joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55bed4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
xor eax, eax
push ebp
push 0x55c06f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406a04
xor eax, eax
push ebp
push 0x55bf40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4865ec]
call fcn.0048c198
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55bfe8
xor eax, eax
push ebp
push 0x55c040
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0048bf80
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0048bcdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c047
mov eax, dword [ebp - 0x14]
call fcn.00404358
cmp dword [ebp - 8], 0
je 0x55c03f
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
call sub.kernel32.dll_DeleteFileW
ret

Function at 0x55c1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x486708]
call fcn.00404328
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x55c25b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
mov eax, ebx
call fcn.0048bcdc
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0048bf80
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
dec eax
test eax, eax
jl 0x55c21c
inc eax
xor byte [ebx], 0x27
inc ebx
dec eax
jne 0x55c215
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0048bcdc
mov ecx, 0x55c278
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.0055bd58
mov dword [ebp - 4], eax
push 0
push 0
mov eax, esi
call fcn.0048bcdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c262
mov eax, dword [ebp - 8]
call fcn.00404358
ret

Function at 0x561990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004069b0
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406bb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5619ec
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffec0
mov ebx, 1
mov eax, esp
xor ecx, ecx
mov edx, 0x11c
call fcn.00403a80
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
lea eax, [esp + 0x11c]
xor ecx, ecx
mov edx, 0x24
call fcn.00403a80
push 0x561b48
push 0x561b70
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409db4
test eax, eax
je 0x561a4b
lea edx, [esp + 0x11c]
push edx
call eax
jmp 0x561a58
lea eax, [esp + 0x11c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [esp + 0x10], 2
jne 0x561b3c
mov eax, dword [esp + 4]
add eax, 0xfffffffd
sub eax, 2
jae 0x561a74
mov ebx, 2
cmp dword [esp + 4], 5
jne 0x561a8c
cmp dword [esp + 8], 0
jne 0x561a8c
mov ebx, 3
jmp 0x561b3c
cmp dword [esp + 4], 5
jne 0x561aa4
cmp dword [esp + 8], 1
jne 0x561aa4
mov ebx, 4
jmp 0x561b3c
cmp dword [esp + 4], 5
jne 0x561ad5
cmp dword [esp + 8], 2
jne 0x561ad5
cmp byte [esp + 0x11a], 1
jne 0x561ace
cmp word [esp + 0x11c], 9
jne 0x561ace
mov ebx, 4
jmp 0x561b3c
mov ebx, 5
jmp 0x561b3c
cmp dword [esp + 4], 6
jne 0x561aea
cmp dword [esp + 8], 0
jne 0x561aea
mov ebx, 6
jmp 0x561b3c
cmp dword [esp + 4], 6
jne 0x561aff
cmp dword [esp + 8], 1
jne 0x561aff
mov ebx, 7
jmp 0x561b3c
cmp dword [esp + 4], 6
jne 0x561b19
mov eax, dword [esp + 8]
add eax, 0xfffffffe
sub eax, 2
jae 0x561b19
mov ebx, 8
jmp 0x561b3c
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x561b32
mov edx, dword [esp + 8]
sub edx, 4
jne 0x561b32
mov ebx, 0xa
jmp 0x561b3c
cmp eax, 0xa
jne 0x561b3c
mov ebx, 0xa
mov eax, ebx
add esp, 0x140
pop ebx
ret
Function at 0x563b90
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00406998
xor eax, eax
push ebp
push 0x563dae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00403b1c
mov esi, eax
lea eax, [ebp - 0x2d0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00403a80
cmp dword [ebp + 0x20], 0
je 0x563c4b
cmp dword [ebp - 0x10], 0
je 0x563c4b
mov eax, dword [ebp + 0x20]
call fcn.00470f58
test al, al
jne 0x563c01
mov eax, dword [ebp + 0x20]
call fcn.00470fa0
test al, al
je 0x563c24
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00406a3c
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x563c45
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00406a3c
push eax
call sub.shell32.dll_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x563c72
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x563dc0
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
jmp 0x563c91
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x563dc0
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00409774
test bl, bl
je 0x563cd9
cmp byte [ebp + 0x14], 0
jne 0x563cd9
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0049e94c
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 4]
call fcn.00564814
test byte [ebp + 0x14], bl
je 0x563d98
mov dl, 1
mov eax, dword [0x49bedc]
call fcn.004a2c60
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x563d91
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004a3578
call fcn.0049e94c
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004035f0
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004035f0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 4]
call fcn.00563ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563d98
mov eax, dword [ebp - 0x1c]
call fcn.00404358
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563db5
lea eax, [ebp + 0x20]
call fcn.004069a0
ret
Function at 0x578db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x578e24
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x632b50]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406bb0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.00478da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x578e2b
lea eax, [ebp - 0x20c]
call fcn.004069a0
ret

Function at 0x579314
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x579418
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, edi
call fcn.00580edc
mov ebx, eax
test ebx, ebx
je 0x57936f
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_GetWindowLongW
mov esi, eax
and esi, 0x10000000
cmp esi, 0x10000000
jne 0x579340
mov eax, dword [edi + 0x14]
cmp eax, 1
jne 0x5793a3
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x579434
call fcn.004723c4
mov eax, dword [ebp - 0xc]
call fcn.004ece38
jmp 0x5793d2
cmp eax, 5
jne 0x5793d2
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x579460
call fcn.004723c4
mov eax, dword [ebp - 0x18]
call fcn.004ece38
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
imul eax, dword [ebp - 4], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x5793f4
cmp eax, dword [esp]
setb bl
jmp 0x5793f7
setl bl
add esp, 8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57941f
lea eax, [ebp - 0x18]
call fcn.004069a0
lea eax, [ebp - 0xc]
call fcn.004069a0
ret
Function at 0x579480
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
xor eax, eax
push ebp
push 0x579572
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push 0x9c4
call sub.kernel32.dll_Sleep_1
push 0x579584
push 0x57959c
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
jbe 0x57950d
mov eax, 0x5795c4
call fcn.004ece38
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x57950d
mov eax, 0x5795fc
call fcn.004ece38
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x579503
push 0x12c
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x1770
ja 0x57950d
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x5794eb
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x57963c
call fcn.004723c4
mov eax, dword [ebp - 4]
call fcn.004ece38
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
xor edx, edx
push edx
push eax
imul eax, edi, 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x579556
cmp eax, dword [esp]
setb bl
jmp 0x579559
setl bl
add esp, 8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x579579
lea eax, [ebp - 4]
call fcn.004069a0
ret

Function at 0x57965c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x579726
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, edi
call fcn.00580edc
mov ebx, eax
test ebx, ebx
je 0x5796be
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_GetWindowLongW
mov esi, eax
and esi, 0x10000000
cmp esi, 0x10000000
jne 0x579685
push ebx
call sub.user32.dll_IsIconic
test eax, eax
jne 0x579685
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x579744
call fcn.004723c4
mov eax, dword [ebp - 0xc]
call fcn.004ece38
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
imul eax, dword [ebp - 4], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x57970a
cmp eax, dword [esp]
setb bl
jmp 0x57970d
setl bl
add esp, 8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57972d
lea eax, [ebp - 0xc]
call fcn.004069a0
ret
Function at 0x582784
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x38]
mov edx, dword [0x537bd4]
call fcn.00407704
xor eax, eax
push ebp
push 0x5828af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x38
call fcn.00403a80
movzx eax, byte [esi + 0x28]
push eax
movzx eax, byte [esi + 0x30]
push eax
movzx eax, byte [esi + 0x4c]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 0x14]
movzx ecx, byte [esi + 0x24]
call fcn.00537da0
mov edx, dword [ebp - 0x38]
mov eax, ebx
call fcn.004c80dc
mov edx, dword [ebp - 0x34]
mov eax, ebx
call fcn.004c8110
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00530fe4
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00530534
movzx eax, byte [ebp - 8]
test al, al
jbe 0x582821
movzx eax, al
xor edx, edx
sub edx, eax
mov eax, dword [ebx + 0x1f0]
call fcn.00525294
mov esi, dword [ebp - 0x14]
cmp esi, 0xffffffff
je 0x58283d
mov eax, esi
call fcn.004ecf14
mov edx, eax
mov eax, dword [ebx + 0x1f0]
call fcn.005251c0
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x582852
mov eax, esi
call fcn.004ecf14
mov dword [ebx + 0x2b8], eax
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x582867
mov eax, esi
call fcn.004ecf14
mov dword [ebx + 0x2c4], eax
cmp dword [ebp - 0x18], 0
je 0x58287b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x1f0]
call fcn.005252e8
cmp byte [ebp - 7], 0
je 0x582893
movzx edx, byte [0x5828bc]
mov eax, dword [ebx + 0x1f0]
call fcn.005254a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5828b6
lea eax, [ebp - 0x38]
mov edx, dword [0x537bd4]
call fcn.004077dc
ret
Function at 0x585638
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5856ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x632b50]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406bb0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.00478da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5856b3
lea eax, [ebp - 0x20c]
call fcn.004069a0
ret

Function at 0x5857d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58584c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x632b50]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406bb0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.00478da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x585853
lea eax, [ebp - 0x20c]
call fcn.004069a0
ret
Function at 0x599824
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0059a3dc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x59a2d8
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x59a31d
lea eax, [ebp - 0x60]
call fcn.00599824
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.0059984c
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00599920
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x59a31f
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x59a348
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x59a34e
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x59a32d
lea eax, [ebp - 0x60]
call fcn.00599824
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.0059984c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.0059a1c0
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00599920
lea eax, [ebp - 0x60]
call fcn.00599824
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.0059984c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.0059984c
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00599920
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x59f4a0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x59f4b4
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x59f4b3
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.00406378
xor ebx, ebx
cmp esi, dword [esp]
jge 0x59f618
inc ebx
mov eax, edi
call fcn.00406250
movzx edx, byte [ebp + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x59f5d1
inc ebx
mov eax, edi
call fcn.00406250
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x59f5a0
inc ebx
mov eax, edi
call fcn.00406250
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00406250
movzx edx, byte [ebp + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x59f60c
inc ebx
mov eax, edi
call fcn.00406250
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00406250
mov byte [eax + ebx - 1], 0x3d
jmp 0x59f60c
inc ebx
mov eax, edi
call fcn.00406250
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00406250
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00406250
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x59f4e8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a0b30
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x626194
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x5a0b4f
mov esi, 1
mov edx, 0x62629c
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x5a0bc8
dec ebx
je 0x5a0bea
dec ebx
je 0x5a0c0c
dec ebx
je 0x5a0c2d
jmp 0x5a0c47
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5a0c47
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5a0c47
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5a0c47
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x5a0bb8
inc esi
add edx, 0x40
cmp esi, 9
jne 0x5a0b6b
mov esi, 0x20
mov eax, 0x6261c4
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x5a0c6c
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5a0ca8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x62624b]
test bl, bl
jbe 0x5a0cd9
lea eax, [esi + 0x3e0]
call fcn.005a0c84
lea eax, [esi + 0x3fc]
call fcn.005a0c84
dec bl
jne 0x5a0cbf
mov cl, 0x30
mov edi, 0x62621c
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x5a0cfa
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x5a0d07
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x5a0ce3
pop edx
pop edi
pop esi
pop ebx
ret