; ═══════════ S U B R O U T I N E ═══════════

; int __fastcall sub_401000(void *a1, int a2)

sub_401000 proc near

var_28  = qword ptr -28h

var_20  = dword ptr -20h

arg_0   = qword ptr  8

  push    rbp

  mov     rbp, rsp

  sub     rsp, 30h

  mov     [rbp+arg_0], rcx

  mov     [rbp+var_20], edx

  mov     rax, [rbp+arg_0]

  mov     rcx, [rax+18h]

  lea     rdx, [rbp+var_28]

  call    rcx

  test    eax, eax

  jnz     short loc_401040

  mov     eax, [rbp+var_20]

  and     eax, 0FFh

  mov     [rbp+var_28], rax

  xor     ecx, ecx

  call    sub_401200

  mov     rsp, rbp

  pop     rbp

  retn

sub_401000 endp

; ═══════════ S U B R O U T I N E ═══════════

; void __fastcall decrypt_buffer(void *buf, size_t len)

sub_401200 proc near

buf     = qword ptr -18h

len     = qword ptr -10h

key     = dword ptr -8

  push    rbp

  mov     rbp, rsp

  sub     rsp, 20h

  mov     [rbp+buf], rcx

  mov     [rbp+len], rdx

  mov     [rbp+key], 5A4Dh

  xor     r8d, r8d

loc_401230:

  cmp     r8, [rbp+len]

  jge     short loc_401260

  mov     rax, [rbp+buf]

  movzx   ecx, byte ptr [rax+r8]

  xor     ecx, [rbp+key]

  mov     [rax+r8], cl

  rol     [rbp+key], 3

  inc     r8

  jmp     short loc_401230

loc_401260:

  mov     rsp, rbp

  pop     rbp

  retn

sub_401200 endp

; ═══════════ S U B R O U T I N E ═══════════

; int __fastcall sub_401000(void *a1, int a2)

sub_401000 proc near

var_28  = qword ptr -28h

var_20  = dword ptr -20h

arg_0   = qword ptr  8

  push    rbp

  mov     rbp, rsp

  sub     rsp, 30h

  mov     [rbp+arg_0], rcx

  mov     [rbp+var_20], edx

  mov     rax, [rbp+arg_0]

  mov     rcx, [rax+18h]

  lea     rdx, [rbp+var_28]

  call    rcx

  test    eax, eax

  jnz     short loc_401040

  mov     eax, [rbp+var_20]

  and     eax, 0FFh

  mov     [rbp+var_28], rax

  xor     ecx, ecx

  call    sub_401200

  mov     rsp, rbp

  pop     rbp

  retn

sub_401000 endp

; ═══════════ S U B R O U T I N E ═══════════

; void __fastcall decrypt_buffer(void *buf, size_t len)

sub_401200 proc near

buf     = qword ptr -18h

len     = qword ptr -10h

key     = dword ptr -8

  push    rbp

  mov     rbp, rsp

  sub     rsp, 20h

  mov     [rbp+buf], rcx

  mov     [rbp+len], rdx

  mov     [rbp+key], 5A4Dh

  xor     r8d, r8d

loc_401230:

  cmp     r8, [rbp+len]

  jge     short loc_401260

  mov     rax, [rbp+buf]

  movzx   ecx, byte ptr [rax+r8]

  xor     ecx, [rbp+key]

  mov     [rax+r8], cl

  rol     [rbp+key], 3

  inc     r8

  jmp     short loc_401230

loc_401260:

  mov     rsp, rbp

  pop     rbp

  retn

sub_401200 endp

// Generated by AIDA decompiler

int __fastcall initialize_session(

    config_t *cfg,

    uint32_t flags)

{

    session_t sess;

    int result;

    memset(&sess, 0, sizeof(sess));

    sess.flags = flags & 0xFF;

    result = cfg->vtable->init(

        &sess, flags);

    if (result != 0)

{

        log_error(

            "init failed: %d",

            GetLastError());

        return -1;

}

    cfg->session = &sess;

    cfg->state |= SESSION_ACTIVE;

    if (flags & FLAG_ENCRYPTED)

{

        setup_crypto_context(&sess);

        sess.crypto_enabled = 1;

}

    return 0;

}

// XREFs: sub_401800, sub_401C00, main

void __fastcall decrypt_buffer(

    void *buf,

    size_t len)

{

    uint32_t key = 0x5A4D;

    for (size_t i = 0; i < len; i++)

{

        ((uint8_t *)buf)[i] ^= key;

        key = _rotl(key, 3);

}

}

// String refs found:

//   "init failed: %d"

//   "session_ctx"

//   "MZ"

// AIDA confidence: 94.2%

// Generated by AIDA decompiler

int __fastcall initialize_session(

    config_t *cfg,

    uint32_t flags)

{

    session_t sess;

    int result;

    memset(&sess, 0, sizeof(sess));

    sess.flags = flags & 0xFF;

    result = cfg->vtable->init(

        &sess, flags);

    if (result != 0)

{

        log_error(

            "init failed: %d",

            GetLastError());

        return -1;

}

    cfg->session = &sess;

    cfg->state |= SESSION_ACTIVE;

    if (flags & FLAG_ENCRYPTED)

{

        setup_crypto_context(&sess);

        sess.crypto_enabled = 1;

}

    return 0;

}

// XREFs: sub_401800, sub_401C00, main

void __fastcall decrypt_buffer(

    void *buf,

    size_t len)

{

    uint32_t key = 0x5A4D;

    for (size_t i = 0; i < len; i++)

{

        ((uint8_t *)buf)[i] ^= key;

        key = _rotl(key, 3);

}

}

// String refs found:

//   "init failed: %d"

//   "session_ctx"

//   "MZ"

// AIDA confidence: 94.2%

IDA Pro Plugin

AI-Powered
Reverse Engineering

Chat with your personal AI assitant. Ask AIDA to decompile functions, trace strings, follow xrefs — full access, one conversation.

See it in action

Ask AIDA anything about your binary.

AIDA — malware.exeConnected

Ask AIDA anything about this binary...

Full binary access through natural conversation.

Ask questions in plain English. AIDA understands context and follows your investigation naturally.

Decompile any function, trace strings, follow cross-references. AIDA navigates the binary autonomously.

Lives inside IDA Pro. Results appear directly in your workflow — no context switching.

Pay with crypto. No subscriptions, no accounts.

Daily

24-hour access

$29.99

Popular

Weekly

7-day access

$99.99

Monthly

30-day access

$299.99

Join the community for support, updates, and discussion.