joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b793
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x454070]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x4419df
call fcn.0042a441
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x238]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.0042b7e0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x234], 1
jne 0x41b7ff
push str.projonepodlp
jmp 0x41b80d
cmp dword [ebp + 0x234], 2
jne 0x41b82c
push str.projonepotcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, ebx
je 0x41b826
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
push eax
jmp 0x41b87f
cmp dword [ebp + 0x234], ebx
jne 0x41b87a
push ebx
lea eax, [ebp]
push 2
push eax
call fcn.0041b793
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x41b852
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
test eax, eax
je 0x41b876
push 2
push edi
call fcn.0041b793
add esp, 0xc
push ebx
push 1
lea esi, [ebp]
call fcn.00401828
jmp 0x41b886
push 1
jmp 0x41b860
push 0x448bb0
mov esi, edi
call fcn.004015bd
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.004291e7
add ebp, 0x228
leave
ret
Function at 0x41cb36
Capabilities:
Delete file
Get file size

Disassembly:
push 0x2ac
mov eax, 0x44317c
call fcn.0042a4aa
xor edi, edi
push edi
push dword [0x458730]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x41cbb3
push 0x2d
push edi
mov esi, 0x458734
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
xor ecx, ecx
mov word [eax], cx
inc dword [0x45893c]
push dword [0x45893c]
lea eax, [ebp - 0x90]
push str.__d.log
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [0x458730]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x458730], 0xffffffff
xor eax, eax
push 0x206
mov word [ebp - 0x298], ax
lea eax, [ebp - 0x296]
push edi
push eax
call fcn.0042b7e0
add esp, 0xc
push 1
lea eax, [ebp - 0x298]
push eax
call fcn.0041c93a
lea eax, [ebp - 0x2b0]
push eax
call fcn.0040eaa0
push edi
push edi
lea eax, [ebp - 0x2b8]
push eax
push 0x41cac2
push edi
lea eax, [ebp - 0x298]
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2b8], edi
mov dword [ebp - 0x2b4], edi
call fcn.0040b1ee
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0x2a4]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 0x64
ja 0x41cc40
cmp dword [ebp - 0x2b4], edi
ja 0x41cc40
cmp dword [ebp - 0x2b8], 0x3200000
jbe 0x41cc7b
cmp eax, 0x14
jbe 0x41cc4a
push 0xa
pop ebx
jmp 0x41cc51
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp ebx, edi
jle 0x41cc7b
push edi
lea esi, [ebp - 0x2b0]
call fcn.0040d481
cmp dword [eax + 0x18], 8
jb 0x41cc6c
mov eax, dword [eax + 4]
jmp 0x41cc6f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, ebx
jl 0x41cc55
lea esi, [ebp - 0x2b0]
call fcn.004031a5
push dword [ebp - 0x2b0]
call fcn.00429220
pop ecx
call fcn.0042a52d
ret
Function at 0x41d3f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x4054db
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x41d42b
push dword [ebp + 8]
push dword [ebp - 4]
push str.thread__d_created:__s
push esi
call sym.poda32.exe_E7248971
add esp, 0x10
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x41d84e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
test esi, esi
je 0x41d85e
and dword [esi], 0
and dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0x1001
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
test eax, eax
je 0x41d889
mov ecx, dword [ebp + 0x10]
push str.open_file_failed
call fcn.0040315d
jmp 0x41d8da
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 8]
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0041d531
pop ecx
pop ecx
mov byte [esp + 7], al
test esi, esi
je 0x41d8b2
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [esp + 7], 0
je 0x41d8d1
cmp dword [esp + 0xc], 0xc8
jne 0x41d8d1
mov al, 1
jmp 0x41d8dc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x41d944
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44241a
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x454070]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
mov eax, dword [0x454070]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x41d9ee
push edi
lea ecx, [esp + 0x20]
call fcn.00402e17
lea eax, [esp + 0x1c]
mov dword [esp + 0xc8], esi
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], ebx
call fcn.0040117f
cmp dword [eax + 0x18], 8
pop ecx
mov dword [esp + 0x10], 3
jb 0x41d9dc
mov eax, dword [eax + 4]
jmp 0x41d9df
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [esp + 0xf], bl
test eax, eax
je 0x41d9f3
mov byte [esp + 0xf], 0
test byte [esp + 0x10], 2
je 0x41da0a
and dword [esp + 0x10], 0xfffffffd
push esi
push ebx
lea esi, [esp + 0x40]
call fcn.00401828
or dword [esp + 0xc8], 0xffffffff
test byte [esp + 0x10], bl
je 0x41da24
push 0
push ebx
lea ecx, [esp + 0x24]
call fcn.00401730
cmp byte [esp + 0xf], 0
je 0x41da2f
xor al, al
jmp 0x41da89
lea esi, [esp + 0x58]
call fcn.00401543
lea esi, [esp + 0x74]
call fcn.00401543
lea esi, [esp + 0x90]
call fcn.00401543
push dword [esp + 0x18]
lea ecx, [esp + 0x5c]
mov dword [esp + 0xcc], ebx
call fcn.0040315d
push edi
mov ecx, esi
mov byte [esp + 0x58], bl
call fcn.0040315d
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x54]
push eax
add esi, 0x3c
call fcn.0041e54b
lea esi, [esp + 0x54]
call fcn.0041dbff
mov al, bl
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.004291e7
mov esp, ebp
pop ebp
ret 8
Function at 0x41f36c
Capabilities:
Delete registry value

Disassembly:
push 0x40
mov eax, 0x4422a2
call fcn.0042a4aa
mov esi, ecx
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x458a60
push str._hs__d._d
lea ecx, [ebp - 0x2c]
call fcn.0040ccac
add esp, 0x10
cmp dword [ebp + 8], 0
mov byte [ebp - 4], 1
je 0x41f3f0
lea eax, [ebp + 0x10]
push eax
push esi
push str.dispatching_message__hs_to__hs
lea ecx, [ebp - 0x48]
call fcn.0040ccac
mov esi, dword [ebp - 0x44]
add esp, 0xc
cmp dword [ebp - 0x30], 8
jae 0x41f3cc
lea esi, [ebp - 0x44]
cmp dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x28]
jae 0x41f3d8
lea ebx, [ebp - 0x28]
mov edi, 0x458b68
call fcn.0040cd76
push 0
push 1
lea esi, [ebp - 0x48]
call fcn.00401828
jmp 0x41f40d
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41f3fc
lea eax, [ebp - 0x28]
push eax
push 0x458b68
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00401828
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0x114]
push eax
call fcn.00408556
call fcn.0042a52d
ret
Function at 0x4216fa
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x442b20
call fcn.0042a4aa
lea eax, [ebp - 0x5c]
push eax
mov esi, ecx
call fcn.00405902
and dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jmp 0x421764
lea esi, [ebp - 0x38]
call fcn.00426fc5
cmp dword [eax + 0x18], 8
jb 0x42173d
mov eax, dword [eax + 4]
jmp 0x421740
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42175c
lea esi, [ebp - 0x38]
call fcn.00426fc5
push eax
lea eax, [ebp - 0x5c]
call fcn.00405951
lea esi, [ebp - 0x38]
call fcn.004270ce
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x38]
call fcn.0040d464
test al, al
jne 0x42172a
cmp dword [ebp - 0x44], 0
jne 0x421797
mov esi, 0x44e
lea edi, [ebp - 0x5c]
call fcn.004059f3
push dword [ebp - 0x5c]
call fcn.00429220
pop ecx
mov eax, esi
call fcn.0042a52d
ret
mov edi, ebx
call fcn.0040b426
mov esi, ebx
call fcn.0040b99d
push ebx
push 0x44b40c
push 0x44b410
lea ecx, [ebp - 0x30]
call fcn.0040ccac
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
jmp 0x421823
lea esi, [ebp - 0x38]
call fcn.00426fc5
cmp dword [eax + 0x18], 8
jb 0x4217e8
mov eax, dword [eax + 4]
jmp 0x4217eb
add eax, 4
push eax
push str.___s_
lea ecx, [ebp - 0x78]
call fcn.0040ccac
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0040dbe5
push 0
push 1
lea esi, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00401828
lea esi, [ebp - 0x38]
call fcn.004270ce
lea edi, [ebp - 0x40]
lea esi, [ebp - 0x38]
call fcn.0040d464
test al, al
jne 0x4217d5
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x421860
push 0x44b434
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x421860
push str.__md1M
lea eax, [ebp - 0x30]
push eax
call fcn.0040d2e3
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x60], 0xf
call fcn.004019d2
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x421881
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x78]
push ecx
push eax
call fcn.00421693
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x78]
mov edi, eax
call fcn.00401730
test edi, edi
je 0x4218a6
mov esi, ebx
call fcn.0040b99d
push 0
push 1
lea esi, [ebp - 0x30]
call fcn.00401828
mov esi, edi
jmp 0x42177e
Function at 0x421c88
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x454070]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x140], 0
push esi
push edi
push 0x3f
lea eax, [ebp - 0x4b]
push 0
push eax
mov esi, ecx
mov edi, edx
mov byte [ebp - 0x4c], 0
call fcn.0042b7e0
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push edi
push eax
call fcn.0042b860
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x4c]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x8c], dl
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x40
jb 0x421ccb
lea eax, [ebp - 0x13c]
call fcn.00425dcf
lea eax, [ebp - 0x8c]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.00425e13
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425e13
lea edi, [ebp - 0x6c]
call fcn.00425e51
lea eax, [ebp - 0x13c]
call fcn.00425dcf
lea eax, [ebp - 0xcc]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.00425e13
mov eax, edi
push 0x20
push eax
lea eax, [ebp - 0x13c]
call fcn.00425e13
add esp, 0x20
lea edi, [ebp - 0x2c]
call fcn.00425e51
push 0x20
mov eax, edi
push eax
call fcn.0040d29c
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004291e7
leave
ret

Function at 0x422858
Capabilities:
Delete registry value

Disassembly:
push 0x34
mov eax, 0x44439d
call fcn.0042a441
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
mov edi, 0x458d88
push edi
xor ebx, ebx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x44b474
push bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x40]
push eax
call fcn.0040eaa0
push ebx
mov dword [ebp - 4], ebx
call esi
lea edi, [ebp - 0x40]
mov esi, eax
call fcn.004221da
test eax, eax
jne 0x4228c7
mov esi, edi
call fcn.0040186f
push dword [ebp - 0x40]
call fcn.00429220
pop ecx
xor eax, eax
call fcn.0042a519
ret
lea ecx, [ebp - 0x40]
call fcn.004227ad
cmp dword [0x4592d0], ebx
jne 0x4228ec
lea esi, [ebp - 0x40]
call fcn.0040186f
push dword [ebp - 0x40]
call fcn.00429220
pop ecx
mov eax, ebx
jmp 0x4228c1
mov eax, dword [0x4592cc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4592b4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4592cc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4592b4]
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call fcn.00420be0
test al, al
jne 0x42293a
call fcn.0040dbba
add eax, 0x1c
push eax
push 0x45927c
lea ebx, [ebp - 0x28]
call fcn.00404695
call fcn.0040904e
jmp 0x4228fe
xor ebx, ebx
inc ebx
jmp 0x4228d7
Function at 0x423a92
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x20a0]
mov eax, 0x2120
call fcn.00434be0
mov eax, dword [0x454070]
xor eax, ebp
mov dword [ebp + 0x209c], eax
mov eax, dword [ebp + 0x20a8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x1fff
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x63]
mov esi, ecx
push ebx
mov dword [ebp - 0x6c], ebx
push eax
mov dword [ebp - 0x70], esi
mov edi, edx
mov byte [ebp - 0x64], bl
call fcn.0042b7e0
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push 0x2000
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x423be1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.VarFileInfoTranslation
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueW
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
test eax, eax
je 0x423b89
test dword [ebp - 0x68], 0xfffffffc
mov esi, dword [ebp - 0x7c]
mov dword [ebp - 0x74], ebx
jbe 0x423b89
mov eax, dword [ebp - 0x74]
push dword [ebp - 0x80]
shl eax, 2
movzx ecx, word [eax + esi + 2]
movzx eax, word [eax + esi]
push ecx
push eax
push str.StringFileInfo_04x_04x_s
lea eax, [ebp + 0x1f9c]
push 0x80
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f9c]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x423c05
mov eax, dword [ebp - 0x68]
inc dword [ebp - 0x74]
shr eax, 2
cmp dword [ebp - 0x74], eax
jb 0x423b2b
mov dword [ebp - 0x78], 0x40904b0
mov dword [ebp - 0x74], 0x40904e4
xor esi, esi
push dword [ebp - 0x80]
lea eax, [ebp + 0x1f9c]
push dword [ebp + esi*4 - 0x78]
push str.StringFileInfo_08x_s
push 0x80
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f9c]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x423c05
inc esi
cmp esi, 2
jb 0x423b99
mov esi, dword [ebp - 0x70]
push 0x448bb0
call fcn.004015bd
mov eax, esi
mov ecx, dword [ebp + 0x209c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004291e7
add ebp, 0x20a0
leave
ret
push dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x70]
call fcn.00423a2c
pop ecx
mov eax, edi
jmp 0x423bed

Function at 0x4253d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x4253ea
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x4253e6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425505
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x454070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.004256cb
mov bl, al
mov al, dl
call fcn.004256cb
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.004256cb
mov bl, al
mov al, byte [esi - 4]
call fcn.004256cb
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.004256cb
mov bl, al
mov al, byte [esi]
call fcn.004256cb
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.004256cb
mov bl, al
mov al, byte [esi - 0xc]
call fcn.004256cb
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x42552d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004291e7
leave
ret 4

Function at 0x4255ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x454070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.00425747
push ebx
mov dl, al
call fcn.00425720
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.004256db
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.004256f9
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.004256db
push ebx
mov byte [ebp - 0x15], al
call fcn.004256f9
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.00425720
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.00425747
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.00425720
mov bl, al
mov al, byte [edi + 4]
call fcn.00425747
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.004256f9
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.004256db
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.004256f9
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.004256db
xor bl, al
mov al, dl
call fcn.00425747
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.00425720
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x4255e6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004291e7
leave
ret 4
Function at 0x425962
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x441802
call fcn.0042a4aa
mov ebx, ecx
mov eax, dword [ebp + 8]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x14]
mov esi, edx
mov dword [ebp - 0x34], esi
test al, 0xf
je 0x425997
push 0x448c8e
mov ecx, esi
call fcn.00402e17
jmp 0x425ab7
push 0
mov edi, eax
lea esi, [ebp - 0x2c]
call fcn.004155cb
and dword [ebp - 4], 0
cmp dword [ebx + 0x18], 0x10
mov eax, dword [ebx + 0x14]
jb 0x4259b5
mov ebx, dword [ebx + 4]
jmp 0x4259b8
add ebx, 4
cmp dword [ebp - 0x14], 0x10
mov esi, dword [ebp - 0x28]
jae 0x4259c4
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 0xc]
cmp eax, 0x10
jb 0x425a0f
shr eax, 4
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx + 0x18], 0x10
mov ecx, dword [edx + 0x14]
lea eax, [edx + 4]
jb 0x4259e3
mov eax, dword [eax]
push 0
push eax
push esi
push ebx
call fcn.0042591c
add esp, 0x10
mov ecx, edi
push 0x10
mov eax, esi
sub ecx, esi
pop edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x4259f9
mov edi, ebx
add ebx, 0x10
add esi, 0x10
dec dword [ebp - 0x38]
jne 0x4259d2
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jae 0x425a38
mov ecx, dword [ebp - 0x34]
push 0x448c8e
call fcn.00402e17
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401730
mov eax, dword [ebp - 0x34]
jmp 0x425ab9
lea esi, [eax - 1]
cmp eax, esi
ja 0x425a47
call fcn.004291af
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x425a53
lea ecx, [ebp - 0x28]
mov bl, byte [ecx + esi]
cmp bl, 0x10
ja 0x425a17
mov byte [ebp - 0x2d], 0
test bl, bl
jbe 0x425a97
movzx edi, bl
movzx ecx, byte [ebp - 0x2d]
mov esi, eax
sub esi, ecx
dec esi
cmp eax, esi
ja 0x425a7b
call fcn.004291af
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x425a87
lea ecx, [ebp - 0x28]
movsx ecx, byte [ecx + esi]
cmp ecx, edi
jne 0x425a17
inc byte [ebp - 0x2d]
cmp byte [ebp - 0x2d], bl
jb 0x425a66
mov esi, dword [ebp - 0x34]
movzx ecx, bl
sub eax, ecx
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0041bfde
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401730
mov eax, esi
call fcn.0042a52d
ret
Function at 0x425abf
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x4412de
call fcn.0042a4aa
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x425ade
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.004019d2
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x425be3
jmp 0x425b0f
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x44a100]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x425b23
cmp al, 0xff
je 0x425b0f
cmp al, 0xff
je 0x425be3
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x44a100]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x425b43
cmp cl, 0xff
je 0x425b2b
cmp cl, 0xff
je 0x425be3
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.0040d6f8
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x425be3
movsx eax, al
mov al, byte [eax + 0x44a100]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x425b83
cmp al, 0xff
je 0x425b63
cmp al, 0xff
je 0x425be3
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.0040d6f8
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x425be3
movsx eax, al
mov cl, byte [eax + 0x44a100]
cmp esi, dword [ebp - 0x30]
jae 0x425bc1
cmp cl, 0xff
je 0x425ba3
cmp cl, 0xff
je 0x425be3
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.0040d6f8
cmp esi, dword [ebp - 0x30]
jb 0x425b0c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.00402e39
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401730
mov eax, dword [ebp - 0x38]
call fcn.0042a52d
ret