joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427bca
Capabilities:
Check if file exists
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x45c4d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x427beb
mov eax, dword [edi]
jmp 0x427bed
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427c97
cmp dword [esi + 0x10], 0
je 0x427c97
cmp dword [esi + 0x14], 8
jb 0x427c10
mov ecx, dword [esi]
jmp 0x427c12
mov ecx, esi
cmp dword [edi + 0x14], 8
jb 0x427c1c
mov eax, dword [edi]
jmp 0x427c1e
mov eax, edi
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
jne 0x427c93
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x427c93
push ecx
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.00427f85
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 8
jb 0x427c58
mov edi, dword [edi]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
je 0x427c87
cmp dword [esi + 0x14], 8
jb 0x427c70
mov esi, dword [esi]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 5
cmovae eax, dword [ebp - 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004040c8
mov eax, ebx
jmp 0x427c99
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b782
mov esp, ebp
pop ebp
ret

Function at 0x427efd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45c4d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
xor eax, eax
push esi
push edi
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov esi, ecx
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e7e0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x427f65
push str.TencentQQBrowser
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0042c16e
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00403d75
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0042b782
mov esp, ebp
pop ebp
ret

Function at 0x428046
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42809f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x428090
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x42808c
cmp esi, ecx
jae 0x428090
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x42807c
cmp esi, ecx
jb 0x428094
xor eax, eax
jmp 0x42809e
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4283a2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 4
mov eax, 0x448154
call fcn.0042efd1
mov esi, ecx
xor ebx, ebx
lea eax, [ebp + 8]
push ebx
push 0x80
push 3
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 8
push ebx
cmovae eax, dword [ebp + 8]
push 1
push 0x80000000
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
xor eax, eax
push eax
push eax
push eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0xc
mov dword [ebp - 0x10], eax
call fcn.004277c4
pop ecx
test eax, eax
je 0x428422
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x428424
xor eax, eax
push 0
push 1
lea ecx, [ebp + 8]
mov dword [esi], eax
call fcn.004040c8
mov eax, esi
call fcn.0042efae
ret 0x18

Function at 0x4285fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x45c4d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x4286f0
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x4286f0
xor eax, eax
push 0x4e
push eax
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x56]
push eax
call fcn.0042e7e0
movzx eax, byte [ebp - 0x261]
push eax
movzx eax, byte [ebp - 0x262]
push eax
movzx eax, byte [ebp - 0x263]
push eax
movzx eax, byte [ebp - 0x264]
push eax
movzx eax, byte [ebp - 0x265]
push eax
movzx eax, byte [ebp - 0x266]
push eax
movzx eax, byte [ebp - 0x267]
push eax
movzx eax, byte [ebp - 0x268]
push eax
movzx eax, word [ebp - 0x26a]
push eax
movzx eax, word [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
lea eax, [ebp - 0x58]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push 0x28
push eax
call fcn.004285a6
add esp, 0x44
xor eax, eax
mov word [ebp - 0x260], ax
push 0x206
push eax
lea eax, [ebp - 0x25e]
push eax
call fcn.0042e7e0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
inc eax
jmp 0x4286f2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042b782
mov esp, ebp
pop ebp
ret
Function at 0x42ab54
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
test edx, edx
jne 0x42ab63
xor eax, eax
jmp 0x42ac3b
push ebx
push esi
mov esi, dword [ebp + 8]
or ecx, 0xffffffff
mov ebx, 0xff
cmp esi, 8
jb 0x42ac1c
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
dec edi
jne 0x42ab7f
pop edi
test esi, esi
je 0x42ac35
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x452cd0]
inc edx
dec esi
jne 0x42ac20
not ecx
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f515
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45c4d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004310eb
mov dword [ebp - 0x14], eax
cmp dword [0x45f138], esi
jne 0x43f608
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43f595
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43f6e8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43f6e8
push 0x44ea30
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43f6e8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45f138], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45f13c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45f140], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45f148], eax
test eax, eax
je 0x43f605
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45f144], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43f62d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43f620
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43f642
push 4
pop eax
jmp 0x43f6ea
cmp dword [ebp - 0x14], esi
je 0x43f642
push dword [0x45f138]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43f627
mov eax, dword [0x45f144]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43f6a0
cmp dword [0x45f148], edi
je 0x43f6a0
push eax
call ebx
push dword [0x45f148]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43f6a0
test eax, eax
je 0x43f6a0
call ecx
test eax, eax
je 0x43f695
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43f695
test byte [ebp - 8], 1
jne 0x43f6a0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43f6d0
mov eax, dword [0x45f13c]
cmp eax, edi
je 0x43f6cd
push eax
call ebx
test eax, eax
je 0x43f6cd
call eax
mov esi, eax
test esi, esi
je 0x43f6cd
mov eax, dword [0x45f140]
cmp eax, edi
je 0x43f6cd
push eax
call ebx
test eax, eax
je 0x43f6cd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45f138]
call ebx
test eax, eax
je 0x43f6e8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43f6ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b782
mov esp, ebp
pop ebp
ret
Function at 0x2e0284d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2e0284e4
pop dword [ebp - 0x48]
mov eax, 0x419ec06f
add eax, 0xec63c475
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x78655ca9
add dword [ebp - 0x58], 0xd5ece8a2
mov dword [ebp - 0x54], 0xcdcb942c
sub dword [ebp - 0x54], 0x9b9847e7
mov dword [ebp - 0x50], 0xca085366
sub dword [ebp - 0x50], 0x7dbc0f38
mov dword [ebp - 0x4c], 0xe0268696
sub dword [ebp - 0x4c], 0xe0268696
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xce388b2c
add dword [ebp - 0x58], 0xa639de2a
mov dword [ebp - 0x54], 0x1ce15b0b
add dword [ebp - 0x54], 0x248b066a
mov dword [ebp - 0x50], 0xc92b9cd7
sub dword [ebp - 0x50], 0x65bc306b
mov dword [ebp - 0x4c], 0x4d91a77d
sub dword [ebp - 0x4c], 0x4d91a77d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d0e2
push 0
call eax
mov ecx, 0x1d30b57d
add ecx, 0xe2cf82f0
xor esi, esi
add esi, eax
mov edx, 0x1fa8e621
sub edx, 0xf1a37821
add edx, dword [ebp - 0x48]
mov edi, 0xba236641
add edi, 0x13dae88c
sub dword [ebp - 0x34], 0xb76d6d81
mov ebx, dword [edx]
sub dword [ebp - 0x40], ecx
sub ebx, edi
xor dword [ebp - 0x28], ecx
mov dword [esi], ebx
sub dword [ebp - 0x24], 0x6f6fbb45
add esi, 0xa1426e2b
sub esi, 0xa1426e27
add edx, 0xd08c0e11
sub edx, 0xd08c0e0d
loop 0x2e0285fe
add eax, 0xd487
xor ebx, ebx
add ebx, eax
add eax, 0x3f8e4ea3
sub eax, 0x3f8e4e9e
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x537520
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 4
push esi
lea ebx, [esi + 4]
mov edi, 0x8c
push 0
mov dword [ebx], edi
mov dword [esi], 0x15974263
call fcn.00517b72
push 0x88
push ebx
push eax
mov dword [esi], eax
call fcn.00517b72
push 0x50505255
mov ebx, 0x1000
push ebx
push 1
mov dword [esi], eax
call dword [0x2a6d4]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x5375e1
xor eax, eax
xor dword [eax + esi], 0x53f83610
add eax, 4
cmp eax, edi
jb 0x537576
push ebx
push dword [ebp + 0xc]
push edi
push esi
call fcn.005179b2
xor ecx, ecx
xor dword [ecx + esi], 0x53f83610
add ecx, 4
cmp ecx, edi
jb 0x537591
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
movzx eax, word [esi + 2]
push dword [ebp + 0x10]
push eax
push dword [esi + 4]
call fcn.00519254
add esp, 0x14
test eax, eax
jl 0x5375d9
lea eax, [ebp - 4]
push eax
movzx eax, word [esi + 2]
push eax
push dword [esi + 4]
call fcn.00519422
test eax, eax
jl 0x5375d9
mov ax, word [ebp - 4]
mov word [esi], ax
push dword [ebp + 0xc]
call fcn.0051b75e
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43a940
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edx
call fcn.00490382
call fcn.00468a8f

Function at 0x44600f
Capabilities:
Authenticate hmac

Disassembly:
sub eax, dword [esp + eax*2 - 0x3c679f0e]
adc esi, 1
rol eax, 0xe1
jno 0x4bd340
mov dword [esp], eax
add cl, dl
pop edx
sub eax, edx
mov word [esp + eax*4 + 4], dx
mov word [esi + eax*2], cx
mov dword [esp + eax], edi
ret 4
Function at 0x49066e
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + eax*2 - 4]
or al, dh
adc eax, dword [edi + eax]
sub dl, 5
movsx ecx, byte [esp + edx - 0xfb]
xor eax, ebx
xor eax, 0x4697fb35
and cl, ch
neg eax
shl byte [esp + edx*4 - 0x3e9], 0x87
bt edx, ecx
adc eax, ecx
neg eax
xchg dword [esp + ecx*2], ecx
mov word [esp + edx - 0xfa], cx
not eax
xor ebx, eax
sar dword [esp + edx*2 - 0x1f6], 0x2f
pop edx
adc ebp, eax
sub cx, cx
jbe 0x49510f
push eax
invalid
push ecx
lea edx, [esp + edx + 0x18]
btc eax, 0xb4
mov ax, word [eax + edx - 0xf1090f8]
lea edx, [ecx*4 - 0x16f01de7]
lea ebp, [ebp + ecx - 0x88d4010]
adc dword [esp + ecx*4 - 0x22350024], 0x660b6b07
mov word [ebp + ecx*4 - 0x22350038], ax
mov eax, 0x3c2d6ebc
pop ecx
pop ecx
pop ecx
pop eax
pop edx
pop eax
ja fcn.004862ae
mov eax, 0x50327f1d
push eax
neg byte [esp + eax - 0x50327f1b]
mov edx, dword [eax + esi - 0x50327f1d]
or ax, word [esp + eax - 0x50327f1b]
mov ecx, dword [esi + eax - 0x50327fdb]
cwde
lea esi, [eax + esi - 0x7fdb]
adc eax, 0x92a29c3b
sub eax, eax
dec byte [esp + eax + 3]
adc edx, ecx
shl dword [esp + eax], 0x6c
mov dword [eax + esi], edx
movsx edx, al
ja 0x41b7d0
mov eax, 0x748a91b8
mov edx, eax
cbw
mov eax, dword [esi + edx - 0x748a91b8]
movzx ecx, dl
lea ecx, [edx + ecx*4 - 0x3cf231e1]
xadd cl, dh
lea esi, [esi + ecx*2 - 0x6f30c48c]
jge 0x487ba4
xor eax, ebx
shl cx, 0x62
sbb eax, 0xc3bb5918
and dx, dx
sbb cl, 0xae
neg cl
not eax
sar dl, 0xc3
not cl
dec eax
bswap ecx
btr edx, edx
ror eax, 1
not dx
xor ebx, eax
inc edx
add ebp, eax
neg cx
ror cx, 0x45
movzx edx, word [esi + edx - 0x740a4809]
ror ecx, cl
adc esi, 1
movzx eax, cl
and ecx, eax
xor dx, bx
not dx
xor dx, 0xc424
lea ecx, [eax + eax - 0x394bc3c4]
inc dx
lea ecx, [eax*4 + 0x58a2cc1e]
rol dx, 1
xor bx, dx
lea edi, [edi + eax*8 - 0x7ca]
btr eax, eax
call fcn.0042d56e
jmp ebp

Function at 0x4baac9
Capabilities:
Encode data using xor

Disassembly:
add edi, 6
call fcn.00490c02
salc
mov bl, 0x3d
or byte [bp + 0x47], 0x33
dec eax
nop
xchg esp, eax
scasd eax, dword es:[edi]
call 0xc83027c3
dec ecx
sub ah, bh
xor eax, 0xb2b92353
push es
dec ecx
ficomp word [esi + 0x3a9ad3a6]
xchg ecx, eax
sub dl, ah
xchg byte [edi + 8], dh
add byte [edi], 0x4d
invalid
Function at 0x4bcfa4
Capabilities:
Manually build aes constants

Disassembly:
sar cl, 0x23
xor eax, ebx
bts ecx, 8
ror eax, 3
jmp 0x483c11
mov ecx, dword [ebp]
add ebp, 4
mov dword [esp], ecx
popfd
bswap eax
movsx ecx, ax
movzx edx, cl
lea edi, [edx + edi - 0x8c]
or edx, 0xda856415
mov eax, dword [edi]
jae 0x428aa9
xor bl, al
add ecx, ecx
sbb esi, 1
rol ecx, 0xa5
setae dl
setb dl
mov word [esi + ecx - 0x57f3a45f], ax
mov eax, ecx
lea edi, [edi + ecx - 0x57f3a463]
shl eax, cl
mov eax, dword [edi + eax - 0x80000000]
jp 0x43e4cf
mov eax, 0xfb815288
sub edi, 4
lea ecx, [eax + eax*8 + 0x74a27397]
cbw
lea edx, [eax + ecx*2 - 0x2f4536c7]
mov ecx, dword [edi + ecx - 0x4c2e5a5f]
sub eax, eax
push edx
mul dword [esp + eax]
xor ecx, ebx
mov dword [esp + eax], 0x58a32f3f
dec edx
or eax, 0xabaa5c34
lea ecx, [ecx + eax - 0x6297df34]
setle byte [esp + 2]
neg ecx
sar dl, 0xc1
or byte [esp + 1], al
mov word [esp + 1], dx
lea ecx, [ecx + eax - 0x40921c89]
rol dword [esp], 0xc1
rol eax, 0x7e
ror ecx, 1
sub edx, eax
shl eax, 0x19
mul eax
lea ecx, [ecx + eax*4 - 0x571bd48b]
idiv byte [esp + eax*2 + 1]
xadd byte [esp + eax + 1], dh
xadd ax, dx
rol ecx, 2
xor dword [esp + eax - 0xfe00], eax
btc edx, 0x84
adc dword [esp + eax*2 - 0x1fc00], edx
neg ecx
push edx
shr eax, 0x3b
xor ebx, ecx
add esi, ecx
imul dword [esp + eax + 4]
mov ecx, dword [ebp + edx*2]
and word [esp + eax*2 + 2], ax
jns 0x48b30b
add edi, 2
mov edx, 0xa2bf3391
btr edx, edx
add edx, 0x25328529
shr eax, cl
movzx ecx, dl
mov dword [ecx + edi - 0xba], eax
jmp ebp

Function at 0x4c8fa8
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea edi, [edi + edx*4 - 0x3ac0446a]
mov dword [esp + edx - 0xeb0111b], edx
shr eax, cl
mov dword [edi + edx*4 - 0x3ac0446c], eax
movsx ecx, byte [esp + edx - 0xeb0111b]
mov eax, dword [ecx + esi - 0x1b]
lea esi, [esi + edx - 0xeb01117]
and word [esp + edx*2 - 0x1d602236], 0x969f
xor eax, ebx
bswap eax
neg eax
dec eax
neg byte [esp + edx - 0xeb0111b]
sal dx, 0x45
lea ecx, [edx + ecx - 0x52ca35f1]
ror eax, 1
shl edx, 0xa7
jb 0x4b4283
Function at 0x4c9000
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 4
mov ecx, dword [ebp]
shr edx, 4
bts dx, dx
xor ecx, ebx
movzx eax, dl
sub edx, 0x822e6a10
neg ecx
imul eax, edx
lea eax, [edx*8 - 0x1a40b7c3]
sbb ecx, 0xf79e8825
and eax, eax
mul al
rol ecx, 1
ror edx, 0x67
shl al, 0x44
neg ax
dec ecx
shr edx, 0x1a
push edx
xor ebx, ecx
pop eax
add edi, ecx
jmp edi
mov dword [esi], ecx
jmp 0x410a95
rol ecx, 1
push edx
sub ecx, 0xf532c188
dec eax
bswap ecx
sar al, 0xa2
xor ebx, ecx
not ax
shl edx, 0xab
div dword [esp + eax - 0xfef9]
add esi, ecx
sub al, ah
mov dx, word [ebp + edx - 0x45e14de1]
movsx ecx, ax
pop eax
jae 0x49a2a7
sar ecx, 0x7b
or ecx, dword [edi + edx]
or eax, eax
inc al
xor ecx, ebx
inc ecx
btc ax, dx
ror ecx, 1
not dl
neg eax
sbb ecx, 0xc63e5616
or eax, edx
or ax, 0xa637
or edx, 0x97aa4d39
bswap ecx
neg ecx
dec ecx
xor ebx, ecx
sub al, 0x8e
rol dx, 0xc
sbb esi, 3
jmp 0x49a1f2
push edx
adc ecx, eax
mov dword [esp + eax*2 + 2], edx
neg al
jno 0x4c3760
mov eax, dword [ebp]
mov edx, 0x8d9d569f
movsx ecx, dx
xchg dx, cx
mov ecx, dword [ebp + ecx*2 - 0xad3a]
add ebp, 4
ror dl, 0xc6
sar dx, 0xeb
sar edx, 0x23
not eax
and dl, dl
ror dl, 0x61
bts edx, 0x34
not ecx
shr edx, 0xa3
sar edx, 0xa3
or eax, ecx
sar dl, 0x26
mov dword [edx + ebp - 0x3c6cefe], eax
bswap edx
lea eax, [edx + edx*4 - 0x5e7e1efc]
sbb edx, edx
lea edi, [edx + edi - 4]
bswap edx
seta dl
lea ecx, [edx*4 + 0x2c9a198c]
add edx, dword [edi + edx]
dec al
not ax
jo 0x47b693
xor edx, ebx
btr ecx, eax
shr eax, 0x8d
lea edx, [edx + eax*2 + 0x65ae9888]
btr eax, ecx
rol al, 0xc1
neg edx
xor edx, 0xa219c393
ror edx, 2
sal ecx, cl
inc ecx
xor ebx, edx
imul eax, ecx
sar cx, 0xa1
add esi, edx
jmp esi
Function at 0xc4c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc4c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc4c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc4c06a
add dl, dl
jne 0xc4c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc4c0dc
xor eax, eax
add dl, dl
jne 0xc4c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc4c17d
add dl, dl
jne 0xc4c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc4c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc4c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc4c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc4c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc4c075
mov eax, 1
add dl, dl
jne 0xc4c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc4c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc4c0e1
sub eax, ebx
mov ebx, 1
jne 0xc4c128
mov ecx, 1
add dl, dl
jne 0xc4c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc4c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc4c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc4c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc4c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc4c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc4c136
cmp eax, 0x7d00
jae 0xc4c16d
cmp eax, 0x500
jb 0xc4c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc4c075
cmp eax, 0x7f
ja 0xc4c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc4c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc4c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc4c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ca10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x467014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x468070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041c100
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x467a88
push eax
call fcn.0041c100
mov esi, dword [0x468080]
xor ebx, ebx
mov edi, dword [0x468084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46b280], bl
mov eax, ebx
mov ecx, 0x468070
cmovae ecx, dword [0x468070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46b390], al
inc ebx
cmp ebx, 0x100
jl 0x4055c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46b280]
movzx eax, byte [esi + 0x46b390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x405614
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46b280]
mov byte [esi + 0x46b280], al
inc esi
mov byte [edi + 0x46b280], dl
cmp esi, 0x100
jl 0x4055f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405190
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405669
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40565f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.004216ab
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4056ab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4056a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.004216ab
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043acab
int3