joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f5e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov ebp, edx
mov esi, eax
mov eax, ebp
call fcn.00404f64
mov edi, eax
cmp edi, 1
jl 0x41f6e7
push edi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x41ee4c]
call fcn.00405120
add esp, 4
mov edx, dword [ebx]
mov eax, ebp
mov ecx, edi
call fcn.004028b8
cmp edi, 1
jne 0x41f64a
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 5
lea eax, [esi + eax*8]
xor edx, edx
mov dl, byte [esi + 0x34]
mov al, byte [eax + edx + 0x1003c]
mov edx, dword [ebx]
mov byte [edx], al
jmp 0x41f6e7
mov edx, edi
sub edx, 2
test edx, edx
jl 0x41f67a
inc edx
xor eax, eax
mov ecx, dword [ebx]
movzx ecx, byte [ecx + eax]
shl ecx, 5
lea ecx, [esi + ecx*8]
mov ebp, dword [ebx]
movzx ebp, byte [ebp + eax + 1]
mov cl, byte [ecx + ebp + 0x1003c]
mov ebp, dword [ebx]
mov byte [ebp + eax], cl
inc eax
dec edx
jne 0x41f656
mov eax, dword [ebx]
movzx eax, byte [eax + edi - 1]
shl eax, 5
lea eax, [esi + eax*8]
mov dl, byte [esi + 0x34]
xor dl, 0x55
and edx, 0xff
mov al, byte [eax + edx + 0x1003c]
mov edx, dword [ebx]
mov byte [edx + edi - 1], al
mov eax, edi
dec eax
cmp eax, 1
jl 0x41f6cc
mov edx, dword [ebx]
movzx edx, byte [edx + eax]
shl edx, 5
lea edx, [esi + edx*8]
mov ecx, dword [ebx]
movzx ecx, byte [ecx + eax - 1]
mov dl, byte [edx + ecx + 0x1003c]
mov ecx, dword [ebx]
mov byte [ecx + eax], dl
dec eax
test eax, eax
jne 0x41f6a8
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 5
lea eax, [esi + eax*8]
xor edx, edx
mov dl, byte [esi + 0x34]
mov al, byte [eax + edx + 0x1003c]
mov edx, dword [ebx]
mov byte [edx], al
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [esp + 0xe], 8
call dword [sym.imp.user32.dll_GetKeyboardState]
call fcn.004023d8
sub ecx, edx
call fcn.00403680
mov ebx, 0x7eff
inc ebx
call dword [fcn.0040365c]
add byte [eax], al
add byte [eax], al
mov bl, 0x31
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + 0x4032], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x36], ah
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
jmp 0x5a1285

Function at 0x4023d8
Capabilities:
Terminate process

Disassembly:
mov edx, eax
xor edi, edi
xor esi, esi
push dword [0x403657]
call dword [sym.imp.winmm.dll_waveInClose]
add eax, 5
inc eax
test eax, 0xb
jne 0x402401
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401037], eax
ret
Function at 0x4e4412
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4e4438
jmp 0x4e454e
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x4e4458
jmp 0x4e454e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004e9551
add esp, 4
mov dword [0x50b0a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x4e44a5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x4e44c5
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x4e44a2
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e452d
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004e90f4
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x4e44e1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e4553
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004e8e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004e8f15
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004e978f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 2
jne 0x4e45d6
cmp dword [0x50b2d2], 1
jne 0x4e45d6
cmp dword [ebp - 0xc], 0
je 0x4e45d6
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e4412
add esp, 8
jmp 0x4e45e5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x4e47d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x4e481b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4e4841
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x50b0a4], ecx
jne 0x4e483f
cmp dword [ebp - 0xc], 0
je 0x4e483d
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
jmp 0x4e4841
jmp 0x4e4818
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x4e48e4
mov dword [ebp - 0x18], 0
jmp 0x4e486f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4e48e4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x50b0a4], ecx
jne 0x4e48e2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x50b1b2]
cmp dword [eax*4 + 0x50b13a], ecx
jb 0x4e48d1
mov eax, dword [ebp - 0x10]
cmp dword [0x50b0a0], eax
je 0x4e48bf
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x50b11c]
push eax
call fcn.004e9551
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x50b0a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e90a8
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x50b13a], eax
jmp 0x4e48e4
jmp 0x4e486c
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4e48f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4e4943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4e49a5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x50b0a4], ecx
jne 0x4e49a3
mov eax, dword [ebp - 0xc]
cmp dword [0x50b0a0], eax
je 0x4e497d
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x50b11c]
push eax
call fcn.004e9551
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x50b0a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e90f4
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x4e49a1
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x4e49a5
jmp 0x4e4940
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x4e49d3
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e90a8
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4e9188
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffffff
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
jmp 0x4e91c7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jge 0x4e929d
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
mov al, byte [ebp - 0x20]
cmp eax, 0x54
jne 0x4e9298
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x44
je 0x4e9217
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
je 0x4e9217
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x53
jne 0x4e9298
mov al, byte [ebp - 0x17]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.004e9551
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
jne 0x4e926a
mov dword [0x50b2d2], 1
mov dword [ebp - 0x10], 0
jmp 0x4e924d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jge 0x4e9268
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x1e]
xor cl, byte [ebp - 0x17]
mov eax, dword [ebp - 0x10]
mov byte [eax + ebp - 0x1e], cl
jmp 0x4e924a
jmp 0x4e9274
mov dword [0x50b2d2], 0
mov eax, dword [ebp - 0x1e]
xor eax, 0x19611225
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a]
xor eax, 0x198931
and eax, 0xffffff
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov dword [ebp - 8], eax
jmp 0x4e929d
jmp 0x4e91c4
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
jmp 0x4e92b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e93de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 0xa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], 0
jmp 0x4e9410
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x4e942b
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x18]
xor cl, byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov byte [eax + ebp - 0x18], cl
jmp 0x4e940d
cmp dword [ebp - 0x18], 0x646c6f47
jne 0x4e9475
cmp dword [ebp - 0x14], 0x6f736e65
jne 0x4e9475
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 0x66
jne 0x4e9475
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.004e9551
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4e946c
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 4], 0xa
jmp 0x4e9485
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
jmp 0x4e948a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e97ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e8e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004e8f15
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004e9a19
add esp, 8
cmp eax, 0xffffffff
je 0x4e984f
mov dword [ebp - 0x14], 1
jmp 0x4e9856
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 2
jne 0x4e9886
cmp dword [ebp - 8], 0
je 0x4e9886
cmp dword [ebp - 0x14], 0
je 0x4e9886
push 0x50ba80
mov eax, dword [ebp - 4]
push eax
call fcn.004e9897
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4e9a67
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 2
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4e9b3c
cmp dword [ebp - 8], 0
jne 0x4e9b3c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
push eax
call fcn.004e9551
add esp, 4
mov dword [ebp - 0x41c], 0x646c6f47
mov dword [ebp - 0x418], 0x6f736e65
mov byte [ebp - 0x414], 0x66
mov dword [ebp - 0x1c], 0
jmp 0x4e9af4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jge 0x4e9b16
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax + ebp - 0x41c]
mov ecx, dword [ebp + 0xc]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + ebp - 0x41c], al
jmp 0x4e9af1
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 0x413], al
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xa
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4e9b4e
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ed4e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
push 0xfffffffffffffff0
add ecx, 0x646c6f47
pop esi
xor word [eax + 0xc], cx
xor word [eax + 0xe], cx
xor dword [eax + 0x110], ecx
xor byte [eax + 0x114], cl
mov dword [ebp + 8], ecx
lea ecx, [eax + 0x10]
sub esi, eax
mov edi, 0x100
lea eax, [ecx + esi]
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 8]
xor byte [ecx], al
inc ecx
dec edi
jne 0x4ed51a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4ed532
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], 0x100
add eax, 0x646c6f47
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 7]
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp - 4]
xor al, byte [esi + edi]
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4ed55c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ed579
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4ed5a1
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, ecx
je 0x4ed5d5
dec eax
je 0x4ed5b5
dec eax
je 0x4ed5c7
jmp 0x4ed59d
cmp dword [ebp - 0x8c], ecx
jne 0x4ed5c1
push 4
jmp 0x4ed5d7
jbe 0x4ed5c7
push 5
jmp 0x4ed5d7
cmp dword [ebp - 0x90], 5
sbb eax, eax
add eax, 7
leave
ret
push 3
pop eax
leave
ret

Function at 0x4ed5da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x48
mov eax, dword [edi]
mov cl, byte [eax]
mov al, byte [eax + 1]
mov byte [esi + 3], al
mov eax, dword [edi + 8]
mov byte [esi + 2], cl
mov eax, dword [eax]
mov dword [esi + 4], eax
call fcn.004ed677
mov dword [esi + 8], eax
lea ecx, [eax + 0x646c6f47]
mov eax, dword [edi]
mov dword [ebp + 8], ecx
mov dx, word [eax + 2]
xor dx, cx
mov word [esi + 0xc], dx
mov edx, dword [eax + 0x12]
mov edx, dword [edx]
xor edx, ecx
mov dword [esi + 0x110], edx
mov dx, word [eax + 8]
xor dx, cx
mov word [esi + 0xe], dx
mov dl, byte [eax + 0x16]
xor dl, cl
mov byte [esi + 0x114], dl
mov dx, word [eax + 4]
test dx, dx
jbe 0x4ed673
mov edi, dword [eax + 0xe]
push ebx
movzx eax, dx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp + 0xc], eax
mov eax, ebx
push 4
cdq
pop esi
idiv esi
mov al, byte [edx + ebp + 8]
xor al, byte [edi + ebx]
inc ebx
mov byte [ecx], al
inc ecx
dec dword [ebp + 0xc]
jne 0x4ed65a
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4ed6ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add dword [ebp + 0x10], 0x646c6f47
mov eax, dword [eax]
mov dx, word [eax + 6]
test dx, dx
jbe 0x4ed711
push ebx
push esi
mov esi, dword [eax + 0xa]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
lea ecx, [eax + 7]
movzx eax, dx
mov dword [ebp + 8], eax
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx]
mov byte [esi + edi], al
inc edi
inc ecx
dec dword [ebp + 8]
jne 0x4ed6f6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4edbb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4edbca
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x4edbdd
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0x10265db9
Capabilities:
Encode data using xor

Disassembly:
push 0x58910d49
lea esp, [esp + 0x34]
ja 0x1026f18a
jmp 0x102689d7
cmp al, 9
pushfd
jmp 0x101e8adf
cmc
pushfd
bt cx, si
imul edx, edx, 0xa
call fcn.1026a36d
add al, ch
test dword [ecx], ebx
add byte [eax], al
inc esp
jle 0x102689e2
loope 0x10268a61
invalid
push es
sbb byte [ebx], dl
mov ah, 0x3a
insb byte es:[edi], dx
cld
jno 0x10268aa0
add byte [ebp + 0x3dff9d76], 5
loopne 0x10268abb
sbb al, byte [eax + ebp + 0x17]
sub dword [eax], edx
invalid
xchg edi, eax
das
or ebx, ebp
add al, 0x73
push 0x40e7d313
push ds
mov ebp, 0xd77e5463
outsb dx, byte [esi]
ret
sub eax, 0x7da5727f
lds edi, [edx + 0x2efa8a54]
sbb byte [edi - 0x64], 0xc
mov cl, 0xa
dec esi
xchg bl, al
or al, 0
push 0x826038e2
mov dl, 0x89
xchg edx, eax
mov esi, dword [ebp - 0x5832c6a1]
inc edx
sbb ch, al
xchg byte [edx - 0x6660d7d4], ch
insd dword es:[edi], dx
mov bl, 0x5c
xchg edx, eax
mov bh, 0xb9
lds ebx, [ebp - 0x7e9bc201]
mov al, 0x49
push edx
neg byte [0xc3e53ce2]
xor dword [eax + 0x1df65249], 0xc3e53ce2
cmp al, 0xe5
ret
add dword [eax - 0x682dd324], ecx
inc eax
mov edi, 0x84f46ebe
cli
shr dh, 1
xor edx, dword [ebp - 0x65]
je 0x10268af3
sub al, 5
or al, 0x1f
adc eax, 0x93316ad6
push 0x1c856702
adc dword [edx + 0x4a], esp
adc ch, byte [ecx + 0x26f5df97]
bound ebp, qword [eax]
jb 0x10268b8c
in eax, dx
mov edx, 0xab68d884
xor dword [esp + ebp*2], ecx
aas
out dx, al
jmp 0x10268afa
test byte [eax], cl
sal dword [esi + 0x69aae922], cl
pop edx
pushal
not bh
xor byte [esp + edi*8 + 0x3d6ab2ea], cl
in al, dx
cdq
xchg ch, ah
mov esi, 0xf42f4887
add ecx, dword [esi + 0x2b]
mov esp, 0xf46b6fa
insd dword es:[edi], dx
mov bh, 0x71
sti
bound ebp, qword [edi - 0x4a]
ret 0xdd34
Function at 0x1026e67c
Capabilities:
Encode data using xor

Disassembly:
bt esi, esp
clc
call fcn.1026a232
or bl, ch
add eax, 0x179d06dd
fld qword [ebx]
fld qword [ebx]
pop ebp
add al, 0x1d
pop es
sbb eax, 0xdd069d06
add bl, byte [ebp - 0x62f9a2fd]
pop ss
fld qword [esi]
popfd
add al, 0x5d
add bl, ch
add ebx, dword [ebp + 1]
popfd
pop ss
fld qword [ebx]
fld qword [ebx + 0x5d049d05]
add bl, ch
pop ss
fst qword [esi]
popfd
pop es
sbb eax, 0x1d07dd17
add al, 0x1d
add bl, byte [ebp - 0x22f922fc]
pop ss
fld qword [ebx*2 - 0x22fde2fc]
pop ss
fld qword [edi]
pop ebp
push es
popfd
pop ss
fld qword [ebx*8 + 0x1d071d04]
pop es
popfd
add bl, ch
push es
popfd
push es
fst qword [edi]
fld qword [0x175d049d]
fld qword [edx]
fld qword [0x179d06dd]
fld qword [esi]
fld qword [ecx]
popfd
add al, 0x5d
pop es
popfd
add al, 0x9d
add eax, 0x171d079d
fld qword [ebx*8 + 0x5d049d05]
add eax, 0x4dd171d
fld qword [0x35d079d]
pop ebp
pop es
popfd
add ebx, dword [ebp + 1]
popfd
pop ss
fst qword [esi]
popfd
add ebx, dword [0xc739dd1f]
mov dword [esp + 0x44], esi
bsr esi, eax
mov esi, edi
clc
sub esi, eax
mov word [esp], bx
push esi
lea esp, [esp + 0x48]
jo 0x1026100d
rep movsb byte es:[edi], byte [esi]
push 0xf9fb55d6
lea esi, [eax - 0x7771b7d5]
not si
mov esi, dword [esp + 4]
pushfd
mov word [esp + 8], sp
pushfd
lea esp, [esp + 0x10]
jmp fcn.1026aea8
pushfd
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx*4 - 0x6a1ef6b9]
mov esi, dword [esp + 4]
pushfd
push dword [esp + 4]
pushal
lea esp, [esp + 0x30]
jmp fcn.1026aea8
add byte [eax], al
push 0x936885b5
sub al, 0x76
stc
push ebp
test bh, dl
neg al
clc
lea esp, [esp + 0x30]
jle 0x101ef681
cmc
rol al, 5
cmc
clc
shr eax, 1
call fcn.102684cb
add esp, ecx
add dword [edx + ebx], esi
call 0xfc51188
inc dword [ebx]
loope 0x1026e6a5
xor al, 0x1a
sbb al, byte [eax + 0x77]
or dl, ah
inc eax
ja 0x1026e69b
or dl, ah
dec esp
jl 0x1026e67a
daa
cli
scasd eax, dword es:[edi]
or eax, 0x372190d7
aad 0xf7
popfd
dec edx
dec edx
invalid