joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ade0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405aa8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4ade25
test al, 0x10
jne 0x4ade29
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4ae148
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405c90
xor eax, eax
push ebp
push 0x4ae271
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405b7c
je 0x4ae241
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004adda0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040594c
mov eax, dword [ebp - 4]
call fcn.004ade0c
test al, al
jne 0x4ae241
mov eax, dword [ebp - 4]
call fcn.00405ab8
cmp eax, 3
jl 0x4ae241
mov eax, dword [ebp - 4]
call fcn.004ade0c
test al, al
jne 0x4ae241
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004053bc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040a760
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405a98
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405b7c
je 0x4ae241
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004add24
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.004ae148
test al, al
je 0x4ae220
push 0
mov eax, dword [ebp - 4]
call fcn.00405aa8
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4ae224
xor ebx, ebx
jmp 0x4ae226
mov bl, 1
test bl, bl
je 0x4ae241
test si, si
jbe 0x4ae241
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.00405aa8
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae278
lea eax, [ebp - 0x18]
call fcn.004058e8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405158
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405900
ret

Function at 0x4b01c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4b01da
add esp, 0xfffffff0
call fcn.00404558
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.00405c90
xor eax, eax
push ebp
push 0x4b0286
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00404204
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.00405924
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
movzx eax, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x4acefc]
call fcn.004066d4
add esp, 4
mov eax, edi
call fcn.004b001c
test al, al
jne 0x4b0270
call fcn.0040dd30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b028d
lea eax, [ebp + 0x1c]
call fcn.004058e8
ret
Function at 0x4b08f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x4b08f9
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.00405c90
xor eax, eax
push ebp
push 0x4b0b12
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.004adf8c
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.004ae280
mov eax, dword [ebp - 0x14018]
mov edx, 0x4b0b2c
call fcn.00405b7c
jne 0x4b0ae9
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov byte [ebx + 0xa0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.00405aa8
mov ecx, 1
mov edx, 0x80000000
call fcn.004ae344
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0ae2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004ae3d8
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae3d8
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x4b0a57
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.004b08b8
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4b0a53
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
jmp 0x4b0a57
inc esi
dec edi
jne 0x4b0a1e
cmp byte [ebx + 0xa0], 0
jne 0x4b0acb
push ebp
call fcn.004b07c8
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x4b0acb
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae3d8
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.004b08b8
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4b0acb
mov eax, esi
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0ae9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0b19
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.00405900
lea eax, [ebp - 0x14008]
call fcn.004058e8
ret

Function at 0x4b66b0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4e9558]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret
Function at 0x4b66e8
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4b6700
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b66f9
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403a24
xor edx, edx
mov eax, 0x4e9758
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4b6767
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4b671e
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4b69a8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4b69c1
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4b69ba
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4b69d3
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b69cc
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004b65a0
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b69ed
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.004b66b0
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4b6a75
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4b6a93
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004b6630
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b6abd
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b6ad4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4b6aed
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4b6ae6
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4b6b01
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b64a0
test bl, bl
jne 0x4b6bdb
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4f294c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b6b39
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b6b4e
push 0x63
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b69a8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4b6b81
add dword [ebp - 0x14], 0x64
dec dword [ebp - 8]
jne 0x4b6b2e
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b6ba5
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4b6bb7
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b6bcc
jmp 0x4b6c9c
cmp bl, 1
jne 0x4b6c9c
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4f2f28
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b6bfb
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b6c10
push 0x63
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b69a8
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4b6c43
sub ebx, 0x64
inc dword [ebp - 8]
jne 0x4b6bf0
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4b6c6b
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4b6c7d
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4b6c92
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b6520
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4ba90c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ba98b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040531c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4ba9a0
call fcn.0040544c
mov eax, dword [ebp - 4]
call fcn.004055c4
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
je 0x4ba96a
cmp eax, 1
je 0x4ba96a
cmp eax, 3
jne 0x4ba96a
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x5b
jne 0x4ba92a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba992
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405158
ret
Function at 0x4bca94
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4bcb2e
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x4e98ec]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x4e98ec]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x4e98ec]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x4e98ec]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4bcab3
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4bcb44
dec edx
je 0x4bcb79
jmp 0x4bcbca
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4e98ec]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x4e98ec]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4bcbca
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4e98ec]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x4e98ec]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x4e98ec]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4bf164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4bf18e
mov ecx, 0x4bf1f0
mov dl, 1
mov eax, dword [0x4be520]
call fcn.0040dd5c
call fcn.00404aa8
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4bf1dd
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x68]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403170
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4bf19e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bf208
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4bf232
mov ecx, 0x4bf29c
mov dl, 1
mov eax, dword [0x4be520]
call fcn.0040dd5c
call fcn.00404aa8
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4bf28a
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x68]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00403170
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4bf244
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bf858
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bf8da
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4be84c]
mov eax, 0x14
call fcn.004060f0
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409978
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00405188
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x4f2fa0]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x4f2fa0], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf8e1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405158
ret

Function at 0x4bf8e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4bf964
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4be874]
mov eax, 0x10
call fcn.004060f0
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409978
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00405188
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x4f2fa4]
mov dword [ebx], eax
mov dword [0x4f2fa4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf96b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405158
ret

Function at 0x4bf9c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4bf9e1
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bf9ce
pop edi
pop esi
pop ebx
ret
Function at 0x4c1f48
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c1fbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x1400
mov eax, dword [ebp - 8]
call fcn.00402f74
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405134
test esi, esi
je 0x4c1f96
push esi
call sub.kernel32.dll_SetLastError
call fcn.0040f3b4
mov esi, ebx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x190]
lea eax, [esi + 0x194]
call fcn.004c1ebc
mov eax, ebx
call fcn.00402f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1fcf
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d1ed0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d2048
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004d21d4
mov esi, eax
test esi, esi
je 0x4d1f2e
inc dword [ebp - 0x14]
test ebx, ebx
jne 0x4d1f2e
mov eax, dword [edi + 0x38]
mov eax, dword [eax + 0x38]
mov edx, esi
call fcn.004219e0
cmp dword [ebp - 0x18], 0
jle 0x4d1f89
mov dword [ebp - 0x10], esi
inc ebx
mov eax, dword [ebp - 4]
call fcn.00406518
cmp ebx, eax
jl 0x4d1f78
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4d1e88]
call fcn.004066d4
add esp, 4
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4d1eac]
call fcn.004066d4
add esp, 4
mov eax, dword [ebp - 8]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax + ebx*4], edx
jmp 0x4d1fc1
test ebx, ebx
jle 0x4d1fc1
mov eax, dword [ebp - 4]
dec dword [eax + ebx*4]
jmp 0x4d1fa0
dec ebx
test ebx, ebx
jle 0x4d1fa0
mov eax, dword [ebp - 4]
dec dword [eax + ebx*4]
mov eax, dword [ebp - 4]
cmp dword [eax + ebx*4], 0
jne 0x4d1fad
test ebx, ebx
jg 0x4d1f95
test ebx, ebx
jne 0x4d1fb8
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4d1fc1
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x64
cdq
idiv ecx
test edx, edx
jne 0x4d1fe2
mov eax, dword [ebp - 0xc]
call fcn.0041bdc4
push edx
push eax
mov eax, dword [edi + 0x38]
call fcn.004cd244
test esi, esi
jne 0x4d1f03
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x4d2060
call fcn.0040b0e0
mov eax, dword [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, edi
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d204f
lea eax, [ebp - 0x1c]
call fcn.00405134
lea eax, [ebp - 8]
mov edx, dword [0x4d1eac]
call fcn.004067d4
lea eax, [ebp - 4]
mov edx, dword [0x4d1e88]
call fcn.004067d4
ret

Function at 0x4dc5dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
or ecx, 0xffffffff
dec edx
test edx, edx
jb 0x4dc608
inc edx
xor ebx, ebx
mov esi, ecx
shr esi, 8
mov edi, eax
add edi, ebx
xor ecx, dword [edi]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4eb120]
mov ecx, esi
inc ebx
dec edx
jne 0x4dc5ea
mov eax, ecx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x4dd6d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
test eax, eax
je 0x4dd6f9
test edx, edx
je 0x4dd6f9
dec ecx
test ecx, ecx
jb 0x4dd6f9
inc ecx
movzx ebx, byte [eax]
xor bl, 0x9e
movzx ebx, bl
movzx ebx, byte [ebx + 0x4eb520]
xor bl, 0x34
mov byte [edx], bl
inc eax
inc edx
dec ecx
jne 0x4dd6df
pop ebx
ret

Function at 0x4dddbc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 5
push ebx
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x4ebad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
cmp dword [0x4eb6c8], 0
je 0x4dde00
push 1
mov eax, dword [0x4eb6c8]
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 3
mov eax, dword [0x4eb6c8]
push eax
call sub.user32.dll_SendMessageA
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
call sub.user32.dll_SetWindowPos
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x4ebad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
pop ebx
ret

Function at 0x7b6cc1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x4d
test dl, cl
aaa
push ebp
ror bp, 8
mov ebp, esp
and al, dh
test esi, 0xfdad286c
pushfd
sub esp, 0xc
add ah, 0x10
push esi
cwde
push edi
dec al
push ebx
pushfd
rcr ax, 3
cmc
shl ah, 5
mov dword [esp], edx
inc ah
lahf
mov eax, dword [ebp + 8]
clc
pushfd
pushfd
jmp 0x85d302
test eax, eax
mov word [esp + 4], 0xff85
pushal
lea esp, [esp + 0x28]
je fcn.007b6272
rol dx, 0xc
mov si, 0xae88
not esi
bt dx, cx
mov esi, dword [eax + 0x3c]
clc
rol dl, 5
shr dl, cl
movzx edx, cl
add esi, eax
btc dx, cx
cmp cl, 0xcb
mov edx, dword [esi + 0x78]
pushfd
bt ecx, edi
push 0x75ab461a
test edx, edx
mov byte [esp], 5
pushfd
pushal
lea esp, [esp + 0x2c]
je fcn.007b6272
inc cx
add edx, eax
cmc
sal cx, 0xb
xor ecx, 0x378df1aa
mov ecx, dword [esi + 0x7c]
pushfd
add ecx, edx
cmc
bt cx, 0xa
jmp 0x7b2b79