joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68dc357c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x24
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp + 0x10]
cmp eax, 2
ja 0x68dc35e4
mov dword [ebp - 0xc], 0
jmp 0x68dc35c1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
mov byte [eax], dl
inc dword [ebp + 0xc]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x68dc35a8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov edx, eax
add edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], edx
mov eax, 0
jmp 0x68dc3714
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x68dc3607
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp + 0xc]
dec dword [ebp + 0x10]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jbe 0x68dc35ef
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
shr al, 2
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_z]
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
movzx eax, al
and eax, 3
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x14]
inc eax
mov al, byte [eax]
shr al, 4
movzx eax, al
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_z]
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x14]
inc eax
mov al, byte [eax]
movzx eax, al
and eax, 0xf
lea edx, [eax*4]
mov eax, dword [ebp - 0x14]
add eax, 2
mov al, byte [eax]
shr al, 6
movzx eax, al
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_z]
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x14]
add eax, 2
mov al, byte [eax]
movzx eax, al
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_z]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
cmp eax, 1
je 0x68dc36a9
cmp eax, 2
jne 0x68dc36af
mov byte [ebp - 0x16], 0x3d
mov byte [ebp - 0x15], 0x3d
jmp 0x68dc36af
nop
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp + 8], 4
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__cairo_output_stream_write
cmp dword [ebp + 0x10], 2
ja 0x68dc35e4
mov dword [ebp - 0xc], 0
jmp 0x68dc36f5
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp + 0xc]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x68dc36e0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.__cairo_output_stream_get_status
leave
ret
Function at 0x68dd1efd
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x1505
jmp 0x68dd1f27
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, eax
add edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax]
movsx eax, al
add eax, edx
mov dword [ebp - 4], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0
je 0x68dd1f36
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
jne 0x68dd1f0c
mov eax, dword [ebp - 4]
leave
ret

Function at 0x68de8e6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
outsb dx, byte [esi]
or esp, 0x68
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
invalid
xchg ebp, eax
invalid

Function at 0x68de9de7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp - 0x6fc], 2
jne 0x68de9ea6
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], pe_nt_image_headers32
mov byte [ebp - 0x795], 0x81
invalid
test dword [eax + edi*8 - 1], ebp

Function at 0x68deb08c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fwrite
cmp eax, dword [ebp + 0x10]
je 0x68deb0cf
mov dword [esp], 0xb
call sym.__cairo_error
jmp 0x68deb0d4
mov eax, 0
leave
ret
Function at 0x68e005d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x30
mov edx, dword [ebp + 0xc]
mov eax, edx
shl eax, 0x10
add eax, edx
shl eax, 1
add eax, edx
shl eax, 3
add eax, edx
shl eax, 3
add eax, edx
shl eax, 1
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
movzx eax, al
xor dword [ebp + 0xc], eax
inc dword [ebp - 4]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x68e005ec
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x68e21d47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x68e21e89
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
movzx eax, al
mov word [ebp - 0x16], ax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x5c]
shr ax, 8
xor ax, word [ebp - 0x16]
mov word [ebp - 0x18], ax
movzx edx, word [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x5c]
movzx eax, ax
add eax, edx
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, edx
lea ecx, [eax*4]
add eax, ecx
shl eax, 1
add eax, edx
shl eax, 2
add eax, edx
add eax, 0x58bf
mov edx, dword [ebp - 0x10]
mov word [edx + 0x5c], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x60]
test eax, eax
je 0x68e21e66
mov eax, dword [ebp - 0x18]
shr ax, 4
movzx eax, ax
mov al, byte [eax + 0x68e5e6b5]
mov byte [ebp - 0x1b], al
movzx eax, word [ebp - 0x18]
and eax, 0xf
mov al, byte [eax + 0x68e5e6b5]
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0xa
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x64]
lea edx, [eax + 2]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x64]
cmp eax, 0x4e
jne 0x68e21e47
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x58]
mov dword [esp + 8], 3
lea edx, [ebp - 0x1b]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__cairo_output_stream_write
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], 0
jmp 0x68e21e89
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x58]
mov dword [esp + 8], 2
lea edx, [ebp - 0x1b]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__cairo_output_stream_write
jmp 0x68e21e89
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x58]
mov dword [esp + 8], 1
lea edx, [ebp - 0x1b]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__cairo_output_stream_write
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0x68e21d69
mov eax, 0
leave
ret
Function at 0x68e234e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov word [ebp - 0xa], 0xd971
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x98]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x9c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x9c]
mov dword [esp], eax
call sym._malloc
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xa4], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xa4]
test eax, eax
jne 0x68e23549
mov dword [esp], 1
call sym.__cairo_error
jmp 0x68e23669
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x14], eax
jmp 0x68e2361b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xa0]
test eax, eax
je 0x68e235b2
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
movzx eax, al
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.__cairo_isspace
test eax, eax
jne 0x68e2361a
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._hex_to_int
mov ebx, eax
shl ebx, 4
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
movzx eax, al
inc dword [ebp - 0x10]
mov dword [esp], eax
call sym._hex_to_int
or eax, ebx
mov dword [ebp - 0x18], eax
jmp 0x68e235c0
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
movzx eax, al
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
mov ax, word [ebp - 0xa]
shr ax, 8
movzx eax, ax
xor eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0xa]
add eax, dword [ebp - 0x18]
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, edx
lea ecx, [eax*4]
add eax, ecx
shl eax, 1
add eax, edx
shl eax, 2
add eax, edx
add eax, 0x58bf
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x24]
mov dl, al
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
inc dword [ebp - 0x14]
jmp 0x68e2361b
nop
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jb 0x68e2355a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0xa8], edx
mov dword [ebp - 0x1c], 0
jmp 0x68e23650
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov byte [eax], 0x20
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jg 0x68e23664
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x9c]
cmp eax, dword [ebp - 0x1c]
jg 0x68e2363c
mov eax, 0
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x68e294d5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xd4
mov eax, dword [0x68e7de18]
test eax, eax
jne 0x68e29561
mov dword [ebp - 0xa4], 0x94
lea eax, [ebp - 0xa4]
mov dword [esp], eax
call sym._GetVersionExA_4
sub esp, 4
mov eax, dword [ebp - 0x94]
cmp eax, 1
jne 0x68e29524
mov eax, dword [ebp - 0xa0]
cmp eax, 4
jne 0x68e29524
mov eax, dword [ebp - 0x9c]
cmp eax, 0xa
je 0x68e29557
mov dword [esp], str.msimg32
call sym._LoadLibraryW_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x68e29557
mov dword [esp + 4], str.AlphaBlend
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [0x68e7de1c], eax
mov dword [0x68e7de18], 1
mov eax, dword [0x68e7de1c]
test eax, eax
jne 0x68e29574
mov eax, 0x64
jmp 0x68e2964c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x154]
and eax, 8
test eax, eax
jne 0x68e2958e
mov eax, 0x64
jmp 0x68e2964c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x100]
cmp eax, 1
jne 0x68e295b3
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100]
test eax, eax
jne 0x68e295b3
mov eax, 0x64
jmp 0x68e2964c
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0xe], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x100]
test eax, eax
sete al
mov byte [ebp - 0xd], al
mov ebx, dword [0x68e7de1c]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x104]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x104]
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x30]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x2c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x28]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x2c
test eax, eax
jne 0x68e29647
mov dword [esp], str._cairo_win32_surface_composite_AlphaBlend_
call sym.__cairo_win32_print_gdi_error
jmp 0x68e2964c
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x68e3355a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._png_get_io_ptr
mov dword [ebp - 0xc], eax
jmp 0x68e335ee
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fwrite
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 0
je 0x68e335ee
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
and eax, 0x20
test eax, eax
je 0x68e335ee
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._png_get_error_ptr
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
jne 0x68e335db
mov dword [esp], 0xb
call sym.__cairo_error
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._png_error
cmp dword [ebp + 0x10], 0
jne 0x68e33570
leave
ret

Function at 0x68e338f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x68e33964
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 0
je 0x68e33964
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
and eax, 0x10
test eax, eax
jne 0x68e33956
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
and eax, 0x20
test eax, eax
je 0x68e33964
mov dword [esp], 0xa
call sym.__cairo_error
jmp 0x68e3396f
cmp dword [ebp + 0x10], 0
jne 0x68e33906
mov eax, 0
leave
ret

Function at 0x68e398cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.68e511d8
sub esp, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x104]
mov eax, dword [eax + 0xc]
and eax, 0x20
test eax, eax
je 0x68e398ff
mov dword [esp], 0x17
call sym.__cairo_error
jmp 0x68e3998e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x104]
mov dword [esp], eax
call sym._rewind
jmp 0x68e39934
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100]
mov dword [esp + 8], edx
lea edx, [ebp - 0x100c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__cairo_output_stream_write
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x104]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x68e39912
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x104]
mov eax, dword [eax + 0xc]
and eax, 0x20
test eax, eax
je 0x68e39989
mov dword [esp], 0x17
call sym.__cairo_error
jmp 0x68e3998e
mov eax, 0
leave
ret
Function at 0x68e4c8d3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, dword [ebp + 0x10]
cmp eax, 2
ja 0x68e4c93b
mov dword [ebp - 0xc], 0
jmp 0x68e4c918
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
mov byte [eax], dl
inc dword [ebp + 0xc]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x68e4c8ff
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov edx, eax
add edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov eax, 0
jmp 0x68e4ca69
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
jmp 0x68e4c95e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp + 0xc]
dec dword [ebp + 0x10]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jbe 0x68e4c946
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
shr al, 2
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_image_jpeg]
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
movzx eax, al
and eax, 3
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x14]
inc eax
mov al, byte [eax]
shr al, 4
movzx eax, al
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_image_jpeg]
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x14]
inc eax
mov al, byte [eax]
movzx eax, al
and eax, 0xf
lea edx, [eax*4]
mov eax, dword [ebp - 0x14]
add eax, 2
mov al, byte [eax]
shr al, 6
movzx eax, al
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_image_jpeg]
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x14]
add eax, 2
mov al, byte [eax]
movzx eax, al
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_image_jpeg]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
cmp eax, 1
je 0x68e4ca00
cmp eax, 2
jne 0x68e4ca06
mov byte [ebp - 0x16], 0x3d
mov byte [ebp - 0x15], 0x3d
jmp 0x68e4ca06
nop
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp + 8], 4
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.__cairo_output_stream_write
cmp dword [ebp + 0x10], 2
ja 0x68e4c93b
mov dword [ebp - 0xc], 0
jmp 0x68e4ca4b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp + 0xc]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x68e4ca36
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call sym.__cairo_output_stream_get_status
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x48ca31c5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x575811fc
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x408935
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
add esi, edi
and esi, esi
call fcn.0040895e
and edi, edi
xor dword [edx], ebx
add esi, edi
sub edi, edi
add edx, 1
mov edi, edi
cmp edx, eax
jne fcn.00408935
ret
Function at 0x402bd7
Capabilities:
Delete directory
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.00409350
cmp dword [0x2a9b018], 0x594
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x402c14
push 0x402500
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0x402554
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov eax, dword [0x426c78]
push ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [str._n_P]
push esi
xor esi, esi
mov dword [ebp - 0x24], eax
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00402bd0
mov eax, dword [0x426c80]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x426c84]
add ebx, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
shl eax, 4
cmp dword [0x2a9b018], 0xc
mov dword [ebp - 4], eax
jne 0x402c9f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x2a9b018]
cmp eax, 0xfa9
jne 0x402cbb
mov dword [0x2a9a5b4], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402cc8
mov dword [0x2a99f68], esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
lea eax, [ebx + edx]
shr edx, cl
mov dword [ebp - 0x14], eax
mov dword [0x2a9a5b0], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x2a9b018], 0x213
mov dword [ebp - 0x14], edx
jne 0x402d0f
push esi
push 0x402560
push esi
push 0x402610
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x2a9b018], 0xc
jne 0x402d4c
push esi
lea eax, [ebp - 0x82c]
push eax
push 0x4026e8
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
lea eax, [ebp - 0x102c]
push eax
push 0x402740
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edi, eax
shr edi, cl
lea edx, [ebx + eax]
xor dword [ebp - 4], edx
add edi, dword [ebp - 0x24]
cmp dword [0x2a9b018], 0x121
jne 0x402d8a
push 0x4026b4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 0xc]
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
sub dword [ebp - 0x10], ecx
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x402c54
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [ecx], edx
mov dword [ecx + 4], eax
pop ebx
leave
ret 4