joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb1ecc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
cmp ebx, 0x80
jle 0xb1ecee
push 0xb1ee10
mov ecx, 2
mov dl, 1
mov eax, dword [0xb1ebd4]
call fcn.00b1ec28
call fcn.00a14d24
cmp ebx, 1
jge 0xb1ed0e
push 0xb1ee38
mov ecx, 2
mov dl, 1
mov eax, dword [0xb1ebd4]
call fcn.00b1ec28
call fcn.00a14d24
cmp dword [ebp - 4], 0
jle 0xb1ed1d
cmp dword [ebp - 4], 0x400
jle 0xb1ed38
push 0xb1ee5c
mov ecx, 3
mov dl, 1
mov eax, dword [0xb1ebd4]
call fcn.00b1ec28
call fcn.00a14d24
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.00a132b8
mov edx, ebx
cmp edx, 0x7f
jg 0xb1ed74
mov eax, dword [ebp + 8]
lea eax, [eax + edx - 1]
mov ecx, edx
sub ecx, ebx
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
add cl, byte [eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0xba0240]
mov byte [eax + 1], cl
inc edx
inc eax
cmp edx, 0x80
jne 0xb1ed50
mov ebx, dword [ebp - 4]
add ebx, 7
test ebx, ebx
jns 0xb1ed81
add ebx, 7
sar ebx, 3
mov ecx, dword [ebp - 4]
add ecx, 8
movzx eax, bl
add eax, eax
add eax, eax
add eax, eax
sub ecx, eax
mov eax, 1
shl eax, cl
push eax
mov eax, 0xff
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov eax, edx
movzx esi, bl
mov edx, 0x80
sub edx, esi
mov ecx, dword [ebp + 8]
and al, byte [ecx + edx]
movzx eax, al
mov ecx, dword [ebp + 8]
movzx eax, byte [eax + 0xba0240]
mov byte [ecx + edx], al
mov edx, 0x7f
sub edx, esi
cmp edx, 0
jl 0xb1ee00
mov eax, dword [ebp + 8]
lea eax, [eax + edx + 1]
movzx ecx, bl
add ecx, edx
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
xor cl, byte [eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0xba0240]
mov byte [eax - 1], cl
dec edx
dec eax
cmp edx, 0xffffffff
jne 0xb1edde
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0xb1f5e4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xba0340
movzx eax, byte [ebx]
dec eax
movzx edx, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb1f65f
mov eax, esi
and eax, 0x8000001f
jns 0xb1f63e
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb1f655
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x38
jne 0xb1f609
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0xb1f66c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xba0388
movzx eax, byte [ebx]
dec eax
movzx edx, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb1f6e7
mov eax, esi
and eax, 0x8000001f
jns 0xb1f6c6
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb1f6dd
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x30
jne 0xb1f691
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb1fde0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0xba0788
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0xb1fdfd
add edi, 4
dec byte [esp + 4]
jne 0xb1fdf9
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb1fe1c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0xba0888
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0xb1fe39
add edi, 4
dec byte [esp + 4]
jne 0xb1fe35
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb1ff5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb1ff7f
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
movzx edx, byte [esi]
mov al, 2
call fcn.00b1ff24
push eax
movzx ebp, bl
mov eax, ebp
inc eax
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 3
call fcn.00b1ff24
pop edx
xor dl, al
mov eax, ebp
add eax, 2
and eax, 3
xor dl, byte [esp + eax + 4]
add ebp, 3
and ebp, 3
xor dl, byte [esp + ebp + 4]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb1ff98
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb1ff75
lea eax, [esp + 4]
mov edx, 4
call fcn.00b1ec6c
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb20000
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb20023
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
movzx edx, byte [esi]
mov al, 0xe
call fcn.00b1ff24
push eax
movzx ebp, bl
mov eax, ebp
inc eax
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 0xb
call fcn.00b1ff24
pop edx
xor dl, al
push edx
mov eax, ebp
add eax, 2
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 0xd
call fcn.00b1ff24
pop edx
xor dl, al
push edx
add ebp, 3
and ebp, 3
movzx edx, byte [esp + ebp + 8]
mov al, 9
call fcn.00b1ff24
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb2003c
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb20019
lea eax, [esp + 4]
mov edx, 4
call fcn.00b1ec6c
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb200d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 0xc], 0
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0xc]
add eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
xor ebx, ebx
mov eax, dword [esp + 0x10]
mov esi, eax
mov edi, esi
mov edx, ebp
mov eax, ebx
call fcn.00b200c0
xor byte [edi], al
inc ebx
add esi, 4
cmp bl, 4
jne 0xb2010d
inc byte [esp + 0xc]
inc dword [esp + 0x10]
cmp byte [esp + 0xc], 4
jne 0xb200f5
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb2116c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, ecx
dec eax
test eax, eax
jl 0xb21181
inc eax
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0xb21177
pop esi
ret

Function at 0xb2139c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb213a5
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0xc], 0
jl 0xb21430
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a132b8
movzx eax, byte [esi]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xb213de
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1ec6c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb21448
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb21451
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2010]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0x10], 0
jl 0xb214e6
lea edx, [ebp - 0x1010]
lea eax, [ebp - 0x2010]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x1010]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x2010]
lea eax, [ebp - 0x200f]
call fcn.00a132b8
movzx eax, byte [esi]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
mov byte [ebp + ebx - 0x2011], al
movzx eax, byte [ebp - 9]
xor al, byte [ebp - 0x1010]
mov byte [esi], al
dec dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 0
jge 0xb2148a
lea eax, [ebp - 0x1010]
mov edx, ebx
call fcn.00b1ec6c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb214fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb21505
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0xc], 0
jl 0xb21594
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a132b8
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xb2153e
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1ec6c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb215ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb215b5
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0xc], 0
jl 0xb21644
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a132b8
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xb215ee
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1ec6c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb410b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb410b9
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xb41596
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
lea eax, [ebp - 4]
call fcn.00a153f0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb10c74]
call fcn.00b12c00
mov dword [ebp - 0x20], eax
xor ecx, ecx
push ebp
push 0xb41569
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12cec
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb410ac
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb41090
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb41094
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
movzx edx, byte [0xb415a8]
call fcn.00b120a8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.00af0c80
test al, al
je 0xb41191
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b12554
jmp 0xb4119f
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b125d4
mov eax, dword [ebp - 0xc]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b12654
xor eax, eax
push ebp
push 0xb41206
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12514
jmp 0xb411ee
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0xba9da8]
mov eax, dword [eax]
call fcn.00a86f08
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb411fc
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb411cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb41210
push ebp
Function at 0xb76730
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0xbb22c0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0xb76752
shr eax, 1
xor eax, 0xedb88320
jmp 0xb76754
shr eax, 1
dec edx
jne 0xb76740
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0xb76739
mov byte [0xbb26c0], 1
pop esi
pop ebx
ret

Function at 0xb76770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0xbb26c0], 0
jne 0xb76787
call fcn.00b76730
mov eax, edi
dec eax
test eax, eax
jl 0xb767af
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xbb22c0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0xb76791
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0xb78c04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0xb78c9e.0
jmp dword [ecx*4 + 0xb78c37]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0xb78c69
sub dl, 8
je 0xb78c78
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78970
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb789c8
jmp case.0xb78c9e.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0xb78c9e.0
movzx ecx, byte [ecx + 0xb78ca5]
jmp dword [ecx*4 + 0xb78cb6]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78a20
jmp case.0xb78c9e.0
cmp dl, 3
jne 0xb78ce3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78a74
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78a30
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78ab8
jmp case.0xb78c9e.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0xb78d0e
sub dl, 8
je 0xb78d1a
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78ad4
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78b40
jmp case.0xb78c9e.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0xb78d39
sub dl, 8
je 0xb78d45
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78bb0
jmp case.0xb78c9e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78bd8
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0xb78dd5
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00b77f64
test eax, eax
je 0xb78dd5
mov eax, ebx
call fcn.00b78de0
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0xb78d75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xb78de0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0xb78e11
dec al
je 0xb78e4c
dec al
je 0xb78e91
dec al
je 0xb78efa
jmp 0xb78f84
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0xb78f84
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0xb78e21
jmp 0xb78f84
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xb78f84
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0xb78e5c
jmp 0xb78f84
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xb78f84
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0xb78ec0
xor ebp, ebp
jmp 0xb78ed0
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0xb78ed9
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0xb78ea1
jmp 0xb78f84
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xb78f84
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0xb78f53
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00b767b8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0xb78f0e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb8f0dc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb8f0e4
push ecx
push ebx
push esi
mov eax, 0xb8cd08
call fcn.00a17920
mov esi, dword [0xba9da8]
xor eax, eax
push ebp
push 0xb8f2b8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a134b4
cmp eax, 2
jne 0xb8f175
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13514
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a1a908
call fcn.00af3148
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13514
mov eax, dword [ebp - 0x18]
call fcn.00a15890
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13514
mov eax, dword [ebp - 0x1c]
call fcn.00a1af08
test al, al
je 0xb8f175
push 0xa
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0xb8f137
movzx eax, byte [0xb8f2c8]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13514
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb8f2d4
call fcn.00a206b8
mov eax, dword [ebp - 0x20]
call fcn.00a15890
push eax
push 0
push 0
call fcn.00a17c44
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb8f1ee
push 0x40
push 0xb8f2d8
lea edx, [ebp - 0x2c]
mov eax, dword [0xba9ee8]
call fcn.00a1779c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ae2058
mov eax, dword [ebp - 0x28]
call fcn.00a15890
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb8f29d
mov dl, 1
mov eax, dword [0xa2ac9c]
call fcn.00a14440
mov edx, dword [0xbaa0ec]
mov dword [edx], eax
mov eax, dword [0xbaa0ec]
mov eax, dword [eax]
call fcn.00af0138
test al, al
jne 0xb8f220
mov eax, dword [0xbaa0ec]
mov eax, dword [eax]
call fcn.00a14470
jmp 0xb8f29d
mov eax, dword [esi]
call fcn.00a8701c
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a878dc
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1b380
mov eax, dword [ebp - 0x30]
call fcn.00a1b6ec
mov ecx, dword [0xba9b70]
mov eax, dword [esi]
mov edx, dword [0xb7ffb4]
call fcn.00a87034
mov ecx, dword [0xbaa000]
mov eax, dword [esi]
mov edx, dword [0xb8bf0c]
call fcn.00a87034
mov ecx, dword [0xba9c34]
mov eax, dword [esi]
mov edx, dword [0xb8b430]
call fcn.00a87034
mov ecx, dword [0xba9e7c]
mov eax, dword [esi]
mov edx, dword [0xb8a7f8]
call fcn.00a87034
mov eax, dword [esi]
call fcn.00a8716c
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb8f2bf
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a15414
ret