joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4804b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x4804d6
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4804ce
test al, 0x10
je 0x4804d2
xor eax, eax
jmp 0x4804d8
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x48075c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x480812
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405150
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4807fc
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.004052dc
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405150
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4807fc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x480824
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4807fc
cmp dword [ebp - 8], 0x34
jne 0x4807fc
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480819
lea eax, [ebp - 0x10]
call fcn.00404c90
ret

Function at 0x480828
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x48083d
add esp, 0xfffffff0
call fcn.004040e0
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.004804b8
test al, al
jne 0x480873
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x5431fc]
mov dl, 1
mov eax, dword [0x4801e0]
call fcn.0040e4cc
call fcn.0040460c
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00405150
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4808a6
mov ecx, dword [0x54345c]
mov dl, 1
mov eax, dword [0x4801e0]
call fcn.0040e490
call fcn.0040460c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004052dc
mov eax, dword [ebx + 4]
call fcn.00405150
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.00405150
push eax
call sub.version.dll_GetFileVersionInfoA
call fcn.0040fcf8
mov eax, ebx
call fcn.00480ee0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4808ee
call fcn.00404138
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4820e8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4820fd
add esp, 0xfffffff0
call fcn.004040e0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00403d4c
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00404ce4
mov eax, esi
call fcn.00405150
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA_1
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x482152
mov ecx, dword [0x543a50]
mov dl, 1
mov eax, dword [0x481ec8]
call fcn.0047ab34
call fcn.0040460c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x482179
call fcn.00404138
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x48347c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x483556
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x4834b1
or ebx, 0x8000
call fcn.00482db0
cmp al, 0xb
jne 0x4834db
test bh, 0x80
je 0x4834db
lea eax, [ebp - 0x104]
push eax
push 0
push 0
mov eax, ebx
and eax, 0xffff7fff
push eax
push 0
call sub.shell32.dll_SHGetFolderPathA
jmp 0x4834e0
mov eax, 0x80004005
test eax, eax
je 0x4834f7
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push ebx
push 0
call sub.shell32.dll_SHGetFolderPathA
test eax, eax
jne 0x483531
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404f00
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00482c50
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.00482cf0
jmp 0x483538
mov eax, esi
call fcn.00404c90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48355d
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00404cb4
ret

Function at 0x483858
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004034bc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
test bl, bl
je 0x483894
mov word [ebp - 0x18], 1
jmp 0x48389a
mov word [ebp - 0x18], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, edi
call fcn.00405150
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4838eb
cmp byte [ebp - 1], 0
je 0x4838d8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
test esi, esi
je 0x4838eb
mov edx, esi
lea eax, [ebp - 0x58]
mov ecx, 0x10
call fcn.00402b9c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4838f8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x483988
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, edi
mov eax, esi
call fcn.0040f1b0
test eax, eax
je 0x483972
mov eax, edi
call fcn.00483ed0
lea edx, [ebp - 8]
mov eax, edi
call fcn.0040a780
mov eax, dword [ebp - 8]
call fcn.00480494
test al, al
jne 0x48394f
mov eax, dword [ebp - 8]
call fcn.004804dc
cmp byte [ebp - 1], 1
cmc
sbb eax, eax
push eax
mov eax, edi
call fcn.00405150
push eax
mov eax, esi
call fcn.00405150
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48398f
lea eax, [ebp - 8]
call fcn.00404c90
ret

Function at 0x483998
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x483a0f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x204]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405150
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x204]
call fcn.0040ac6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483a16
lea eax, [ebp - 4]
call fcn.00404c90
ret

Function at 0x4840c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48412e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.0040ac6c
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00483810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484135
lea eax, [ebp - 0x104]
call fcn.00404c90
ret

Function at 0x48413c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4841a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.0040ac6c
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00483810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4841ad
lea eax, [ebp - 0x104]
call fcn.00404c90
ret
Function at 0x484908
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x484993
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
mov ecx, 0x4849a8
mov edx, dword [ebp - 4]
call fcn.00404f9c
mov eax, dword [ebp - 0x10c]
call fcn.00405150
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edx, ebx
lea eax, [ebp - 0x108]
call fcn.0040ac6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48499a
lea eax, [ebp - 0x10c]
call fcn.00404c90
lea eax, [ebp - 4]
call fcn.00404c90
ret

Function at 0x48ef4c
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x53c3f0], 0
mov eax, dword [0x543cfc]
cmp dword [eax], 2
jne 0x48f125
mov eax, dword [0x543270]
cmp dword [eax], 5
jl 0x48f125
call fcn.0048c07c
test al, al
jne 0x48ef7d
call fcn.0048c088
call fcn.0048c074
mov dword [0x53c3f8], eax
push 0x48f128
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3bc], eax
cmp dword [0x53c3bc], 0
jne 0x48efd8
mov edx, 0x8000
mov eax, 0x48f13c
call fcn.00410284
mov dword [0x53c3f4], eax
mov eax, dword [0x53c3f4]
mov dword [0x53c3f8], eax
push 0x48f128
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3bc], eax
cmp dword [0x53c3bc], 0
je 0x48f120
push 0x48f148
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3c0], eax
cmp dword [0x53c3c0], 0
je 0x48f120
push 0x48f154
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3c4], eax
cmp dword [0x53c3c4], 0
je 0x48f120
mov byte [0x53c3f0], 1
push 0x48f164
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3c8], eax
push 0x48f170
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3cc], eax
push 0x48f17c
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3d0], eax
push 0x48f18c
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3d4], eax
push 0x48f19c
mov eax, dword [0x53c3f8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3d8], eax
mov edx, 0x8000
mov eax, 0x48f1b4
call fcn.00410284
mov dword [0x53c3fc], eax
cmp dword [0x53c3fc], 0
je 0x48f125
push 0x48f1c4
mov eax, dword [0x53c3fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3dc], eax
push 0x48f1e0
mov eax, dword [0x53c3fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3e0], eax
push 0x48f200
mov eax, dword [0x53c3fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3e4], eax
push 0x48f21c
mov eax, dword [0x53c3fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3e8], eax
push 0x48f234
mov eax, dword [0x53c3fc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x53c3ec], eax
ret
call fcn.0048eecc
ret
Function at 0x4918e8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x491a10
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004917d0
mov eax, dword [esi]
call fcn.004061a4
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x487924]
call fcn.00406360
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00402b9c
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00402b9c
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004061a4
mov dword [ebp - 0xc], eax
mov eax, dword [0x543af0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.004896f0
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004034bc
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004061a4
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.00489618
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.00489364
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004896e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491a17
lea eax, [ebp - 8]
mov edx, dword [0x487924]
call fcn.00406480
ret
Function at 0x4a4ecc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
movzx eax, word [esi + 0x54]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.004a4ba0
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x4a4fb0
xor ecx, ecx
mov cl, byte [esi + 0x1098]
lea edx, [esi + 0x1057]
mov eax, dword [esi + 0x34]
call fcn.00402b9c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x4a4f56
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0x56]
xor cl, byte [esi + edx + 0x1057]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x4a4f32
mov al, byte [esi + 0x1098]
cmp bl, al
jne 0x4a4f72
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0x34]
mov eax, dword [esp + 8]
call fcn.00402b9c
jmp 0x4a4f85
xor eax, eax
mov al, bl
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x34]
mov eax, esi
call fcn.004a4bac
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 8], eax
add dword [esp + 4], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.004a4ba0
mov ebx, eax
test bl, bl
ja 0x4a4f04
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4a4fb8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
movzx eax, word [esi + 0x54]
mov dword [esp], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.004a4ba0
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
test bl, bl
jbe 0x4a50a4
xor ecx, ecx
mov cl, byte [esi + 0x1098]
lea edx, [esi + 0x1057]
mov eax, dword [esi + 0x34]
call fcn.00402b9c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov al, byte [esi + 0x1098]
cmp bl, al
jne 0x4a502d
xor ecx, ecx
mov cl, al
mov edx, dword [esi + 0x34]
mov eax, dword [esp + 4]
lea eax, [esi + eax + 0x56]
call fcn.00402b9c
jmp 0x4a5044
xor eax, eax
mov al, bl
push eax
mov eax, dword [esp + 8]
lea ecx, [esi + eax + 0x56]
mov edx, dword [esi + 0x34]
mov eax, esi
call fcn.004a4bac
mov edi, ebx
and edi, 0xff
dec edi
test di, di
jb 0x4a5079
inc edi
xor eax, eax
movzx edx, ax
mov ecx, edx
add ecx, dword [esp + 4]
mov cl, byte [esi + ecx + 0x56]
xor cl, byte [esi + edx + 0x1057]
push ecx
mov ecx, dword [esp + 0xc]
add ecx, edx
pop edx
mov byte [ecx], dl
inc eax
dec di
jne 0x4a5055
xor eax, eax
mov al, bl
sub dword [esp], eax
add dword [esp + 4], eax
add dword [esp + 8], eax
xor edx, edx
mov dl, byte [esi + 0x1098]
mov ecx, dword [esp]
mov eax, esi
call fcn.004a4ba0
mov ebx, eax
test bl, bl
ja 0x4a4ff0
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4a51ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
xor esi, esi
jmp 0x4a51c8
movzx eax, cx
mov byte [ebx + eax + 0x56], 0
inc word [ebx + 0x54]
mov cx, word [ebx + 0x54]
movzx eax, cx
xor edx, edx
mov dl, byte [ebx + 0x1098]
mov edi, edx
xor edx, edx
div edi
test edx, edx
jne 0x4a51bc
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea edx, [ebx + 0x1057]
lea eax, [ebx + esi + 0x56]
call fcn.00402b9c
xor edx, edx
mov dl, byte [ebx + 0x1098]
dec edx
test dx, dx
jb 0x4a521f
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0x34]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1057], cl
inc eax
dec dx
jne 0x4a5209
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
mov edx, dword [ebx + 0x34]
lea eax, [ebx + 0x1057]
call fcn.00402b9c
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea eax, [ebx + 0x1057]
call fcn.00402b9c
xor eax, eax
mov al, byte [ebx + 0x1098]
add esi, eax
movzx eax, word [ebx + 0x54]
cmp esi, eax
jne 0x4a51e1
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4a5270
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
xor esi, esi
jmp 0x4a528c
movzx eax, cx
mov byte [ebx + eax + 0x56], 0
inc word [ebx + 0x54]
mov cx, word [ebx + 0x54]
movzx eax, cx
xor edx, edx
mov dl, byte [ebx + 0x1098]
mov edi, edx
xor edx, edx
div edi
test edx, edx
jne 0x4a5280
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea edx, [ebx + 0x1057]
lea eax, [ebx + esi + 0x56]
call fcn.00402b9c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
xor edx, edx
mov dl, byte [ebx + 0x1098]
dec edx
test dx, dx
jb 0x4a52ea
inc edx
xor eax, eax
movzx edi, ax
mov ecx, dword [ebx + 0x34]
mov cl, byte [ecx + edi]
xor byte [ebx + edi + 0x1057], cl
inc eax
dec dx
jne 0x4a52d4
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
mov edx, dword [ebx + 0x34]
lea eax, [ebx + esi + 0x56]
call fcn.00402b9c
mov eax, dword [esp]
lea edx, [eax + esi]
xor ecx, ecx
mov cl, byte [ebx + 0x1098]
lea eax, [ebx + 0x1057]
call fcn.00402b9c
xor eax, eax
mov al, byte [ebx + 0x1098]
add esi, eax
movzx eax, word [ebx + 0x54]
cmp esi, eax
jne 0x4a52a5
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b0324
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b03e9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x479848]
call fcn.00406360
add esp, 4
xor edx, edx
push ebp
push 0x4b03c6
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004b03fc
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [ebp - 4]
shl edx, 2
mov ecx, dword [ebp - 4]
shr ecx, 0x1e
or edx, ecx
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax]
xor edx, ecx
mov dword [ebp - 4], edx
inc eax
cmp eax, 0x10
jne 0x4b0380
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b03cd
push 0
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x479848]
call fcn.00406360
add esp, 4
ret

Function at 0x4b6bbc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4b6c20
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004b6c2c
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040ac6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6c27
lea eax, [ebp - 4]
call fcn.00404c90
ret
Function at 0x4b7168
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4b7258
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004b6960
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a89c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b76d0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a780
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b7744
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b725f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb4
ret