joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46aed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x79c], 0
je 0x46af3f
cmp dword [ebp + 8], 0x100
jne 0x46af2f
cmp word [ebp + 0xc], 0xd
jne 0x46af2f
cmp byte [esi + 0x7a2], 0
je 0x46af0e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x46af2f
cmp byte [esi + 0x7a3], 0
jne 0x46af2f
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x46af28
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.00452b90
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x79c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x478160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x478187
cmp eax, edi
jge 0x47817f
push esi
call fcn.00473fd0
add esp, 4
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4781b0
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x478193
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4781cc
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4781bd
xor dl, dl
jmp 0x4781c2
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4781b3
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x478201
pop edi
pop esi
mov dword [ebp + 8], str.zlib_corrupt
pop ebp
jmp fcn.00473ee0
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x478219
pop edi
pop esi
mov dword [ebp + 8], str.read_past_buffer
pop ebp
jmp fcn.00473ee0
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x478237
push edi
push ecx
push esi
call fcn.0047b3e0
add esp, 0xc
test eax, eax
jne 0x478237
pop edi
pop esi
pop ebp
ret
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0049d050
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x490070
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d104b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [eax + 0x7f8], 0
cmp dword [edi + 4], 0
jne 0x49011d
lea eax, [ebp - 0xa4]
push eax
call fcn.0048fbc0
mov ecx, dword [edi + 0x10]
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044e6c0
push eax
mov ecx, edi
call fcn.0044b2b0
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00458330
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044e1f0
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0044aa80
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.0044a150
test bl, bl
je 0x490161
mov eax, dword [edi + 0x10]
add eax, 0x7e8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, 0x7e8
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 4

Function at 0x4901b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045ad00
mov ecx, dword [esi + 0x800]
test ecx, ecx
je 0x490241
lea eax, [ebp - 0x14]
push eax
call fcn.0048fbc0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x490217
mov ecx, dword [esi + 0x800]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x800]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490350
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.0045d150
mov ecx, dword [esi + 0x800]
test ecx, ecx
je 0x4903e9
lea eax, [ebp - 0x14]
push eax
call fcn.0048fbc0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4903bf
mov ecx, dword [esi + 0x800]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x800]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0x14

Function at 0x493ea0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.0044e6e0
mov edi, eax
add esp, 8
test edi, edi
jne 0x493f44
push eax
push 0x80
push 3
push eax
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x493f39
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x493f39
push eax
mov dword [ebp + 8], edi
call fcn.004494b9
add esp, 4
mov edi, eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [ebp + 8], eax
je 0x493f35
push edi
call fcn.00495dcf
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x493f47
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
call fcn.00493f70
push edi
mov esi, eax
call fcn.00495dcf
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49ac1e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4bac34
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0049e394
mov dword [ebp - 0x14], eax
cmp dword [0x515fc8], esi
jne 0x4bad27
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4bacb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4bae07
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4bae07
push 0x4e6828
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4bae07
push eax
call ebx
push 0x4e6834
push edi
mov dword [0x515fc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x515fcc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x515fd0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x515fd8], eax
test eax, eax
je 0x4bad24
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x515fd4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4bad4c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4bad3f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4bad61
push 4
pop eax
jmp 0x4bae09
cmp dword [ebp - 0x14], esi
je 0x4bad61
push dword [0x515fc8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4bad46
mov eax, dword [0x515fd4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4badbf
cmp dword [0x515fd8], edi
je 0x4badbf
push eax
call ebx
push dword [0x515fd8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4badbf
test eax, eax
je 0x4badbf
call ecx
test eax, eax
je 0x4badb4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4badb4
test byte [ebp - 8], 1
jne 0x4badbf
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4badef
mov eax, dword [0x515fcc]
cmp eax, edi
je 0x4badec
push eax
call ebx
test eax, eax
je 0x4badec
call eax
mov esi, eax
test esi, esi
je 0x4badec
mov eax, dword [0x515fd0]
cmp eax, edi
je 0x4badec
push eax
call ebx
test eax, eax
je 0x4badec
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x515fc8]
call ebx
test eax, eax
je 0x4bae07
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4bae09
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004944c3
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x417e10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x4c3074
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x4c6aec], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [0x4c6aec], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov dword [0x4c74b0], eax
mov dword [esp + 8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test esi, esi
je 0x417e66
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
pop esi
mov ecx, dword [esp]
add ecx, eax
mov eax, ecx
pop ecx
ret

Function at 0x437856
Capabilities:
Encode data using xor

Disassembly:
pop edi
div byte [esi - 0x6b1b1afd]
les eax, [ebp + 0x39]
push ecx
sal byte [ecx], 1
xor dl, byte [0x1235a8]
dec eax
ja 0x437857
inc esi
push ebx
push ebx
salc
aam 0xe5
pop ebp
pop esi
test dword [eax + 0x6e104c8f], esi
jl 0x4378cc
aad 0x8c
rcr byte [eax + 0x6a], 1
dec eax
int 0x7a
sbb dword [edx + 0x227dfe6d], ebp
mov byte [edi + 0x5d], cl
jge 0x43787a
invalid
scasb al, byte es:[edi]
add esp, edi
cld
mov dh, byte [esi - 0x66]
or al, 0x85
sub edx, 0x15
sar byte [0xf1a8c8f8], cl
lds edx, [edi - 0x4a11b701]
sti
movsb byte es:[edi], byte [esi]
mov byte [0x3ca69410], al
push ebp
dec edx
xchg esi, edx
mov bl, 0x9e
push esp
adc al, 0x54
pop ebx
jo 0x437891
hlt
inc ebp
adc eax, 0x9e54f95
push sp
aad 0x6f
leave
jp 0x43794f
test dword [edi + ebx*4 + 0x35f4515e], 0x5a538f3d
out dx, eax
fdivrp st(2)
ja 0x437887
imul edi, esp, 0x656bed12
sahf
inc ecx
ret 0xb39a
mov ebp, 0x8d84ca7a
and eax, 0x454ac4c4
push ds
bound ecx, qword [esi + 0x40841024]
hlt

Function at 0x45c77a
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [ebp + 0x55]
pop ecx
xlatb
jb 0x45c6bf
mov ch, 0x8e
das
lodsb al, byte [esi]
xor byte [edx], dl
and eax, 0x23e68d14
jo 0x45c765
and al, 0xb4
jb 0x45c712
movsd dword es:[edi], dword [esi]
pop esp

Function at 0x45c7be
Capabilities:
Encode data using xor

Disassembly:
in al, dx
out 0x10, al
sal esi, cl
sub ax, 0x1566
cmp eax, 0xa2520156
add dword [0xd0d2610e], esp
push edx
mov byte [0x610e2501], al
rcl al, cl
pop ebx
inc edx
adc dword [ebp - 0x24d302ec], esp
sal edi, cl
xchg esi, eax
out 0x43, al
popal
out 0xbd, al
daa
xor al, 0xa2
xchg ebx, eax
inc ebx
add esi, dword [ebx + 0x1947dfca]
pop esp
mov esp, 0xb0cbb5d4
cli
pop esp
fld xword fs:[ebp - 0x5c21bade]
shr dword [esi], 1
popal
push es
jne 0x45c7ca

Function at 0x48b336
Capabilities:
Encode data using xor

Disassembly:
dec esi
dec ecx
lds esp, [ebx - 0x17]
aaa
sbb byte [edx - 0x35], dl
mov bh, 0xa3
invalid
loop 0x48b2d0
push eax
mov bh, 0x9d
push esi
das
pop ebx
push ebx
mov cl, 0x8c
invalid
Function at 0x493e82
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x3b
add dword [esi - 0x4ab0ec5b], ecx
movsd dword es:[edi], dword [esi]
adc ecx, dword [edi - 0x4b]
dec edi
mov ch, 0x58
pop eax
and eax, dword [ecx + 0x1e]
inc ecx
push ds
mov eax, dword [0xaa06b716]
mov byte [0x772c865f], al
mov al, 0xae
mov word [esi + 0x79], ds
sub ch, 0xca
xchg ecx, eax
push 0x71
add dl, byte [esi + 0x3416575a]
sub esp, dword [edi - 0x7ab90b0a]
mov dh, 0xe4
mov dl, 0xa5
mov edi, dword [edi]
test byte [esi + 0x20], al
adc bl, bl
in eax, 0xff
mov ch, 0x10
push es
dec edi
xor byte [ecx], ah
test cl, ah
add esi, edi
and eax, 0x7d2c5508
jle 0x493e3c
dec ecx
xchg edi, eax
mov dl, 0xae
push es
xchg esi, eax
rcr byte [0xffc9942], 1
daa
and dl, byte [di - 0x2684]
loope 0x493f04
or eax, 0x4113eb7b
add dh, byte [edx + 2]
in eax, dx
add ch, ch
jle 0x493e3a
ror dword [edx], 0xf6
xor eax, 0xaee46e65
mov cs, ecx
xchg edi, eax
loope 0x493e40
aam 0xb3
inc ebp
lds eax, [ebp + eax*2 + 0x76655b17]
in al, 0x80
sbb eax, 0x22dabc52
push 0x6830621
xchg ebx, eax
test byte [ebp + 0x17], al
pop ebx
jbe 0x493e9d
sbb byte [0x22dabc52], 0x68
and dword [esi], eax
add dword [esi], 0xffffff93
wait
insb byte es:[edi], dx
sahf
aad 0x96
daa
and dl, byte [esi + eax*8 + 0x2b7db381]
stosd dword es:[edi], eax
test dword [ebx], ecx
inc edi
or esp, dword [edi + 0x3e]
inc edi
ret 0x118d
mov byte [0x25ef85fe], al
fiadd dword [ecx + ebx*4 - 0x5d]
mov esp, ebp
xchg ecx, eax
push edi
push es
or bh, byte [esi + 0x39742566]
and eax, 0x45f63974
inc edi
xor al, 0x77
xchg ebx, eax
add eax, esp
cmc
mov ah, 0x2e
je 0x493f91
mov ah, 0x1e
aam 0xf3
sbb al, 0xa3
rcr dword [ebx], 0x61
mov ah, 0xf1
sub edi, dword [ebx - 0x5862faaa]
dec esi
and al, 0xdc
sti
cli
adc eax, 0x87b65087
push eax
mov dh, 0x87
movsb byte es:[edi], byte [esi]
in al, dx
push esi
jb 0x493ed4
jno 0x493f3e
nop
cmp dword [esi + ebx*2 + 0x72], 0xffffffa6
out 0xae, eax
sbb al, 0x12
adc al, 0xe
push ss
and byte gs:[ecx + 0x5c], ch
mov dword [eax - 0x63], 0x62e7c630
ret
add al, 0x15
sub dword [edx + 0x4b62be7], 0xc17197a
daa
iretd
Function at 0xd54c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xd54d8c
test eax, eax
je 0xd54d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0xd6fff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0xd54d73
lea edi, [eax + 4]
jmp 0xd54cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0xd54cec
mov dword [ebp - 4], 2
jmp 0xd54d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0xd54d03
mov dword [ebp - 4], 1
jmp 0xd54d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0xd54d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0xd54d46
mov byte [ecx], 0x3d
jmp 0xd54d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0xd54d5d
mov byte [ecx], 0x3d
jmp 0xd54d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0xd54cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ed0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x38560cf5
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1b113f99
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x33b439e4
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5af654ed
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405646
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x405655
pop dword [ebp - 0x1c]
mov eax, 0x405655
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x67262c3e
add dword [ebp - 0x2c], 0xe72c190d
mov dword [ebp - 0x28], 0x11ad67ee
add dword [ebp - 0x28], 0x2085e457
mov dword [ebp - 0x24], 0xbb81087c
add dword [ebp - 0x24], 0x90cb3bb2
mov dword [ebp - 0x20], 0xd77cf9ae
add dword [ebp - 0x20], 0x28830652
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xfeebbe1c
add eax, 0x154b328
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xea9293f2
add dword [ebp - 0x2c], 0x89dfd564
mov dword [ebp - 0x28], 0xc87012c9
sub dword [ebp - 0x28], 0x8703b154
mov dword [ebp - 0x24], 0x2d390bb4
sub dword [ebp - 0x24], 0xc9c99f48
mov dword [ebp - 0x20], 0x11e09cb0
sub dword [ebp - 0x20], 0x11e09cb0
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x3d771a1e
sub eax, 0x3d36a90e
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35e8f
push 0
call eax
mov ecx, 0x43f6
mov esi, eax
mov edi, 0x436000
add edi, dword [ebp - 0x1c]
mov ebx, 0x6cc84fa8
xor dword [ebp - 0xc], ecx
mov edx, dword [edi]
sub dword [ebp - 0x10], ebx
add edx, ebx
mov dword [esi], edx
xor dword [ebp - 4], 0x2606a29d
add esi, 0xf04a2ecb
sub esi, 0xf04a2ec7
add edi, 4
loop 0x405760
add eax, 0xd1b622a1
sub eax, 0xd1b51ff6
mov ebx, eax
add eax, 0x5396a509
add eax, 0xac695afc
mov ecx, 0xbfad06a3
sub ecx, 0xbf6d06a3
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4058f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421968
push esi
call fcn.00405d21
push esi
call fcn.004058a8
mov edi, eax
test edi, edi
jne 0x405916
xor eax, eax
jmp 0x405968
push edi
call fcn.00405f83
test byte [0x423f78], 0x80
je 0x40592f
mov al, byte [edi]
test al, al
je 0x405912
cmp al, 0x5c
je 0x405912
sub edi, esi
jmp 0x405947
call fcn.0040601c
test eax, eax
je 0x405941
test byte [eax], 0x10
je 0x405912
push esi
call fcn.0040585b
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405933
call fcn.00405814
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059d9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059f5
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x4059f8
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc