joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e529e
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.006e544e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x6e539c
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x6e533f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x6e5382
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x6e5356
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x6e5371
test al, 0x40
je 0x6e5368
mov ecx, dword [edi + 0x20]
jmp 0x6e536f
test al, 0x80
je 0x6e5382
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x6e5382
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x6e530e
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4718c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x61000]
push edi
jmp 0x4718da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4718e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4718d0
mov eax, 1
add ebx, ebx
jne 0x4718f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x471904
jne 0x471923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x471923
dec eax
add ebx, ebx
jne 0x471910
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4718e8
add ebx, ebx
jne 0x47191f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x471975
xor ecx, ecx
sub eax, 3
jb 0x47193b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4719aa
sar eax, 1
mov ebp, eax
jmp 0x471946
add ebx, ebx
jne 0x471946
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x471914
inc ecx
add ebx, ebx
jne 0x471954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x471914
add ebx, ebx
jne 0x471961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x471956
jne 0x471972
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x471956
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x471994
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x471986
jmp 0x4718d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x471994
add edi, ecx
jmp 0x4718d6
pop esi
mov edi, esi
mov ecx, 0x1684
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4719b2
cmp byte [edi], 7
jne 0x4719b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4719b7
lea edi, [esi + 0x6f000]
mov eax, dword [edi]
or eax, eax
je 0x471a2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x71250]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x71354]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4719e4
mov ecx, edi
jns 0x471a13
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x71358]
or eax, eax
je 0x471a29
mov dword [ebx], eax
add ebx, 4
jmp 0x471a01
call dword [esi + 0x71368]
mov ebp, dword [esi + 0x7135c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x471a63
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x10006fd0
Capabilities:
Create directory

Disassembly:
push edi
push esi
sub esp, 0x208
cmp dword [esp + 0x218], 1
jne 0x100070ea
mov esi, esp
push 0x208
push 0
push esi
call fcn.10007b20
add esp, 0xc
push str.APPDATA
call fcn.1000f377
sub esp, 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._subd_
mov dword [esp], 0x10034500
call fcn.10007a10
add esp, 0x10
push 0
push 0x10034500
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 0xc], 0x10034500
mov dword [esp + 8], str._subd.log
call fcn.10007a10
sub esp, 0xc
vmovaps xmm0, xmmword [0x10024340]
vmovups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x100344fc], eax
test eax, eax
je 0x100070d6
mov ecx, 0xfae18277
mov edx, 0x9291ed39
call fcn.100074b0
test eax, eax
je 0x100070ea
mov dword [esp], 0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push 4
push 4
push dword [eax + 8]
mov esi, eax
call edi
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov dword [0x100344f4], ecx
mov dword [eax], 0x10006ba0
push 0
push dword [esp + 4]
push 4
push dword [esi + 8]
call edi
push str.Success_n
call fcn.100077a0
add esp, 4
mov al, 1
jmp 0x100070ec
push 0
push str.Failure
push str.Failed_to_create_file_handle.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0x208
pop esi
pop edi
ret 0xc
Function at 0x100077a0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x804
mov edi, dword [esp + 0x814]
lea ebx, [esp + 0x818]
mov dword [esp], ebx
call fcn.10006fc0
mov ecx, dword [eax]
or ecx, 1
lea esi, [esp + 4]
push ebx
push 0
push edi
push 0xffffffffffffffff
push esi
push dword [eax + 4]
push ecx
call fcn.10009801
add esp, 0x1c
push esi
call fcn.1000f580
add esp, 4
push 0
push 0
push eax
push esi
push dword [0x100344fc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x804
pop esi
pop edi
pop ebx
ret

Function at 0x10007800
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc14
mov ebx, dword [esp + 0xc2c]
mov ebp, dword [esp + 0xc30]
lea esi, [esp + 0xc34]
mov dword [esp], esi
call fcn.10006fc0
mov ecx, dword [eax]
or ecx, 1
lea edi, [esp + 0x414]
push esi
push 0
push ebp
push 0xffffffffffffffff
push edi
push dword [eax + 4]
push ecx
call fcn.10009801
add esp, 0xc
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc38]
mov dword [esp + 8], eax
lea ebx, [esp + 0x21c]
mov dword [esp], ebx
call fcn.100078e0
add esp, 0x10
lea esi, [esp + 4]
push 0x10034500
push esi
call fcn.1000f8e1
add esp, 8
push ebx
push esi
call fcn.1000f8b0
sub esp, 0x14
vmovaps xmm0, xmmword [0x10024360]
vmovups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x100078d1
mov esi, eax
push edi
call fcn.1000f580
add esp, 4
push 0
push 0
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100078d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10007920
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x414
mov edi, dword [esp + 0x430]
lea ebx, [esp + 0x434]
mov dword [esp], ebx
call fcn.10006fc0
lea esi, [esp + 0x20c]
push ebx
push 0
push edi
push 0x7fffffff
push esi
push dword [eax + 4]
push dword [eax]
call fcn.1000971c
add esp, 0x1c
lea edi, [esp + 4]
push 0x10034500
push edi
call fcn.1000f8e1
add esp, 8
push esi
push edi
call fcn.1000f8b0
sub esp, 0x14
vmovaps xmm0, xmmword [0x10024360]
vmovups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x100079fa
mov esi, eax
mov ebx, dword [esp + 0x42c]
mov ebp, dword [esp + 0x428]
push 4
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push ebx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x414
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000e28d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e2cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e2cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e2cc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e2cc
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e2cc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000fe60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000fe8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000fe8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1001020d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001eb10
push 0x1001eb08
push str.FlsAlloc
push 0x1f
call fcn.100104f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10010241
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10010247
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001028b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001eb20
push 0x1001eb18
push str.FlsGetValue
push 0x21
call fcn.100104f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100102c2
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100102ca
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001eb28
push 0x1001eb20
push str.FlsSetValue
push 0x22
call fcn.100104f0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10010304
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10014bbf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10014c5c
push ebx
push esi
call fcn.10014cad
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10014ac3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10014c09
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014c5b
push edi
push eax
call fcn.1001240a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10014c29
call fcn.10011755
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014c5a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10014ac3
add esp, 0x20
test eax, eax
jne 0x10014c48
push edi
call fcn.10011755
jmp 0x10014c50
push ebx
call fcn.10011755
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10014c5f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10014c70
pop esi
ret
push ebx
push edi
push esi
call fcn.10014cad
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1001240a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10014c98
push ebx
push esi
push edi
call fcn.10013470
add esp, 0xc
push 0
call fcn.10011755
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10014cef
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10014f5a
Function at 0x48c958
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48c986
mov eax, ebx
call fcn.0048d40c
cmp dword [ebx + 0x40], 0
je 0x48c97f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48c9f7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48c9e9
cmp dword [ebx + 8], 0
je 0x48c9a8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48c9ba
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48c9e9
cmp dword [ebx + 8], 0
je 0x48c99b
cmp eax, 3
je 0x48c9cd
dec eax
jne 0x48c99b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48c99b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48c99b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48ca15
cmp dword [ebx + 0x14], 0xcc
je 0x48ca15
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048ca20
pop ebx
ret

Function at 0x4a2de8
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
jl 0x4a2df3
jge 0x4a2df3
call 0xc3d60282
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.00402a38
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.00402a38
add esp, 0x58
pop ebx
ret
Function at 0x4a7570
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4a76b5
push dword fs:[eax]
mov dword fs:[eax], esp
jbe 0x4a75a5
ja 0x4a75a5
call 0x1c97927
jle 0x4a75aa
jg 0x4a75aa
call 0x1bf7922
je 0x4a75af
jne 0x4a75af
call 0x104ab134
add byte [eax], al
cmp dword [ebx], 0x1000
jle 0x4a75de
lea edx, [ebp - 0x100c]
mov eax, dword [0x4c003c]
call fcn.00406a84
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x407f60]
call fcn.0040d3b8
call fcn.004041b4
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x4a7635
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x4a760a
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x4a7630
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x4a761d
inc esi
add ecx, esi
jmp 0x4a763f
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x4a7675
lea edx, [ebp - 0x1010]
mov eax, dword [0x4c003c]
call fcn.00406a84
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x407f60]
call fcn.0040d3b8
call fcn.004041b4
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402a38
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.00402a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a76bc
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.0040483c
ret

Function at 0x4a943c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
je 0x4a9442
jne 0x4a9442
call 0xe1cb5ed1
and byte [ebx + 0x1ee380da], cl
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff

Function at 0x4a9466
Capabilities:
Encrypt data using des

Disassembly:
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x4bfce8]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret
Function at 0x4a947c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4a9494
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4a948d
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jbe 0x4a94a1
ja 0x4a94a1
call 0x1c99823
jle 0x4a94a6
jg 0x4a94a6
call 0x1bf981e
je 0x4a94ab
jne 0x4a94ab
call 0x3442da3a
leave
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004031cc
xor edx, edx
mov eax, 0x4bfee8
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4a950d
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4a94c1
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4a97ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4a97c5
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4a97be
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4a97d7
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4a97d0
mov eax, esp
mov dword [ebp - 4], ecx
push ecx
xor ecx, ecx
jcxz 0x4a97e3
call 0x754e0c40
add eax, ebp
pop ecx
je 0x4a97e9
jne 0x4a97e9
call 0x4dd79d57
imul al
xor ebx, edi
invalid
push 5
lea ecx, [ebp - 0xa]
call fcn.004a9324
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4a97fe
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004a943c
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4a9883
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4a98a0
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004a93b8
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4a98c9
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a98e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4a98f9
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4a98f2
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
jle 0x4a9905
jg 0x4a9905
call 0x942ded0
add byte [eax], al
add byte [ebx + 0x4d8bfc45], cl
or al, 0x8a
adc byte [eax - 0xbfbeef], cl
dec ebp
clc
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4a9912
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a9200
test bl, bl
jne 0x4a99e5
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4c1f38
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a9949
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a995d
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a97ac
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4a998f
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4a993e
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a99b2
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4a99c3
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a99d7
jmp 0x4a9aa0
cmp bl, 1
jne 0x4a9aa0
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4c1f92

Function at 0x4aa8b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4aa975
push dword fs:[eax]
mov dword fs:[eax], esp
push ecx
xor ecx, ecx
jcxz 0x4aa8db
call 0x734e1b38
add eax, ebp
pop ecx
jb 0x4aa8e1
jae 0x4aa8e1
call 0x68a06918
push ebp
test eax, 0xff64004a
xor byte [ecx + ecx*4 + 0x20], ah
xor eax, eax
push ebp
push 0x4aa955
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi