joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x409888
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x409888
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40983b
test edx, 3
jne 0x40982a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x409835
jmp 0x40983b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40983b
cmp dword [ecx - 8], 1
je 0x409845
mov edx, ebx
or edx, 3
call fcn.00406200
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x409857
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405ab4

Function at 0x409894
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x409924
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x409924
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4098d7
test edx, 3
jne 0x4098c6
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4098d1
jmp 0x4098d7
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4098d7
cmp dword [ecx - 8], 1
je 0x4098e1
mov edx, ebx
or edx, 3
call fcn.00406200
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4098f3
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405ab4

Function at 0x40a180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405f78
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a199
test al, 0x10
je 0x40a19d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a1a4
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405f78
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x40a1b8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405f78
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40a1da
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40d404
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d43d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00405ba4
jmp 0x40d446
mov eax, ebx
mov edx, esi
call fcn.00405b08
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d450
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d472
movzx eax, byte [esp]
jmp 0x40d474
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40db04
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d97c
mov eax, dword [0x4e2ed0]
cmp byte [eax], 0
je 0x40db80
mov eax, dword [0x4e2ac4]
call fcn.0040378c
call fcn.00402e00
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a778
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40dbc8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40dbb6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4e2a48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e67f4]
call fcn.00406f7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x420434
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x18
add esp, 0xfffff004
push eax
dec eax
jne 0x42043d
mov eax, dword [ebp - 4]
add esp, 0xffffff9c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 8], eax
lea esi, [ebp - 0x18065]
xor eax, eax
push ebp
push 0x4205b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1000d]
mov edx, ebx
call fcn.0040a7b4
mov edx, 0x4205c8
lea eax, [ebp - 0x1000d]
call fcn.0040a998
test eax, eax
je 0x4204d7
mov edx, 0x4205c8
lea eax, [ebp - 0x1000d]
call fcn.0040a848
lea eax, [ebp - 0x1000d]
call fcn.0040a778
mov edx, eax
test edx, edx
jl 0x4204c5
inc edx
lea eax, [ebp - 0x1000d]
cmp byte [eax], 0x7c
jne 0x4204c1
mov byte [eax], 0
inc eax
dec edx
jne 0x4204b9
mov edx, 0x4205cc
lea eax, [ebp - 0x800d]
call fcn.0040a7b4
jmp 0x4204f4
mov edx, 0x4205cc
lea eax, [ebp - 0x1000d]
call fcn.0040a7b4
lea eax, [ebp - 0x800d]
mov edx, ebx
call fcn.0040a7b4
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402edc
mov eax, dword [ebp - 4]
call fcn.00405f78
mov edx, eax
lea eax, [ebp - 0x1800d]
call fcn.0040a7b4
mov dword [esi], 0x4c
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
lea eax, [ebp - 0x1000d]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 1
lea eax, [ebp - 0x800d]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xff
xor eax, eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x1800d]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov word [esi + 0x38], 0
mov word [esi + 0x3a], 0
mov eax, 0x4205d0
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x34], 0x81804
push esi
call sub.comdlg32.dll_GetOpenFileNameA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov edx, dword [esi + 0x1c]
mov eax, ebx
call fcn.0040a7b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4205bd
lea eax, [ebp - 4]
call fcn.00405ab4
ret
Function at 0x422dd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, esp
push 0x70
call sub.user32.dll_GetAsyncKeyState
cmp ax, 0x8001
jne 0x422eb4
mov al, 5
call fcn.00422d7c
jmp 0x422eb4
mov ebx, dword [edi + 4]
cmp ebx, 0x100
jb 0x422e09
cmp ebx, 0x109
jbe 0x422e1c
mov esi, dword [edi + 4]
cmp esi, 0x200
jb 0x422e23
cmp esi, 0x20a
ja 0x422e23
mov byte [0x5076d0], 1
cmp dword [edi + 4], 0x12
jne 0x422e2e
call fcn.00422cc0
push edi
mov eax, dword [0x4e2f30]
mov eax, dword [eax]
push eax
mov eax, dword [0x4dcc04]
push eax
call sub.user32.dll_TranslateAcceleratorA
test eax, eax
jne 0x422eae
mov eax, edi
call fcn.00422d20
test al, al
jne 0x422eb4
mov ebp, dword [edi + 4]
cmp ebp, 0x104
je 0x422e64
cmp ebp, 0x112
jne 0x422e6d
cmp byte [0x4dcc20], 0
jne 0x422e8d
cmp dword [edi + 4], 0x112
jne 0x422e7f
cmp byte [0x4dcc24], 0
jne 0x422e8d
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
jmp 0x422eb4
mov dword [edi + 4], 0x111
xor eax, eax
mov dword [edi + 0xc], eax
and dword [edi + 8], 0xffff
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
jmp 0x422eb4
push edi
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x422df6
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x427d4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f68
xor eax, eax
push ebp
push 0x427e1b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b50
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], si
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405f78
mov edx, eax
lea eax, [ebp - 0x15c]
call fcn.0040a7b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x427e05
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeThread
push 0x64
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 8], 0x103
je 0x427dca
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4e2ab8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427e22
lea eax, [ebp - 4]
call fcn.00405ab4
ret
Function at 0x427e2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f68
xor eax, eax
push ebp
push 0x427ed5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b50
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405f78
mov edx, eax
lea eax, [ebp - 0x158]
call fcn.0040a7b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x427ebf
mov ebx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427edc
lea eax, [ebp - 4]
call fcn.00405ab4
ret

Function at 0x428b88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405f78
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x428be0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e3120]
mov dl, 1
mov eax, dword [0x4286ac]
call fcn.0040dce8
call fcn.004054fc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004287b4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x429c98
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x429c9e
ret
Function at 0x434400
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x43442e
mov eax, ebx
call fcn.00434eb4
cmp dword [ebx + 0x40], 0
je 0x434427
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x43449f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x434491
cmp dword [ebx + 8], 0
je 0x434450
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x434462
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x434491
cmp dword [ebx + 8], 0
je 0x434443
cmp eax, 3
je 0x434475
dec eax
jne 0x434443
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x434443
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x434443
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4344bd
cmp dword [ebx + 0x14], 0xcc
je 0x4344bd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004344c8
pop ebx
ret

Function at 0x446118
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x446147
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4461c6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004449d4
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x446194
mov cx, word [esp]
sub cx, si
jmp 0x446196
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x44617d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4461bc
mov cx, word [esp]
sub cx, si
jmp 0x4461be
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4461a5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x446223
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00445dec
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x44620e
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x446223
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x446122
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44c618
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x508924
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x44c63a
shr eax, 1
xor eax, 0xedb88320
jmp 0x44c63c
shr eax, 1
dec edx
jne 0x44c628
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x44c621
mov byte [0x508d24], 1
pop esi
pop ebx
ret

Function at 0x44c658
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x508d24], 0
jne 0x44c66f
call fcn.0044c618
mov eax, edi
dec eax
test eax, eax
jl 0x44c697
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x508924]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x44c679
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x44eedc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45e]
movzx ecx, dl
cmp ecx, 6
ja case.0x44ef76.0
jmp dword [ecx*4 + 0x44ef0f]
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44ef41
sub dl, 8
je 0x44ef50
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eb88
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ebe0
jmp case.0x44ef76.0
movzx ecx, byte [eax + 0x45d]
cmp ecx, 0x10
ja case.0x44ef76.0
movzx ecx, byte [ecx + 0x44ef7d]
jmp dword [ecx*4 + 0x44ef8e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec8c
jmp case.0x44ef76.0
cmp dl, 3
jne 0x44efbb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ece0
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ec9c
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ed24
jmp case.0x44ef76.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44efe6
sub dl, 8
je 0x44eff2
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ed50
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44edbc
jmp case.0x44ef76.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x44f011
sub dl, 8
je 0x44f01d
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44ee78
jmp case.0x44ef76.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x44eea0
mov edx, dword [eax + 0x462]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x44d]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x451]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x449]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x44f0c1
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x49]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0044e108
test eax, eax
je 0x44f0c1
mov eax, ebx
call fcn.0044f0cc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x462]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x44f05a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44f0cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x44f0fd
dec al
je 0x44f138
dec al
je 0x44f17d
dec al
je 0x44f1e6
jmp 0x44f270
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x44f270
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x44f10d
jmp 0x44f270
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f270
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x44f148
jmp 0x44f270
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f270
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x44f1ac
xor ebp, ebp
jmp 0x44f1bc
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x44f1c5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x44f18d
jmp 0x44f270
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x44f270
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x44f23f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0044c6a0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x44f1fa
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x452ae4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f68
xor eax, eax
push ebp
push 0x452c91
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
jmp 0x452b20
lea eax, [ebp - 4]
mov edx, 0x452ca8
call fcn.00405d80
inc esi
mov eax, dword [ebp - 4]
call fcn.00405d74
cmp eax, 3
jl 0x452b12
jmp 0x452b3d
lea eax, [ebp - 4]
mov edx, 0x452ca8
call fcn.00405d80
inc esi
mov eax, dword [ebp - 4]
call fcn.00405d74
mov ecx, 3
cdq
idiv ecx
test edx, edx
jne 0x452b2f
mov eax, edi
call fcn.00405ab4
mov ebx, 1
jmp 0x452c29
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shr eax, 2
and al, 0x3f
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shl eax, 4
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
shr edx, 4
or al, dl
mov byte [ebp - 6], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
add eax, eax
add eax, eax
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx + 1]
shr edx, 6
or al, dl
mov byte [ebp - 7], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx + 1]
and al, 0x3f
mov byte [ebp - 8], al
push dword [edi]
lea eax, [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov ecx, 0x452cb4
movzx edx, byte [ecx + edx]
call fcn.00405c9c
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
movzx edx, byte [ebp - 6]
mov ecx, 0x452cb4
movzx edx, byte [ecx + edx]
call fcn.00405c9c
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
movzx edx, byte [ebp - 7]
mov ecx, 0x452cb4
movzx edx, byte [ecx + edx]
call fcn.00405c9c
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
movzx edx, byte [ebp - 8]
mov ecx, 0x452cb4
movzx edx, byte [ecx + edx]
call fcn.00405c9c
push dword [ebp - 0x18]
mov eax, edi
mov edx, 5
call fcn.00405e38
add ebx, 3
mov eax, dword [ebp - 4]
call fcn.00405d74
sub eax, 2
cmp ebx, eax
jle 0x452b62
test esi, esi
jle 0x452c6e
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x452c51
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
cmp ebx, 1
jl 0x452c6e
mov eax, edi
call fcn.00405fd0
mov byte [eax + ebx - 1], 0x3d
dec esi
test esi, esi
je 0x452c6e
dec ebx
test ebx, ebx
jne 0x452c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452c98
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405ad8
lea eax, [ebp - 4]
call fcn.00405ab4
ret