joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a784
Capabilities:
Check os version
Encode data using base64

Disassembly:
mov ecx, ecx
shl bx, 0x20
shr esi, 0x40
push eax
push 0x43c494
ret
jne 0x44be75
xchg bx, bp
xchg bl, cl
xchg si, di
shr ecx, 0x40
xchg di, si
shl ax, 0x20
xchg cl, bl
xchg bp, bx
je 0x417940
push ebp
movsb byte es:[edi], byte [esi]
ja 0x4472c4
jbe 0x41794c
cpuid
nop
ret
jbe 0x4472c4
sbb byte [esi + 0x3d817e8], 0
pop dword [esp - 4]
lea eax, [ebp - 0x100]
push 0x10c
shr cl, 0x40
xchg ah, bl
xchg bl, ah
push eax
call fcn.0043387f
call fcn.0043db41
and eax, 0x43d66fb
add byte [edi], cl
test dword [edi - 0x6d6dffff], edx
je 0x41a7b9
cdq
stosb byte es:[edi], al
aaa
je 0x438f46
sbb byte [ebx], 0x8b
inc ebp
cld
or ebx, ebx
test eax, 0xa2c3450c
add dl, 0
cmp ax, 3
jne 0x41791f
mov dl, dl
je 0x42273b
cwde
cmp ah, byte [ecx - 0x217bf071]
push ecx
invalid
je 0x41791f
invalid
jne 0x42271f
mov ah, ah
xchg dx, ax
xchg ch, bl
xchg bl, ch
xchg dx, ax
mov esi, esi
je 0x436fde
nop
cpuid
ret
jmp 0x436fdf
push esi
call 0x42f79a
xchg esi, edi
xchg edi, esi
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
ja 0x414b08
jbe 0x436ffb
adc ecx, ebx
jbe 0x414b08
xor byte [edi + 0x76], 0x4b
inc edx
add byte [eax + esi*2 + 0x43], ch
add byte [edi], cl
lahf
inc edx
add byte [eax + eax], bh
add byte [eax], al
int 6
inc edx
add byte [eax + eax], bh
add byte [eax], al
jp 0x43709c
inc ebx
add byte [esi], ah
jo 0x437065
add dl, al
mov esp, 0x44265b8a
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ecx + ebx*2 - 0x2760ffbe], dh
inc ebx
add byte [ebx + 0x43ae], cl
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
inc dword [eax]
add byte [eax], al
add byte [edx], dl
add byte [eax], al
add byte [edx], al
add byte [eax], dh
add byte [eax], al
add byte [eax + eax*8 + 0x6cd0041], ah
inc edx
add byte [eax + eax], al
add byte [edx + ecx*2], ah
inc edx
add byte [ecx - 0x5f], bl
je 0x4370b9
inc edx
add byte [ebx - 0x24], cl
inc ecx
add byte [edx + 0x7f], bh
inc ebx
add byte [esi + 0x70], bh
inc ebx
add byte [edx], al
adc eax, 0x437f7a
dec ebx
fadd qword [ecx]
invalid
cpuid
xchg esi, eax
ret
add byte [eax], al
jne 0x436fc6
je 0x438f51
cld
xlatb
pushfd
je 0x436fc6
fcomp dword [edx - 0x76bef775]
or byte [esi - 0x77], ah
fistp dword [ebx + 0x5d]
ret
push esi
jne 0x443df2
je 0x4472d0
adc al, byte [ecx]
stc
and al, 0xf
test byte [ebx + ecx*8], bl
invalid
je 0x443df2
fcmovu st(0), st(5)
shl si, 0x20
xchg ah, bl
xchg bl, ah
adc word [edi], bx
lea ebp, [ebp]
jmp dword [esi]
Function at 0x41e3ef
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck

Disassembly:
js 0x423a79
jns 0x41e3fb
invalid
jns 0x423a79
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
mov ax, ax
jno 0x42ca13
jo 0x423a88
cpuid
ret
jo 0x42ca13
xor al, 0x77
call fcn.004150ac
add esp, 0x24
test ax, ax
jb 0x4362a3
je 0x423ace
add byte [eax], al
add byte [ebp + 2], dh
jne 0x423aae
mov edx, 0x1a3d663b
add byte [edi], cl
test byte [esi], dl
add byte [eax], al
add byte [ebp + 4], dh
cmp ax, 0x1a
je 0x423ace
jne 0x423abe
loope 0x423acb
mov byte [0xa3d66c3], al
add byte [edi], cl
test dword [ebp + 0x740000d6], ebp
add al, 0xb5
cmp ax, 0xa
jne 0x431175
je 0x423ace
mov ch, 0x10
jne 0x423aa7
push ebp
mov ebp, esp
mov cx, cx
mov eax, dword [ebp + 0x10]
mov ecx, eax
dec eax
cmp edx, edx
test ecx, ecx
jb 0x43d287
jmp 0x44768f
jmp fcn.00431176
fld dword [ecx - 0x75]
inc esi
add al, 0xf5
je 0x426750
jne 0x447699
dec ebp
retf
mov ebp, ebp
lea ecx, [eax + 1]
push 0x44af0d
ret
Function at 0x423195
Capabilities:
Authenticate hmac
Check os version
Encode data using base64

Disassembly:
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x438211
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x4231eb
jbe 0x4231c1
nop
cpuid
ret
xor ecx, ecx
jb 0x444d28
shr ecx, 0x40
mov cl, byte [eax + 0x453a94]
jmp dword [ecx*4 + 0x453a8c]
xor eax, eax
jb 0x444d41
pop ebp
jne 0x424e47
mov dx, dx
je 0x423203
cpuid
ret
je 0x424e47
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
ret
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x45061c
je 0x444d5a
sub dword [ebx], ecx
inc ecx
je 0x45061c
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x431e1a
je 0x444d78
cpuid
ret
je 0x431e1a
fidiv dword [edx - 0x75]
scasb al, byte es:[edi]
inc ebx
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
rcl dword [esi + 0x447f0041]
inc ecx
add byte [ecx + ebx*2 + 0x4db40042], dh
inc esp
add byte [eax - 0x4b3c5df1], dl
pop ecx
inc edx
add byte [esi], ch
daa
inc ebp
add dl, bl
xchg ecx, eax
pop esi
pop ebp
ret
Function at 0x42ccdd
Capabilities:
Check os version
Encode data using base64

Disassembly:
push ebp
pop ebp
mov ecx, edx
and ecx, 0xff
jb 0x42f451
pop dword [esp - 4]
mov dl, byte [esi]
test ebx, edx
jae 0x42ccea
invalid
jae 0x430775
ljmp 0x4782:0xfc0847e
jbe 0x4452f7
mov al, byte [eax]
lea esi, [esi + 0xc]
shl di, 0x20
sbb byte [ebp + ebx], al
jmp dword [esi]
je 0x42f43c
mov byte [0xd80001dd], al
jp 0x42f41b
jmp fcn.0042f49d
cmp dl, 0x61
jb 0x422026
jae 0x430783
pushal
outsd dx, dword [esi]
mov ecx, 0xa5c78166
mov eax, 0xa5ef8166
mov eax, 0xf7afa80
xchg dword [eax - 0x3e0000e8], edx
loope 0x4307b9
add di, 0xb8a5
sub di, 0xb8a5
cmp dl, 0x7a
ja 0x422026
shl ecx, 0x20
jbe 0x43079d
aam 0x96
jmp 0x44b885
ret
mov si, word [edi + 6]
jmp fcn.00445309
mov ecx, edx
push 0x422006
ret

Function at 0x42dd92
Capabilities:
Check os version
Encode data using base64

Disassembly:
jmp 0x41b7f6
push esi
mov byte [esi + 0xba], bl
mov dl, dl
push 0x44bd43
ret
pop dword [esp - 4]
call fcn.0042c24d
shl di, 0x20
shr dx, 0x40
shr edx, 0x40
jne 0x43b64c
je 0x42ddb2
daa
arpl si, si
mov cl, 0xf
test byte [eax + ebx*8 + 0x73350000], dl
mov ebx, dword [esi + 8]
je 0x43b64c
xor eax, 0x85e8b73
mov ax, word [ebp + eax]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
xor word [ebx], ax
jb 0x431f00
jmp dword [esi]
pop ebp
shl cx, 0x20
mov edx, edx
lea ebx, [ebx]
jne 0x43254e
je 0x431f16
push ss
push ss
push ebp
call 0x675a329
add byte [eax], al
je 0x43254e
mov al, byte [ebp + 0xb]
js 0x41b7f5
jns 0x43b65b
push ds
ret
jns 0x41b7f5
xor al, 0x50
pop ebp
ret
Function at 0x430a97
Capabilities:
Authenticate hmac
Check os version

Disassembly:
push ebp
ja 0x43c7a6
jbe 0x41ac82
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x43c7a6
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x41ac75
jo 0x430aa2
dec edi
xor edi, ecx
jo 0x41ac75
xor eax, 0xfbe1e8e0
invalid
push ebx
jmp 0x431c95
push esi
mov ebp, esp
push ecx
js 0x431c93
jns 0x43c7b3
mov dh, 0xe6
jns 0x431c93
add eax, 0x433fd988
add byte [ecx], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [esi + 0x4b], dh
inc edx
add cl, dh
cmp al, 0x44
add byte [edx + 0x7f], bh
inc ebx
add bl, bl
mov dword [ebx], 0xffc3a20f
jecxz 0x43c84a
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
push ebp
jg 0x43c82d
add dl, dh
mov dword [ebx], 0x557a5d12
jg 0x43c838
add bl, bl
cmp eax, dword [eax + eax - 0x26]
xchg dword [ebx], ebp
bound eax, qword [ecx]
xor byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
mov ah, 0x59
inc edx
add byte [ecx], ch
mov dh, 0x43
add byte [edi - 0xaffbb11], bl
dec ebx
inc ebx
add byte [edi], cl
js 0x43c85e
add bh, al
xor ecx, ebp
xor cl, byte [edx - 0x37260001]
push ss
invalid
Function at 0x43898d
Capabilities:
Check os version
Encode data using base64

Disassembly:
mov ebx, ebx
jmp 0x43897f
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00428eab
and eax, 0xab850f1d
int3
Function at 0x447420
Capabilities:
Check os version
Encode data using base64

Disassembly:
cld
or ah, byte [esi - 0x3f]
loop 0x437592
mov eax, dword [esi + 4]
jmp fcn.00417fca
cpuid
ret
xchg edi, eax
sbb esi, edx
jbe 0x43f9b8
fldenv [ebx + 0x83826ff]
shr ch, 0x40
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov al, byte [ebp + eax]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
jmp dword [esi]
mov ecx, dword [esi + 4]
mov bx, bx
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
shr word [ebx], cl
jmp dword [esi]
clc
lodsb al, byte [esi]
call fcn.004344f0
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
pop dword [esp - 4]
je 0x44ddc8
jne 0x44742f
pop ebx
out 0x6e, al
xor eax, eax
jb 0x43d0e9
pop esi
mov esp, ebp
jne 0x44ddc1
je 0x447444
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x44ddc1
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x44de1d
je 0x44ddda
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x43d0f2
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x43f9ca
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x44ddeb
jge 0x44de16
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
xchg ecx, edx
xchg edx, ecx
mov eax, edx
shr bl, 0x40
shr eax, 0x1f
add edx, eax
shr ah, 0x40
mov eax, ecx
shr eax, 0x40
mov edi, edx
shl bl, 0x20
cdq
and edx, 3
jb 0x43756c
jmp fcn.00443f4c
cmp al, 2
mov esi, esi
call 0x452830
invalid
add eax, edx
sar ebx, 2
jne 0x426e87
je 0x44de61
shr bl, 0x70
clc
je 0x426e87
invalid
Function at 0x44e301
Capabilities:
Check os version
Encode data using base64

Disassembly:
mov dword [ebp + ebx], eax
jmp dword [esi]
lea esi, [esi]
mov al, byte [ebp + 0xb]
xchg ah, dh
xchg dh, ah
mov bh, bh
call fcn.00452c30
xor eax, 0xef870f8f
xor dword [eax], eax
add byte [esi + 4], dh
fmul dword [edx - 0x79f0bd2a]
jecxz 0x41c092
add byte [eax], al
lea esp, [esp + 4]
mov byte [esi + 0xbb], 0
shl bl, 0x20
mov word [esi + 0xbc], dx
mov al, al
call fcn.0044f6c9
push edi
mov di, ax
pop edi
mov ah, ah
js 0x41c03f
shr al, 0x40
jns 0x44e333
cpuid
nop
ret
jns 0x41c03f
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
movzx eax, byte [eax + edx]
lea esi, [esi + 0xc]
jne 0x414980
je 0x44e351
inc ebp
adc al, dl
je 0x414980

Function at 0x450c70
Capabilities:
Get file size

Disassembly:
add esp, 4
cmp word [ebp + 0xa], ax
je 0x439ede
jne 0x450642
mov dl, 0x55
xor eax, eax
jb 0x44ab33
pop esi
mov esp, ebp
ja 0x439eda
jbe 0x450659
cpuid
ret
jbe 0x439eda
xor al, 0xb8
jne 0x41f856
shr ecx, 0x40
shl edi, 0x20
mov bp, bp
je 0x450674
mov ch, 0xcc
je 0x41f856
invalid
push ebp
mov ebp, esp
js 0x41b446
jns 0x450c7f
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x41b446
fisubr dword [edi - 0x75]
push es
jmp 0x450c8a
push eax
call fcn.0043c32e
jno 0x45062e
jo 0x450c9d
cpuid
test ebx, 0xf98b800f
invalid
jo 0x45062e
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x450ccf

Function at 0x4538cc
Capabilities:
Check os version
Encode data using base64
Encode data using xor

Disassembly:
pop dword [esp - 4]
jne 0x433f2a
shl ax, 0x20
je 0x4538df
ja 0x41d5eb
jbe 0x4538eb
Function at 0x454430
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x454454
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x45446e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.00463d50
add esp, 0xc
cmp si, 0xfc
jbe 0x4544b9
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.00460b40
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x454567
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4544e9
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x454505
jmp 0x45462a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.00463d50
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.00463d50
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4545a1
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4545c0
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.00463d30
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.00460b90
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x454790
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x4547bc
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.00454430
add esp, 0xc
test ax, ax
jne 0x454908
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x454804
cmp eax, 1
je 0x45487e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x454825
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00460b90
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00460cf0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x45483b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x454866
mov eax, dword [esp + 8]
jmp 0x4548ef
mov eax, dword [esp + 0x188]
test eax, eax
je 0x45489f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00460b90
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00460cf0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4548b5
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x4548dd
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.00463d30
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x455100
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x455167
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x536e30]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x536e30]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x536e30]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x536e30]
dec esi
jne 0x455113
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x455170
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x455192
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x455290
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x455249
mov ecx, 3
cmp ecx, 1
jne 0x455257
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x455279
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x45526e
mov byte [esi], 0x3d
jmp 0x455279
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x4551a0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4558c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x4558f8
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x4558e0
pop esi
pop ebx
ret
Function at 0x455b90
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x455c13
pop esi
pop ebx
ret

Function at 0x457850
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x4578a1
mov dl, byte [edi]
mov eax, edi
dec edi
mov cl, bl
mov bl, dl
add dl, dl
shr bl, 7
or dl, cl
mov byte [eax], dl
mov ax, si
dec si
test ax, ax
jne 0x457885
test bl, bl
je 0x4578ac
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x457877
xor si, si
test ebp, ebp
je 0x4578d9
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x4578c2
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x458070
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x45809a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x458089
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x4580dc
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x4580bb
test cl, cl
je 0x4580e3
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4580a8
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x45be50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x45be80
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x45bf72
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x45bf42
cmp dword [esp + 0x1c], 2
push 0
jbe 0x45bf23
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0045c020
add esp, 0xc
cmp dword [0x5372f8], 0
jne 0x45c00d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x45bef4
jmp 0x45bf50
push 0
push esi
call fcn.0045c020
add esp, 0xc
cmp dword [0x5372f8], 0
je 0x45bf50
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0045c340
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x45bea7
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x45bf88
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x45bf7a
cmp dword [esp + 0x1c], 2
jbe 0x45bfa3
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.0045c340
add esp, 8
jmp 0x45bfc8
cmp dword [esp + 0x1c], 1
jne 0x45bfb7
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.0045c020
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x45c000
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x45bfe7
mov dl, byte [esi + ecx - 8]
lea eax, [esi + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x18]
jb 0x45bfd7
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret