joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x50f509
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, dword [ebp + 0xc]
xor edx, edx
push ebp
push 0x50f7a1
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x50f6a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 8]
push edx
push esi
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.004066a0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x50f7c0
call fcn.004068c8
mov eax, dword [ebp - 0xc]
mov edx, 0x50f7e0
call fcn.0050c8a0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004066a0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x50f80c
call fcn.004068c8
mov eax, dword [ebp - 0x14]
mov edx, 0x50f7e0
call fcn.0050c8a0
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x10]
call fcn.004066a0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x50f82c
call fcn.004068c8
mov eax, dword [ebp - 0x1c]
mov edx, 0x50f7e0
call fcn.0050c8a0
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.004066a0
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x50f84c
call fcn.004068c8
mov eax, dword [ebp - 0x24]
mov edx, 0x50f7e0
call fcn.0050c8a0
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0045ca34
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x50f86c
call fcn.004068c8
mov eax, dword [ebp - 0x2c]
mov edx, 0x50f7e0
call fcn.0050c8a0
cmp ebx, 0x20
ja 0x50f693
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.00405914
push dword [ebp - 0x34]
push 0x50f88c
lea eax, [ebp - 0x38]
mov edx, dword [ebp + 0x10]
mov ecx, 0
call fcn.00405914
push dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405b3c
push 1
lea eax, [ebp - 4]
call fcn.00405d60
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.0045ca34
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x50f89c
call fcn.004068c8
mov eax, dword [ebp - 0x3c]
mov edx, 0x50f7e0
call fcn.0050c8a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50f74a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f7a8
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.004064ec
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00405650
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004064ec
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405650
lea eax, [ebp - 0x30]
mov edx, 0xa
call fcn.004064ec
lea eax, [ebp - 4]
call fcn.0040562c
ret
Function at 0x50f8d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004064dc
xor eax, eax
push ebp
push 0x50f951
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0x50f960
push 0x50f960
mov eax, dword [ebp - 4]
call fcn.00406580
mov esi, eax
push esi
push 0x50f964
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
test bl, bl
jne 0x50f93b
push 5
push 0x50f960
push esi
push 0x50f970
push 0x50f964
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f958
lea eax, [ebp - 4]
call fcn.004064e4
ret

Function at 0x510760
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5107fa
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x599d40]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x599d40]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x599d40]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x599d40]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x51077f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x510810
dec edx
je 0x510845
jmp 0x510896
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x599d40]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x599d40]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x510896
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x599d40]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x599d40]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x599d40]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x510908
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x510927
add edx, 3
sar edx, 2
test edx, edx
jle 0x510a35
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x51095c
je 0x51099f
sub ecx, 0x2b
je 0x510995
sub ecx, 4
je 0x51099a
dec ecx
sub ecx, 0xa
jb 0x510987
jmp 0x5109a2
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x51096e
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x510979
jmp 0x5109a2
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x5109a2
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x5109a2
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x5109a2
mov byte [eax], 0x3e
jmp 0x5109a2
mov byte [eax], 0x3f
jmp 0x5109a2
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x51093f
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x5109f3
cmp byte [esp + 7], 0xff
jne 0x5109f3
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x510a2a
cmp dl, 0xff
je 0x510a2a
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x510936
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x5117bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x5117dd
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x5117ca
pop edi
pop esi
pop ebx
ret

Function at 0x512804
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x512858
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x59bf80]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x59c380]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x59c780]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x59cb80]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x512812
pop edi
pop esi
pop ebx
ret

Function at 0x5174d4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x5174fa
shr edx, 1
xor edx, eax
jmp 0x5174fc
shr edx, 1
inc ecx
jne 0x5174ec
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x5174e5
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x517514
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x51751d
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00476df4
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x5175ca
cmp dword [ebp - 0xc], 0x2800
jl 0x517578
mov dword [ebp - 8], 0x2800
jmp 0x51757e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x5175c2
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x5a98e0]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x517599
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x517560
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x52288c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x522895
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x522a47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00522bdc
xor eax, eax
push ebp
push 0x522a25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x5228e4
call fcn.00404f28
jmp 0x522a2c
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x5229b3
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x522939
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x522939
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005227e0
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406998
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x522972
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005227e0
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406998
mov eax, dword [ebp - 0x14]
call fcn.00406580
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x522a0f
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.005227e0
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x522a64
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00406998
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00522800
jmp 0x522a0f
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x5229d6
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x5229d6
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x5229ec
mov eax, ebx
call fcn.00406580
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x522a0f
lea eax, [ebp - 0x24]
mov ecx, 0x522a64
mov edx, ebx
call fcn.004068c8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00522800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522a2c
mov eax, dword [ebp - 4]
call fcn.00522be8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522a4e
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.004064ec
ret
Function at 0x52482c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x52484d
inc edi
mov eax, esi
call fcn.004059c0
cmp edi, eax
jg 0x52485f
cmp byte [esi + edi - 1], 0x20
je 0x52484c
mov eax, esi
test eax, eax
je 0x52486a
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x52492c
cmp byte [esi + edi - 1], 0x2e
je 0x524950
jmp 0x52492c
cmp byte [esi + edi - 1], 0x2e
jne 0x5248d4
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x524950
cmp dword [esp + 8], 0xff
jg 0x524950
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x5248b8
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x5248c0
mov bl, 1
jmp 0x5248ce
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x524950
jmp 0x52492b
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x5248f9
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x52492b
inc edi
mov eax, esi
call fcn.004059c0
cmp edi, eax
jg 0x52490b
cmp byte [esi + edi - 1], 0x20
je 0x5248f8
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x524923
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x524950
jmp 0x52493b
inc edi
mov eax, esi
call fcn.004059c0
cmp edi, eax
jle 0x524882
cmp dword [esp + 4], 3
jne 0x524950
cmp dword [esp + 8], 0xff
jg 0x524950
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5322c8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x5322dc
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x5322db
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.00405fcc
xor ebx, ebx
cmp esi, dword [esp]
jge 0x532440
inc ebx
mov eax, edi
call fcn.00405d60
movzx edx, byte [ebp + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x5323f9
inc ebx
mov eax, edi
call fcn.00405d60
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x5323c8
inc ebx
mov eax, edi
call fcn.00405d60
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405d60
movzx edx, byte [ebp + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x532434
inc ebx
mov eax, edi
call fcn.00405d60
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405d60
mov byte [eax + ebx - 1], 0x3d
jmp 0x532434
inc ebx
mov eax, edi
call fcn.00405d60
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405d60
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00405d60
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x532310
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x53269c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00533150
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x535730
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x59fea0
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x53574f
mov esi, 1
mov edx, 0x59ffa8
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x5357c8
dec ebx
je 0x5357ea
dec ebx
je 0x53580c
dec ebx
je 0x53582d
jmp 0x535847
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x535847
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x535847
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x535847
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x5357b8
inc esi
add edx, 0x40
cmp esi, 9
jne 0x53576b
mov esi, 0x20
mov eax, 0x59fed0
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x53586c
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5358a8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x59ff57]
test bl, bl
jbe 0x5358d9
lea eax, [esi + 0x3e0]
call fcn.00535884
lea eax, [esi + 0x3fc]
call fcn.00535884
dec bl
jne 0x5358bf
mov cl, 0x30
mov edi, 0x59ff28
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x5358fa
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x535907
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x5358e3
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x535914
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.005356c8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x535930
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.005356c8
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.005356c8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x53594c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.005358a8
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x535976
mov bl, 1
mov eax, 0x59fe20
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x5359af
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x5359bc
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x53599b
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x5359e6
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.00535730
jmp 0x535a0d
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.00535730
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x535a15
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x5359ce
mov bl, 0x40
mov esi, 0x59fe60
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x535a7b
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x535a88
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x535a64
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.005356f0
inc ebx
inc esi
cmp bl, 0x41
jne 0x535a96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x535b8c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x535c3d
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x535c38
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.00405fcc
push 1
mov eax, edi
call fcn.00405d60
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.00535914
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret