joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508b2a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov byte [ebp - 1], 0
xor edi, edi
mov edx, dword [ebp + 0xc]
mov eax, esi
mov ecx, edi
call fcn.0050a114
and al, 0xf
add byte [ebp - 1], al
add edi, 4
cmp edi, 0x40
jb 0x508b3d
and esi, 0xb
or eax, 0xffffffff
sub eax, esi
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00508512
mov edi, dword [0x1bf14]
mov ebx, 0x80000000
test ebx, edi
mov esi, edx
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], esi
je 0x508ba1
push esi
push eax
push 0x1be94
push 0x1f
push dword [0x1bf0c]
push dword [0x1bf08]
call fcn.00508458
mov edi, dword [0x1bf14]
test ebx, edi
mov al, byte [ebp + 0x1c]
je 0x508bca
movzx eax, al
push eax
push 0x1be94
push 0x20
push dword [0x1bf0c]
push dword [0x1bf08]
call fcn.004ff204
mov edi, dword [0x1bf14]
movzx eax, byte [ebp + 0x1c]
cdq
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
xor ebx, ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.0050a0fc
xor dword [ebp + 0x18], eax
add ebx, 8
xor esi, edx
cmp ebx, 0x40
jb 0x508bd7
mov ebx, dword [ebp + 0x18]
mov ecx, esi
shrd ebx, ecx, 0x18
xor bl, byte [ebp - 1]
shr ecx, 0x18
mov ecx, dword [ebp + 0x18]
mov edx, esi
shrd ecx, edx, 8
mov eax, esi
shr eax, 0x10
xor al, byte [ebp - 1]
shr edx, 8
test edi, edi
mov byte [ebp - 5], al
mov byte [ebp + 0xf], cl
jns 0x508c4b
movzx edx, bl
push edx
movzx eax, al
push eax
movzx eax, cl
push eax
push 0x1be94
push 0x21
push dword [0x1bf0c]
push dword [0x1bf08]
call fcn.004ff266
mov edi, dword [0x1bf14]
mov al, byte [ebp - 5]
mov cl, byte [ebp + 0xf]
xor cl, byte [ebp - 1]
mov edx, esi
shr edx, 0x18
cmp dl, cl
je 0x508c72
test edi, 0x40000000
je 0x508d31
push 0x1be94
push 0x22
jmp 0x508d20
mov ecx, esi
shr ecx, 8
xor cl, byte [ebp + 0xf]
mov dl, bl
xor dl, al
cmp cl, dl
je 0x508c9a
test edi, 0x40000000
je 0x508d31
push 0x1be94
push 0x23
jmp 0x508d20
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
shrd ecx, edx, 0xd
shr edx, 0xd
mov edx, dword [ebp + 0x18]
shrd edx, esi, 0x10
xor cl, dl
shr esi, 0x10
cmp cl, bl
je 0x508cc8
test edi, 0x40000000
je 0x508d31
push 0x1be94
push 0x24
jmp 0x508d20
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
shrd ecx, esi, 0x17
xor cl, byte [ebp + 0x18]
shr esi, 0x17
cmp cl, al
je 0x508ced
test edi, 0x40000000
je 0x508d31
push 0x1be94
push 0x25
jmp 0x508d20
push dword [ebp - 5]
call fcn.00508566
test al, al
je 0x508d0b
test byte [0x1bf17], 0x40
je 0x508d31
push 0x1be94
push 0x26
jmp 0x508d20
cmp bl, 2
jb 0x508d44
test byte [0x1bf17], 0x40
je 0x508d31
push 0x1be94
push 0x27
push dword [0x1bf0c]
push dword [0x1bf08]
call fcn.004ff028
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
mov eax, dword [ebp + 0x24]
mov byte [eax], 0
mov eax, 0xc000026a
jmp 0x508d74
test byte [0x1bf17], 0x80
je 0x508d65
push 0x1be94
push 0x28
push dword [0x1bf0c]
push dword [0x1bf08]
call fcn.004ff028
mov eax, dword [ebp + 0x20]
mov cl, byte [ebp - 5]
mov byte [eax], cl
mov eax, dword [ebp + 0x24]
mov byte [eax], bl
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x6a52ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
call fcn.006a50fa
rdtsc
mov bx, word [esp]
xchg dword [esp], esi
mov bh, 0x15
call fcn.006a5341
bsf bx, bx
pop word [esp]
lea esp, [esp + 2]
lea esi, [esi + 0x11]
rdtsc
jmp 0x6a532b
btc bx, ax
mov edx, esp
lea ebx, reloc.WINMM.dll_midiStreamRestart
jmp 0x6a535d
mov ebx, 0xfe70cf56
xchg dword [esp], esi
call fcn.006a5347
lea esp, [esp + 0x18]
not ebp
mov dl, 0xc4
sub esp, 0x1e
jmp 0x6a53a7
jnp 0x6a53d3
pop bx
jmp 0x6a53d5
mov edx, dword [esp]
mov bh, byte [esp]
adc dx, cx
jmp 0x6a53f4
adc dx, cx
jmp 0x6a53f4
pop bx
add ebp, dword [esi]
cmp dx, 0x826f
jmp 0x6a5427
rcr al, 0
ror bx, cl
bt eax, ebx
mov bh, 0xda
jmp 0x6a5431
movzx edx, byte [ebp]
lea eax, [ecx*4]
not al
cmc
jmp 0x6a5408
jge 0x6a53de
rcr al, 0
ror bx, cl
jmp 0x6a5447
jbe 0x6a53ad
mov edx, dword [esp]
mov bh, byte [esp]
jmp 0x6a53bc
lea ebx, reloc.WINMM.dll_midiStreamRestart
jmp 0x6a5458
bt eax, ebx
mov bh, 0xda
lea ebx, reloc.WINMM.dll_midiStreamRestart
jmp 0x6a5458
add dl, cl
mov ax, bx
setbe bh
bsf ebx, ebx
jns 0x6a58a0
js 0x6a54e4
bound ebx, qword [ebp - 0x70990014]
add al, 0x24
pushal
jmp 0x6a5143
dec eax
mov al, 0x7b
jmp 0x6a54b5
dec ah
jle 0x6a5479
dec eax
mov al, 0x7b
pushal
lea eax, [eax*4]
jmp 0x6a54bd
pushal
lea eax, [eax*4]
lea esp, [esp + 0x20]
jmp 0x6a54c7
inc bl
mov ax, word [esp]
lea eax, [esp + edi]
mov ax, sp
btc ax, cx
jbe 0x6a5501
bswap eax
jmp 0x6a5519
neg al
jmp 0x6a5573
bswap eax
cmp ax, 0x4a54
mov ah, 0x58
jmp 0x6a5503
jmp 0x6a54eb
ror bl, 0
mov al, byte [esp]
btc ax, di
jae 0x6a5537
jb 0x6a5521
invalid
cmp ax, 0x4a54
mov ah, 0x58
jmp 0x6a5503
mov eax, esi
mov eax, dword [esp]
jmp 0x6a553c
mov eax, esi
mov eax, dword [esp]
xor bl, 0xc5
lea eax, [ebx - 0x57]
call fcn.006a57fd
adc ecx, dword [ebp - reloc.WINMM.dll_midiStreamRestart]
jmp 0x6a55ec
mov ax, 0x2308
mov ax, 0xf3de
mov eax, dword [esp]
jmp 0x6a55b9
neg al
mov bl, dl
mov al, byte [esp]
mov eax, dword [esp]
lea eax, reloc.WINMM.dll_midiStreamRestart
jmp 0x6a548f
xor bl, 0xd5
call fcn.006a55d4
ljmp 0xf0cd
mov eax, dword [esp]
jmp 0x6a55b9
jb 0x6a5553
mov ax, 0x2308
mov ax, 0xf3de
jmp 0x6a55cf
jmp 0x6a5571

Function at 0x6a7157
Capabilities:
Encode data using xor

Disassembly:
call 0x6a71b4
add edx, 0x7f44b5ac
jmp 0x6a8c7d
mov bl, 0x3a
neg bl
jmp 0x6a8ca0
in al, dx
inc esi
jno 0x6a8ce4
bt bx, dx
bt ebx, edx
jg 0x6a8c67
jle 0x6a8cb6
xor dword [ebx - 0xe], esi
jae 0x6a8c79
pushal
pop es
inc ebx
ja 0x6a8c84
add dh, cl
dec ebp
push 0xffffffffffffff85
xor al, 0x27
dec esi
jb 0x6a8cd6
not bx
jmp 0x6a715c
mov edx, dword [edx - reloc.WINMM.dll_midiStreamRestart]
inc ebx
jnp 0x6a8cbc
neg bl
jmp 0x6a8cc0
mov bl, 0x3a
neg bl
jmp 0x6a8ca0
neg bl
jmp 0x6a8d16
mov ebx, 0xa801f635
jmp 0x6a8d1b
not bx
jmp 0x6a715c
cwde
pop eax
invalid
mov ebx, 0xa801f635
call 0x6a8cf4
mov bx, 0x8ce3
mov bh, byte [esp]
jmp 0x6a8d47
mov bh, byte [esp]
push edx
ret
Function at 0x6bd305
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06adbb0
jmp 0x6bd043
pushfd
jmp 0x6bcb26
pushal
lea esp, [esp + 1]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x6bd068
lea esp, [esp + 4]
lea esp, [esp + 1]
lea esp, [esp]
jmp 0x6bd0a2

Function at 0xa6dfac
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec si
push word [esp + 1]
lea esp, [esp + 2]
mov esi, dword [esp + 0x1f]
jmp 0xa6de03
lea esp, [esp + 0x28]
popfd
jmp 0xa6ded7
push 0x824269a9
add dword [esp], reloc.WINMM.dll_midiStreamRestart
push cx
call fcn.00a6de8a
lea esp, [esp + 2]
mov dword [esp + 3], ebp
push word [esp + 2]
jmp 0xa6df1a
push word [esp + 1]
mov word [esp + 8], di
push word [esp + 0xa]
mov byte [esp + 0xc], al
call fcn.00a6df53
insb byte es:[edi], dx
jae 0xa6dfa9
jb 0xa6dfa3
outsb dx, byte gs:[esi]
push edi
add bl, ch
jmp 0xa6df00
push dword [esp + 0x13]
pop word [esp + 2]
lea esp, [esp + 3]
jmp 0xa6e0a8
outsb dx, byte [esi]
jns 0xa6e004
mov byte [esp + 0x19], dh
pop word [esp + 0x19]
mov byte [esp + 2], dl
mov byte [esp + 0xa], ch
jmp 0xa6df96
cpuid
xchg ecx, edi
mov bh, byte [esp]
mov esi, 0x58da0ab4
pushfd
mov dl, al
jmp 0xa6dff0
mov dh, byte [esp]
xchg dword [esp], ebp
push word [esp + 3]
xchg dx, ax
lea esp, [esp + 1]
jmp 0xa6e018
and byte [ebx - 0x66], ah
mov eax, edx
pushal
mov bx, word [esp + 0x19]
popal
mov di, 0x9620
mov ch, 0xf0
jmp 0xa6dfdb
mov ecx, 0x86723245
mov word [esp + 2], di
push dword [esp + 1]
xchg cl, dh
push dword [esp + 3]
xchg byte [esp + 8], cl
jmp 0xa6e07b
setl al
mov ebx, 0xfbfb566b
mov bx, 0xc56f
lea ebp, reloc.WINMM.dll_midiStreamRestart
mov dx, 0x716f
mov di, 0xaed1
jmp 0xa6e007
pop word [esp + 5]
pop cx
mov dh, byte [esp + 0xb]
pop word [esp + 1]
rdtsc
xchg byte [esp + 0xa], ah
jmp 0xa6e0e8
push dword [esp]
mov dl, byte [esp + 0xb]
mov esi, dword [esp + 0xc]
lea esi, [ecx - 0xcb]
push word [esp + 7]
lea ebp, [ebx + ebp]
jmp 0xa6e057
lea esp, [esp + 0x1c]
push 0
pushal
rdtsc
not si
jmp 0xa6e03b
lea ebp, [edx*4]
mov ebp, dword [esp + 3]
pop bp
jmp 0xa6e14d
pop dword [esp + 3]
xchg dl, al
lea eax, [edx + ebp]
mov al, bl
setg ch
push word [esp + 3]
jmp 0xa6e0b6
mov dword [esp + 6], edi
mov esi, esp
push dword [esp + 5]
lea ebx, [edx*4]
xchg edi, eax
lea ebp, [edi + ebp]
jmp 0xa6e0cc
not dh
mov ch, 0xa
call fcn.00a6e0ff
push word [esp + 5]
mov ebx, dword [esp + 1]
mov ebx, dword [esp + 1]
call fcn.00a6e164
call 0x89848340
dec esp
and al, 0xb
xchg ebx, edi
bswap ebx
mov dl, 0x91
mov eax, 0x5ceeebb0
jmp 0xa6e11e
xchg byte [esp + 0xb], dl
push dword [esp + 5]
xchg byte [esp + 0xc], cl
pop dword [esp + 7]
xchg byte [esp], dh
xchg ebp, esi
jmp 0xa6e115

Function at 0xa71e8d
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 2], bl
lea esp, [esp + 1]
jmp 0xa71eaa
mov dword [esp + 4], ebp
call fcn.00a71f2c

Function at 0xa71eb3
Capabilities:
Parse pe header

Disassembly:
call fcn.00a70ffb
call fcn.00a71efc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xa71ee0
mov eax, dword [eax + 8]
push di
lea esp, [esp + 2]
push eax
jmp 0xa70ff6
Function at 0xa71efc
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 8], edi
lea esp, [esp + 8]
mov eax, dword fs:[0x30]
jmp 0xa71eb8

Function at 0xa71f2c
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 4], esi
call fcn.00a71eb3
Function at 0x5182c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xef000]
push edi
or ebp, 0xffffffff
jmp 0x5182e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5182e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5182d8
mov eax, 1
add ebx, ebx
jne 0x5182fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51830c
jne 0x51832b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51832b
dec eax
add ebx, ebx
jne 0x518318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5182f0
add ebx, ebx
jne 0x518327
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51837d
xor ecx, ecx
sub eax, 3
jb 0x518343
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5183b2
sar eax, 1
mov ebp, eax
jmp 0x51834e
add ebx, ebx
jne 0x51834e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51831c
inc ecx
add ebx, ebx
jne 0x51835c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51831c
add ebx, ebx
jne 0x518369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51835e
jne 0x51837a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51835e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51839c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51838e
jmp 0x5182de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51839c
add edi, ecx
jmp 0x5182de
pop esi
mov edi, esi
mov ecx, 0xcbf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5183ba
cmp byte [edi], 0xb
jne 0x5183ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5183bf
lea edi, [esi + 0x115000]
mov eax, dword [edi]
or eax, eax
je 0x518437
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11d99c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11db18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5183ec
mov ecx, edi
jns 0x51841b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11db1c]
or eax, eax
je 0x518431
mov dword [ebx], eax
add ebx, 4
jmp 0x518409
call dword [esi + 0x11db2c]
mov ebp, dword [esi + 0x11db20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51846b
sub esp, 0xffffff80
jmp 0x4207d2
Function at 0x4a2358
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
jle 0x4a236e
jg 0x4a236e
call 0xc6d5fafd
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.00402a38
cmp byte [esp], 0
je 0x4a2410
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4a238f
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4a2495
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4a241b
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4a7360
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4a749b
push dword fs:[eax]
mov dword fs:[eax], esp
jle 0x4a7395
jg 0x4a7395
call 0x104aaf1a
add byte [eax], al
cmp dword [ebx], 0x1000
jle 0x4a73c4
lea edx, [ebp - 0x100c]
mov eax, dword [0x4c003c]
call fcn.00406a84
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x407f60]
call fcn.0040d3b8
call fcn.004041b4
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x4a741b
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x4a73f0
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x4a7416
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x4a7403
inc esi
add ecx, esi
jmp 0x4a7425
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x4a745b
lea edx, [ebp - 0x1010]
mov eax, dword [0x4c003c]
call fcn.00406a84
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x407f60]
call fcn.0040d3b8
call fcn.004041b4
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402a38
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.00402a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a74a2
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.0040483c
ret

Function at 0x4a9231
Capabilities:
Encrypt data using des

Disassembly:
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns fcn.004a9231
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jbe 0x4a9245
ja 0x4a9245
call 0x1c995c7
jle 0x4a924a
jg 0x4a924a
call 0x1bf95c2
je 0x4a924f
jne 0x4a924f
call 0x3442d7de
leave
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004031cc
xor edx, edx
mov eax, 0x4bfee8
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4a92b1
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4a9265
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a966c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4a9685
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4a967e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
jle 0x4a9691
jg 0x4a9691
call 0x942dc5c
add byte [eax], al
add byte [ebx + 0x4d8bfc45], cl
or al, 0x8a
adc byte [eax - 0xbfbeef], cl
dec ebp
clc
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4a969e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a8f94
test bl, bl
jne 0x4a9771
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4c1f38
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a96d5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a96e9
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a9528
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4a971b
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4a96ca
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a973e
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4a974f
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a9763
jmp 0x4a982c
cmp bl, 1
jne 0x4a982c
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4c1f92
Function at 0x4a97da
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a9791
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a97a5
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a9528
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
push cs
push cs
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4a97d7
sub ebx, 6
inc dword [ebp - 8]
jne 0x4a9786
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4a97fe
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4a980f
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4a9823
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a901c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8

Function at 0x4aa66c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4aa725
push dword fs:[eax]
mov dword fs:[eax], esp
jle 0x4aa691
jg 0x4aa691
call 0x68a066c8
add eax, 0x64004aa7
push dword [eax]
xor eax, eax
push ebp
push 0x4aa705
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404818
mov eax, 0x104
call fcn.00409f20
mov ebx, eax
lea eax, [ebp - 4]
push eax
push edi
mov eax, dword [0x4c04cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4aa6de
mov eax, esi
mov edx, ebx
call fcn.00404a10
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, ebx
call fcn.00409f6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aa70f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa72c
lea eax, [ebp - 8]
call fcn.004065a4
ret
Function at 0x4ac89a
Capabilities:
Delete file

Disassembly:
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d38
jmp 0x4ac8b7
mov eax, dword [ebp - 0xc]
call fcn.00409794
test al, al
je 0x4ac918
lea eax, [ebp - 0x2a]
xor ecx, ecx
mov edx, 0x1e
call fcn.004031cc
xor eax, eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], 3
lea eax, [ebp - 0x34]
mov ecx, 0x4ac980
mov edx, dword [ebp - 0xc]
call fcn.00404b24
mov eax, dword [ebp - 0x34]
call fcn.00404cd8
mov dword [ebp - 0x22], eax
mov eax, 0x4ac984
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], 0x14
lea eax, [ebp - 0x2a]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete byte [ebp - 5]
jmp 0x4ac91c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac930
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac962
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0040483c
lea eax, [ebp - 0xc]
call fcn.00404818
lea eax, [ebp - 4]
call fcn.00404818
ret

Function at 0x4ad910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cc8
xor eax, eax
push ebp
push 0x4ad9c9
push dword fs:[eax]
mov dword fs:[eax], esp
je 0x4ad93b
jne 0x4ad93b
call 0x1c7dcbb
jl 0x4ad940
jge 0x4ad940
call 0x1bde1b6
jb 0x4ad94a
jae 0x4ad945
call 0x1bddcbb
jb 0x4ad94a
jae 0x4ad94a
call 0x1c3dcc6
js 0x4ad94f
jns 0x4ad94f
call 0x68140aa4
jecxz 0x4ad956
push ecx
xor ecx, ecx
jcxz 0x4ad956
call 0xfc9064b3
pop ecx
mov eax, dword [ebp - 4]
call fcn.00404ad8
mov ecx, eax
test ecx, ecx
jle 0x4ad9a2
mov esi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
and eax, 0xff
mov edx, dword [0x4c05f8]
mov eax, dword [edx + eax*4]
shr ebx, 8
and ebx, 0xffffff
xor eax, ebx
mov ebx, eax
inc esi
dec ecx
jne 0x4ad96a
mov ecx, dword [ebp - 8]
mov eax, ebx
not eax
mov edx, 8
call fcn.0040931c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad9d0
lea eax, [ebp - 4]
call fcn.00404818
ret