joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f740
Capabilities:
Create service
Modify service

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rbp, rsp
mov rax, rcx
mov rsi, r9
mov qword [rbp + 0x78], rbp
lea rdi, [rbp + 0x90]
mov ecx, 8
rep movsq qword [rdi], qword [rsi]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rdx
mov qword [rbp + 0x120], r8
mov rcx, qword [rbp + 0x110]
call fcn.0040e210
mov rcx, qword [rbp + 0x118]
call fcn.0040e210
mov rcx, qword [rbp + 0x120]
call fcn.0040e210
nop
mov dword [rbp + 0x8c], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
nop
mov rcx, qword [rbp + 0x110]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
mov r8d, 0xf003f
call sub.advapi32.dll_OpenSCManagerW
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x47f80e
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x8c], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x78]
call fcn.0047fa00
jmp 0x47f9d2
mov rcx, qword [rbp + 0x118]
call fcn.0040feb0
mov rcx, qword [rbp + 0xd8]
mov rdx, rax
mov r8d, 0xf01ff
call sub.advapi32.dll_OpenServiceW
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0
jne 0x47f90c
mov rcx, qword [rbp + 0x118]
call fcn.0040feb0
mov rbx, rax
mov rcx, qword [rbp + 0x120]
call fcn.0040feb0
mov rcx, qword [rbp + 0xd8]
mov rdx, rbx
mov r8, qword [rbp + 0xc8]
mov r9d, 0xf01ff
mov r10d, dword [rbp + 0x90]
mov dword [rsp + 0x20], r10d
mov r10d, dword [rbp + 0x94]
mov dword [rsp + 0x28], r10d
mov r10d, dword [rbp + 0x98]
mov dword [rsp + 0x30], r10d
mov r10, qword [rbp + 0xa0]
mov qword [rsp + 0x38], r10
mov r10, qword [rbp + 0xa8]
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], 0
mov r10, qword [rbp + 0xb8]
mov qword [rsp + 0x50], r10
mov r10, qword [rbp + 0xc0]
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x60], rax
call sub.advapi32.dll_CreateServiceW
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0
jne 0x47f90c
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x8c], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x78]
call fcn.0047fa00
jmp 0x47f9d2
mov rcx, qword [rbp + 0x120]
call fcn.0040feb0
mov rcx, qword [rbp + 0xd0]
mov edx, dword [rbp + 0x90]
mov r8d, dword [rbp + 0x94]
mov r9d, dword [rbp + 0x98]
mov r10, qword [rbp + 0xa0]
mov qword [rsp + 0x20], r10
mov r10, qword [rbp + 0xa8]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], 0
mov r10, qword [rbp + 0xb8]
mov qword [rsp + 0x38], r10
mov r10, qword [rbp + 0xc0]
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0xc8]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
setne al
test al, al
jne 0x47f9a4
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x8c], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x78]
call fcn.0047fa00
jmp 0x47f9d2
nop
cmp qword [rbp + 0xd8], 0
je 0x47f9bb
mov rcx, qword [rbp + 0xd8]
call sub.advapi32.dll_CloseServiceHandle
cmp qword [rbp + 0xd0], 0
je 0x47f9d1
mov rcx, qword [rbp + 0xd0]
call sub.advapi32.dll_CloseServiceHandle
nop
lea rcx, [rbp + 0x110]
mov edx, 3
call fcn.0040e160
mov eax, dword [rbp + 0x8c]
lea rsp, [rbp + 0xe8]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x47fcd0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040e210
nop
mov dword [rbp + 0x54], 0
mov rax, qword [rbp + 0x80]
mov dword [rax], 0
mov rax, qword [rbp + 0x78]
mov qword [rax], 0
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0xffffffffffffffff
jne 0x47fd66
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
jmp 0x47fe57
nop
mov rcx, qword [rbp + 0x58]
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x47fd97
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.0047fe70
jmp 0x47fe57
mov rcx, qword [rbp + 0x58]
lea rdx, [rbp + 0x50]
call sub.kernel32.dll_GetFileSize_1
mov rcx, qword [rbp + 0x80]
mov dword [rcx], eax
mov rax, qword [rbp + 0x80]
cmp dword [rax], 0xffffffff
jne 0x47fdd2
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.0047fe70
jmp 0x47fe57
mov rax, qword [rbp + 0x80]
mov ecx, dword [rax]
call fcn.00405da0
mov rcx, qword [rbp + 0x78]
mov qword [rcx], rax
mov rax, qword [rbp + 0x78]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x80]
mov edx, dword [rax]
xor r8, r8
call fcn.00408d50
mov dword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x78]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x80]
mov r8d, dword [rax]
lea r9, [rbp + 0x50]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile_1
test eax, eax
setne al
test al, al
jne 0x47fe4c
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.0047fe70
jmp 0x47fe57
nop
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x70]
call fcn.0040e080
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x47fec0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x70], rcx
mov dword [rbp + 0x78], edx
mov qword [rbp + 0x80], r8
mov dword [rbp + 0x88], r9d
mov rcx, qword [rbp + 0x70]
call fcn.0040e210
nop
mov dword [rbp + 0x54], 0
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rax
mov edx, 0x40000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 2
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0xffffffffffffffff
jne 0x47ff3f
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
jmp 0x47ffea
nop
mov rcx, qword [rbp + 0x58]
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x47ff6d
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.00480000
jmp 0x47ffea
mov dword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
mov r8d, dword [rbp + 0x88]
lea r9, [rbp + 0x50]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
test eax, eax
setne al
test al, al
jne 0x47ffb7
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.00480000
jmp 0x47ffea
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_SetEndOfFile_1
test eax, eax
setne al
test al, al
jne 0x47ffdf
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0x54], eax
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.00480000
jmp 0x47ffea
nop
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x70]
call fcn.0040e080
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x480370
Capabilities:
Timestomp file

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xa0], rcx
movsd qword [rbp + 0xa8], xmm1
mov byte [rbp + 0xb0], r8b
mov rcx, qword [rbp + 0xa0]
call fcn.0040e210
nop
mov byte [rbp + 0x87], 0
movsd xmm0, qword [rbp + 0xa8]
lea rdx, [rbp + 0x64]
lea r8, [rbp + 0x66]
lea r9, [rbp + 0x6a]
call fcn.00433610
movsd xmm0, qword [rbp + 0xa8]
lea rdx, [rbp + 0x6c]
lea r8, [rbp + 0x6e]
lea r9, [rbp + 0x70]
lea rax, [rbp + 0x72]
mov qword [rsp + 0x20], rax
call fcn.004332b0
lea rcx, [rbp + 0x64]
lea rdx, [rbp + 0x74]
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
setne al
test al, al
je 0x48050f
mov rax, qword [rbp + 0x74]
mov qword [rbp + 0x5c], rax
lea rcx, [rbp + 0x5c]
lea rdx, [rbp + 0x7c]
call sub.kernel32.dll_LocalFileTimeToFileTime
mov dword [rbp + 0x58], eax
cmp dword [rbp + 0x58], 0
setne al
test al, al
je 0x48050f
mov rcx, qword [rbp + 0xa0]
call fcn.0040feb0
mov rcx, rax
mov edx, 0x40000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW_1
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0xffffffffffffffff
je 0x48050f
nop
movzx rax, byte [rbp + 0xb0]
sub al, 1
cmp al, 0xff
je 0x480491
test al, al
je 0x4804b4
sub al, 1
test al, al
jne 0x4804fa
jmp 0x4804d7
mov rcx, qword [rbp + 0x88]
lea rdx, [rbp + 0x7c]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFileTime
test eax, eax
setne al
mov byte [rbp + 0x87], al
jmp 0x480501
mov rcx, qword [rbp + 0x88]
xor rdx, rdx
lea r8, [rbp + 0x7c]
xor r9, r9
call sub.kernel32.dll_SetFileTime
test eax, eax
setne al
mov byte [rbp + 0x87], al
jmp 0x480501
mov rcx, qword [rbp + 0x88]
xor rdx, rdx
xor r8, r8
lea r9, [rbp + 0x7c]
call sub.kernel32.dll_SetFileTime
test eax, eax
setne al
mov byte [rbp + 0x87], al
jmp 0x480501
mov byte [rbp + 0x87], 0
nop
mov rcx, qword [rbp + 0x88]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0xa0]
call fcn.0040e080
movzx rax, byte [rbp + 0x87]
lea rsp, [rbp + 0x90]
pop rbp
ret

Function at 0x480590
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov dword [rbp + 0x2c], edx
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbp + 0x50]
call fcn.0040e210
nop
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4805dd
mov eax, dword [rbp + 0x2c]
not eax
and ebx, eax
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rcx, rax
mov edx, ebx
call sub.kernel32.dll_SetFileAttributesW
nop
lea rcx, [rbp + 0x50]
call fcn.0040e080
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x480a90
Capabilities:
Get hostname

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
nop
mov dword [rbp + 0x34], 0
xor rcx, rcx
lea rdx, [rbp + 0x34]
call sub.kernel32.dll_GetComputerNameW
cmp dword [rbp + 0x34], 0
je 0x480b3b
mov ecx, dword [rbp + 0x34]
add ecx, ecx
mov ecx, ecx
call fcn.00405da0
mov qword [rbp + 0x38], rax
nop
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x34]
add edx, edx
mov edx, edx
xor r8, r8
call fcn.00408d50
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0x34]
call sub.kernel32.dll_GetComputerNameW
test eax, eax
setne al
cmp al, 1
jne 0x480b20
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
call fcn.0040ff50
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x20]
xor r8, r8
mov r9d, dword [rbp + 0x34]
call fcn.00410500
jmp 0x480b30
mov rcx, qword [rbp + 0x50]
lea rdx, [0x00480bac]
call fcn.0040e6f0
nop
mov rcx, qword [rbp + 0x38]
call fcn.00405dd0
nop
lea rcx, [rbp + 0x20]
call fcn.0040e080
mov rax, qword [rbp + 0x50]
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x480bc0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
nop
xor rcx, rcx
xor rdx, rdx
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x480c74
mov ecx, dword [rbp + 0x44]
add ecx, 1
add ecx, ecx
mov ecx, ecx
call fcn.00405da0
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 0x44]
add edx, edx
mov edx, edx
xor r8, r8
call fcn.00408d50
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 0x44]
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [rbp + 0x44], eax
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
call fcn.0040ff50
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
xor r8, r8
mov r9d, dword [rbp + 0x44]
call fcn.00410500
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
call fcn.00438d10
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040e6f0
nop
mov rcx, qword [rbp + 0x48]
call fcn.00405dd0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e160
mov rax, qword [rbp + 0x60]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x480cf0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
nop
xor rcx, rcx
xor rdx, rdx
call sub.kernel32.dll_GetSystemDirectoryW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x480da4
mov ecx, dword [rbp + 0x44]
add ecx, 1
add ecx, ecx
mov ecx, ecx
call fcn.00405da0
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 0x44]
add edx, edx
mov edx, edx
xor r8, r8
call fcn.00408d50
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 0x44]
call sub.kernel32.dll_GetSystemDirectoryW
mov dword [rbp + 0x44], eax
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
call fcn.0040ff50
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
xor r8, r8
mov r9d, dword [rbp + 0x44]
call fcn.00410500
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
call fcn.00438d10
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040e6f0
nop
mov rcx, qword [rbp + 0x48]
call fcn.00405dd0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e160
mov rax, qword [rbp + 0x60]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x480f70
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x60], rcx
nop
xor rcx, rcx
xor rdx, rdx
call sub.kernel32.dll_GetTempPathW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x481024
mov ecx, dword [rbp + 0x44]
add ecx, 1
add ecx, ecx
mov ecx, ecx
call fcn.00405da0
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 0x44]
add edx, edx
mov edx, edx
xor r8, r8
call fcn.00408d50
mov ecx, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x48]
call sub.kernel32.dll_GetTempPathW
mov dword [rbp + 0x44], eax
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
call fcn.0040ff50
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
xor r8, r8
mov r9d, dword [rbp + 0x44]
call fcn.00410500
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
call fcn.00438d10
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x28]
call fcn.0040e6f0
nop
mov rcx, qword [rbp + 0x48]
call fcn.00405dd0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e160
mov rax, qword [rbp + 0x60]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x4816d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov rcx, qword [rbp + 0x40]
call fcn.0040e240
nop
xor rax, rax
mov word [rbp + 0x2e], ax
xor rax, rax
cmp qword [rbp + 0x40], 0
je 0x4816fe
mov rax, qword [rbp + 0x40]
mov eax, dword [rax - 4]
mov ecx, 1
mov edx, eax
mov eax, ecx
cmp eax, edx
jg 0x48175f
add edx, 1
lea rcx, [0x00737bfc]
movzx r8, word [rbp + 0x2e]
movzx r8d, r8w
shr r8d, 8
mov r9, qword [rbp + 0x40]
movsxd r10, eax
movzx r9, byte [r9 + r10 - 1]
xor r8d, r9d
and r8d, 0xff
mov r8d, r8d
movzx r9, word [rbp + 0x2e]
shl r9d, 8
and r9w, 0xffff
movzx rcx, word [rcx + r8*2]
xor cx, r9w
mov word [rbp + 0x2e], cx
add eax, 1
cmp eax, edx
jne 0x48170f
nop
nop
lea rcx, [rbp + 0x40]
call fcn.0040e0d0
movzx rax, word [rbp + 0x2e]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x482040
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov rcx, rdx
xor rbx, rbx
xor rax, rax
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x30]
lea r9, [rax + rbp + 0x1058]
mov rax, rbp
neg rax
lea r9, [r9 + rax]
mov r10d, dword [rbp + 0x3c]
mov r10d, r10d
mov rax, qword [rbp + 0x30]
lea r11, [rax + rbp + 0x1058]
mov rax, rbp
neg rax
lea r11, [r11 + rax]
mov esi, dword [rbp + 0x3c]
mov esi, esi
mov eax, ebx
movzx rdi, byte [rcx + rax]
shl edi, 0x18
mov eax, ebx
add eax, 1
xor edx, edx
div r8d
mov edx, edx
movzx rax, byte [rcx + rdx]
shl eax, 0x10
add edi, eax
mov eax, ebx
add eax, 2
xor edx, edx
div r8d
mov edx, edx
movzx rax, byte [rcx + rdx]
shl eax, 8
add edi, eax
mov eax, ebx
add eax, 3
xor edx, edx
div r8d
mov edx, edx
movzx rax, byte [rcx + rdx]
add edi, eax
mov eax, dword [r11 + rsi*4]
xor eax, edi
mov dword [r9 + r10*4], eax
mov eax, ebx
add eax, 4
xor edx, edx
div r8d
mov rbx, rdx
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
cmp eax, 0x12
jne 0x48205b
nop
mov dword [rbp + 0x4c], 0
mov dword [rbp + 0x48], 0
xor rax, rax
mov dword [rbp + 0x3c], eax
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x4c]
lea r8, [rbp + 0x48]
lea rax, [rbp + 0x1058]
sub rax, rbp
mov r9, qword [rbp + 0x30]
add r9, rax
mov dword [rsp + 0x20], 1
call fcn.004817d0
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0x1058]
mov rcx, rbp
neg rcx
lea rax, [rax + rcx]
mov ecx, dword [rbp + 0x3c]
add ecx, ecx
mov ecx, ecx
mov edx, dword [rbp + 0x4c]
mov dword [rax + rcx*4], edx
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0x105c]
mov rcx, rbp
neg rcx
lea rax, [rax + rcx]
mov ecx, dword [rbp + 0x3c]
add ecx, ecx
mov ecx, ecx
mov edx, dword [rbp + 0x48]
mov dword [rax + rcx*4], edx
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
cmp eax, 9
jne 0x48211d
nop
xor rax, rax
mov dword [rbp + 0x3c], eax
xor rbx, rbx
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x4c]
lea r8, [rbp + 0x48]
lea rax, [rbp + 0x1058]
sub rax, rbp
mov r9, qword [rbp + 0x30]
add r9, rax
mov dword [rsp + 0x20], 1
call fcn.004817d0
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0x58]
mov rcx, rbp
neg rcx
lea rax, [rax + rcx]
mov ecx, dword [rbp + 0x3c]
mov ecx, ecx
shl rcx, 7
lea rax, [rax + rcx*8]
mov ecx, ebx
add ecx, ecx
mov ecx, ecx
mov edx, dword [rbp + 0x4c]
mov dword [rax + rcx*4], edx
mov rax, qword [rbp + 0x30]
lea rax, [rax + rbp + 0x5c]
mov rcx, rbp
neg rcx
lea rax, [rax + rcx]
mov ecx, dword [rbp + 0x3c]
mov ecx, ecx
shl rcx, 7
lea rax, [rax + rcx*8]
mov ecx, ebx
add ecx, ecx
mov ecx, ecx
mov edx, dword [rbp + 0x48]
mov dword [rax + rcx*4], edx
add ebx, 1
cmp ebx, 0x80
jne 0x4821ac
nop
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
cmp eax, 4
jne 0x4821a9
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x482260
Capabilities:
Encrypt data using blowfish

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov byte [rsp - 0xa8], 0
mov byte [rsp - 0x10a8], 0
sub rsp, 0x10a8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov dword [rbp + 0x34], edx
mov ebx, r8d
lea rdi, [rbp + 0x1058]
lea rsi, [0x00737e90]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
lea rdi, [rbp + 0x58]
lea rsi, [0x00737ed8]
mov ecx, 0x200
rep movsq qword [rdi], qword [rsi]
xor rsi, rsi
test r9, r9
je 0x4822bf
mov esi, dword [r9 - 4]
mov rcx, r9
call fcn.0040f340
mov rcx, rbp
mov rdx, rax
mov r8d, esi
call fcn.00482040
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x38], rax
test bl, bl
je 0x4822f4
lea rax, [rbp + 0x1058]
mov qword [rbp + 0x40], rax
mov esi, 1
jmp 0x482302
lea rax, [rbp + 0x109c]
mov qword [rbp + 0x40], rax
or esi, 0xffffffff
xor rbx, rbx
mov edi, dword [rbp + 0x34]
shr edi, 3
sub edi, 1
cmp ebx, edi
jg 0x482460
add edi, 1
cmp qword [rbp + 0x10f0], 0
je 0x4823c4
mov dword [rbp + 0x54], 7
mov eax, dword [rbp + 0x54]
mov ecx, dword [rbp + 0x54]
movzx rcx, byte [rcx + rbp + 0x10f0]
add cl, 1
and cl, 0xff
mov byte [rax + rbp + 0x10f0], cl
mov eax, dword [rbp + 0x54]
cmp byte [rax + rbp + 0x10f0], 0
jne 0x482361
sub dword [rbp + 0x54], 1
cmp dword [rbp + 0x54], 0xffffffff
jne 0x48232e
nop
mov rcx, rbp
mov edx, dword [rbp + 0x10f0]
call fcn.004817a0
mov dword [rbp + 0x54], eax
mov rcx, rbp
mov edx, dword [rbp + 0x10f4]
call fcn.004817a0
mov dword [rbp + 0x50], eax
mov rcx, rbp
lea rdx, [rbp + 0x54]
lea r8, [rbp + 0x50]
mov r9, qword [rbp + 0x40]
mov dword [rsp + 0x20], esi
call fcn.004817d0
mov rcx, rbp
mov edx, dword [rbp + 0x54]
call fcn.004817a0
mov rcx, qword [rbp + 0x38]
xor dword [rcx], eax
mov rcx, rbp
mov edx, dword [rbp + 0x50]
call fcn.004817a0
mov rcx, qword [rbp + 0x38]
xor dword [rcx + 4], eax
jmp 0x482449
cmp byte [rbp + 0x10f8], 0
jne 0x48242d
mov rcx, rbp
mov rax, qword [rbp + 0x38]
mov edx, dword [rax]
call fcn.004817a0
mov dword [rbp + 0x54], eax
mov rcx, rbp
mov rax, qword [rbp + 0x38]
mov edx, dword [rax + 4]
call fcn.004817a0
mov dword [rbp + 0x50], eax
mov rcx, rbp
lea rdx, [rbp + 0x54]
lea r8, [rbp + 0x50]
mov r9, qword [rbp + 0x40]
mov dword [rsp + 0x20], esi
call fcn.004817d0
mov rcx, rbp
mov edx, dword [rbp + 0x54]
call fcn.004817a0
mov rcx, qword [rbp + 0x38]
mov dword [rcx], eax
mov rcx, rbp
mov edx, dword [rbp + 0x50]
call fcn.004817a0
mov rcx, qword [rbp + 0x38]
mov dword [rcx + 4], eax
jmp 0x482449
mov rcx, rbp
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 4]
mov r8, qword [rbp + 0x38]
mov r9, qword [rbp + 0x40]
mov dword [rsp + 0x20], esi
call fcn.004817d0
mov rax, qword [rbp + 0x38]
add rax, 8
mov qword [rbp + 0x38], rax
add ebx, 1
cmp ebx, edi
jne 0x482319
nop
lea rsp, [rbp + 0x10a8]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x484730
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x70]
call fcn.0040e210
nop
mov word [rbp + 0x4c], 0
mov word [rbp + 0x4e], 0
mov word [rbp + 0x50], 0
mov word [rbp + 0x52], 0
mov rcx, qword [rbp + 0x70]
mov dl, 1
call fcn.0042cb00
test al, al
je 0x48483e
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rax
lea rdx, [rbp + 0x44]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x48483e
movsxd rcx, dword [rbp + 0x54]
call fcn.00405da0
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x58]
movsxd rdx, dword [rbp + 0x54]
xor r8, r8
call fcn.00408d50
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
mov r8d, dword [rbp + 0x54]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x48482f
mov rcx, qword [rbp + 0x58]
lea rdx, [0x004848c0]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x48]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x48482f
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
shr eax, 0x10
mov word [rbp + 0x4c], ax
mov rax, qword [rbp + 0x38]
movzx rax, word [rax + 8]
and ax, 0xffff
mov word [rbp + 0x4e], ax
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 0xc]
shr eax, 0x10
mov word [rbp + 0x50], ax
mov rax, qword [rbp + 0x38]
movzx rax, word [rax + 0xc]
and ax, 0xffff
mov word [rbp + 0x52], ax
nop
mov rcx, qword [rbp + 0x58]
movsxd rdx, dword [rbp + 0x54]
call fcn.00405dd0
nop
lea rcx, [rbp + 0x70]
call fcn.0040e080
mov rax, qword [rbp + 0x4c]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x48a080
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp + 0x30], r8d
mov qword [rbp + 0x38], r9
xor rax, rax
mov ecx, dword [rbp + 0x30]
sub ecx, 1
mov dword [rbp + 0xc], eax
cmp dword [rbp + 0xc], ecx
jg 0x48a0da
add ecx, 1
mov rax, qword [rbp + 0x38]
movsxd rdx, dword [rbp + 0xc]
mov r8, qword [rbp + 0x20]
movsxd r9, dword [rbp + 0xc]
mov r10, qword [rbp + 0x28]
movsxd r11, dword [rbp + 0xc]
movzx r8, byte [r8 + r9]
xor r8b, byte [r10 + r11]
mov byte [rax + rdx], r8b
add dword [rbp + 0xc], 1
cmp dword [rbp + 0xc], ecx
jne 0x48a0ac
nop
lea rsp, [rbp + 0x10]
pop rbp
ret