joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ec0
Capabilities:
Encode data using xor

Disassembly:
push cs
add byte [edi], bh
pop esi
jg 0x414e1f
jno 0x414ea6
retf
lea edx, [ecx + 0x1c]
jg 0x414e38
xor eax, 0x95a1ff11
add edi, edi
jg 0x414ec8
xchg ebp, eax
add dword [edi + 0x14], edi
xchg ecx, eax
add dword [ecx + 0x5c], edx
mov edi, 0xf5a1ff72
cmc
cmc
mov eax, dword [0xbf30bf6f]
xor byte [ecx], dh
sub bh, byte [edi + 0x1610230]
jbe 0x414e8c
xor byte [edx], al
popal
add dword [esi - 0x44], esi
jae 0x414eca
push ecx
mov cs, word [esi - 0x61]
mov ebx, 0x342bb9f
inc eax
add bh, bh
add byte cs:[ebx + ebp*2 - 0x59], ah
dec esi
rcl dword [ebp + eax + 0x53], 0
sub edx, dword [eax + eax + 0x4e]
sub cl, byte [esi + 0x16]
bound eax, qword [ecx]
push ecx
add ch, ah
dec esi
or cl, byte [esi - 0x7c]
jbe 0x414f06
or byte [esi + 0x17], 0x52
adc ecx, dword [esi + 0x29]
push edx
mov edi, 0xb53f5fa0
jg 0x414f62
aas
mov ch, 0x7f
pop eax
adc dword [esi], ecx
aas
adc edi, edi
test dword [edi], esi
push eax
xchg dword [edi + edi*8], ebp
adc byte [ebp + 0x43ff27bf], dh
xchg ecx, eax
xchg esi, eax
int1
wait
fbld tbyte [edi]
fbld tbyte [edi]
adc ecx, dword [edi]
push ecx
push cs
jmp dword [edi]
add esi, dword [eax]
adc al, 0x56
adc ch, dl
pop edi
add byte [eax], ah
push esi
add byte [ebp], al
push edx
nop
add byte [ecx], cl
or byte [edi], 0x4e
add byte [edi], bl
dec ecx
push eax
add byte [esi], al
inc esi
mov al, 0
mov cl, 0x16
mov ebp, 0xfeef04
rol byte [eax], 1
add dword [eax], eax
add dh, byte [eax]
add byte [eax + eax], al
add dword [ebp], esi
mov esi, 0x3001c117
add byte [ebx], dh
add esp, eax
add byte [eax + eax - 0x4a], ah
shr byte [edx + ebx], 1
invalid
Function at 0x428e20
Capabilities:
Encode data using xor

Disassembly:
arpl word [eax + 0x6ead81c3], cx
lodsd eax, dword [esi]
outsb dx, byte [esi]
daa
or al, byte [ebx + 0x43]
pop es
push esi
mov esi, dword [eax - 0x41]
jns 0x428dd7
out 0xd1, al
ret 0xb85
push ebx
leave
push 3
or eax, 0x265bdbc0
push eax
in eax, 0xae
pop ecx
aam 0x52
xchg esi, eax
lodsd eax, dword [esi]
cmp dword [esi - 0x62], ebp
mov bh, 0xb7
dec eax
sub al, 0xee
scasb al, byte es:[edi]
scasb al, byte es:[edi]
add ah, al
pop eax
xor esi, dword [ebx]
xor bl, byte [esi]
xor esp, dword [esi + 0x57d89581]
daa
loope 0x428dd3
cmp bh, dl
sbb byte [ebx], bl
sbb dword [ebp - 0x31], edx
pushal
in eax, 0xcc
outsd dx, dword [esi]
xchg dword [edi - 0x26934494], eax
xor bh, byte [edx]
jbe 0x428e2b
int3
test al, 6
dec esp
sar esp, 0x8f
xor eax, 0x595b3ae0
cwde
lodsd eax, dword [esi]
out 0xb8, al
jl 0x428df7
neg esp
mov ecx, 0x8dada002
or eax, 0x24b4b44d
lodsd eax, dword [esi]
lea ecx, [0x24b4b44d]
jae 0x428eaa
push ebx
xor bl, byte [edx]
cmp eax, 0x24ebcfa
in al, 0x84
mov cl, 0x63
repne movsb byte es:[edi], byte [esi]
dec ecx
in al, 0xc5
stosb byte es:[edi], al
add eax, eax
lds ecx, [ebx - 0x79dd2ce9]
sbb byte [esi], dl
sbb cl, byte [edx - 0x7b]
test dword [ebp + 0x7175301a], eax
rcl dword [esp + esi*4 - 0x4c]
jno 0x428e4e
push esp
mov ah, 0xb4
aas
in eax, 0xcf
jns 0x428ee4
add ecx, dword [esi]
push eax
mov edx, dword [edi + 0xe]
mov eax, dword [0x9af3f4c6]
jecxz 0x428ec4
xor dh, byte [edx]
inc esp
sub al, 0x84
or dl, byte [ecx - 0x26]
mov al, byte [0x82424466]
ret 0xe959
cmp al, byte [edi]
rol ah, 1
enter 0x148, 0xfffffffffffffff5
cmc
jns 0x428e7b
sahf
dec ebp
or edx, dword [edi]
sub al, 0xa0
jne 0x428f20
xlatb
push edx
outsb dx, byte [esi]
outsb dx, byte [esi]
scasb al, byte es:[edi]
adc byte [ecx + 0x4a439393], 0xa5
mov eax, 0x2a46c6c6
sub dword [ecx], ebp
adc ebx, ebp
aad 0xd5
aad 0xb4
insd dword es:[edi], dx
jmp 0x428f2a
rol dh, 0xc6
inc esi
sub ch, byte [ecx]
sub dword [ecx], edx
jmp 0x428ea3
adc eax, 0xbcfb1c6e
cmp dword [esi + 0x21], esi
out 0x35, al
aaa
aaa
shr dword [0xe56ab086], cl
dec edx
lcall 0xab1b, 0x171f37c2
add eax, 0x5e3b29a9
rcl byte [ebx + 0x6d44bfdb], 0x75
in eax, 0x5a
sti
test bh, 0xc4
nop
sbb dword [ebx - 0x54aa5515], edi
dec eax
xchg edi, eax
mov ebp, dword [ebp - 0x69]
pop ebp
adc bh, byte [ebp - 0x5ea9f4ea]
mov ebp, 0xa1560b16
mov eax, dword [0xbc71b189]
into
mov dword [ecx + 0x1cebc71], esi
sbb al, 0x6f
add dword [edi + ebp*2], ebx
popal
push ecx
pop es
and byte [edi], 0x4f
pushfd
adc byte [edi], dh
jl 0x428f24
fdiv dword [ecx]
mov dl, 0xe5
sbb eax, dword [esi + 0x36]
jne 0x428f24
cmp byte [esi - 0x5959471e], al
inc esi
or edx, esp
cmp dword [ebx + ebp*2 - 0x546ead2c], 0xffffffb5
sub eax, 0x108f2f2f
or ch, ah
mov ecx, 0x338d376b
invalid
Function at 0x4320e0
Capabilities:
Encode data using xor

Disassembly:
cwde
pop esi
xor eax, 0x9d045b63
mov esp, 0x296b62dc
and al, 0x5a
salc
invalid
mov esi, 0x1dbe4031
ltr word [esi]
sub dword [ebx - 0x1e], esp
xor dword [eax - 0x42], eax
sbb eax, 0x291e000f
arpl dx, sp
pop ebx
jno 0x4320e1
jnp 0x4320a5
movsb byte es:[edi], byte [esi]
mov ebx, 0xa52d0853
in eax, 0x9b
cdq
dec ecx
xchg byte [ecx - 0x97488c4], cl
sub dword [esi + 0x5de2d55c], ebp
mov ebp, 0x53031fe5
mov dword [edi + 0x3365becd], edi
retf
Function at 0x4445b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0xc]
mov dword [edi + 0x10], eax
push ecx
mov eax, edi
call fcn.004447b0
mov ecx, dword [edi + 0x10]
cmp byte [ecx + 0x855], 0
mov esi, 0x40000080
je 0x4445e9
mov esi, 0x400000a0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [eax + 4]
sub edx, ecx
push edx
mov edx, dword [esp + 0x10]
sub ebx, edx
push ebx
push ecx
push edx
push 0
push esi
push 0
push eax
mov eax, edi
call fcn.0040fad0
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
mov ebx, dword [ecx + 0x63c]
call eax
mov esi, eax
mov eax, ebx
call fcn.00415d50
mov ecx, dword [eax]
mov edx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 1
push ebx
push ecx
push 0x30
push edx
call esi
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 0x850]
mov edx, dword [edi + 4]
push 0
push ecx
push 0xc5
push edx
call esi
mov eax, dword [edi + 0x10]
cmp byte [eax + 0x855], 0
je 0x444680
movzx eax, word [eax + 0x858]
mov ecx, dword [edi + 4]
push 0
push eax
push 0xcc
push ecx
call esi
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 0x1c]
push eax
call edx
mov eax, dword [eax]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x4446b1
push eax
call fcn.0047370f
add esp, 4
mov eax, dword [edi + 4]
push 0
push 0
push 0xb9
push eax
call esi
mov ecx, dword [edi + 4]
push 0
push 3
push 0xd3
push ecx
call esi
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd0]
call eax
mov edx, dword [edi + 4]
xor ecx, ecx
cmp al, bl
sete cl
push ecx
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 4]
xor ecx, ecx
cmp byte [eax + 0x854], bl
push 0
sete cl
push ecx
push 0xcf
push edx
call esi
mov eax, dword [edi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xd0c]
or edx, eax
mov eax, dword [edi + 4]
push edx
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [edi + 4]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [edi + 0x10]
lea eax, [esp + 0x1c]
call fcn.00446a30
mov eax, dword [eax]
push eax
lea esi, [edi + 0x18]
or eax, 0xffffffff
call fcn.00410720
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x444773
push eax
call fcn.0047370f
add esp, 4
push 0
mov byte [edi + 0x9c], bl
mov edi, dword [edi + 0x10]
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
push 0
push 0
push str.eidtinit
mov ecx, edi
call eax
mov ecx, edi
mov edi, eax
call fcn.00415560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444ec0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b3cc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x10], 0
push esi
push edi
je 0x444f78
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea eax, [esi + esi]
call fcn.004812c0
mov edi, esp
test edi, edi
je 0x444f78
mov ecx, dword [ebx + 4]
push esi
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebx + 0x10]
add esi, 0x2c8
push edi
or eax, 0xffffffff
call fcn.00410720
mov esi, dword [ebx + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push 0
push 0
push 0
push str.textchanged
mov ecx, esi
call eax
mov ecx, esi
mov edi, eax
call fcn.00415560
mov ecx, dword [ebx + 0x10]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0x1d
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebx]
mov edx, dword [edx + 0x118]
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call edx
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472007
mov esp, ebp
pop ebp
ret

Function at 0x448050
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, eax
xor ebp, ebp
xor al, al
cmp dword [edi + 0x40], 0xffffffff
je 0x44832a

Function at 0x44c930
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x44c948
mov esi, 8
push 2
call edi
test ax, ax
jge 0x44c954
or esi, 1
push 1
call edi
test ax, ax
jge 0x44c960
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x44c96c
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x44c978
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x453b10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
cmp ebx, 0x24
ja 0x453be3
je 0x453bd3
mov eax, ebx
sub eax, 1
je 0x453bc5
sub eax, 4
je 0x453b7d
sub eax, 3
jne 0x453b98
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x453b6b
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, edi
call fcn.0040fca0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [esp + 0x14]
push edx
mov esi, edi
call fcn.00453f40
cmp dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
jne 0x453c51
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push ecx
push esi
push ebx
lea edx, [edi + 0xa4]
lea ecx, [esp + 0x1c]
call fcn.004121a0
test al, al
je 0x453c3d
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00453880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0x14]
push eax
push edi
call fcn.00453e80
jmp 0x453b89
cmp ebx, 0x84
je 0x453c2c
cmp ebx, 0x112
jne 0x453b98
mov eax, dword [ebp + 0xc]
cmp eax, 0xf060
jne 0x453c0b
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [edi + 4]
push ecx
push eax
mov eax, dword [edi + 8]
push 0x112
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
call fcn.00453cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
push edx
push esi
push ebx
push eax
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x456eb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491778
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4b3cc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
push 0x694
mov dword [ebp - 4], ebx
call fcn.00465873
add esp, 4
cmp eax, ebx
je 0x456eff
mov esi, eax
call fcn.0043de90
mov dword [ebp - 0x14], eax
jmp 0x456f02
mov dword [ebp - 0x14], ebx
push 0xd04
call fcn.00465873
add esp, 4
cmp eax, ebx
je 0x456f1a
call fcn.0043ad60
jmp 0x456f1c
xor eax, eax
push 0xd04
mov dword [edi + 0x13c], eax
call fcn.00465873
add esp, 4
cmp eax, ebx
je 0x456f3a
call fcn.0043ad60
jmp 0x456f3c
xor eax, eax
mov ecx, dword [edi + 0x13c]
mov dword [edi + 0x140], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0xe4]
push ebx
call edx
mov ecx, dword [edi + 0x13c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x60]
push 0x64
call edx
mov esi, dword [ebp - 0x14]
mov ecx, dword [edi + 0x13c]
mov eax, dword [esi + 0x634]
mov edx, dword [eax + 0x10]
add esi, 0x634
push ecx
mov ecx, esi
call edx
push 0x634
call fcn.00465873
add esp, 4
cmp eax, ebx
je 0x456f9b
mov ebx, eax
call fcn.00422be0
xor ebx, ebx
jmp 0x456f9d
xor eax, eax
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edi + 0x140]
mov edx, dword [edx + 0x10]
push eax
mov ecx, esi
call edx
xor ecx, ecx
push ecx
mov eax, 0x457060
push eax
lea ecx, [edi - 0x694]
lea eax, [ebp - 0x30]
call fcn.00457b70
add esp, 8
mov byte [ebp - 4], 1
mov esi, dword [edi + 0x140]
add esi, 0x13c
mov ecx, eax
call fcn.004102a0
mov byte [ebp - 4], bl
mov eax, dword [edi + 0xdc0]
mov ecx, dword [edi + 0x140]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [edi + 0x140]
mov edx, dword [ecx]
mov eax, dword [edx + 0x60]
push 0x3c
call eax
mov eax, dword [edi + 0x604]
mov ecx, dword [edi + 0x140]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x120]
push str.hotbkcolor
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x458cd0
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x67c
jmp method.UiLib::CListViewUI.virtual_284

Function at 0x472007
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b3cc4]
jne 0x472011
repz ret
jmp fcn.00478d3f
Function at 0x4734f1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x473522
call fcn.004768b9
mov dword [eax], esi
call fcn.004768a6
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00472e63
add esp, 0x14
push 0x16
pop eax
jmp 0x473577
test dword [ebp + 0xc], 0xfffffff9
jne 0x4734fe
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47354f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004768cc
pop ecx
call fcn.004768a6
mov eax, dword [eax]
jmp 0x473577
test al, 0x10
jne 0x473575
test al, 1
je 0x473575
test byte [ebp + 0xc], 2
je 0x473575
call fcn.004768b9
mov dword [eax], 5
call fcn.004768a6
mov dword [eax], 0xd
jmp 0x473546
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4884df
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047a9bc
and dword [ebp - 4], 0
cmp dword [0x4b9478], 0
mov ebx, eax
jne 0x488590
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x488641
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x488641
push eax
call fcn.0047a94a
mov dword [esp], 0x498a24
push edi
mov dword [0x4b9478], eax
call esi
push eax
call fcn.0047a94a
mov dword [esp], 0x498a10
push edi
mov dword [0x4b947c], eax
call esi
push eax
call fcn.0047a94a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b9480], eax
call esi
push eax
call fcn.0047a94a
pop ecx
mov dword [0x4b9488], eax
test eax, eax
je 0x488590
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047a94a
pop ecx
mov dword [0x4b9484], eax
mov eax, dword [0x4b9484]
cmp eax, ebx
je 0x4885e8
cmp dword [0x4b9488], ebx
je 0x4885e8
push eax
call fcn.0047a9c5
push dword [0x4b9488]
mov esi, eax
call fcn.0047a9c5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4885e8
test edi, edi
je 0x4885e8
call esi
test eax, eax
je 0x4885df
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4885df
test byte [ebp - 0xc], 1
jne 0x4885e8
or dword [ebp + 0x10], 0x200000
jmp 0x488621
mov eax, dword [0x4b947c]
cmp eax, ebx
je 0x488621
push eax
call fcn.0047a9c5
pop ecx
test eax, eax
je 0x488621
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x488621
mov eax, dword [0x4b9480]
cmp eax, ebx
je 0x488621
push eax
call fcn.0047a9c5
pop ecx
test eax, eax
je 0x488621
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b9478]
call fcn.0047a9c5
pop ecx
test eax, eax
je 0x488641
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x488643
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bbeb
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x4272e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.B9FAC64A_40E3_4913_AD48_96AA87DC4465
push 0
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x429d04], eax
test eax, eax
jne 0x402047
push 0x425b8c
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0xb4
call fcn.00408e5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40210f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40206a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x425b8c
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0xc4
call fcn.00408e5b
sub esp, 8
lea ecx, [ebp - 0xd0]
call fcn.00402e80
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x38]
mov edx, str.Internal_Exception_Occured_
lea ecx, [ebp - 0xd0]
call fcn.00405800
mov ecx, eax
call fcn.004026e0
mov edx, 0x424994
mov ecx, eax
call fcn.00405800
mov ecx, eax
call fcn.00402870
mov edx, 0x424974
mov ecx, eax
call fcn.00405800
mov ecx, eax
call fcn.00402a10
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00402f50
cmp dword [eax + 0x14], 0x10
jb 0x4020ef
mov eax, dword [eax]
push 0x10
push str.Exception
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x2c]
call fcn.00402660
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00407000
mov esp, ebp
pop ebp
ret
Function at 0x405fe0
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
push esi
je 0x40619c
cmp dword [esp + 0x10], 0
je 0x40619c
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40619c
mov eax, dword [esp + 0x18]
test al, 3
jne 0x40619c
push ebp
xor ebp, ebp
test eax, eax
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
jle 0x406195
push ebx
mov cl, byte [esi]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x406032
mov bl, al
jmp 0x406066
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x406041
sub cl, 0x47
mov bl, cl
jmp 0x406066
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x406052
add cl, 4
mov bl, cl
jmp 0x406066
cmp cl, 0x2b
je 0x406064
cmp cl, 0x2f
je 0x406060
xor bl, bl
jmp 0x406066
mov bl, 0x3f
jmp 0x406066
mov bl, 0x3e
mov cl, byte [esi + 1]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x406077
mov byte [esp + 0x18], al
jmp 0x4060b8
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x406088
sub cl, 0x47
mov byte [esp + 0x18], cl
jmp 0x4060b8
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x40609b
add cl, 4
mov byte [esp + 0x18], cl
jmp 0x4060b8
cmp cl, 0x2b
je 0x4060b3
cmp cl, 0x2f
je 0x4060ac
mov byte [esp + 0x18], 0
jmp 0x4060b8
mov byte [esp + 0x18], 0x3f
jmp 0x4060b8
mov byte [esp + 0x18], 0x3e
mov cl, byte [esi + 2]
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
jbe 0x4060f9
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x4060d4
sub cl, 0x47
mov dl, cl
jmp 0x4060f9
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x4060e5
add cl, 4
mov dl, cl
jmp 0x4060f9
cmp cl, 0x2b
je 0x4060f7
cmp cl, 0x2f
je 0x4060f3
xor dl, dl
jmp 0x4060f9
mov dl, 0x3f
jmp 0x4060f9
mov dl, 0x3e
mov cl, byte [esi + 3]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x406108
mov cl, al
jmp 0x406136
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x406115
sub cl, 0x47
jmp 0x406136
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x406122
add cl, 4
jmp 0x406136
cmp cl, 0x2b
je 0x406134
cmp cl, 0x2f
je 0x406130
xor cl, cl
jmp 0x406136
mov cl, 0x3f
jmp 0x406136
mov cl, 0x3e
movzx eax, byte [esp + 0x18]
add bl, bl
shr al, 4
add bl, bl
or al, bl
mov byte [edi], al
mov al, byte [esp + 0x18]
mov bl, dl
shl al, 4
shr bl, 2
add edi, 1
or bl, al
mov byte [edi], bl
mov al, 0x3d
add edi, 1
add ebp, 1
cmp byte [esi + 2], al
je 0x406194
shl dl, 6
or dl, cl
mov byte [edi], dl
add ebp, 1
add edi, 1
cmp byte [esi + 3], al
je 0x406194
sub dword [esp + 0x10], 4
add ebp, 1
add esi, 4
cmp ebp, dword [esp + 0x1c]
jae 0x406194
cmp dword [esp + 0x10], 0
jg 0x406024
pop ebx
pop edi
mov eax, ebp
pop ebp
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x406520
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2010
call fcn.00408200
mov eax, dword [0x4272e0]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
mov ebx, dword [esp + 0x2020]
push esi
mov esi, dword [esp + 0x201c]
test esi, esi
push edi
mov edi, dword [esp + 0x2024]
je 0x4065f1
test edi, edi
je 0x4065f1
lea eax, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0x2014], 0
mov word [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4065b7
test ebx, ebx
je 0x4065a0
push ebx
push edi
push esi
push eax
lea ecx, [esp + 0x1c]
push str.error:0x_08X__s__s_:__s._n
push ecx
call fcn.00402e30
add esp, 0x18
jmp 0x4065e6
push edi
push esi
push eax
lea edx, [esp + 0x18]
push str.error:0x_08X__s__s._n
push edx
call fcn.00402e30
add esp, 0x14
jmp 0x4065e6
test ebx, ebx
je 0x4065d2
push ebx
push edi
push esi
lea eax, [esp + 0x18]
push str.error__s__s_:__s._n
push eax
call fcn.00402e30
add esp, 0x14
jmp 0x4065e6
push edi
push esi
lea ecx, [esp + 0x14]
push 0x41d308
push ecx
call fcn.00402e30
add esp, 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x2018]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407000
add esp, 0x2010
ret