joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489fbe
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [eax + 0x14], 0x10
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [eax + 0x10], ebx
jb 0x489fec
mov eax, dword [eax]
mov byte [eax], bl
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x108], bl
jne 0x48a02b
xor al, al
jmp 0x48a17d
push esi
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x224]
call fcn.00407395
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov esi, eax
push esi
call fcn.004071c8
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00407429
cmp dword [ebp - 0x210], 0x10
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
push ebx
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x230], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x48a16f
push edi
call fcn.0048eb44
cmp dword [ebp - 0x210], 0x10
pop ecx
mov esi, eax
push esi
push edi
lea ecx, [ebp - 0x224]
cmovae ecx, dword [ebp - 0x224]
push ebx
push ecx
mov dword [ebp - 0x238], esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x48a0c9
push esi
call fcn.0048eb4d
jmp 0x48a16e
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x4d628c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x48a0be
mov eax, dword [ebp - 0x228]
push 0x103
movzx ecx, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx esi, word [eax + 0xc]
xor eax, eax
push eax
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x20b]
push eax
mov dword [ebp - 0x234], ecx
call fcn.004921d0
mov eax, dword [ebp - 0x234]
push esi
push edi
movzx eax, ax
push ebx
push eax
push 0x4c7d78
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00499880
lea eax, [ebp - 0x20c]
push eax
call fcn.004071c8
mov ecx, dword [ebp - 0x22c]
add esp, 0x2c
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00407429
push dword [ebp - 0x238]
call fcn.0048eb4d
mov bl, 1
pop ecx
lea ecx, [ebp - 0x224]
call fcn.004073c4
mov al, bl
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x48ab78
Capabilities:
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov edi, 0x4d5ea8
push edi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
call fcn.00407395
push edi
lea ecx, [ebp - 0x1c]
call fcn.00407395
push edi
lea ecx, [ebp - 0x64]
call fcn.00407395
push edi
lea ecx, [ebp - 0x4c]
call fcn.00407395
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x228]
call fcn.004894c5
cmp dword [ebp - 0x24], 8
mov ecx, esi
je 0x48ac03
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
push 1
jmp 0x48ac1b
cmp dword [ebp - 0xc], 8
je 0x48ac25
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
push 2
call fcn.0048ccbf
jmp 0x48acd9
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
cmp edi, 0x10
cmovae eax, ebx
push eax
call fcn.0048bb51
test al, al
jne 0x48ac5d
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
push 4
mov ecx, esi
call fcn.0048ccbf
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
test eax, eax
jne 0x48ac8c
cmp byte [esi + 0x9b], al
je 0x48ac8c
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0x1c]
cmp edi, 0x10
lea eax, [ebp - 0x1c]
cmovae eax, ebx
test eax, eax
jne 0x48acb1
cmp byte [esi + 0x9b], al
je 0x48acb1
cmp edi, 0x10
lea eax, [ebp - 0x1c]
cmovae eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esi + 0x3c]
lea eax, [ebp - 0x34]
xor ebx, ebx
cmp ecx, eax
je 0x48acc6
push 0xffffffffffffffff
push ebx
push eax
call fcn.004074a2
lea ecx, [esi + 0x54]
lea eax, [ebp - 0x1c]
cmp ecx, eax
je 0x48acd9
push 0xffffffffffffffff
push ebx
push eax
call fcn.004074a2
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
cmp dword [esi + 0x38], ebx
jne 0x48ad19
lea eax, [esi + 0xfc]
cmp dword [eax + 0x14], 0x10
jb 0x48ad0a
mov eax, dword [eax]
push ebx
push eax
push dword [0x4eb29c]
mov ecx, esi
call fcn.0048b53e
add esi, 0xfc
cmp dword [esi + 0x14], 0x10
jb 0x48ad27
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x94]
call fcn.004073c4
lea ecx, [ebp - 0x4c]
call fcn.004073c4
lea ecx, [ebp - 0x64]
call fcn.004073c4
lea ecx, [ebp - 0x1c]
call fcn.004073c4
lea ecx, [ebp - 0x34]
call fcn.004073c4
lea ecx, [ebp - 0x7c]
call fcn.004073c4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x48b358
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0x80c], 0xffffffff
mov dword [ebp - 0x814], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp + 0x18]
push esi
lea esi, [ebx + 0xb4]
mov dword [ebp - 0x810], eax
cmp dword [esi + 0x14], 0x10
mov eax, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x818], eax
mov byte [ebp - 0x805], 0
jb 0x48b3b0
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push str._s_send__x.gz
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call fcn.00499880
add esp, 0x14
test eax, eax
js 0x48b46a
lea eax, [ebp - 0x804]
push 0x4c8070
push eax
call fcn.004b2c81
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48b46a
push dword [ebp + 0x10]
push dword [ebp - 0x81c]
push edi
call fcn.004b2870
push edi
mov esi, eax
call fcn.004b2b7f
add esp, 0x10
test esi, esi
je 0x48b450
push dword [ebp - 0x810]
lea eax, [ebp - 0x80c]
push dword [ebp + 0x14]
push eax
push dword [ebp - 0x818]
lea eax, [ebp - 0x804]
push eax
sub esp, 0x18
mov ecx, esp
push dword [ebp - 0x814]
call fcn.0040513a
lea eax, [ebx + 0x12c]
push eax
call fcn.0048ced2
mov byte [ebp - 0x805], 1
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [ebp - 0x805], 0
jne 0x48b527
cmp dword [ebx + 0xdc], 0
je 0x48b527
lea esi, [ebx + 0xcc]
cmp dword [esi + 0x14], 0x10
jb 0x48b485
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push str._s_send__x.gz
lea eax, [ebp - 0x804]
push 0x7ff
push eax
call fcn.00499880
add esp, 0x14
test eax, eax
js 0x48b527
lea eax, [ebp - 0x804]
push 0x4c8070
push eax
call fcn.004b2c81
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48b527
push dword [ebp + 0x10]
push dword [ebp - 0x81c]
push edi
call fcn.004b2870
push edi
mov esi, eax
call fcn.004b2b7f
add esp, 0x10
test esi, esi
je 0x48b51a
push dword [ebp - 0x810]
lea eax, [ebp - 0x80c]
push dword [ebp + 0x14]
push eax
push dword [ebp - 0x818]
lea eax, [ebp - 0x804]
push eax
sub esp, 0x18
mov ecx, esp
push dword [ebp - 0x814]
call fcn.0040513a
lea eax, [ebx + 0x12c]
push eax
call fcn.0048ced2
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 0x18
Function at 0x48b53e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0x848], 0xffffffff
push esi
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x844], ecx
mov ecx, dword [ebp + 0x10]
push 0x4d457c
push eax
mov dword [ebp - 0x850], ecx
call fcn.00493eaf
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x48b6c0
push ebx
push edi
push 2
xor edi, edi
push edi
push esi
call fcn.004942d4
push esi
call fcn.004946ac
push edi
push edi
push esi
mov ebx, eax
call fcn.004942d4
add esp, 0x1c
lea edi, [ebp - 0x810]
cmp ebx, 0x800
jb 0x48b5c5
lea eax, [ebx + 1]
push eax
call fcn.0048eb44
pop ecx
mov edi, eax
push esi
push ebx
push 1
push edi
call fcn.00494199
add esp, 0x10
test eax, eax
je 0x48b6a6
cmp ebx, 8
jle 0x48b6a6
xor eax, eax
push 8
mov byte [ebp - 0x10], al
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00498820
lea ecx, [ebp - 0x10]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48b603
sub ecx, edx
je 0x48b63d
push dword [ebp - 0x850]
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebx - 8]
mov ebx, dword [ebp - 0x844]
push eax
lea eax, [edi + 8]
push eax
push dword [ebp - 0x84c]
mov ecx, ebx
call fcn.0048b358
mov dword [ebp - 0x848], eax
jmp 0x48b643
mov ebx, dword [ebp - 0x844]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0048bb51
test al, al
jne 0x48b6a6
push 0x4d5ea8
lea ecx, [ebp - 0x828]
call fcn.00407395
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x840]
call fcn.00407395
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x828]
push eax
push eax
push 5
mov ecx, ebx
call fcn.0048ccbf
lea ecx, [ebp - 0x840]
call fcn.004073c4
lea ecx, [ebp - 0x828]
call fcn.004073c4
push esi
call fcn.00493d4e
lea eax, [ebp - 0x810]
pop ecx
cmp edi, eax
je 0x48b6be
push edi
call fcn.0048eb4d
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x848]
xor ecx, ebp
pop esi
call fcn.0048f059
leave
ret 0xc
Function at 0x48bba4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x800
push ebx
lea eax, [ebp - 0x804]
push eax
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00407395
mov esi, str.AppDataupdatemsg.ini
push esi
call fcn.004071c8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x81c]
call fcn.00420541
cmp dword [ebp - 0x808], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
push ebx
lea eax, [ebp - 0x804]
push eax
mov ebx, 0x4c4bc0
push ebx
push 0x4c7fdc
push str.report
call esi
lea eax, [ebp - 0x804]
push eax
call fcn.00494a3b
cmp dword [ebp - 0x808], 0x10
pop ecx
mov dword [edi + 8], eax
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
push str.send
push str.report
mov dword [edi + 0xc], edx
call esi
lea eax, [ebp - 0x804]
push eax
call fcn.00494a3b
cmp dword [ebp - 0x808], 0x10
pop ecx
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
push str.post
push str.report
mov dword [edi + 0x14], edx
call esi
lea eax, [ebp - 0x804]
push eax
call fcn.00494a3b
cmp dword [ebp - 0x808], 0x10
mov dword [edi + 0x18], eax
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
pop ecx
mov dword [edi + 0x1c], edx
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
push str.off1
push str.report
call esi
lea eax, [ebp - 0x804]
push eax
call fcn.00494a3b
cmp dword [ebp - 0x808], 0x10
pop ecx
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
push str.send1
push str.report
mov dword [edi + 0x24], edx
call esi
lea eax, [ebp - 0x804]
push eax
call fcn.00494a3b
cmp dword [ebp - 0x808], 0x10
pop ecx
mov dword [edi + 0x28], eax
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
push str.post1
mov ebx, str.report
push ebx
mov dword [edi + 0x2c], edx
call esi
lea eax, [ebp - 0x804]
push eax
call fcn.00494a3b
cmp dword [ebp - 0x808], 0x10
mov dword [edi + 0x30], eax
pop ecx
lea eax, [ebp - 0x81c]
cmovae eax, dword [ebp - 0x81c]
push eax
push 0
push str.disable
push ebx
mov dword [edi + 0x34], edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x81c]
mov dword [edi + 0x38], eax
call fcn.004073c4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x48cc11
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
or ebx, 0xffffffff
test eax, eax
je 0x48cc56
cmp dword [ebp + 8], 1
jne 0x48cc38
push eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [0x4eb294]
jmp 0x48cc4f
cmp dword [ebp + 8], 0
jne 0x48ccb8
push eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [0x4eb298]
call fcn.0048b358
jmp 0x48cc6f
cmp byte [ecx + 0x9a], 0
je 0x48cc73
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048bdf6
mov ebx, eax
jmp 0x48ccb8
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esi + 0x10]
push eax
call fcn.0048f28d
mov ecx, dword [ebp + 8]
mov edi, eax
push esi
push dword [ebp + 0xc]
mov dword [edi], ecx
lea ecx, [edi + 0xc]
xor ebx, ebx
push ecx
mov dword [edi + 4], ebx
mov dword [edi + 8], esi
call fcn.00491b80
push ebx
push ebx
push edi
push 0x48bdd7
push ebx
push ebx
call fcn.004924d8
add esp, 0x28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x48dd57
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [ebx + str.91__]
dec eax
mov ebx, eax
and ebx, reloc.OLEAUT32.dll_VariantInit
jns 0x48dd93
dec ebx
or ebx, 0xfffffff8
inc ebx
cdq
push 7
pop ecx
sub ecx, ebx
and edx, 7
add eax, edx
sar eax, 3
mov byte [ebp - 0xd], 1
mov ch, byte [ebp - 0xd]
shl ch, cl
mov cl, 7
sub cl, bl
mov ebx, dword [ebp - 0x14]
and ch, byte [ebp + eax - 0xc]
mov al, bl
and al, 7
shr ch, cl
mov cl, 7
sub cl, al
mov eax, ebx
shl ch, cl
and eax, 7
push 7
mov edx, ebx
mov byte [ebp - 0xd], ch
pop ecx
sub ecx, eax
mov al, 1
shl al, cl
shr edx, 3
not al
and al, byte [edx + esi]
or al, byte [ebp - 0xd]
inc ebx
mov byte [edx + esi], al
mov dword [ebp - 0x14], ebx
cmp ebx, 0x38
jb 0x48dd7c
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret

Function at 0x48ddf9
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ebx
movzx eax, byte [ebx + 0x4eb2d8]
dec eax
mov ebx, eax
and ebx, reloc.OLEAUT32.dll_VariantInit
jns 0x48de23
dec ebx
or ebx, 0xfffffff8
inc ebx
cdq
push 7
pop ecx
sub ecx, ebx
and edx, 7
add eax, edx
sar eax, 3
mov byte [ebp - 1], 1
mov ch, byte [ebp - 1]
shl ch, cl
mov cl, 7
sub cl, bl
mov ebx, dword [ebp - 8]
and ch, byte [eax + edi]
mov al, bl
and al, 7
shr ch, cl
mov cl, 7
sub cl, al
mov eax, ebx
shl ch, cl
and eax, 7
push 7
mov edx, ebx
mov byte [ebp - 1], ch
pop ecx
sub ecx, eax
mov al, 1
shl al, cl
shr edx, 3
not al
and al, byte [edx + esi]
or al, byte [ebp - 1]
inc ebx
mov byte [edx + esi], al
mov dword [ebp - 8], ebx
cmp ebx, 0x30
jb 0x48de0c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48e140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x24], edi
call fcn.0048e2e6
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 4]
mov edi, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0048e254
pop ecx
push 0xf
pop eax
sub eax, ebx
cmp dword [edi], 1
cmove eax, ebx
xor ecx, ecx
imul eax, eax, 6
lea edx, [eax + edi]
mov al, byte [edx + ecx + 0x10]
xor al, byte [ebp + ecx - 0x1c]
inc ecx
mov byte [ebp + ecx - 0xd], al
cmp ecx, 6
jl 0x48e18f
mov cl, byte [ebp - 0xc]
mov dl, byte [ebp - 0xb]
mov al, cl
shr al, 2
mov byte [ebp - 0x14], al
and cl, 3
mov al, dl
shr al, 4
shl cl, 4
or cl, al
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0xa]
mov al, cl
shr al, 6
and cl, 0x3f
and dl, 0xf
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 9]
shl dl, 2
or dl, al
mov al, cl
shr al, 2
mov byte [ebp - 0x10], al
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 8]
mov al, dl
and cl, 3
shr al, 4
shl cl, 4
or cl, al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 7]
mov al, cl
and dl, 0xf
shr al, 6
shl dl, 2
or dl, al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
and cl, 0x3f
push eax
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xd], cl
call fcn.0048e4d2
mov eax, dword [ebp - 0x28]
add esp, 0xc
inc ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
cmp ebx, 0x10
jl 0x48e170
mov edi, dword [ebp - 0x24]
push edi
mov dword [edi], eax
mov dword [edi + 4], esi
call fcn.0048e393
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret

Function at 0x48e254
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov dword [ebp - 4], eax
xor edi, edi
movzx eax, byte [edi + 0x4eb3e0]
dec eax
mov ebx, eax
and ebx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e27d
dec ebx
or ebx, 0xfffffff8
inc ebx
mov ecx, edi
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e28c
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp - 8], ecx
cdq
and edx, 7
add eax, edx
push 7
pop ecx
sub ecx, ebx
mov byte [ebp + 0xb], 1
mov ch, byte [ebp + 0xb]
shl ch, cl
sar eax, 3
mov cl, 7
sub cl, bl
and ch, byte [ebp + eax - 4]
mov ebx, dword [ebp - 8]
shr ch, cl
mov cl, 7
sub cl, bl
mov eax, edi
shl ch, cl
cdq
and edx, 7
add eax, edx
mov byte [ebp + 0xb], ch
push 7
pop ecx
sub ecx, ebx
mov dl, 1
shl dl, cl
sar eax, 3
not dl
and dl, byte [eax + esi]
or dl, byte [ebp + 0xb]
inc edi
mov byte [eax + esi], dl
cmp edi, 0x30
jl 0x48e266
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48e2e6
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
xor edi, edi
movzx eax, byte [edi + 0x4eb360]
dec eax
mov ebx, eax
and ebx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e320
dec ebx
or ebx, 0xfffffff8
inc ebx
mov ecx, edi
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e32f
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp - 0x14], ecx
cdq
and edx, 7
add eax, edx
push 7
pop ecx
sub ecx, ebx
mov byte [ebp - 0xd], 1
mov ch, byte [ebp - 0xd]
shl ch, cl
sar eax, 3
mov cl, 7
sub cl, bl
and ch, byte [ebp + eax - 0xc]
mov ebx, dword [ebp - 0x14]
shr ch, cl
mov cl, 7
sub cl, bl
mov eax, edi
shl ch, cl
cdq
and edx, 7
add eax, edx
mov byte [ebp - 0xd], ch
push 7
pop ecx
sub ecx, ebx
mov dl, 1
shl dl, cl
sar eax, 3
not dl
and dl, byte [eax + esi]
or dl, byte [ebp - 0xd]
inc edi
mov byte [eax + esi], dl
cmp edi, 0x40
jl 0x48e309
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret

Function at 0x48e393
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
xor edi, edi
movzx eax, byte [edi + 0x4eb3a0]
dec eax
mov ebx, eax
and ebx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e3cd
dec ebx
or ebx, 0xfffffff8
inc ebx
mov ecx, edi
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e3dc
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp - 0x14], ecx
cdq
and edx, 7
add eax, edx
push 7
pop ecx
sub ecx, ebx
mov byte [ebp - 0xd], 1
mov ch, byte [ebp - 0xd]
shl ch, cl
sar eax, 3
mov cl, 7
sub cl, bl
and ch, byte [ebp + eax - 0xc]
mov ebx, dword [ebp - 0x14]
shr ch, cl
mov cl, 7
sub cl, bl
mov eax, edi
shl ch, cl
cdq
and edx, 7
add eax, edx
mov byte [ebp - 0xd], ch
push 7
pop ecx
sub ecx, ebx
mov dl, 1
shl dl, cl
sar eax, 3
not dl
and dl, byte [eax + esi]
or dl, byte [ebp - 0xd]
inc edi
mov byte [eax + esi], dl
cmp edi, 0x40
jl 0x48e3b6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x48e440
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov dword [ebp - 4], eax
xor edi, edi
movzx eax, byte [edi + 0x4eb410]
dec eax
mov ebx, eax
and ebx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e469
dec ebx
or ebx, 0xfffffff8
inc ebx
mov ecx, edi
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x48e478
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp - 8], ecx
cdq
and edx, 7
add eax, edx
push 7
pop ecx
sub ecx, ebx
mov byte [ebp + 0xb], 1
mov ch, byte [ebp + 0xb]
shl ch, cl
sar eax, 3
mov cl, 7
sub cl, bl
and ch, byte [ebp + eax - 4]
mov ebx, dword [ebp - 8]
shr ch, cl
mov cl, 7
sub cl, bl
mov eax, edi
shl ch, cl
cdq
and edx, 7
add eax, edx
mov byte [ebp + 0xb], ch
push 7
pop ecx
sub ecx, ebx
mov dl, 1
shl dl, cl
sar eax, 3
not dl
and dl, byte [eax + esi]
or dl, byte [ebp + 0xb]
inc edi
mov byte [eax + esi], dl
cmp edi, 0x20
jl 0x48e452
pop edi
pop esi
pop ebx
leave
ret