joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
test byte [ebp + 8], 7
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
je 0x41ef5a
push 0x2d2
push str..._sshdes.c
push str._len__7___0
call fcn.0043f7f4
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x84]
mov ebx, dword [eax + 0x80]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jbe 0x41f051
dec ecx
shr ecx, 3
inc ecx
mov dword [ebp - 8], ecx
movzx edx, byte [esi + 2]
xor ecx, ecx
mov ch, byte [esi]
add esi, 4
add eax, 0x110
mov cl, byte [esi - 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi - 1]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dh, byte [esi]
mov dword [ebp + 8], ecx
movzx ecx, byte [esi + 2]
push dword [ebp + 8]
add esi, 4
mov dl, byte [esi - 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi - 1]
shl edx, 8
or edx, ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
mov dword [ebp - 0xc], edx
call fcn.0041e189
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
add ecx, 0x88
call fcn.0041d787
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.0041e189
xor ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x10]
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 3], bl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 1], cl
shr ebx, 0x18
mov byte [edi], bl
mov ebx, dword [ebp + 8]
add edi, 4
mov ecx, eax
shr ecx, 8
mov byte [edi + 3], al
mov byte [edi + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
mov byte [edi], al
mov eax, dword [ebp - 0xc]
mov byte [edi + 1], cl
add esp, 0x18
add edi, 4
dec dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
jne 0x41ef7f
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x80], ebx
mov dword [eax + 0x84], ecx
pop ebx
leave
ret

Function at 0x42111d
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x54], ecx
ret
Function at 0x42131b
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x40
pop esi
push esi
lea eax, [ebp - 0x40]
push 0x36
push eax
call fcn.00440010
xor ecx, ecx
add esp, 0xc
cmp dword [ebp + 0x10], ecx
jle 0x421358
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub edi, eax
cmp ecx, esi
jge 0x421358
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x421345
mov ebx, dword [ebp + 8]
push ebx
call fcn.0042111d
push esi
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.00421148
push esi
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.00440010
xor ecx, ecx
add esp, 0x1c
cmp dword [ebp + 0x10], ecx
jle 0x42139d
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub edi, eax
cmp ecx, esi
jge 0x42139d
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x42138a
lea edx, [ebx + 0x5c]
push edx
call fcn.0042111d
push esi
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.00421148
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00440010
add esp, 0x1c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x421acb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor ecx, ecx
or edi, 0xffffffff
mov eax, dword [ebp + 8]
mov al, byte [ecx + eax]
cmp al, 0x41
jl 0x421aee
cmp al, 0x5a
jg 0x421aee
movsx eax, al
sub eax, 0x41
jmp 0x421b25
cmp al, 0x61
jl 0x421afe
cmp al, 0x7a
jg 0x421afe
movsx eax, al
sub eax, 0x47
jmp 0x421b25
cmp al, 0x30
jl 0x421b0e
cmp al, 0x39
jg 0x421b0e
movsx eax, al
add eax, 4
jmp 0x421b25
cmp al, 0x2b
jne 0x421b17
push 0x3e
pop eax
jmp 0x421b25
cmp al, 0x2f
jne 0x421b1f
push 0x3f
jmp 0x421b14
cmp al, 0x3d
jne 0x421b49
mov eax, edi
mov dword [ebp + ecx*4 - 0x10], eax
inc ecx
cmp ecx, 4
jl 0x421ad8
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x421b49
cmp dword [ebp - 0xc], edi
je 0x421b49
mov esi, dword [ebp - 8]
cmp esi, edi
mov edx, dword [ebp - 4]
jne 0x421b4f
cmp edx, edi
je 0x421b5c
xor eax, eax
pop edi
pop esi
leave
ret
xor eax, eax
cmp edx, edi
setne al
inc eax
inc eax
mov edi, eax
jmp 0x421b5f
xor edi, edi
inc edi
shl ecx, 6
or ecx, dword [ebp - 0xc]
and esi, 0x3f
shl ecx, 6
or ecx, esi
and edx, 0x3f
shl ecx, 6
or ecx, edx
mov edx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x10
cmp edi, 1
mov byte [edx], al
jle 0x421b8c
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
cmp edi, 2
jle 0x421b94
mov byte [edx + 2], cl
mov eax, edi
jmp 0x421b4b

Function at 0x422a50
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 1
mov esi, 0x258
push esi
call fcn.004091c4
mov edi, eax
call fcn.00422882
mov eax, dword [0x464368]
push esi
lea eax, [eax + 0x463eb8]
push eax
push edi
call fcn.00440070
mov eax, dword [esp + 0x24]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
add esp, 0x14
mov dword [eax], edi
pop edi
pop esi
jmp fcn.00422882
Function at 0x42556c
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x42577c
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x40
pop esi
push esi
lea eax, [ebp - 0x40]
push 0x36
push eax
call fcn.00440010
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x4257b6
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub edi, eax
cmp ecx, esi
jge 0x4257b6
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x4257a4
push dword [ebp + 8]
call fcn.0042556c
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
call fcn.0042559e
push esi
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.00440010
add esp, 0x1c
xor ecx, ecx
test ebx, ebx
jle 0x4257fa
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub edi, eax
cmp ecx, esi
jge 0x4257fa
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x4257e8
mov edx, dword [ebp + 8]
add edx, 0x60
push edx
call fcn.0042556c
push esi
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.0042559e
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00440010
add esp, 0x1c
pop edi
pop esi
leave
ret
Function at 0x43533f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00409333
push dword [0x44b478]
mov esi, eax
lea eax, [ebp - 0x64]
push str._.70s_Command_Line_Error
push eax
call fcn.0043ffad
add esp, 0x14
push 0x10
lea eax, [ebp - 0x64]
push eax
push esi
push dword [0x468854]
call dword [0x44b3b4]
push esi
call fcn.0040927f
pop ecx
push 1
call fcn.00442488
int3
Function at 0x438c68
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [0x463048], ebx
push esi
mov dword [0x464a4c], ebx
je 0x438cb2
mov ecx, 0x463048
mov edx, dword [ecx - 8]
cmp edx, dword [0x466844]
je 0x438c9f
add ecx, 0xc
inc eax
cmp dword [ecx], ebx
jne 0x438c8a
jmp 0x438cb2
lea eax, [eax + eax*2]
mov eax, dword [eax*4 + 0x463048]
cmp eax, ebx
mov dword [0x464a4c], eax
jne 0x438ce3
push dword [0x44b478]
push str._s_Internal_Error
call fcn.004094dc
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Unsupported_protocol_number_found
push ebx
call dword [0x44b3b4]
push esi
call fcn.0040927f
pop ecx
push 1
call fcn.00437492
push edi
push dword [0x46685c]
lea ecx, [ebp - 4]
push dword [0x466858]
mov esi, 0x466640
push ecx
push dword [0x466840]
push esi
push esi
push 0x464720
push ebx
call dword [eax]
push dword [0x466624]
mov dword [ebp - 8], eax
push dword [0x464720]
mov eax, dword [0x464a4c]
call dword [eax + 0x34]
add esp, 0x28
cmp dword [ebp - 8], ebx
je 0x438d70
push dword [0x44b478]
push str._s_Error
call fcn.004094dc
push dword [ebp - 8]
mov edi, eax
push esi
lea eax, [ebp - 0x408]
push str.Unable_to_open_connection_to_n_.800s_n_s
push eax
call fcn.0043ffad
add esp, 0x18
push 0x10
push edi
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [0x44b3b4]
push edi
call fcn.0040927f
pop ecx
push ebx
call fcn.00442488
cmp byte [0x467a64], bl
mov dword [0x465584], ebx
mov dword [0x4655c0], ebx
je 0x438d8b
mov edi, 0x467a64
jmp 0x438dae
push dword [0x44b478]
lea eax, [ebp - 0x408]
push dword [ebp - 4]
push str._s____s
push eax
call fcn.0043ffad
add esp, 0x10
lea edi, [ebp - 0x408]
push dword [ebp - 4]
call fcn.0040927f
push edi
push ebx
call fcn.0043667d
push edi
push ebx
call fcn.004366d5
push dword [0x464720]
mov eax, dword [0x464a4c]
push dword [eax + 0x14]
push dword [0x46662c]
call fcn.00428b00
push ebx
push dword [0x464720]
push dword [0x464a4c]
push dword [0x46662c]
push esi
call fcn.004065a8
add esp, 0x34
mov dword [0x464a60], eax
xor esi, esi
pop edi
push ebx
push 0x40
push dword [esi + 0x464710]
call dword [0x44b348]
add esi, 8
cmp esi, 0x10
jb 0x438e01
pop esi
mov dword [0x4655b0], ebx
pop ebx
leave
ret
Function at 0x43d742
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [ebp + 0x14]
call fcn.0043fd50
mov edi, eax
inc edi
push 1
push edi
call fcn.004091c4
add esp, 0xc
push 1
push dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0x20], ebx
call fcn.0043fd50
push dword [ebp + 0x10]
mov esi, eax
call fcn.0043fd50
pop ecx
lea eax, [esi + eax + 5]
pop ecx
lea eax, [eax + eax*2]
push eax
call fcn.004091c4
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.0043d700
add esp, 0x14
lea eax, [ebp - 8]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [0x44b00c]
test eax, eax
je 0x43d7bf
xor eax, eax
inc eax
jmp 0x43d94b
mov esi, dword [0x44b010]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x43d8fe
cmp eax, 0xea
je 0x43d8fe
push 0x45446c
push dword [ebp + 0x10]
call fcn.0043fde0
test eax, eax
pop ecx
pop ecx
jne 0x43d8fe
push 0x452ef8
push dword [ebp - 4]
call fcn.00441fb0
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x18], eax
lea eax, [edi + 0xa]
push 1
push eax
call fcn.004091c4
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
push dword [ebp - 8]
call esi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x43d8fe
cmp dword [ebp - 0x14], 1
jne 0x43d8fe
mov edi, dword [ebp - 0x1c]
mov esi, ebx
mov dword [ebp - 0x18], 2
mov byte [esi], 0x30
inc esi
push 0x4508b0
mov byte [esi], 0x78
push edi
inc esi
call fcn.00441fb0
pop ecx
pop ecx
mov ecx, eax
push 4
cdq
pop ebx
idiv ebx
lea edx, [ecx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x43d893
cmp ecx, 1
jle 0x43d89e
dec ecx
dec edx
mov eax, edx
xor eax, 3
cmp byte [eax + edi], 0x30
je 0x43d88c
xor ebx, ebx
test ecx, ecx
jle 0x43d8b8
lea edx, [ecx + esi - 1]
mov eax, ebx
xor eax, 3
mov al, byte [eax + edi]
inc ebx
mov byte [edx], al
dec edx
cmp ebx, ecx
jl 0x43d8a8
mov eax, dword [ebp - 0x1c]
lea edi, [edi + eax*4]
add esi, ecx
cmp byte [edi], 0
je 0x43d8ca
inc edi
mov byte [esi], 0x2c
inc esi
dec dword [ebp - 0x18]
mov byte [esi], 0
jne 0x43d867
push dword [ebp + 0x14]
mov ebx, dword [ebp - 0x20]
push ebx
call fcn.0043fde0
test eax, eax
pop ecx
pop ecx
jne 0x43d8fe
push ebx
call fcn.0043fd50
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [0x44b008]
push dword [ebp - 8]
call dword [section..rdata]
push dword [ebp + 0x14]
push ebx
call fcn.0043fde0
push ebx
mov esi, eax
call fcn.0040927f
push dword [ebp - 4]
call fcn.0040927f
add esp, 0x10
cmp dword [ebp - 0x10], 0xea
je 0x43d948
cmp dword [ebp - 0x10], 0
jne 0x43d7b7
cmp dword [ebp - 0x14], 1
jne 0x43d7b7
test esi, esi
jne 0x43d948
xor eax, eax
jmp 0x43d94b
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44265f
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4605c8
call fcn.00444594
mov edi, 0x94
mov eax, edi
call fcn.0043ff70
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x44b258]
mov ecx, dword [esi + 0x10]
mov dword [0x46621c], ecx
mov eax, dword [esi + 4]
mov dword [0x466228], eax
mov edx, dword [esi + 8]
mov dword [0x46622c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x466220], esi
cmp ecx, 2
je 0x4426bf
or esi, 0x8000
mov dword [0x466220], esi
shl eax, 8
add eax, edx
mov dword [0x466224], eax
xor esi, esi
push esi
mov edi, dword [0x44b250]
call edi
cmp word [eax], 0x5a4d
jne 0x4426fa
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4426fa
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x442712
cmp eax, 0x20b
je 0x4426ff
mov dword [ebp - 0x1c], esi
jmp 0x442726
cmp dword [ecx + 0x84], 0xe
jbe 0x4426fa
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x442720
cmp dword [ecx + 0x74], 0xe
jbe 0x4426fa
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00444edf
pop ecx
test eax, eax
jne 0x442752
cmp dword [0x466268], 1
jne 0x44273f
call fcn.00446a94
push 0x1c
call fcn.0044691d
push 0xff
call fcn.0044232d
pop ecx
pop ecx
call fcn.00446dbb
mov dword [ebp - 4], esi
call fcn.0044488b
test eax, eax
jge 0x44276b
push 0x1b
call fcn.0044263a
pop ecx
call dword [0x44b17c]
mov dword [0x468c00], eax
call fcn.0044748b
mov dword [0x466260], eax
call fcn.004473e9
test eax, eax
jge 0x442791
push 8
call fcn.0044263a
pop ecx
call fcn.004471b6
test eax, eax
jge 0x4427a2
push 9
call fcn.0044263a
pop ecx
push 1
call fcn.0044235d
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4427b8
push eax
call fcn.0044263a
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x44b180]
call fcn.00447159
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4427d9
movzx eax, word [ebp - 0x40]
jmp 0x4427dc
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0043a87d
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4427fa
push edi
call fcn.00442488
call fcn.004424aa
jmp 0x44282c
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004445cf
ret
Function at 0x449062
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x449090
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x449097
cmp ebx, dword [eax + 4]
jae 0x449097
xor eax, eax
jmp 0x449287
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4490a8
xor eax, eax
inc eax
jmp 0x449286
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4490be
cmp ecx, edx
jae 0x449203
cmp dword [eax + 4], 0
je 0x4490c7
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4490af
cmp dword [ebp + 8], 0
je 0x4490e9
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x449203
cmp eax, esi
jae 0x449203
mov eax, dword [0x466508]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x44910e
cmp dword [esi*4 + 0x466510], edi
je 0x449207
inc esi
cmp esi, eax
jl 0x4490fc
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x44b15c]
test eax, eax
je 0x449283
cmp dword [ebp - 8], 0x1000000
jne 0x449283
test byte [ebp - 0xc], 0xcc
je 0x44918c
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x449283
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x449283
cmp word [eax + 0x18], 0x10b
jne 0x449283
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x449283
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x44918c
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x44918c
test byte [ecx + 0x27], 0x80
jne 0x449203
push 1
push 0x466550
call dword [0x44b114]
test eax, eax
jne 0x4490a0
mov ecx, dword [0x466508]
test ecx, ecx
mov edx, ecx
jle 0x4491c0
lea eax, [ecx*4 + 0x46650c]
cmp dword [eax], edi
je 0x4491c0
dec edx
sub eax, 4
test edx, edx
jg 0x4491b4
test edx, edx
jne 0x4491f1
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4491cd
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4491e5
lea eax, [edx*4 + 0x466510]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4491d3
cmp ecx, 0x10
jge 0x4491f1
inc ecx
mov dword [0x466508], ecx
push 0
push 0x466550
call dword [0x44b114]
jmp 0x4490a0
xor eax, eax
jmp 0x449286
test esi, esi
jle 0x4490a0
mov ebx, dword [0x44b114]
push 1
push 0x466550
call ebx
test eax, eax
jne 0x4490a0
cmp dword [esi*4 + 0x466510], edi
je 0x44925d
mov eax, dword [0x466508]
lea esi, [eax - 1]
test esi, esi
jl 0x44924b
cmp dword [esi*4 + 0x466510], edi
je 0x449247
dec esi
jns 0x44923b
test esi, esi
jge 0x44925b
cmp eax, 0x10
jge 0x449256
inc eax
mov dword [0x466508], eax
lea esi, [eax - 1]
jmp 0x44925d
je 0x449275
xor ecx, ecx
test esi, esi
jl 0x449275
lea eax, [ecx*4 + 0x466510]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x449263
push 0
push 0x466550
call ebx
jmp 0x4490a0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [str.bdfhjlnprtvxz_BDFHJLNPRT____.02468:__]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [str.bdfhjlnprtvxz_BDFHJLNPRT____.02468:__]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [str.bdfhjlnprtvxz_BDFHJLNPRT____.02468:__]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [str.bdfhjlnprtvxz_BDFHJLNPRT____.02468:__]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x40f244
call fcn.00403434
pop ecx
pop ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, str.bL_
push eax
push ebx
call fcn.00403464
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c438
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.00403434
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
je 0x401268
push 0x40fb6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push str.D.2
call fcn.00403434
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, str.bL_
push 0
push edi
call fcn.00403464
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c438
lea eax, [ebp - 0x814]
push eax
call fcn.0040c438
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.00403434
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403b7d
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push str.____
push eax
call fcn.004072d0
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8