joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4166d0
Capabilities:
Access peb ldr_data
Get process heap flags
Persist via appinit_dlls registry key

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
cmp byte [eax + 0x6e1], 0
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x17], 0
jne 0x4168f9
mov ecx, dword [0x98761c]
push 0x92bb4c
push 0
push 0x1402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
mov eax, 0x92bb4c
call fcn.00500730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4168f9
mov eax, dword [esi + 8]
lea edx, [esi + 0xc]
shr eax, 1
push edx
call fcn.004fef10
add esp, 4
mov ebp, eax
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x18]
push esi
push 0
push edx
mov dword [esp + 0x28], ebp
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
test ebp, ebp
je 0x4168f9
cmp word [ebp], 0
mov ebx, ebp
je 0x4168f0
jmp 0x416770
movzx eax, word [ebx]
cmp ax, 0x20
je 0x41677f
cmp ax, 0x2c
jne 0x416784
add ebx, 2
jmp 0x416770
movzx eax, word [ebx]
mov dword [esp + 0x18], ebx
test ax, ax
je 0x4168d0
mov edi, ebx
mov byte [esp + 0x16], 0
movzx eax, ax
mov edi, edi
cmp ax, 0x20
je 0x4167b8
cmp ax, 0x2c
je 0x4167b8
movzx eax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4167a0
cmp edi, ebx
jb 0x416880
mov esi, edi
sub esi, ebx
sar esi, 1
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00507d92
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x416877
add esi, esi
push esi
push ebx
push ebp
call fcn.005186a0
xor eax, eax
add esp, 0xc
push eax
mov ecx, ebp
mov word [esi + ebp], ax
call fcn.004fabf0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41686a
push str.AppInit_DLL
call fcn.00505200
mov esi, dword [esp + 0x28]
add esp, 4
push ebx
push esi
mov dword [esi + 0x784], eax
call fcn.00416140
mov ecx, dword [esi + 0x654]
cmp dword [ecx + 0x30], 0xd
jne 0x416844
mov byte [esp + 0x17], 1
mov byte [esp + 0x16], 1
mov esi, dword [esi + 0x784]
push 1
push 2
call fcn.00505290
mov edx, dword [esp + 0x2c]
push ebx
mov dword [edx + 0x784], 0
call fcn.00507bce
add esp, 0xc
push ebp
call fcn.00507bce
mov ebx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x1c]
jmp 0x416880
movzx eax, word [edi]
cmp ax, 0x20
je 0x41688f
cmp ax, 0x2c
jne 0x416894
add edi, 2
jmp 0x416880
cmp byte [esp + 0x16], 0
je 0x4168c0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4168a0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push ebx
call fcn.005087f0
add esp, 0xc
jmp 0x4168c6
mov dword [esp + 0x18], edi
mov ebx, edi
cmp word [ebx], 0
jne 0x416770
cmp byte [esp + 0x17], 0
je 0x4168f0
push 0x92bb4c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
mov edx, ebp
call fcn.00500b20
add esp, 0xc
push ebp
call fcn.00507bce
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x417180
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x238
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], 0
mov eax, str.Current_User
cmp esi, 0x80000001
je 0x4171bb
mov eax, str.Local_Machine
push eax
push str.Startup_Programs___s_
lea edx, [esp + 0x40]
call fcn.00401bb0
mov ecx, dword [0x98761c]
add esp, 8
lea eax, [esp + 0x38]
push eax
push 0
push 0x1402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push 0xb
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.00500570
mov edi, eax
add esp, 0xc
test edi, edi
jl 0x41734f
push 0
lea eax, [esp + 0x20]
call fcn.00500d00
add esp, 4
test eax, eax
jne 0x417346
mov eax, dword [0x98761c]
xor esi, esi
mov dword [esp + 0x18], 1
test eax, eax
je 0x417258
push 8
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
mov bl, 1
test esi, esi
je 0x417346
mov eax, dword [esi + 8]
test eax, eax
je 0x417346
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x41727f
xor bl, bl
movzx eax, bl
mov dword [esi + 0x1c], eax
test bl, bl
jne 0x417346
cmp dword [esp + 0x30], 0
je 0x417325
cmp dword [esp + 0x34], 0
je 0x417325
mov eax, dword [esp + 0x20]
push 0x92bd80
call fcn.00505200
mov ecx, dword [esp + 0x34]
add esp, 4
push 1
mov dword [ebp + 0x784], eax
call fcn.004fabf0
mov esi, eax
add esp, 4
test esi, esi
je 0x417301
push esi
push ebp
call fcn.00416140
mov ecx, dword [ebp + 0x654]
cmp dword [ecx + 0x30], 0xd
jne 0x4172f8
lea edi, [esp + 0x1c]
call fcn.00500da0
mov edi, eax
test edi, edi
jl 0x4172f8
mov dword [esp + 0x18], 0
push esi
call fcn.00507bce
add esp, 4
mov edx, dword [ebp + 0x654]
mov eax, dword [edx + 0x30]
mov esi, dword [ebp + 0x784]
push 1
push eax
call fcn.00505290
add esp, 8
mov dword [ebp + 0x784], 0
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
push eax
lea eax, [esp + 0x20]
call fcn.00500d00
add esp, 4
test eax, eax
je 0x41723a
lea esi, [esp + 0x1c]
call fcn.00500e20
mov ecx, dword [esp + 0x244]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x238
ret 4
Function at 0x41c910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x536fda
mov eax, dword fs:[0]
push eax
mov eax, dword [0x984164]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov edx, dword [esp + 0x14]
push edx
call fcn.0041c200
xor eax, eax
mov dword [esp + 0xc], eax
or ecx, 0xffffffff
mov dword [edx], vtable.AvgBasFileImplementation.0
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], ecx
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x10], eax
mov byte [edx + 0x28], al
mov dword [edx + 0x24], eax
mov dword [edx + 0x14], eax
mov dword [esp + 0xc], ecx
mov eax, edx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x41caa0
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [esp + 0x10]
mov dword [esi], 0
mov dword [esi + 4], 0
mov ecx, dword [ecx + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41cae5
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebx
test eax, eax
je 0x41cae5
call ebx
mov ecx, eax
call fcn.0041c040
pop edi
pop esi
pop ebx
ret 4
mov edx, dword [esp + 0x10]
push 1
push 0
push 0
push edx
call fcn.005183d0
xor ecx, ecx
add eax, edi
adc edx, ecx
pop edi
mov dword [esi], eax
mov dword [esi + 4], edx
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x41cbc0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
test ebx, ebx
je 0x41cbdc
mov dword [ebx], 0
mov eax, dword [esp + 0x18]
push 0
mov ecx, eax
lea edx, [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push edx
sar ecx, 0x1f
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xffffffff
jne 0x41cc20
call ebp
test eax, eax
je 0x41cc20
call ebp
mov ecx, eax
call fcn.0041c040
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x18]
push edi
mov edi, dword [esp + 0x24]
push 0
lea edx, [esp + 0x1c]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x41cc7a
mov eax, dword [esp + 0x18]
cmp eax, edi
jae 0x41cc50
mov dword [esp + 0x10], 0x6001018b
test ebx, ebx
je 0x41cc62
pop edi
pop esi
mov dword [ebx], eax
mov eax, dword [esp + 8]
pop ebp
pop ebx
pop ecx
ret 0x18
cmp eax, edi
je 0x41cc8e
pop edi
pop esi
mov dword [esp + 8], 0xe001018b
mov eax, dword [esp + 8]
pop ebp
pop ebx
pop ecx
ret 0x18
call ebp
cmp eax, 0x26
je 0x41cc66
call ebp
mov ecx, eax
call fcn.0041c040
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
Function at 0x41cf00
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
push ebx
push ebp
push edi
mov ecx, esi
call edx
lea ebp, [esi + 0x40]
push ebp
push 0x104
mov byte [esi + 0x249], 0
mov byte [esi + 0x24a], 0
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
mov dword [esp + 0xc], 0x100
lea ebx, [esi + ebx*2 + 0x40]
movzx eax, di
push eax
push str.avg_04lX.tmp
push ebx
call fcn.005092a5
add esp, 0xc
push 0
push 0x4000100
push 1
push 0
push 0
push 0xc0010000
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x41cf87
inc edi
sub dword [esp + 0xc], 1
jne 0x41cf40
mov eax, 0xe001004f
pop edi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x3c]
push eax
push ecx
mov ecx, esi
call edx
mov edi, eax
test edi, edi
jge 0x41cfa9
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
mov eax, edi
pop edi
pop ebp
mov dword [esi + 0x14], 3
pop ebx
pop ecx
ret 8
Function at 0x432fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x77], 0x10
jae 0x432fe1
mov al, 0x16
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005078c8
mov esp, ebp
pop ebp
ret
mov cl, byte [esi + 0x16]
cmp cl, 4
jne 0x432ff2
test edi, edi
je 0x432fce
cmp edi, 3
je 0x432fce
movzx eax, word [esi + 0x70]
test al, 8
je 0x433001
mov byte [esp + 0xf], 8
jmp 0x433019
and al, 0x80
neg al
sbb al, al
and al, 6
cmp cl, 3
setae cl
lea ecx, [ecx + ecx + 2]
xor al, cl
mov byte [esp + 0xf], al
movzx eax, byte [esp + 0xf]
movzx edx, byte [esi + 0x75]
push 2
push eax
push eax
movzx eax, byte [esi + 0x78]
push edx
lea ebx, [esi + 0x60]
push eax
lea ecx, [esp + 0x24]
mov edx, ebx
call fcn.0041f7c0
test al, al
jne 0x433109
movzx ecx, byte [esi + 0x75]
movzx edx, byte [esi + 0x78]
push 0
push 0
push 2
push ecx
push edx
lea ecx, [esp + 0x2c]
mov edx, ebx
call fcn.0041f7c0
test al, al
jne 0x433109
mov ebx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x24]
call fcn.0041d7d0
test al, al
jne 0x433109
mov al, byte [esp + 0xf]
cmp al, 2
jne 0x433096
movzx eax, byte [esi + 0x76]
mov cx, word [esp + 0x10]
mov word [esi + eax*8 + 0x110], cx
jmp 0x4330d4
cmp al, 4
jne 0x4330ba
movzx edx, byte [esi + 0x76]
mov eax, dword [esp + 0x10]
mov dword [esi + edx*8 + 0x110], eax
movzx ecx, byte [esi + 0x76]
mov dword [esi + ecx*8 + 0x114], 0
jmp 0x4330d4
movzx eax, byte [esi + 0x76]
mov edx, dword [esp + 0x10]
mov dword [esi + eax*8 + 0x110], edx
mov ecx, dword [esp + 0x14]
mov dword [esi + eax*8 + 0x114], ecx
mov ecx, dword [esp + 0x20]
lea edx, [edi + edi*2]
lea eax, [esi + edx*8 + 0x1a0]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
xor al, al
mov ecx, dword [esp + 0x3c]
pop esi
pop ebx
xor ecx, esp
call fcn.005078c8
mov esp, ebp
pop ebp
ret
Function at 0x434670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov eax, 4
xor cl, cl
cmp al, dl
sbb eax, eax
push ebp
mov ebp, dword [esp + 0x14]
and eax, 0x20
add eax, 0x1f
and ebp, eax
push edi
mov dword [esp + 0xc], ebx
jne 0x4346d1
cmp dl, 4
jne 0x4347d7
cmp byte [ebx + 0x16], dl
jne 0x4347d7
lea ecx, [ebx + 0x110]
cmp esi, ecx
jb 0x4347d7
add ebx, 0x188
cmp esi, ebx
ja 0x4347d7
mov dword [esi + 4], ebp
xor al, al
pop edi
pop ebp
pop ebx
add esp, 8
ret 4
mov al, byte [ebx + 0x198]
movzx edx, dl
and al, 1
sub edx, 2
je 0x434768
sub edx, 2
je 0x434722
mov edi, dword [esi]
mov edx, dword [esi + 4]
test ebp, ebp
jbe 0x434718
mov ecx, edx
shr ecx, 0x18
test cl, cl
setl cl
shld edx, edi, 1
movzx eax, al
mov ebx, edx
cdq
add edi, edi
or edi, eax
or edx, ebx
sub ebp, 1
mov al, cl
jne 0x4346f3
mov ebx, dword [esp + 0xc]
mov dword [esi + 4], edx
mov al, byte [esi + 7]
mov dword [esi], edi
jmp 0x43479d
mov edx, dword [esi]
test ebp, ebp
jbe 0x434740
mov ecx, edx
shr ecx, 0x18
test cl, cl
setl cl
movzx eax, al
add edx, edx
or edx, eax
sub ebp, 1
mov al, cl
jne 0x434728
mov dword [esi], edx
cmp byte [ebx + 0x16], 4
jne 0x434763
lea edx, [ebx + 0x110]
cmp esi, edx
jb 0x434763
lea eax, [ebx + 0x188]
cmp esi, eax
ja 0x434763
mov dword [esi + 4], 0
mov al, byte [esi + 3]
jmp 0x43479d
mov dx, word [esi]
mov word [esp + 0xc], dx
test ebp, ebp
jbe 0x434797
mov edx, dword [esp + 0xc]
mov ecx, edx
shr ecx, 8
test cl, cl
setl cl
movzx ax, al
add edx, edx
or dx, ax
sub ebp, 1
mov word [esp + 0xc], dx
mov al, cl
jne 0x434774
mov word [esi], dx
mov al, byte [esi + 1]
and byte [ebx + 0x199], 0xf7
mov dl, byte [ebx + 0x199]
shr al, 7
xor al, cl
je 0x4347ba
or dl, 8
mov byte [ebx + 0x199], dl
test cl, cl
je 0x4347d0
or byte [ebx + 0x198], 1
xor al, al
pop edi
pop ebp
pop ebx
add esp, 8
ret 4
and byte [ebx + 0x198], 0xfe
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 4
Function at 0x434a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov al, byte [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov dl, 4
movzx ebx, dl
push edi
mov edi, ecx
xor cl, cl
cmp bl, al
sbb ebx, ebx
and ebx, 0x20
add ebx, 0x1f
and edi, ebx
mov dword [esp + 0xc], ebp
jne 0x434af4
cmp al, dl
jne 0x434c01
cmp byte [ebp + 0x16], dl
jne 0x434c01
lea eax, [ebp + 0x110]
cmp esi, eax
jb 0x434c01
add ebp, 0x188
cmp esi, ebp
ja 0x434c01
mov dword [esi + 4], edi
xor al, al
pop edi
pop ebp
pop ebx
add esp, 8
ret 8
movzx eax, al
sub eax, 2
je 0x434b8d
sub eax, 2
je 0x434b46
mov edx, dword [esi]
mov eax, dword [esi + 4]
test edi, edi
jbe 0x434b39
mov edi, edi
mov ecx, eax
shr ecx, 0x18
test cl, cl
setl cl
shld eax, edx, 1
mov ebp, eax
add edx, edx
movzx eax, cl
mov ebx, edx
cdq
or ebx, eax
or ebp, edx
sub edi, 1
mov edx, ebx
mov eax, ebp
jne 0x434b10
mov ebp, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, byte [esi + 7]
mov dword [esi], edx
jmp 0x434bc7
mov eax, dword [esi]
test edi, edi
jbe 0x434b66
lea esp, [esp]
mov ecx, eax
shr ecx, 0x18
test cl, cl
setl cl
movzx ebx, cl
add eax, eax
or eax, ebx
sub edi, 1
jne 0x434b50
mov dword [esi], eax
cmp byte [ebp + 0x16], dl
jne 0x434b88
lea edx, [ebp + 0x110]
cmp esi, edx
jb 0x434b88
lea eax, [ebp + 0x188]
cmp esi, eax
ja 0x434b88
mov dword [esi + 4], 0
mov al, byte [esi + 3]
jmp 0x434bc7
mov ax, word [esi]
mov word [esp + 0xc], ax
test edi, edi
jbe 0x434bc1
lea esp, [esp]
mov eax, dword [esp + 0xc]
mov ecx, eax
shr ecx, 8
test cl, cl
setl cl
movzx dx, cl
add eax, eax
or ax, dx
sub edi, 1
mov word [esp + 0xc], ax
jne 0x434ba0
mov word [esi], ax
mov al, byte [esi + 1]
and byte [ebp + 0x199], 0xf7
mov dl, byte [ebp + 0x199]
shr al, 7
xor al, cl
je 0x434be4
or dl, 8
mov byte [ebp + 0x199], dl
test cl, cl
je 0x434bfa
or byte [ebp + 0x198], 1
xor al, al
pop edi
pop ebp
pop ebx
add esp, 8
ret 8
and byte [ebp + 0x198], 0xfe
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 8
Function at 0x435030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, byte [esp + 8]
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov cl, 4
mov bl, cl
cmp bl, al
sbb esi, esi
and esi, 0x20
add esi, 0x1f
and edi, esi
jne 0x43508d
cmp al, cl
jne 0x435173
cmp byte [ebp + 0x16], cl
jne 0x435173
lea eax, [ebp + 0x110]
cmp edx, eax
jb 0x435173
add ebp, 0x188
cmp edx, ebp
ja 0x435173
mov dword [edx + 4], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
movzx eax, al
xor esi, esi
sub eax, 2
mov dword [esp + 0x14], esi
je 0x4350fe
sub eax, 6
je 0x4350d7
cmp byte [ebp + 0x16], cl
jne 0x4350bc
lea ecx, [ebp + 0x110]
cmp edx, ecx
jb 0x4350bc
lea eax, [ebp + 0x188]
cmp edx, eax
ja 0x4350bc
mov dword [edx + 4], esi
mov eax, dword [edx]
mov edi, edi
mov ecx, eax
shr ecx, 0x18
add eax, eax
sub edi, 1
jne 0x4350c0
mov dword [edx], eax
mov edx, eax
shr edx, 0x18
mov edi, eax
jmp 0x435129
mov eax, dword [edx]
mov esi, dword [edx + 4]
lea esp, [esp]
mov ecx, esi
shld esi, eax, 1
shr ecx, 0x18
add eax, eax
sub edi, 1
jne 0x4350e0
mov dword [edx], eax
mov dword [edx + 4], esi
mov edx, esi
shr edx, 0x18
mov edi, eax
jmp 0x435129
mov bx, word [edx]
mov word [esp + 0x14], bx
mov ecx, dword [esp + 0x14]
add bx, bx
shr ecx, 8
sub edi, 1
mov word [esp + 0x14], bx
jne 0x435106
mov eax, dword [esp + 0x14]
mov word [edx], bx
mov edx, eax
shr edx, 8
movzx edi, bx
mov byte [esp + 0x13], dl
and dl, 0x82
and edi, 0xff
or dl, byte [edi + 0x921d38]
mov bl, cl
shr bl, 7
or dl, bl
or dl, 2
or eax, esi
jne 0x43514d
or dl, 0x40
mov al, byte [esp + 0x13]
and byte [ebp + 0x199], 0xf7
xor al, cl
mov byte [ebp + 0x198], dl
mov dl, byte [ebp + 0x199]
test al, al
jns 0x435173
or dl, 8
mov byte [ebp + 0x199], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x454860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
xor eax, eax
test edx, edx
je 0x454893
mov cl, byte [edx]
test cl, cl
je 0x454893
push esi
lea ecx, [ecx]
movzx ecx, cl
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x905670]
inc edx
mov esi, eax
xor ecx, eax
ror esi, 6
add esi, ecx
mov cl, byte [edx]
mov eax, esi
test cl, cl
jne 0x454870
pop esi
ret

Function at 0x454940
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
mov esi, eax
test edx, edx
je 0x45499a
test esi, esi
jbe 0x454971
push ebx
mov edi, edi
movzx eax, byte [edx]
and eax, 0xff
mov eax, dword [eax*4 + 0x905670]
mov ebx, ecx
inc edx
xor eax, ecx
ror ebx, 6
add ebx, eax
sub esi, 1
mov ecx, ebx
jne 0x454950
pop ebx
mov edx, dword [edi + 0x5720]
mov word [edi + edx*2 + 0x3720], cx
inc dword [edi + 0x5720]
cmp dword [edi + 0x5720], 0x1000
jb 0x45499a
mov eax, dword [esp + 8]
call fcn.004548a0
pop esi
ret 4
Function at 0x4578e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
mov eax, ebx
mov edx, ebp
xor cl, cl
mov edi, edi
mov byte [eax], cl
inc eax
inc cl
sub edx, 1
jne 0x4578f0
cmp dword [esp + 0xc], edx
je 0x45792b
push esi
mov dl, byte [edi]
inc edi
mov eax, ebx
mov ecx, ebp
movzx esi, dl
jmp 0x457910
movzx edx, byte [eax]
xor edx, esi
mov dl, byte [edx + 0x908d60]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x457910
sub dword [esp + 0x10], 1
jne 0x457901
pop esi
pop edi
pop ebp
ret 8

Function at 0x457d00
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
mov ecx, ebx
cmp edi, 3
jb 0x457d82
mov eax, 0xaaaaaaab
mul edi
push ebp
mov ebp, edx
shr ebp, 1
lea esp, [esp]
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
shl eax, 8
or eax, edx
movzx edx, byte [esi + 2]
shl eax, 8
or eax, edx
mov edx, eax
shr edx, 0x12
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 0x3f
mov byte [ecx + 2], dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add esi, 3
add ecx, 4
sub edi, 3
sub ebp, 1
jne 0x457d20
pop ebp
cmp edi, 2
jne 0x457dd1
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
shl eax, 8
or eax, edx
mov edx, eax
shr edx, 0xa
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
mov edx, eax
shr edx, 4
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], 0x3d
mov byte [ecx + 2], al
add ecx, 4
mov eax, ecx
pop edi
mov byte [ecx], 0
sub eax, ebx
pop esi
ret
cmp edi, 1
jne 0x457e00
movzx eax, byte [esi]
mov edx, eax
and eax, 3
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shl eax, 4
mov byte [ecx], dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov al, 0x3d
mov byte [ecx + 3], al
mov byte [ecx + 2], al
add ecx, 4
mov eax, ecx
pop edi
mov byte [ecx], 0
sub eax, ebx
pop esi
ret
Function at 0x46e4c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x64
cmp byte [ecx + 0x16], 4
jne 0x46e5ad
lea eax, [esp]
push eax
mov eax, dword [esp + 0x6c]
push edx
push eax
mov edx, 0x60
call fcn.00485310
test al, al
jne 0x46e66f
movzx ecx, word [esp]
movzx edx, word [esp + 2]
mov word [esi], cx
mov ecx, dword [esp + 4]
mov word [esi + 2], dx
mov edx, dword [esp + 8]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], edx
movzx edx, word [esp + 0x10]
mov dword [esi + 0xc], ecx
movzx ecx, word [esp + 0x12]
mov word [esi + 0x10], dx
mov edx, dword [esp + 0x14]
mov word [esi + 0x12], cx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x14], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x34], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x38], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x3c], edx
mov edx, dword [esp + 0x44]
mov dword [esi + 0x40], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x44], edx
mov edx, dword [esp + 0x4c]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x4c], edx
mov edx, dword [esp + 0x54]
mov dword [esi + 0x50], ecx
mov ecx, dword [esp + 0x58]
mov dword [esi + 0x54], edx
mov edx, dword [esp + 0x5c]
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], ecx
add esp, 0x64
ret
lea eax, [esp]
push eax
mov eax, dword [esp + 0x6c]
push edx
push eax
mov edx, 0x48
call fcn.00485310
xor ecx, ecx
cmp al, cl
jne 0x46e66f
mov edx, dword [esp]
mov dword [esi + 8], edx
movzx edx, word [esp + 4]
mov word [esi], dx
movzx edx, word [esp + 6]
mov word [esi + 2], dx
movzx edx, word [esp + 8]
mov word [esi + 0x10], dx
movzx edx, word [esp + 0xa]
mov word [esi + 0x12], dx
mov edx, dword [esp + 0xc]
mov dword [esi + 0x14], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x14]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x30], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x38], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x50], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x54], edx
mov edx, dword [esp + 0x44]
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], ecx
add esp, 0x64
ret