joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8f0200
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00409218
mov eax, dword [ebp - 8]
call fcn.00409218
mov eax, dword [ebp - 0xc]
call fcn.00409218
xor eax, eax
push ebp
push 0x8f035c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x8f0253
mov eax, ebx
call fcn.00409148
jmp 0x8f032b
mov eax, 0x18
call fcn.008efd64
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x8f0324
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.008efdb0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x8f0304
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.008efc40
mov eax, dword [ebp - 0x10]
call fcn.0040b87c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CryptDecrypt
call fcn.0042c770
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0042dfe0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0042df38
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0xfde9
call fcn.00409d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f030b
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CryptDestroyKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f0363
lea eax, [ebp - 0x20]
call fcn.00409124
lea eax, [ebp - 0x10]
mov edx, dword [0x41d1ac]
call fcn.0040bb54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004091b4
ret
Function at 0x8f5910
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x8f5a75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x218]
call fcn.00409124
push esi
call sub.user32.dll_IsWindow
test eax, eax
jne 0x8f597a
lea edx, [ebx + 0x218]
mov eax, 0x8f587c
call fcn.0040d834
lea edx, [ebp - 4]
mov eax, 0x8f587c
call fcn.0040d834
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x8f5a90
mov dl, 1
mov eax, dword [0x8f557c]
call fcn.008f5644
call fcn.0040883c
cmp dword [ebx + 0x214], 0
je 0x8f59b4
lea edx, [ebx + 0x218]
mov eax, 0x8f5874
call fcn.0040d834
lea edx, [ebp - 8]
mov eax, 0x8f5874
call fcn.0040d834
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x8f57a4]
call fcn.0042a960
call fcn.0040883c
mov edi, esi
mov dword [ebx + 0x214], edi
lea eax, [ebx + 0x20c]
push eax
push edi
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebx + 0x210], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
cmp eax, dword [ebx + 0x20c]
setne al
mov byte [ebx + 4], al
cmp byte [ebx + 4], 0
je 0x8f5a1c
mov eax, dword [ebx + 0x20c]
push eax
push 0
push 0x400
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
mov dword [ebx + 0x208], esi
test esi, esi
jne 0x8f5a1c
lea edx, [ebp - 0xc]
mov eax, 0x8f585c
call fcn.0040d834
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.008f6190
mov eax, dword [0xa40b4c]
mov eax, dword [eax]
cmp eax, dword [ebx + 0x210]
je 0x8f5a5a
push 0xffffffffffffffff
mov eax, dword [ebx + 0x210]
push eax
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
jne 0x8f5a5a
lea edx, [ebp - 0x10]
mov eax, 0x8f5864
call fcn.0040d834
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.008f6190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f5a7c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409184
ret
Function at 0x8f5ac0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x8f5ba7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.008f5bec
test al, al
je 0x8f5b1a
lea edx, [ebx + 0x218]
mov eax, 0x8f5854
call fcn.0040d834
lea edx, [ebp - 4]
mov eax, 0x8f5854
call fcn.0040d834
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x8f5bc0
mov dl, 1
mov eax, dword [0x8f557c]
call fcn.008f5644
call fcn.0040883c
mov eax, dword [0xa40b4c]
mov eax, dword [eax]
cmp eax, dword [ebx + 0x210]
je 0x8f5b58
push 0
mov eax, dword [ebx + 0x210]
push eax
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
jne 0x8f5b58
lea edx, [ebp - 8]
mov eax, 0x8f586c
call fcn.0040d834
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.008f6190
xor eax, eax
mov dword [ebx + 0x214], eax
xor eax, eax
mov dword [ebx + 0x210], eax
mov eax, dword [ebx + 0x208]
test eax, eax
je 0x8f5b78
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov dword [ebx + 0x208], eax
xor eax, eax
mov dword [ebx + 0x20c], eax
mov byte [ebx + 4], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f5bae
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409184
ret
Function at 0x8f5bf8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x8f5d81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.008f5bec
test al, al
je 0x8f5c65
mov eax, dword [ebp - 4]
lea edx, [eax + 0x218]
mov eax, 0x8f5854
call fcn.0040d834
lea edx, [ebp - 0xc]
mov eax, 0x8f5854
call fcn.0040d834
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x8f5da0
mov dl, 1
mov eax, dword [0x8f557c]
call fcn.008f5644
call fcn.0040883c
mov byte [ebp - 7], 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.008f6130
xor edx, edx
push ebp
push 0x8f5d64
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
movzx eax, byte [ebp - 5]
push eax
call sub.user32.dll_MapVirtualKeyW
movzx eax, ax
shl eax, 0x10
or eax, 0
mov esi, eax
cmp byte [ebp + 8], 0
je 0x8f5ca4
or esi, 0x1000000
test bl, 2
setne al
mov ebx, eax
test bl, bl
je 0x8f5cb6
or esi, 0x20000000
movzx eax, byte [ebp - 6]
test al, al
je 0x8f5cc2
sub al, 2
jne 0x8f5ceb
push esi
movzx eax, byte [ebp - 5]
push eax
movzx eax, bl
mov eax, dword [eax*8 + 0xa37358]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x214]
push eax
call sub.user32.dll_PostMessageW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 7], al
movzx eax, byte [ebp - 6]
dec eax
sub al, 2
jae 0x8f5d23
or esi, 0xc0000000
push esi
movzx eax, byte [ebp - 5]
push eax
movzx eax, bl
mov eax, dword [eax*8 + 0xa3735c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x214]
push eax
call sub.user32.dll_PostMessageW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 7], al
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x8f5d42
push 0x1f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208]
push eax
call sub.user32.dll_WaitForInputIdle
jmp 0x8f5d4e
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8f5d6b
mov eax, dword [ebp - 4]
call fcn.008f5dcc
ret
Function at 0x8f5fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x8f5fe0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x8f60a3
mov dword [ebp - 0x14], eax
mov esi, 1
mov eax, dword [ebp - 8]
movzx eax, word [eax + esi*2 - 2]
cmp ax, 0xa
sete dl
and dl, byte [ebp - 9]
jne 0x8f6099
push eax
call sub.user32.dll_VkKeyScanW
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0xffff
jne 0x8f602a
push ebp
mov eax, dword [ebp - 8]
movzx eax, word [eax + esi*2 - 2]
call fcn.008f5ed0
pop ecx
jmp 0x8f6099
movzx eax, byte [ebp - 0xe]
mov byte [ebp - 0xc], al
movzx eax, word [0x8f60ac]
mov word [ebp - 0xb], ax
mov bx, pe_nt_image_headers32
mov edi, 3
movsx eax, word [ebp - 0xe]
movzx edx, bx
and eax, edx
je 0x8f6079
mov eax, ebx
sub ax, 0x100
je 0x8f6066
sub ax, 0x100
je 0x8f606d
sub ax, 0x200
je 0x8f6074
jmp 0x8f6079
or word [ebp - 0xb], 1
jmp 0x8f6079
or word [ebp - 0xb], 4
jmp 0x8f6079
or word [ebp - 0xb], 2
add ebx, ebx
dec edi
jne 0x8f6045
movzx eax, word [ebp - 0xb]
push eax
push 0
mov cl, 2
movzx edx, byte [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.008f5bf8
mov ebx, eax
test bl, bl
je 0x8f60a3
inc esi
dec dword [ebp - 0x14]
jne 0x8f5ff0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x90e294
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.004057e8
cmp dword [ebp - 4], 0
je 0x90e348
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
movzx eax, word [ebp + 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 8]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x90e304
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.0090e1e8
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.00404b78
jmp 0x90e314
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.00404b78
movzx edx, word [ebp - 6]
dec edx
test dx, dx
jb 0x90e32e
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x90e325
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 0xc]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x90e360
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x90e3e2
movzx edx, word [eax + 8]
mov word [esp + 4], dx
mov esi, eax
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
movzx edx, word [esp + 4]
dec edx
test edx, edx
jl 0x90e39f
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x90e398
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
movzx ecx, word [esp + 4]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0x14]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 0xa]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x14]
mov esi, dword [ebx + 0x154]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x90e3fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x90e422
mov dword [ebp - 0x10], 1
jmp 0x90e572
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
test ax, ax
jne 0x90e43a
mov dword [ebp - 0x10], 2
jmp 0x90e572
xor edx, edx
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 4
call fcn.004057e8
movzx eax, word [ebp + 8]
dec eax
movzx edx, word [ebp - 0x14]
mov ecx, edx
cdq
idiv ecx
inc eax
test ax, ax
jbe 0x90e572
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x20]
call fcn.0090e3e8
lea eax, [ebp - 0xa8]
xor ecx, ecx
mov edx, 0x40
call fcn.004057e8
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x90e538
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 1
movzx eax, word [ebp - 0xa]
push eax
lea eax, [ebp - 0x200]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0090e294
cmp dword [ebp - 0x18], 1
jne 0x90e4ec
movzx ecx, word [ebp + 0x14]
lea eax, [ebp - 0x200]
mov edx, dword [ebp + 0x18]
call fcn.0090e350
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x200]
mov ecx, 4
call fcn.0090e350
jmp 0x90e4fe
movzx ecx, word [ebp - 0x14]
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.0090e350
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.0090e360
movzx ecx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x90e52c
inc ecx
lea eax, [ebp - 0x68]
lea edx, [ebp - 0xa8]
movzx ebx, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec cx
jne 0x90e520
inc dword [ebp - 0x18]
dec dword [ebp - 0x28]
jne 0x90e4a9
movzx ecx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x90e568
inc ecx
lea eax, [ebp - 0xa8]
movzx edx, word [ebp - 0x12]
cmp dx, word [ebp + 8]
jae 0x90e562
movzx edx, byte [eax]
mov ebx, dword [ebp - 0x1c]
mov byte [ebx], dl
inc word [ebp - 0x12]
inc dword [ebp - 0x1c]
inc eax
dec cx
jne 0x90e549
dec word [ebp - 0x22]
jne 0x90e47a
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x90e5a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0x90e5b0
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x90e5c9
pop ebx
ret
Function at 0x910d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x910d3f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x910dbe
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0090f74c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x910d8c
mov cx, word [esp]
sub cx, si
jmp 0x910d8e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x910d75
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x910db4
mov cx, word [esp]
sub cx, si
jmp 0x910db6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x910d9d
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x910ea3
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00910a7c
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x910e0a
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x910e20
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x910d1a
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x910ea3
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x910e62
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x910e47
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.0090f734
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x910ea3
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x910ea3
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x910e88
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, dword [ebx + 0x16c0]
push eax
call fcn.0090f734
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x919538
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x91957d
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x91955a
mov esp, ebp
pop ebp
ret 4
Function at 0x91cdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x24]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
call fcn.00404b78
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x91ceaf
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0xa3d4a0]
mov edx, 8
call fcn.00919358
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0xa3d4a0]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xa3d4a0]
mov edx, 0x10
call fcn.00919358
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0xa3d4a0]
mov edx, 0x18
call fcn.00919358
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x91ce32
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x928454
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x9284b8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00424dd8
mov eax, dword [ebp - 4]
call fcn.009283a4
test al, al
je 0x92848d
mov byte [ebp - 5], 1
jmp 0x9284a2
mov eax, dword [ebp - 0xc]
call fcn.0040a278
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9284bf
lea eax, [ebp - 0xc]
call fcn.00409124
ret

Function at 0x9287b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x92880a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0xa3e5a0]
mov edx, dword [ebp - 0x10]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x9287d8
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x9289bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x928a19
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.0092890c
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.00928874
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x9289de
mov esp, ebp
pop ebp
ret

Function at 0x928a74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.00409634
dec eax
test eax, eax
jl 0x928aea
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.00409bd0
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.00928874
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x928acd
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0092890c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.00928874
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x928aef
mov esp, ebp
pop ebp
ret
Function at 0x935cf4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21e]
mov edx, 0x935d80
call fcn.00425600
mov eax, dword [ebp - 4]
cmp dword [eax + 0x54], 0
je 0x935d2f
lea eax, [ebp - 0x208]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x54]
call fcn.00425600
jmp 0x935d40
lea eax, [ebp - 0x208]
push eax
push 0xff
call sub.KERNEL32.DLL_GetTempPathW
lea eax, [ebp - 0x428]
push eax
push 0
lea eax, [ebp - 0x21e]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x428]
mov ecx, 0x105
call fcn.0040a334
mov esp, ebp
pop ebp
ret