joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fec4
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x567e74
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x48fee3
mov esi, 1
mov edx, 0x567f7c
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x48ff5c
dec ebx
je 0x48ff7e
dec ebx
je 0x48ffa0
dec ebx
je 0x48ffc1
jmp 0x48ffdb
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x48ffdb
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x48ffdb
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x48ffdb
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x48ff4c
inc esi
add edx, 0x40
cmp esi, 9
jne 0x48feff
mov esi, 0x20
mov eax, 0x567ea4
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x490000
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49003c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x567f2b]
test bl, bl
jbe 0x49006d
lea eax, [esi + 0x3e0]
call fcn.00490018
lea eax, [esi + 0x3fc]
call fcn.00490018
dec bl
jne 0x490053
mov cl, 0x30
mov edi, 0x567efc
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x49008e
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x49009b
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x490077
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4900a8
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.0048fe5c
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4900c4
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.0048fe5c
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.0048fe5c
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4900e0
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.0049003c
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x49010a
mov bl, 1
mov eax, 0x567df4
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x490143
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x490150
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x49012f
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x49017a
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.0048fec4
jmp 0x4901a1
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.0048fec4
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4901a9
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x490162
mov bl, 0x40
mov esi, 0x567e34
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x49020f
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x49021c
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4901f8
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0048fe84
inc ebx
inc esi
cmp bl, 0x41
jne 0x49022a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x490d80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x490e31
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x490e2c
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.00401330
push 1
mov eax, edi
call fcn.00401320
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004900a8
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c7e2c
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00401338
cmp byte [ebp - 1], 0
jne 0x4c7e8c
mov eax, esi
call fcn.00401320
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4c7ea6
sub al, 2
jb 0x4c7ead
jmp 0x4c7eb2
mov ebx, 2
jmp 0x4c7eb2
mov ebx, 1
mov eax, esi
call fcn.00401320
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4c7f96
test edi, edi
jle 0x4c7f0e
mov eax, esi
call fcn.00401320
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00401320
mov byte [eax + ebx - 1], 0
jmp 0x4c7f8a
test edi, edi
jge 0x4c7f54
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00401320
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4c7f8a
mov eax, esi
call fcn.00401320
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00401320
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4c7eca
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4c7fa7
sub al, 2
jb 0x4c7fe1
jmp 0x4c8029
cmp edi, 2
jne 0x4c7fad
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4c8029
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00401320
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x568320]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4c7fbd
jmp 0x4c8029
cmp edi, 2
jne 0x4c7fe7
dec ebx
test ebx, ebx
jle 0x4c8024
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00401320
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x568324]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4c7ff3
jmp 0x4c8024
inc ebx
mov eax, esi
call fcn.00401320
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4c8017
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.00401330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cdbf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
mov esi, ecx
mov ebx, eax
add edx, eax
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
movzx eax, word [ebx]
mov dword [esp], eax
or eax, eax
je 0x4cdd80
add ebx, 2
mov eax, dword [esp]
test ah, 0x80
je 0x4cdc52
and eax, 0x7fff
movzx edx, word [ebx]
shl edx, 0xf
or eax, edx
mov dword [esp], eax
add ebx, 2
lea ebp, [esi - 1]
mov ecx, dword [ebx]
add ebx, 4
mov dword [esp + 0x14], ecx
mov edi, 1
cmp ebx, dword [esp + 0x10]
jae 0x4cdd80
mov ecx, dword [esp + 0x14]
test ecx, edi
jne 0x4cdca6
mov al, byte [ebx]
inc ebx
mov byte [esi], al
inc esi
cmp ebx, dword [esp + 0x10]
lea eax, [esi - 3]
jae 0x4cdd80
cmp eax, ebp
jbe 0x4cdca0
inc ebp
mov eax, dword [ebp]
mov edx, eax
shr eax, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
add edi, edi
jne 0x4cdc71
jmp 0x4cdc55
movzx edx, word [ebx]
add ebx, 2
mov eax, edx
and edx, 0xf
add edx, 2
shr eax, 4
cmp edx, 2
jne 0x4cdcc3
movzx edx, byte [ebx]
inc ebx
add edx, 0x12
mov eax, dword [esp + eax*4 + 0x1c]
mov ecx, esi
mov dword [esp + 0x18], edx
sub ecx, eax
cmp ecx, edx
jl 0x4cdd6e
cmp edx, 0x20
ja 0x4cdd10
sub edx, 8
jg 0x4cdced
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
jmp 0x4cdd38
fild qword [edx + eax]
fild qword [eax]
cmp edx, 8
jle 0x4cdd08
fild qword [eax + 8]
cmp edx, 0x10
jle 0x4cdd05
fild qword [eax + 0x10]
fistp qword [esi + 0x10]
fistp qword [esi + 8]
fistp qword [esi]
fistp qword [edx + esi]
jmp 0x4cdd38
push esi
fild qword [eax]
lea eax, [edx + eax - 8]
lea edx, [edx + esi - 8]
fild qword [eax]
push edx
neg edx
and esi, 0xfffffff8
lea edx, [esi + edx + 8]
pop esi
fild qword [edx + eax]
fistp qword [edx + esi]
add edx, 8
jl 0x4cdd28
fistp qword [esi]
pop esi
fistp qword [esi]
cmp esi, ebp
jbe 0x4cdd54
inc ebp
mov edx, dword [ebp]
mov eax, edx
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
cmp esi, ebp
ja 0x4cdd3c
add esi, dword [esp + 0x18]
cmp ebx, dword [esp + 0x10]
jae 0x4cdd80
add edi, edi
lea ebp, [esi - 1]
je 0x4cdc55
jmp 0x4cdc6d
push ebx
xor ecx, ecx
dec edx
mov bl, byte [ecx + eax]
mov byte [ecx + esi], bl
lea ecx, [ecx + 1]
jne 0x4cdd71
pop ebx
jmp 0x4cdd38
mov eax, dword [esp]
add esp, 0x401c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4cdd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, ebx
dec esi
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
add edi, 4
mov dword [ebp - 8], 1
cmp edi, dword [ebp - 4]
jae 0x4cdeeb
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 8]
jne 0x4cde05
movzx eax, byte [edi]
mov byte [ebx], al
inc edi
inc ebx
cmp edi, dword [ebp - 4]
jae 0x4cdeeb
cmp ebx, dword [ebp + 0xc]
jae 0x4cdeeb
mov eax, ebx
sub eax, 3
cmp esi, eax
jae 0x4cddfa
inc esi
mov eax, dword [esi]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
shl dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4cddbb
jmp 0x4cdda3
movzx eax, word [edi]
add edi, 2
mov edx, eax
and edx, 0xf
add edx, 2
mov dword [ebp - 0x10], edx
shr eax, 4
cmp dword [ebp - 0x10], 2
jne 0x4cde29
movzx edx, byte [edi]
add edx, 0x12
mov dword [ebp - 0x10], edx
inc edi
mov edx, dword [ebp - 0x10]
add edx, ebx
cmp edx, dword [ebp + 0xc]
jb 0x4cde5c
mov edx, dword [ebp + 8]
mov esi, dword [edx + eax*4]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0xc]
sub eax, ebx
add esi, eax
add dword [ebp - 0x14], eax
neg eax
movzx edx, byte [esi + eax]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], dl
inc eax
test eax, eax
jne 0x4cde48
jmp 0x4cdeeb
cmp dword [ebp - 0x10], 8
jbe 0x4cde6f
mov edx, dword [ebp + 8]
mov ecx, ebx
sub ecx, dword [edx + eax*4]
cmp ecx, dword [ebp - 0x10]
jae 0x4cdea1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], eax
neg eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + eax]
mov byte [ebp - 0x1d], dl
mov edx, dword [ebp - 0x1c]
movzx ecx, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc eax
test eax, eax
jne 0x4cde86
jmp 0x4cdeb1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov edx, ebx
mov ecx, dword [ebp - 0x10]
call fcn.00401040
cmp edi, dword [ebp - 4]
jae 0x4cdeeb
cmp ebx, esi
jbe 0x4cded3
inc esi
mov eax, dword [esi]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
cmp ebx, esi
ja 0x4cdeba
add ebx, dword [ebp - 0x10]
mov esi, ebx
dec esi
shl dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4cddbb
jmp 0x4cdda3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dda78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4ddadf
cmp dword [ebp - 4], 0
je 0x4ddadf
mov eax, dword [ebp - 4]
movzx edx, byte [eax]
dec edx
sub dl, 0x20
jae 0x4ddaaf
inc eax
movzx edx, byte [eax]
dec edx
sub dl, 0x20
jb 0x4ddaa5
movzx eax, byte [eax]
sub al, 0x5b
je 0x4ddaba
sub al, 0x20
jne 0x4ddac2
movzx eax, byte [ebp - 5]
xor al, 1
jmp 0x4ddac4
xor eax, eax
test al, al
je 0x4ddad8
push edi
push ebx
lea edx, [ebp - 4]
mov eax, esi
xor ecx, ecx
call fcn.004dd4e8
jmp 0x4ddb2f
test byte [edi + 1], 2
setne bl
mov eax, esi
test dword [eax], 0xbfe8
jne 0x4ddaef
xor edx, edx
mov dword [eax], edx
jmp 0x4ddaf9
mov edi, dword [0x5c3858]
mov edi, dword [edi]
call edi
cmp byte [ebp - 5], 0
jne 0x4ddb0f
mov edx, esi
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.004dd9d8
test al, al
jne 0x4ddb2f
mov word [esi], pe_nt_image_headers32
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
call dword [0x56845c]
mov ecx, eax
lea eax, [esi + 8]
mov edx, dword [ebp - 4]
call fcn.004d26f8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4e58b4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
cmp byte [ebp + 8], 0
je 0x4e58f2
cmp dword [ebp - 8], 0
ja 0x4e58e1
mov edx, 0x4e5a68
mov eax, esi
call fcn.004e5290
jmp 0x4e5a5d
mov edx, 0x56860c
mov ecx, 4
mov eax, esi
call fcn.004e45f0
cmp dword [ebp - 8], 0
jbe 0x4e5a3d
mov eax, dword [ebp - 8]
mov ecx, 3
xor edx, edx
div ecx
mov ebx, eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub dword [ebp - 8], eax
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
sub edx, eax
inc ebx
add ebx, ebx
add ebx, ebx
cmp edx, ebx
jle 0x4e594b
inc eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004d5470
mov ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
add dword [esi + 4], eax
lea eax, [ebx + ebx*2]
add dword [ebp - 4], eax
jmp 0x4e59af
mov eax, esi
mov edx, dword [eax]
call dword [edx + 4]
cmp dword [ebp - 8], 0
jbe 0x4e59af
mov eax, dword [esi + 0x1c]
sub eax, 4
shr eax, 2
lea ebx, [eax + eax*2]
cmp ebx, dword [ebp - 8]
jbe 0x4e596c
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x20]
call fcn.004d5470
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
add ebx, ebx
add ebx, ebx
mov eax, dword [esi + 0x1c]
sub eax, 4
cmp ebx, eax
jae 0x4e5992
add dword [esi + 4], ebx
jmp 0x4e599d
mov ecx, ebx
mov edx, dword [esi + 0x20]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
add dword [ebp - 4], ebx
sub dword [ebp - 8], ebx
cmp dword [ebp - 8], 0
ja 0x4e5958
cmp dword [ebp - 0xc], 0
jbe 0x4e5a3d
mov eax, dword [esi + 4]
inc eax
mov edx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
mov ecx, dword [ebp - 0xc]
dec ecx
je 0x4e59cd
dec ecx
je 0x4e59f8
jmp 0x4e5a39
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
shl ecx, 4
mov ebx, ecx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [edx + ebx]
mov byte [eax], bl
and ecx, 0x3f
movzx edx, byte [edx + ecx]
mov byte [eax + 1], dl
add eax, 2
mov word [eax], 0x3d3d
jmp 0x4e5a39
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
shl ecx, 0xa
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + 1]
add ebx, ebx
add ebx, ebx
or ecx, ebx
mov ebx, ecx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [edx + ebx]
mov byte [eax], bl
mov ebx, ecx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [edx + ebx]
mov byte [eax + 1], bl
and ecx, 0x3f
movzx edx, byte [edx + ecx]
mov byte [eax + 2], dl
mov byte [eax + 3], 0x3d
add dword [esi + 4], 4
cmp byte [ebp + 8], 0
je 0x4e5a5d
mov ebx, esi
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jb 0x4e5a54
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
inc dword [ebx + 4]
mov eax, dword [ebx + 4]
mov byte [eax], 0x22
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e9bcc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
lea eax, [esp + 4]
call fcn.004d657c
cmp ebx, 0x40
jle 0x4e9bfe
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
mov ecx, ebx
mov edx, esi
call fcn.004eb314
jmp 0x4e9c10
mov edi, dword [0x576bec]
mov edi, dword [edi]
lea edx, [esp + 4]
mov eax, esi
mov ecx, ebx
call edi
mov eax, 0x10
lea edx, [esp + 4]
lea ecx, [esp + 0x44]
mov ebx, dword [edx]
xor ebx, 0x36363636
mov dword [ecx], ebx
add ecx, 4
add edx, 4
dec eax
jne 0x4e9c1d
mov eax, 0x10
lea edx, [esp + 4]
mov ecx, dword [esp]
add ecx, 0x6c
mov ebx, dword [edx]
xor ebx, 0x5c5c5c5c
mov dword [ecx], ebx
add ecx, 4
add edx, 4
dec eax
jne 0x4e9c3f
mov eax, dword [esp]
call fcn.004eb348
lea edx, [esp + 0x44]
mov eax, dword [esp]
mov ecx, 0x40
call fcn.004eb398
lea eax, [esp + 4]
call fcn.004d657c
lea eax, [esp + 0x44]
call fcn.004d657c
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x4e9d40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffefc
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
mov edi, dword [0x576dac]
mov edi, dword [edi]
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x80
call edi
cmp ebx, 0x80
jle 0x4e9d81
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
mov ecx, ebx
mov edx, esi
call fcn.004eb994
jmp 0x4e9d93
mov edi, dword [0x576bec]
mov edi, dword [edi]
lea edx, [esp + 4]
mov eax, esi
mov ecx, ebx
call edi
mov eax, 0x20
lea edx, [esp + 4]
lea ecx, [esp + 0x84]
mov ebx, dword [edx]
xor ebx, 0x36363636
mov dword [ecx], ebx
add ecx, 4
add edx, 4
dec eax
jne 0x4e9da3
mov eax, 0x20
lea edx, [esp + 4]
mov ecx, dword [esp]
add ecx, 0xd0
mov ebx, dword [edx]
xor ebx, 0x5c5c5c5c
mov dword [ecx], ebx
add ecx, 4
add edx, 4
dec eax
jne 0x4e9dc8
mov eax, dword [esp]
call fcn.004eb9c8
lea edx, [esp + 0x84]
mov eax, dword [esp]
mov ecx, 0x80
call fcn.004eba64
mov ebx, dword [0x576dac]
mov ebx, dword [ebx]
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x80
call ebx
mov ebx, dword [0x576dac]
mov ebx, dword [ebx]
lea eax, [esp + 0x84]
xor ecx, ecx
mov edx, 0x80
call ebx
add esp, 0x104
pop edi
pop esi
pop ebx
ret
Function at 0x4e9f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd1c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2e4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ea01e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2e4]
mov ecx, 0x4ea03c
mov edx, edi
call fcn.004012f8
mov edx, dword [ebp - 0x2e4]
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004e9ed8
cmp esi, 2
jl 0x4ea005
mov eax, dword [ebp + 8]
push esi
mov esi, eax
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, ebx
call fcn.004012e0
mov ecx, eax
lea eax, [ebp - 0x2e0]
mov edx, ebx
call fcn.004e9d40
mov ebx, esi
sub ebx, 2
jl 0x4e9fcf
inc ebx
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x190]
mov ecx, 0x54
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x190]
mov ecx, 0x40
call fcn.004eba64
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x190]
mov cl, 1
call fcn.004e9e38
mov edx, dword [ebp + 8]
xor eax, eax
lea ecx, [ebp - 0x40]
mov ecx, dword [ecx + eax*4]
xor dword [edx + eax*4], ecx
inc eax
cmp eax, 0x10
jne 0x4e9fbd
dec ebx
jne 0x4e9f82
mov ebx, dword [0x576dac]
mov ebx, dword [ebx]
lea eax, [ebp - 0x190]
xor ecx, ecx
mov edx, 0x150
call ebx
mov ebx, dword [0x576dac]
mov ebx, dword [ebx]
lea eax, [ebp - 0x2e0]
xor ecx, ecx
mov edx, 0x150
call ebx
lea eax, [ebp - 0x40]
call fcn.004d657c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea025
lea eax, [ebp - 0x2e4]
call fcn.00401270
ret

Function at 0x4ea488
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [edx]
movups xmm5, xmmword [0x4ea51d]
cmp al, 0x80
je 0x4ea5bc
cmp al, 0xc0
je 0x4ea62d
movups xmm3, xmmword [edx + 0x10]
add edx, 0x20
aeskeygenassist xmm2, xmm3, 1
call fcn.004ea52d
aeskeygenassist xmm2, xmm3, 2
call fcn.004ea52d
aeskeygenassist xmm2, xmm3, 4
call fcn.004ea52d
aeskeygenassist xmm2, xmm3, 8
call fcn.004ea52d
aeskeygenassist xmm2, xmm3, 0x10
call fcn.004ea52d
aeskeygenassist xmm2, xmm3, 0x20
call fcn.004ea52d
aeskeygenassist xmm2, xmm3, 0x40
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
repz ret
add edx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 2
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 4
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 8
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 0x10
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 0x20
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 0x40
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 0x80
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.004ea58e
aeskeygenassist xmm2, xmm1, 0x36
call fcn.004ea58e
repz ret