joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.0041be60
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x950], 0
jne 0x418f61
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.0041a980
add esp, 0x18
mov dword [esi + 0x950], eax
test eax, eax
je 0x419070
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x418f89
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x418f80
inc eax
cmp byte [eax], 0
jne 0x418f70
jmp 0x418f89
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x4f3cb0]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041bde0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x950]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.0041a9f0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x41906f
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x4f3c70]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.0041aa70
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x419012
push ebx
push esi
call fcn.0041abd0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.0041c0b0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041c0b0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.0041aaf0
add esp, 0x18
test eax, eax
jle 0x41905b
cmp dword [ebp + 0x1c], 0
je 0x41905b
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.0041abd0
push ebx
push esi
call fcn.0041abd0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x954]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
dec ecx
outsb dx, byte [esi]
je 0x41aa06

Function at 0x41a9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x958]
Function at 0x41aa70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aadf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41aaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ab53
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41abbf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41abd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ac26
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b476
cmp dword [esi + 0x18], 0
je 0x41b491
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b46e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b450
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b491
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41b491
cmp eax, ecx
je 0x41b46e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41b484
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b4a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b4f8
cmp dword [esi + 0x18], 0
je 0x41b4f8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b500
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b4e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b568
cmp dword [esi + 0x18], 0
je 0x41b568
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b570
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b550
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x41b664
cmp dword [eax + 0x18], 0
je 0x41b664
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x41b657
mov esp, ebp
pop ebp
ret
Function at 0x41b670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041be60
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41b6fb
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041c480
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00414df0
add esp, 0x10
test eax, eax
jne 0x41b703
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b6d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41bb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41bb4e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bb4a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x41bb4a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x41bb90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41bbb4
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41bbb4
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x41bbbc
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041bf90
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041be10
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041bde0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x41bc4e
mov dword [ebp + 0xc], edx
jmp 0x41bbf9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x41bc10
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x41bc26
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x41bc33
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041bde0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41bbf7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41bc80
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41bc80
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x41bc84
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x41bd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41bd20
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bd20
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41bd24
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41bd20
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41ca00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41cc3c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041be60
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41cbcc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41cbc2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0040abf0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41cbed
inc eax
cmp byte [esi + eax], 0
jne 0x41cbe6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041bde0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41cc0a
inc edi
cmp byte [edi + ebx], 0
jne 0x41cc03
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41cc1a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41cc12
test esi, esi
je 0x41cc2f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041be30
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43b480
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489bce
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4aca0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [ebp - 4], 0
mov eax, 0xaaaaaaab
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], 1
lea ecx, [edi + 2]
mul ecx
mov ecx, dword [ebp - 0x10]
shr edx, 1
shl edx, 2
push edx
call fcn.0043cfb0
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [ebp - 0x14], eax
cmp dword [eax + 0x14], 0x10
jb 0x43b51f
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
mov dword [ebp - 0x20], edx
je 0x43b594
mov edi, edx
nop
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movsx eax, byte [esi]
movzx edx, byte [esi + 1]
and eax, 3
add eax, eax
shr edx, 4
movzx eax, byte [edx + eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movsx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
movzx eax, byte [eax + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movsx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
sub edi, 1
jne 0x43b530
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
lea eax, [edx + edx*2]
sub edi, eax
sub edi, 1
je 0x43b5e4
sub edi, 1
jne 0x43b60f
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movsx eax, byte [esi]
movzx edx, byte [esi + 1]
and eax, 3
add eax, eax
shr edx, 4
movzx eax, byte [edx + eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movsx eax, byte [esi + 1]
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x43b60c
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movsx eax, byte [esi]
and eax, 3
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
add ecx, 4
sub ecx, dword [ebp - 0x14]
push 0
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0043cfb0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43bc20
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489dbe
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4aca0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x10]
shr eax, 2
push 0
mov dword [ebp - 0x24], 1
lea eax, [eax + eax*2]
push eax
call fcn.0043cfb0
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
jb 0x43bcbf
mov edi, dword [edi]
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov dword [ebp - 0x20], esi
jb 0x43bccf
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
xor esi, esi
mov dword [ebp - 0x1c], eax
test ecx, ecx
je 0x43bda4
mov eax, dword [ebp - 0x18]
mov dh, byte [ebp - 0x16]
dec ecx
mov dword [ebp - 0x28], ecx
mov cl, byte [edi]
cmp cl, 0x3d
je 0x43bd54
movzx ecx, cl
mov cl, byte [ecx + 0x49df40]
cmp cl, 0xff
je 0x43bd54
mov byte [ebp + esi - 0x18], cl
inc edi
mov eax, dword [ebp - 0x18]
inc esi
mov dh, byte [ebp - 0x16]
cmp esi, 4
jne 0x43bd4d
mov esi, dword [ebp - 0x1c]
mov dl, ah
shr dl, 4
mov cl, al
and dl, 3
shl cl, 2
add dl, cl
mov cl, ah
mov byte [ebp - 0x14], dl
mov dl, dh
shr dl, 2
and dl, 0xf
shl cl, 4
add dl, cl
mov byte [ebp - 0x13], dl
mov dl, dh
mov cx, word [ebp - 0x14]
shl dl, 6
add dl, byte [ebp - 0x15]
mov word [esi], cx
mov byte [esi + 2], dl
add esi, 3
mov dword [ebp - 0x1c], esi
xor esi, esi
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x43bce2
test esi, esi
je 0x43bda1
mov dl, ah
mov cl, al
shl cl, 2
mov al, ah
shr dl, 4
dec esi
and dl, 3
shl al, 4
add dl, cl
mov cl, dh
shr cl, 2
and cl, 0xf
shl dh, 6
add dh, byte [ebp - 0x15]
add cl, al
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], cl
mov byte [ebp - 0x12], dh
test esi, esi
jle 0x43bda1
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call fcn.0047e050
mov eax, dword [ebp - 0x1c]
add esp, 0xc
add eax, esi
jmp 0x43bda4
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
push 0
push eax
call fcn.0043cfb0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x442520
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c7de
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x34
mov eax, dword [0x4aca0c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], edx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x44264b
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push 0
push dword [ebp - 0x34]
call fcn.0043cfb0
push dword [ebp - 0x34]
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0047e050
add esp, 0xc
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x2c], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 4], 2
mov byte [esi + 0x18], 1
mov byte [ebp - 4], 1
mov dword [ebp - 0x40], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0043a900
jmp 0x44265d
mov byte [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047c239
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret