 0x473613
call fcn.0049b9e0
cmp eax, 1
je 0x473613
call fcn.0049b850
cmp eax, 1
jne 0x47361b
or dword [esi], 2
mov edi, 1
test bl, 0x40
je 0x473641
push 0x400
push 0x58a560
call fcn.00495d30
add esp, 8
cmp eax, 0x6fcf9e13
je 0x473641
or dword [esi], 0x40
mov edi, 1
test bl, 4
je 0x473655
call fcn.0049bd40
cmp eax, 1
jne 0x473655
or dword [esi], 4
mov edi, eax
test bl, 8
je 0x473669
call fcn.0049ba80
cmp eax, 1
jne 0x473669
or dword [esi], 8
mov edi, eax
test bl, 0x10
je 0x47367d
call fcn.0049bcf0
cmp eax, 1
jne 0x47367d
or dword [esi], 0x10
mov edi, eax
test bl, 0x20
je 0x473694
call fcn.0049bbe0
cmp eax, 1
jne 0x473694
or dword [esi], 0x20
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4736a0
Capabilities:
Create thread

Disassembly:
push 0x5976a8
push 0
push 0
push 0x473730
push 0
push 0
call fcn.004d9d04
xor ecx, ecx
mov dword [0x5976a4], eax
add esp, 0x18
test eax, eax
sete cl
mov eax, ecx
ret

Function at 0x4738c0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
cmp dword [0x5976c8], 0
jne 0x473931
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
neg eax
push 0
sbb eax, eax
and dword [0x5976cc], eax
lea eax, [esp + 0x10]
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
neg eax
mov dword [esp], 0xc
push 0
sbb eax, eax
mov dword [esp + 0xc], 1
and dword [0x5976cc], eax
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
inc dword [0x5976c8]
mov dword [0x5976cc], eax
jmp 0x473936
mov eax, dword [0x5976cc]
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x47396d
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi - 4]
lea esi, [edi - 8]
push 0
push edi
call fcn.004d2520
push esi
call fcn.004d58e0
add esp, 0x10
push dword [0x5976cc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
pop edi
add esp, 0x20
ret
Function at 0x473980
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
cmp dword [0x5976c8], 0
jne 0x4739f1
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
neg eax
push 0
sbb eax, eax
and dword [0x5976cc], eax
lea eax, [esp + 0x10]
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
neg eax
mov dword [esp], 0xc
push 0
sbb eax, eax
mov dword [esp + 0xc], 1
and dword [0x5976cc], eax
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
inc dword [0x5976c8]
mov dword [0x5976cc], eax
jmp 0x4739f6
mov eax, dword [0x5976cc]
push esi
push edi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esp + 0x2c]
lea eax, [edi + 8]
push eax
call fcn.004e0a4f
mov esi, eax
add esp, 4
test esi, esi
jne 0x473a1d
pop edi
pop esi
add esp, 0x20
ret
push dword [0x5976cc]
mov dword [esi], 0xfacade11
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
lea eax, [esi + 8]
pop esi
add esp, 0x20
ret
Function at 0x475950
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
mov ebx, ebp
push esi
push edi
test eax, eax
jne 0x4759a3
mov ecx, dword [esp + 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475975
mov esi, dword [esp + 0x128]
sub ecx, edx
lea eax, [esi - 1]
push eax
mov eax, dword [esp + 0x124]
add eax, ecx
push eax
push ebp
call fcn.004e4400
mov byte [esi + ebp - 1], 0
jmp 0x475aad
jns 0x4759ac
call fcn.0049ed90
jmp 0x4759b1
call fcn.0049ed80
mov edi, dword [esp + 0x128]
mov esi, eax
lea eax, [edi - 1]
push eax
push esi
push ebp
call fcn.004e4400
push esi
mov byte [edi + ebp - 1], 0
call fcn.004577f0
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4759ea
or eax, 2
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4759f0
sub ecx, edx
cmp byte [ecx + ebp - 1], 0x2f
je 0x475a1d
lea edi, [ebp - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x475a03
mov ax, word [0x507418]
mov word [edi], ax
mov edi, dword [esp + 0x128]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push dword [esp + 0x130]
call fcn.004e438b
lea ecx, [esp + 0x2c]
add esp, 0x14
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475a40
sub ecx, edx
mov edx, ebp
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x475a50
sub edx, esi
mov eax, edi
sub eax, edx
cmp ecx, eax
jae 0x475afd
mov edx, ebp
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x475a70
sub edx, ecx
lea ecx, [esp + 0x18]
mov eax, ecx
sub edx, eax
add edx, ebp
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x475a83
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475a95
sub ecx, edx
sub edi, ecx
dec edi
push edi
push str..cnt
push ebp
call fcn.004e4670
add esp, 0xc
cmp byte [ebp], 0
je 0x475af0
mov al, byte [ebx]
mov byte [esp + 0x13], al
cmp al, 0x5c
je 0x475ac4
cmp al, 0x2f
jne 0x475aea
mov ecx, ebp
mov byte [ebx], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475ad0
sub ecx, edx
je 0x475ae4
push ebp
call fcn.004e0b20
add esp, 4
mov cl, byte [esp + 0x13]
mov byte [ebx], cl
inc ebx
cmp byte [ebx], 0
jne 0x475ab6
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
Function at 0x475b10
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
mov ebx, ebp
push esi
push edi
test eax, eax
jne 0x475b63
mov ecx, dword [esp + 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475b35
mov esi, dword [esp + 0x128]
sub ecx, edx
lea eax, [esi - 1]
push eax
mov eax, dword [esp + 0x124]
add eax, ecx
push eax
push ebp
call fcn.004e4400
mov byte [esi + ebp - 1], 0
jmp 0x475c6d
jns 0x475b6c
call fcn.0049ed90
jmp 0x475b71
call fcn.0049ed80
mov edi, dword [esp + 0x128]
mov esi, eax
lea eax, [edi - 1]
push eax
push esi
push ebp
call fcn.004e4400
push esi
mov byte [edi + ebp - 1], 0
call fcn.004577f0
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x475baa
or eax, 2
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475bb0
sub ecx, edx
cmp byte [ecx + ebp - 1], 0x2f
je 0x475bdd
lea edi, [ebp - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x475bc3
mov ax, word [0x507418]
mov word [edi], ax
mov edi, dword [esp + 0x128]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push dword [esp + 0x130]
call fcn.004e438b
lea ecx, [esp + 0x2c]
add esp, 0x14
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475c00
sub ecx, edx
mov edx, ebp
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x475c10
sub edx, esi
mov eax, edi
sub eax, edx
cmp ecx, eax
jae 0x475cbd
mov edx, ebp
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x475c30
sub edx, ecx
lea ecx, [esp + 0x18]
mov eax, ecx
sub edx, eax
add edx, ebp
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x475c43
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475c55
sub ecx, edx
sub edi, ecx
dec edi
push edi
push str..p15
push ebp
call fcn.004e4670
add esp, 0xc
cmp byte [ebp], 0
je 0x475cb0
mov al, byte [ebx]
mov byte [esp + 0x13], al
cmp al, 0x5c
je 0x475c84
cmp al, 0x2f
jne 0x475caa
mov ecx, ebp
mov byte [ebx], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475c90
sub ecx, edx
je 0x475ca4
push ebp
call fcn.004e0b20
add esp, 4
mov cl, byte [esp + 0x13]
mov byte [ebx], cl
inc ebx
cmp byte [ebx], 0
jne 0x475c76
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
Function at 0x476980
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
push edi
push 0xffffffffffffffff
mov eax, dword [esi + 0x38]
mov edi, dword [eax + 0x2c]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x3c], 0
jne 0x4769da
push 0x28
call fcn.00473980
add esp, 4
test eax, eax
jne 0x4769c2
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 2
pop esi
add esp, 0x20
ret
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
mov dword [eax], 0xffffffff
mov dword [esi + 0x3c], eax
mov esi, dword [esi + 0x3c]
cmp dword [esi + 0x24], 0
jne 0x476a49
push 1
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x4769f7
mov dword [esi + 0x20], eax
push 0
push 0
push 1
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x476a0f
mov dword [esi + 0x20], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0xc
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
Function at 0x4770d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
lea eax, [ebp - 0x34]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xb4]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, ebx
push esi
push edi
and eax, reloc.WSOCK32.dll_getsockopt
jns 0x477103
dec eax
or eax, 0xfffffff8
inc eax
je 0x47710e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20
push dword [ebp + 0x14]
lea eax, [ebp - 0x34]
push eax
call fcn.004d0d60
add esp, 0xc
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
sub esi, 0x20
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [edi], eax
mov esi, edi
add edi, 0x20
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
jle 0x477257
lea eax, [ebx - 1]
shr eax, 3
inc eax
mov dword [ebp + 0x10], eax
nop dword [eax + eax]
pushal
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x18]
push ebp
mov ecx, 0x20
mov ebp, eax
add eax, dword [esi]
add esi, 4
movzx ebx, al
xor edx, dword [edi + ebx*4]
mov bl, ah
xor edx, dword [edi + ebx*4 + 0x400]
shr eax, 0x10
mov bl, ah
xor edx, dword [edi + ebx*4 + 0xc00]
mov bl, al
xor edx, dword [edi + ebx*4 + 0x800]
mov eax, edx
mov edx, ebp
loop 0x477195
pop ebp
mov esi, dword [ebp + 0xc]
mov dword [esi], edx
mov dword [esi + 4], eax
popal
mov eax, dword [ebp - 8]
add dword [ebp + 8], 8
add dword [ebp + 0xc], 8
add eax, 8
mov dword [ebp - 8], eax
je 0x477203
cmp dword [ebp + 0x1c], 0
je 0x477203
test eax, 0x3ff
jne 0x477203
push dword [ebp + 0x18]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0047a3b0
add esp, 0xc
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
sub esi, 0x20
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [edi], eax
mov esi, edi
add edi, 0x20
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
sub dword [ebp + 0x10], 1
jne 0x477180
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a630
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [0x587580]
lea eax, [esp + 0x10]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
neg eax
push 0
sbb eax, eax
and dword [0x59b418], eax
lea eax, [esp + 0x14]
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
neg eax
mov dword [esp + 4], 0xc
push 0
sbb eax, eax
mov dword [esp + 0x10], 1
and dword [0x59b418], eax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [0x59b418], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x198
call fcn.00473980
add esp, 4
mov dword [0x597724], eax
cmp dword [0x597724], 0
je 0x47a6d1
mov eax, dword [0x597724]
push 0x198
push 0
push eax
call fcn.004d2520
add esp, 0xc
test esi, esi
je 0x47a6e4
mov eax, dword [esi + 4]
push esi
call eax
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x47a6d5
push dword [0x59b418]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
add esp, 0x20
ret
Function at 0x495d30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
push esi
mov esi, dword [esp + 8]
test edx, edx
je 0x495d5a
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x58a560]
sub edx, 1
jne 0x495d40
not eax
pop esi
ret
Function at 0x49abc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xb8]
push 0x20
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push eax
call fcn.004d0d60
push 8
push dword [ebp + 0x1c]
lea eax, [ebp - 0x18]
push eax
call fcn.004d0d60
add esp, 0x18
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [edi], eax
cmp dword [ebp + 0x10], 0
jle 0x49ad58
pushal
mov esi, dword [ebp - 8]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x18]
push ebp
mov ecx, 0x20
mov ebp, eax
add eax, dword [esi]
add esi, 4
movzx ebx, al
xor edx, dword [edi + ebx*4]
mov bl, ah
xor edx, dword [edi + ebx*4 + 0x400]
shr eax, 0x10
mov bl, ah
xor edx, dword [edi + ebx*4 + 0xc00]
mov bl, al
xor edx, dword [edi + ebx*4 + 0x800]
mov eax, edx
mov edx, ebp
loop 0x49ac6b
pop ebp
mov esi, dword [ebp - 8]
mov dword [esi], edx
mov dword [esi + 4], eax
popal
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp eax, esi
jge 0x49acd1
mov dl, byte [ebp + eax - 0x18]
movzx ecx, byte [edi]
inc edi
xor cl, dl
mov byte [ebx], cl
inc ebx
movzx ecx, cl
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 8
jl 0x49acb1
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
sub ebx, 8
mov dword [ebp + 8], edi
add eax, 8
mov dword [ebp + 0x10], ebx
mov dword [ebp - 0xc], eax
je 0x49ad50
cmp dword [ebp + 0x20], 0
je 0x49ad50
test eax, 0x3ff
jne 0x49ad50
push dword [ebp + 0x18]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0049b120
add esp, 0xc
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [edi], eax
test ebx, ebx
jg 0x49ac56
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ad70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xb8]
push 0x20
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push eax
call fcn.004d0d60
push 8
push dword [ebp + 0x1c]
lea eax, [ebp - 0x18]
push eax
call fcn.004d0d60
add esp, 0x18
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [edi], eax
cmp dword [ebp + 0x10], 0
jle 0x49af01
pushal
mov esi, dword [ebp - 8]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x18]
push ebp
mov ecx, 0x20
mov ebp, eax
add eax, dword [esi]
add esi, 4
movzx ebx, al
xor edx, dword [edi + ebx*4]
mov bl, ah
xor edx, dword [edi + ebx*4 + 0x400]
shr eax, 0x10
mov bl, ah
xor edx, dword [edi + ebx*4 + 0xc00]
mov bl, al
xor edx, dword [edi + ebx*4 + 0x800]
mov eax, edx
mov edx, ebp
loop 0x49ae1b
pop ebp
mov esi, dword [ebp - 8]
mov dword [esi], edx
mov dword [esi + 4], eax
popal
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp eax, ebx
jge 0x49ae7d
movzx ecx, byte [esi]
inc esi
xor cl, byte [ebp + eax - 0x18]
mov byte [edx], cl
inc edx
movzx ecx, cl
mov byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 8
jl 0x49ae61
mov eax, dword [ebp - 0xc]
sub ebx, 8
add eax, 8
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 0xc], eax
je 0x49aef9
cmp dword [ebp + 0x20], 0
je 0x49aef9
test eax, 0x3ff
jne 0x49aef9
push dword [ebp + 0x18]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0049b120
add esp, 0xc
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [edi], eax
test ebx, ebx
jg 0x49ae06
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0590
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x104
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4a05e5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4a05e5
mov esi, dword [esp + 0x10c]
push 2
call fcn.004d5d44
add esp, 4
lea ecx, [esp + 0x110]
push ecx
push 0
push esi
push eax
call fcn.0041eb60
push dword [eax + 4]
push dword [eax]
call fcn.004d914e
add esp, 0x18
pop esi
add esp, 0x104
ret
lea eax, [esp + 0x110]
push eax
push 0
push dword [esp + 0x114]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.0041eb60
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004d91d3
add esp, 0x1c
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4a0674
call fcn.004a04e0
test eax, eax
je 0x4a0674
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x104
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
add esp, 0x104
ret