joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019081
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10019090
pop dword [ebp - 0x40]
mov eax, 0xf02d84f4
sub eax, 0xe02bf464
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x3c8aeb27
sub dword [ebp - 0x50], 0xee38a5dc
mov dword [ebp - 0x4c], 0x337383bf
sub dword [ebp - 0x4c], 0x140377a
mov dword [ebp - 0x48], 0x53378f6a
sub dword [ebp - 0x48], 0x6eb4b3c
mov dword [ebp - 0x44], 0xce478769
sub dword [ebp - 0x44], 0xce478769
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa151d2fb
sub eax, 0x914fe2bb
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb63277bb
sub dword [ebp - 0x50], 0x41c00e65
mov dword [ebp - 0x4c], 0xa74396ea
add dword [ebp - 0x4c], 0x9a28ca8b
mov dword [ebp - 0x48], 0x529aef63
sub dword [ebp - 0x48], 0xef2b82f7
mov dword [ebp - 0x44], 0x88c4ac7e
add dword [ebp - 0x44], 0x773b5382
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x376ae
push 0
call eax
mov ecx, 0xd9bbc601
sub ecx, 0xd9bb8440
xor edx, edx
add edx, eax
mov ebx, 0x1002f200
add ebx, dword [ebp - 0x40]
mov esi, 0xfbcbe2d8
add dword [ebp - 0x28], 0x4081c4aa
mov edi, dword [ebx]
add dword [ebp - 0xc], 0xd057fe18
add edi, esi
add dword [ebp - 0x14], esi
mov dword [edx], edi
xor dword [ebp - 0x18], edi
add edx, 0x6134550f
add edx, 0x9ecbaaf5
add ebx, 0xd5ff5437
add ebx, 0x2a00abcd
loop 0x100191a3
add eax, 0x202e105a
sub eax, 0x202d1683
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8f91067e
add ecx, 0x806ef982
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.10019081
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x401a03
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov word [ebp - 8], ax
mov eax, dword [ebp + 0xc]
mov word [ebp - 6], ax
push dword [ebp - 8]
push dword [0x41a2e0]
call sub.kernel32.dll_SetConsoleCursorPosition
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [0x41a2e0]
call sub.kernel32.dll_WriteConsoleA
leave
ret 0x10

Function at 0x401b58
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [0x41a2d4], eax
push 0
push 0x41a683
push 4
push 0x4172e0
push dword [0x41a2d4]
call sub.kernel32.dll_ReadFile
mov eax, dword [0x41a683]
mov ebx, eax
push 0
push 0x41a687
push 0x17e8
push dword [ebp + 0xc]
push dword [0x41a2d4]
call sub.kernel32.dll_ReadFile
mov eax, dword [0x41a687]
mov ebx, eax
push dword [0x41a2d4]
call sub.kernel32.dll_CloseHandle
leave
ret 8

Function at 0x401bca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [0x41a2d4], eax
push 0
push 0x41a68b
push 4
push 0x4172e0
push dword [0x41a2d4]
call sub.kernel32.dll_WriteFile
mov eax, dword [0x41a68b]
mov ebx, eax
cmp ebx, 4
je 0x401c22
push str.Error_while_saving_initial_4_bytes_to_Disk
push str.Program_Message
call fcn.00401a40
jmp 0x401c6b
push 0
push 0x41a68f
push 0x17e8
push dword [ebp + 0xc]
push dword [0x41a2d4]
call sub.kernel32.dll_WriteFile
mov eax, dword [0x41a68f]
mov ebx, eax
cmp ebx, 0x17e8
je 0x401c5c
push str.Error_while_saving_File_to_Disk
push str.Program_Message
call fcn.00401a40
jmp 0x401c6b
push str.Screen_saved_to_Disk
push str.Program_Message
call fcn.00401a40
push dword [0x41a2d4]
call sub.kernel32.dll_CloseHandle
leave
ret 8
Function at 0x402330
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
xchg ebx, eax
mov esi, dword [esp + 0x10]
push esi
call fcn.00402240
cmp dword [esi], 0
jne 0x402365
push eax
mov edx, esp
push 0
push edx
push 0x36
push 0x402410
push ebx
call sub.kernel32.dll_WriteFile
pop ecx
xor eax, eax
jmp 0x40240a
mov edi, dword [esi + 8]
add edi, dword [esi + 0x10]
add edi, dword [esi + 0x14]
add edi, dword [esi + 0x18]
add edi, dword [esi + 0x1c]
add edi, dword [esi + 0x20]
add edi, dword [esi + 0x24]
mov eax, dword [esi + 0x24]
lea eax, [eax*2 + 0x40250e]
mov edx, dword [esi + 0x20]
lea edx, [edx*2 + 0x402502]
mov ecx, dword [esi + 0x1c]
lea ecx, [ecx*2 + 0x4024f8]
push eax
push edx
push ecx
mov eax, dword [esi + 0x18]
lea eax, [eax*2 + 0x4024ee]
mov edx, dword [esi + 0x14]
lea edx, [edx*2 + 0x4024e4]
mov ecx, dword [esi + 0x10]
lea ecx, [ecx*2 + 0x4024da]
push eax
push edx
push ecx
mov eax, dword [esi + 8]
lea eax, [eax*2 + 0x4024d4]
lea edx, [esi + 0x28]
cmp dword [edx], 0
jne 0x4023eb
mov ecx, dword [esi]
add ecx, dword [esi + 4]
add ecx, dword [esi + 8]
add ecx, dword [esi + 0xc]
cmp ecx, 4
jb 0x4023e4
add ecx, dword [esi + 8]
add ecx, dword [esi + 0x10]
mov edx, dword [ecx*4 + 0x4024a0]
add edx, 1
cmp byte [edx - 1], 0x20
je 0x4023eb
dec edx
push eax
push edx
push 0x4024bc
push esi
call sub.user32.dll_wsprintfA
shl eax, 0x10
add esp, 0x28
add eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2981996e
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x2981996e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2981997d
pop dword [ebp - 0xc]
mov eax, 0xb65cc7ae
add eax, 0x7324d1cf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa55a081f
sub dword [ebp - 0x1c], 0x5707c2d4
mov dword [ebp - 0x18], 0xc774abab
add dword [ebp - 0x18], 0x6abea09a
mov dword [ebp - 0x14], 0x18fc0637
sub dword [ebp - 0x14], 0xccafc209
mov dword [ebp - 0x10], 0xca3f6b0e
sub dword [ebp - 0x10], 0xca3f6b0e
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x42228e0c
sub dword [ebp - 0x1c], 0xcdb024b6
mov dword [ebp - 0x18], 0x3f6db47b
add dword [ebp - 0x18], 0x1feacfa
mov dword [ebp - 0x14], 0x88b370e2
sub dword [ebp - 0x14], 0x25440476
mov dword [ebp - 0x10], 0xa3c521dd
sub dword [ebp - 0x10], 0xa3c521dd
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8ef0f45c
add eax, 0x9a947c5c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x4d2e4
push 0
call eax
mov ecx, 0xdfcc009e
sub ecx, 0xdfcba3e2
xor esi, esi
add esi, eax
mov edi, 0x29896400
add edi, dword [ebp - 0xc]
mov edx, 0xf75a6387
mov ebx, dword [edi]
xor dword [ebp - 8], edi
add ebx, edx
sub dword [ebp - 4], ecx
mov dword [esi], ebx
add esi, 4
add edi, 0xc9c3152e
add edi, 0x363cead6
loop 0x29819a90
add eax, 0xf6b538e2
sub eax, 0xf6b3d31f
xor ebx, ebx
add ebx, eax
add eax, 0xc63d42ef
add eax, 0x39c2bd16
mov ecx, 0x9a6e5e5b
sub ecx, 0x70ee5e5b
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2981996e
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2981996e
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2981996e
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2981996e
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2981996e
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2981996e
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403203
pop dword [ebp - 0x1c]
mov eax, 0x403203
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x771de864
sub dword [ebp - 0x2c], 0x28cba319
mov dword [ebp - 0x28], 0xb74ba430
sub dword [ebp - 0x28], 0x851857eb
mov dword [ebp - 0x24], 0xc69c9fda
add dword [ebp - 0x24], 0x85afa454
mov dword [ebp - 0x20], 0xe97cc903
add dword [ebp - 0x20], 0x168336fd
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x9976a8b5
add dword [ebp - 0x2c], 0xdafbc0a1
mov dword [ebp - 0x28], 0x86010789
add dword [ebp - 0x28], 0xbb6b59ec
mov dword [ebp - 0x24], 0x7362fdc3
sub dword [ebp - 0x24], 0xff39157
mov dword [ebp - 0x20], 0xb48a9f64
sub dword [ebp - 0x20], 0xb48a9f64
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35bcd
push 0
call eax
mov ecx, 0x4493
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x1c]
mov ebx, 0xd6926461
sub ebx, 0x569aa346
xor dword [ebp - 8], 0x562348d4
mov edx, dword [esi]
sub dword [ebp - 0xc], ecx
add edx, ebx
xor dword [ebp - 0x10], edx
mov dword [edi], edx
add dword [ebp - 0xc], 0x7e814a40
add edi, 0x3218c479
sub edi, 0x3218c475
add esi, 0x6c4c9574
add esi, 0x93b36a90
loop 0x40330c
add eax, 0xa5dd6e32
sub eax, 0xa5dc6913
xor ebx, ebx
add ebx, eax
add eax, 0xe3462b1a
sub eax, 0xe3462b15
mov ecx, 0xeaedcf68
sub ecx, 0xeaadcf68
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x13e14058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x13e141a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x13e1407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13e1406a
add dl, dl
jne 0x13e14089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13e140dc
xor eax, eax
add dl, dl
jne 0x13e14096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13e1417d
add dl, dl
jne 0x13e140a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13e140b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13e140bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13e140c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13e140d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x13e14075
mov eax, 1
add dl, dl
jne 0x13e140ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13e140f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13e140e1
sub eax, ebx
mov ebx, 1
jne 0x13e14128
mov ecx, 1
add dl, dl
jne 0x13e1410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13e14119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13e14105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13e14075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x13e1413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13e1414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13e14136
cmp eax, 0x7d00
jae 0x13e1416d
cmp eax, 0x500
jb 0x13e14168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13e14075
cmp eax, 0x7f
ja 0x13e14170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13e14075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x13e1419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x13e14075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44be60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x466014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x467070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041a950
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x466a88
push eax
call fcn.0041a950
mov esi, dword [0x467080]
xor ebx, ebx
mov edi, dword [0x467084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46a280], bl
mov eax, ebx
mov ecx, 0x467070
cmovae ecx, dword [0x467070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46a390], al
inc ebx
cmp ebx, 0x100
jl 0x4049c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46a280]
movzx eax, byte [esi + 0x46a390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46a280]
mov byte [esi + 0x46a280], al
inc esi
mov byte [edi + 0x46a280], dl
cmp esi, 0x100
jl 0x4049f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.0041fef8
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.0041fef8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004394fa
int3
Function at 0x404ad0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.0041a810
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x404b23
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x404bce
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x404b61
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x404c45
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x404bf8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x404bfd
mov ecx, eax
sar eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x404c14
sar eax, 4
and eax, 0x3f
jmp 0x404c1a
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
test edx, edx
je 0x404c3f
and ecx, 0xf
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret