joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434290
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596678
mov eax, dword fs:[0]
push eax
mov eax, dword [0x61ce74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
add eax, 0xffffff9b
cmp eax, 3
ja case.default.0x4342c3
jmp dword [eax*4 + 0x434484]
cmp dword [0x61b448], ecx
jne 0x43446b
push 0x80000001
call fcn.00435c10
push 0x80000001
call fcn.00436770
add esp, 8
jmp 0x43446b
push 0x80000001
call fcn.004363c0
push 0x5b3ec4
push 0x5b3ec8
push dword [0x61b418]
push 0x80000001
call fcn.0045c310
add esp, 0x14
call fcn.004356e0
mov eax, dword [0x629a0c]
mov ecx, str.th_TH
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43434e
test dx, dx
je 0x43434a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43434e
add eax, 4
add ecx, 4
test dx, dx
jne 0x434328
xor eax, eax
jmp 0x434353
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43446b
cmp dword [0x6299b0], eax
je 0x43446b
push str.Tahoma
push str.FontFace
push dword [0x61b43c]
push 0x80000001
call fcn.0045c310
push 0xde
push str.FontCharSet
push dword [0x61b43c]
push 0x80000001
call fcn.0045c240
add esp, 0x20
jmp 0x43446b
cmp dword [0x61b44c], ecx
jne 0x4343b0
call fcn.00438840
call fcn.00437a00
call fcn.00438330
push str.wpslive
push dword [0x61b3e0]
push 0x80000001
call fcn.0045bde0
push str.wpslive
push dword [0x61b430]
push 0x80000001
call fcn.0045bed0
push 0x80000001
call fcn.00438790
push 0x80000001
call fcn.004385f0
add esp, 0x20
jmp 0x43446b
push str.office6_addonsqingqingbangong.dll
push dword [0x6299c4]
lea eax, [ebp + 8]
push eax
call fcn.004430a0
add esp, 0xc
cmp dword [0x61b448], 0
mov dword [ebp - 4], 0
jne 0x434449
push dword [ebp + 8]
push str.LibPath
push dword [0x61b42c]
push 0x80000001
call fcn.0045c310
push 0x80000001
call fcn.004362a0
add esp, 0x14
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43446b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 1
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4349b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x434b0b
mov eax, dword [ebp - 0x214]
xor esi, esi
test eax, eax
je 0x434a3c
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edi
test esi, esi
jne 0x434b0b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x434ad7
lea esp, [esp]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.004349b0
mov esi, eax
test esi, esi
jne 0x434b0b
lea eax, [ebp - 0x228]
mov dword [ebp - 0x208], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x434a90
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x434aee
push eax
call ebx
mov dword [ebp - 0x214], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x210], 0
call fcn.00434840
mov esi, eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x434b18
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d079
mov esp, ebp
pop ebp
ret 4
Function at 0x4356e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596800
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x61ce74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x629a0c]
mov ecx, str.ja_JP
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435738
test dx, dx
je 0x435734
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435738
add eax, 4
add ecx, 4
test dx, dx
jne 0x435712
xor eax, eax
jmp 0x43573d
sbb eax, eax
or eax, 1
test eax, eax
je 0x435755
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x61b3f8]
mov dword [ebp - 0x10], 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x4358cb
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
mov ebx, 1
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
test eax, eax
je 0x435862
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push str.StartWithType
push eax
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4357e2
cmp eax, 2
jne 0x43585f
lea ecx, [ebp - 0x14]
call fcn.00426010
mov edx, dword [ebp - 0x18]
shr edx, 1
add edx, ebx
js 0x4358c1
mov esi, dword [ebp - 0x14]
mov ecx, ebx
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x435814
push edx
lea ecx, [ebp - 0x14]
call fcn.00426250
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
push str.StartWithType
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x43585f
mov eax, dword [ebp - 0x18]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.0054b2c2
add esp, 8
test eax, eax
js 0x4358c1
cmp eax, dword [esi - 8]
jg 0x4358c1
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], ecx
je 0x43585f
xor edi, edi
jmp 0x435883
mov eax, dword [ebp - 0x10]
xor edi, edi
test eax, eax
je 0x435883
push 4
push 0x5b151c
push 1
push edi
push str.StartWithType
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove edi, ebx
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43589f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4358ad
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00425f50
push 0x80004005
call fcn.00425f50
int3
Function at 0x438e70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x438e85
mov eax, 1
pop edi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push esi
push dword [eax]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x438ebc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x438eb5
mov dword [edi], esi
mov eax, 1
pop esi
pop edi
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x4394d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596be8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
cmp esi, edi
je 0x439619
nop
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x14]
call fcn.00439650
lea eax, [ebp - 0x40]
push eax
call fcn.004397e0
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x439538
mov eax, dword [eax]
push eax
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00439650
lea eax, [ebp - 0x28]
push eax
call fcn.004397e0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x439558
mov eax, dword [eax]
push eax
call fcn.0054b581
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
sete bl
cmp edx, 8
jb 0x4395a0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439596
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439640
push edx
push ecx
call fcn.0053d0af
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x4395f1
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4395e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439640
push edx
push ecx
call fcn.0053d0af
add esp, 8
test bl, bl
je 0x43960b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4395ff
mov eax, dword [esi]
push eax
mov eax, dword [ebp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esi, 0x18
cmp esi, edi
jne 0x439510
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
call fcn.0054b0c3
int3
Function at 0x439a30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596c98
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x234], 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
push 0x20019
push 0
push str.SoftwareKingsoftOfficewpscloudsvr_refs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439c2e
push 0x208
xor edi, edi
mov dword [ebp - 0x238], 0x104
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00540d70
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x238]
add esp, 0xc
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push dword [ebp - 0x234]
call ebx
test eax, eax
jne 0x439c2e
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439b36
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00439df0
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 2
cmp ecx, dword [esi + 8]
je 0x439bad
mov eax, dword [ebp - 0x230]
mov edx, 7
mov dword [ecx], eax
mov eax, dword [ebp - 0x22c]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x224]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x220]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x21c]
mov dword [ecx + 0x14], eax
xor eax, eax
add dword [esi + 4], 0x18
mov word [ebp - 0x230], ax
jmp 0x439bc2
lea eax, [ebp - 0x230]
push eax
push ecx
mov ecx, esi
call fcn.004390f0
mov edx, dword [ebp - 0x21c]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x439bfc
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439bf2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439c62
push edx
push ecx
call fcn.0053d0af
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x104
push eax
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push dword [ebp - 0x234]
call ebx
test eax, eax
je 0x439b10
mov ecx, dword [ebp - 0x234]
test ecx, ecx
je 0x439c44
cmp ecx, 0xffffffff
je 0x439c44
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
call fcn.0054b0c3
int3
Function at 0x43bee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596ef2
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0
xor eax, eax
mov dword [ebp - 4], 0
push 0x208
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x24c], 1
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x43bf8d
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43bf80
jmp 0x43bfdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x43bff2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43bff2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43bfd0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00439df0
push str._version.dll
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00438f40
mov edx, dword [ebp - 0x21c]
add esp, 0xc
cmp edx, 8
jb 0x43c04d
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43c043
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c0ee
push edx
push ecx
call fcn.0053d0af
add esp, 8
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x5b6dd8
push edi
call esi
push 0x5b6de8
push edi
mov dword [0x629a18], eax
call esi
push 0x5b6dfc
push edi
mov dword [0x629a1c], eax
call esi
mov edx, dword [ebp - 0x234]
mov dword [0x629a20], eax
cmp edx, 8
jb 0x43c0d3
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43c0c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c0f3
push edx
push ecx
call fcn.0053d0af
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
call fcn.0054b0c3
call fcn.0054b0c3
int3
Function at 0x43d1b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x43d1c7
cmp esi, 0x20
jne 0x43d39b
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x43d39a
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x43d232
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x43d205
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x43d31a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x43d2b0
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x5b6d28]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x5b4b28]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x5b4b28]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + 0x5b4b28]
xor esi, eax
movzx ebx, byte [ebx + 0x5b4b28]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x43d2fd
cmp esi, 6
jbe 0x43d2fd
cmp edx, 4
jne 0x43d2fd
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5b4b28]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5b4b28]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x5b4b28]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x5b4b28]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x43d250
xor esi, esi
sub ecx, 1
js 0x43d399
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x43d389
cmp ecx, 4
jb 0x43d389
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5b4b28]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5b6128]
movzx eax, byte [eax + 0x5b4b28]
xor edx, dword [eax*4 + 0x5b6528]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5b4b28]
xor edx, dword [eax*4 + 0x5b5d28]
movzx eax, bl
movzx eax, byte [eax + 0x5b4b28]
xor edx, dword [eax*4 + 0x5b6928]
mov eax, dword [ebp + 8]
jmp 0x43d38b
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x43d327
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43d6f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x43d8c8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x43d8c8
test bl, 3
jne 0x43d8c8
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x43d73a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x43d8c8
cmp byte [eax], 0x3d
je 0x43d727
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x43d8bd
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x43d762
sub al, 0x41
jmp 0x43d791
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x43d76e
sub al, 0x47
jmp 0x43d791
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x43d77a
add al, 4
jmp 0x43d791
cmp al, 0x2b
jne 0x43d782
mov al, 0x3e
jmp 0x43d791
cmp al, 0x2f
jne 0x43d78a
mov al, 0x3f
jmp 0x43d791
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x43d7a1
sub dl, 0x41
jmp 0x43d7d5
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x43d7ae
sub dl, 0x47
jmp 0x43d7d5
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x43d7bb
add dl, 4
jmp 0x43d7d5
cmp dl, 0x2b
jne 0x43d7c4
mov dl, 0x3e
jmp 0x43d7d5
cmp dl, 0x2f
jne 0x43d7cd
mov dl, 0x3f
jmp 0x43d7d5
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x43d7e4
sub bl, 0x41
jmp 0x43d818
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x43d7f1
sub bl, 0x47
jmp 0x43d818
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x43d7fe
add bl, 4
jmp 0x43d818
cmp bl, 0x2b
jne 0x43d807
mov bl, 0x3e
jmp 0x43d818
cmp bl, 0x2f
jne 0x43d810
mov bl, 0x3f
jmp 0x43d818
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x43d82a
sub ah, 0x41
jmp 0x43d862
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x43d839
sub ah, 0x47
jmp 0x43d862
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x43d848
add ah, 4
jmp 0x43d862
cmp ah, 0x2b
jne 0x43d851
mov ah, 0x3e
jmp 0x43d862
cmp ah, 0x2f
jne 0x43d85a
mov ah, 0x3f
jmp 0x43d862
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x43d8c8
cmp dl, 0xff
je 0x43d8c8
cmp bl, 0xff
je 0x43d8c8
cmp ah, 0xff
je 0x43d8c8
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x43d753
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43db80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x43dcf3
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x43dcf3
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x43dcec
xor eax, eax
test ebx, ebx
je 0x43dc50
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + 0x5b6d78]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x5b6d78]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + 0x5b6d78]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x5b6d78]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x43dbe0
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x43dcb7
sub ecx, 1
jne 0x43dce9
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + 0x5b6d78]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x5b6d78]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + 0x5b6d78]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + 0x5b6d78]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + 0x5b6d78]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret