joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x492b30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00442970
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x444dc9
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov ebx, eax
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
push ebp
mov ecx, ebx
call fcn.0043fdc0
mov ebp, dword [esp + 0x70]
mov edi, eax
add edi, ebp
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.0043fdb0
mov edx, dword [esp + 0x74]
mov ecx, esi
add eax, edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.00444420
mov ebp, dword [eax]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x1c]
push eax
mov dword [esp + 0x24], ecx
call dword [0x496448]
push 0
lea ecx, [esp + 0x4c]
call fcn.00489956
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], 0
call fcn.00453c50
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.004423d0
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x4960f8]
mov ecx, ebx
call fcn.0043fd30
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x444e94
push edi
mov ecx, esi
call fcn.004424e0
push eax
push ebp
mov ecx, esi
call fcn.004426a0
cmp eax, dword [esp + 0x40]
jg 0x444e90
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x444e6e
mov eax, ebx
jmp 0x444e9a
cmp edi, ebx
jl 0x444e98
mov eax, ebx
jmp 0x444e9a
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x444eab
mov dword [esp + 0x30], eax
jmp 0x444eb6
cmp edi, ebx
jl 0x444eb1
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.0043fcf0
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x444efd
push edi
mov ecx, esi
call fcn.00442400
push eax
push ebx
mov ecx, esi
call fcn.004427d0
cmp eax, dword [esp + 0x44]
jg 0x444ef5
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x444ecf
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x444f07
cmp edi, ebp
jl 0x444f01
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x444f07
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x444f10
mov ecx, eax
jmp 0x444f19
cmp edi, ebp
jl 0x444f16
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.004423f0
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], 0xffffffff
call fcn.004899c8
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x44ae40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x492fe8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x44ae79
inc eax
mov dword [esi + 0x10], eax
jmp 0x44af8c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x44ae8d
mov eax, 0xffffffc7
jmp 0x44af8e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x44ae9e
cmp dword [esi + 8], eax
jne 0x44ae8d
cmp dword [esi + 8], eax
jne 0x44aeb7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x44aeb7
mov eax, 0xffffffc7
jmp 0x44af8e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x44aecb
push eax
mov ecx, ebx
call fcn.0044a670
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00416f60
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x44aefc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00416f80
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00449de0
test eax, eax
mov dword [esp + 0x38], eax
je 0x44af2f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5e3c48
call fcn.00417160
mov eax, dword [esp + 0x38]
jmp 0x44af8e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0044aca0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x44af73
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0044acc0
mov esi, eax
test esi, esi
jne 0x44afa3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0044aca0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x44af45
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5e3c48
call fcn.00417160
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5e3c48
call fcn.00417160
mov eax, esi
jmp 0x44af8e
Function at 0x4542b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x493618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x496448]
push 0
lea ecx, [esp + 0x20]
call fcn.00489956
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00453c50
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00489884
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00486068
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00486068
push 1
push 0
push 0
mov ecx, esi
call fcn.00486010
push 1
push 0
push 1
mov ecx, esi
call fcn.00486010
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004899c8
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x454430
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x493638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00489956
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00453c50
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00489884
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x496448]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4544f4
cmp dword [esp + 0x40], 1
jne 0x4544f2
cmp ecx, eax
jge 0x4544f4
mov eax, ecx
cmp eax, 0xc8
jge 0x454500
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.004542b0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x49644c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004899c8
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x454c80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4936a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00484488
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x5e8a88
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x5e71c0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4960c0]
push eax
mov ecx, edi
call fcn.00489bfe
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048b199
test eax, eax
je 0x454d9c
mov ecx, dword [esp + 0x3c]
call fcn.00489c2b
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x496428]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x454d60
push edi
mov ecx, esi
call fcn.004871ec
mov ecx, esi
call fcn.00454f00
cmp dword [esp + 0x38], 1
jne 0x454d95
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00487356
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4577d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x457803
push esi
call fcn.0045a8d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4577fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x457889
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x457872
mov eax, dword [esi + 8]
test eax, eax
je 0x457827
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45786e
cmp eax, 2
je 0x457872
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45781a
cmp eax, 3
je 0x45784d
cmp eax, 1
jne 0x45781a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45781a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45781a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004578b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x457898
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004578b0
add esp, 4
pop esi
ret
Function at 0x4682b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00467e60
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00467ee0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00467ee0
lea ecx, [esi + 0xc]
call fcn.00482dec
lea ecx, [esi + 0x10]
call fcn.00482dec
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00469470
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00469470
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00469470
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00482e61
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00482e61
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x408fd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x408fe0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword ds:[eax + 0x30]
movzx eax, byte ds:[eax + 2]
ret

Function at 0x414c50
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edx, dword [eax + 4]
mov ebx, dword [eax]
mov eax, edx
shr eax, 4
xor eax, ebx
and eax, 0xf0f0f0f
xor ebx, eax
shl eax, 4
xor edx, eax
mov eax, ebx
shr eax, 4
xor eax, edx
and eax, 0x1010101
xor edx, eax
shl eax, 4
xor ebx, eax
mov eax, ebx
shr eax, 9
xor eax, ebx
and eax, 0x550055
mov ecx, eax
shl ecx, 9
xor ecx, eax
xor ebx, ecx
mov eax, edx
shr eax, 9
xor eax, edx
and eax, 0x550055
mov ecx, eax
shl ecx, 9
xor ecx, eax
xor edx, ecx
mov eax, ebx
shr eax, 0x12
xor eax, ebx
and eax, 0x3333
mov ecx, eax
shl ecx, 0x12
xor ecx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x3333
xor ebx, ecx
mov ecx, eax
shl ecx, 0x12
xor ecx, eax
xor edx, ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, 0xff
mov ecx, eax
shl ecx, 0x10
xor ecx, eax
xor edx, ecx
xor esi, esi
mov dword [esp + 0x10], esi
and ebx, 0xfffffff
and edx, 0xfffffff
cmp byte [esi + 0x457d68], 0
mov eax, ebx
mov ecx, edx
je 0x414d18
shl eax, 0x1a
shr ebx, 2
shl ecx, 0x1a
shr edx, 2
jmp 0x414d22
shl eax, 0x1b
shr ebx, 1
shl ecx, 0x1b
shr edx, 1
or ebx, eax
or edx, ecx
mov eax, ebx
shr eax, 0x10
movzx esi, al
mov ecx, ebx
shr ecx, 8
movzx eax, cl
mov edi, eax
shr edi, 5
movzx ecx, bl
mov dword [esp + 0x14], ecx
and ecx, 0xc0
or ecx, edi
shr ecx, 2
mov edi, ebx
shr edi, 0x18
and edi, 0xe
or ecx, edi
mov ecx, dword [ecx*4 + 0x458078]
mov edi, esi
shr edi, 5
and edi, 4
mov ebp, esi
and ebp, 0x40
or edi, ebp
shr eax, 1
shr edi, 1
and eax, 0x3f
and esi, 0x1d
or edi, esi
or ecx, dword [edi*4 + 0x457f78]
movzx edi, dl
or ecx, dword [eax*4 + 0x457e78]
mov eax, dword [esp + 0x14]
and eax, 0x3f
or ecx, dword [eax*4 + 0x457d78]
mov eax, edx
shr eax, 0x10
movzx esi, al
mov dword [esp + 0x14], edi
shr edi, 4
and edi, 8
mov ebp, esi
and ebp, 0xc0
or edi, ebp
mov eax, edx
shr eax, 8
movzx eax, al
shr edi, 2
mov ebp, edx
shr ebp, 0x18
and ebp, 0xd
or edi, ebp
mov ebp, eax
shr ebp, 6
and eax, 0x3d
and ebp, 2
or ebp, eax
mov eax, dword [edi*4 + 0x458478]
or eax, dword [ebp*4 + 0x458278]
mov edi, dword [esp + 0x14]
and edi, 0x3f
or eax, dword [edi*4 + 0x458178]
mov edi, dword [esp + 0x1c]
and esi, 0x3f
or eax, dword [esi*4 + 0x458378]
movzx esi, cx
mov ebp, eax
shl ebp, 0x10
or ebp, esi
mov esi, dword [esp + 0x10]
and eax, 0xffff0000
shr ecx, 0x10
or eax, ecx
mov dword [edi + esi*8], ebp
mov dword [edi + esi*8 + 4], eax
inc esi
cmp esi, 0x10
mov dword [esp + 0x10], esi
jl 0x414cf1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x418150
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [0x464720]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0x64]
xor edx, edx
push ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
push edi
cmp word [eax - 2], dx
je 0x41819e
mov eax, dword [eax - 0xa]
jmp 0x4181aa
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4181a1
sub eax, edi
mov ecx, dword [ecx + 0x64]
push ecx
lea ecx, [esp + 0x14]
call fcn.004157d0
mov ebx, dword [0x466444]
lea edi, [esp + 0x10]
mov dword [esi], ebx
call fcn.00415870
mov edi, eax
test edi, edi
je 0x41820f
mov eax, 0x20
mov ebx, esi
call fcn.00416b00
test eax, eax
je 0x418238
mov ecx, edi
add edi, 0x10
movzx edx, byte [ecx]
shr edx, 4
movzx edx, byte [edx + 0x459098]
mov byte [eax], dl
movzx edx, byte [ecx]
and edx, 0xf
movzx edx, byte [edx + 0x459098]
mov byte [eax + 1], dl
inc ecx
add eax, 2
cmp ecx, edi
jb 0x4181e3
mov byte [eax], 0
jmp 0x418238
mov eax, dword [esi]
cmp word [eax - 2], 0
je 0x418236
mov ecx, 0xffff
add word [eax - 2], cx
mov eax, dword [esi]
cmp word [eax - 2], 0
jne 0x418236
add eax, 0xfffffff6
push eax
call fcn.00439029
add esp, 4
mov dword [esi], ebx
mov eax, dword [esi]
lea ecx, [esp + 0xc]
call fcn.00418670
mov ebx, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
cmp word [ebx - 2], ax
je 0x41827c
mov eax, dword [ebx - 0xa]
jmp 0x41828a
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418281
sub eax, edx
push ebx
lea ecx, [esp + 0x14]
call fcn.004157d0
lea edi, [esp + 0x10]
call fcn.00415870
mov edi, eax
test edi, edi
je 0x418326
mov eax, 0x20
mov ebx, esi
call fcn.00416b00
test eax, eax
je 0x4182ea
mov ecx, edi
add edi, 0x10
lea esp, [esp]
movzx edx, byte [ecx]
shr edx, 4
movzx edx, byte [edx + 0x459098]
mov byte [eax], dl
movzx edx, byte [ecx]
and edx, 0xf
movzx edx, byte [edx + 0x459098]
mov byte [eax + 1], dl
inc ecx
add eax, 2
cmp ecx, edi
jb 0x4182c0
mov byte [eax], 0
mov ebx, dword [esp + 0xc]
cmp word [ebx - 2], 0
je 0x418313
mov eax, 0xffff
add word [ebx - 2], ax
movzx eax, word [ebx - 2]
test ax, ax
jne 0x418313
add ebx, 0xfffffff6
push ebx
call fcn.00439029
add esp, 4
mov ecx, dword [esp + 0x6c]
pop edi
pop ebx
xor ecx, esp
mov eax, esi
call fcn.0043901a
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
cmp word [eax - 2], 0
je 0x41834d
mov ecx, 0xffff
add word [eax - 2], cx
mov eax, dword [esi]
cmp word [eax - 2], 0
jne 0x41834d
add eax, 0xfffffff6
push eax
call fcn.00439029
add esp, 4
mov edx, dword [0x466444]
mov dword [esi], edx
jmp 0x4182ee
Function at 0x418580
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x466444]
mov dword [edi], eax
mov eax, 0x2c
mov ebx, edi
call fcn.00416b00
mov ecx, 0xa
lea esp, [esp]
movzx edx, byte [esi]
shr edx, 2
movzx edx, byte [edx*2 + 0x458728]
mov byte [eax], dl
movzx edx, byte [esi + 1]
movzx ebx, byte [esi]
shr edx, 4
shl ebx, 4
or edx, ebx
and edx, 0x3f
movzx edx, byte [edx*2 + 0x458728]
mov byte [eax + 1], dl
movzx ebx, byte [esi + 1]
movzx edx, byte [esi + 2]
shr edx, 6
add ebx, ebx
add ebx, ebx
or edx, ebx
and edx, 0x3f
movzx edx, byte [edx*2 + 0x458728]
mov byte [eax + 2], dl
movzx edx, byte [esi + 2]
and edx, 0x3f
movzx edx, byte [edx*2 + 0x458728]
mov byte [eax + 3], dl
add eax, 4
add esi, 3
sub ecx, 1
jne 0x4185a0
movzx ecx, byte [esi]
shr ecx, 2
movzx edx, byte [ecx*2 + 0x458728]
mov byte [eax], dl
movzx ecx, byte [esi + 1]
movzx edx, byte [esi]
shr ecx, 4
shl edx, 4
or ecx, edx
and ecx, 0x3f
mov cl, byte [ecx*2 + 0x458728]
mov byte [eax + 1], cl
movzx ecx, byte [esi + 1]
movzx edx, byte [esi + 2]
shr edx, 6
add ecx, ecx
add ecx, ecx
or edx, ecx
and edx, 0x3f
movzx edx, byte [edx*2 + 0x458728]
mov byte [eax + 2], dl
mov byte [eax + 3], 0x3d
add eax, 4
pop esi
mov byte [eax], 0
mov eax, edi
pop ebx
ret

Function at 0x41a360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, eax
mov eax, dword [esi]
test eax, eax
jl 0x41a447
cmp eax, 0x1002
jge 0x41a447
mov eax, dword [ebp]
push ebx
push edi
push 0x1002
push 0
push eax
call fcn.0043a340
mov ecx, dword [esi]
mov edx, dword [esp + 0x24]
mov eax, dword [ebp]
push ecx
push edx
inc eax
push eax
call fcn.00441210
mov ecx, dword [ebp]
mov edi, dword [esi]
add esp, 0x18
inc ecx
xor al, al
xor edx, edx
test edi, edi
jle 0x41a3bc
mov ebx, edi
add al, byte [edx + ecx]
inc edx
cmp edx, ebx
jl 0x41a3b4
not al
inc edi
inc al
dec ecx
mov dword [esi], edi
mov byte [ecx], al
mov dl, byte [ebp + 8]
xor eax, eax
cmp dword [esi], eax
jle 0x41a3e4
nop
movzx edi, dl
mov bl, byte [edi + 0x457368]
xor byte [eax + ecx], bl
inc eax
add dl, 3
cmp eax, dword [esi]
jl 0x41a3d0
mov edi, dword [ebp + 4]
mov byte [ebp + 8], dl
mov eax, dword [esi]
add eax, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
xor edx, edx
mov esi, ecx
test eax, eax
jle 0x41a43b
xor dword [ecx + edx*4], edi
movzx edi, word [esi + 2]
movzx ebx, word [esi]
imul edi, edi, 0x4242d
imul ebx, ebx, 0x4242d
add edi, 0x2d08ef
add ebx, 0x2d08ef
and edi, 0xffff0000
shr ebx, 0x10
or edi, ebx
inc edx
xor edi, 0xd77dd77d
add esi, 4
cmp edx, eax
jl 0x41a400
mov dword [ebp + 4], edi
pop edi
pop ebx
pop esi
mov eax, ecx
pop ebp
ret 8
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x425240
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48556b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00479ef1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4252c2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00477bd0
mov eax, dword [eax]
push 0x50e230
push eax
call fcn.0046a814
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047a17c
test bl, bl
je 0x4252c2
push 0x50e230
lea ecx, [esp + 0xc]
call fcn.0047a50c
push 0x511dac
lea ecx, [esp + 0xc]
call fcn.0047a50c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4252fe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047a17c
jmp 0x4253c9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x425382
lea edx, [esp + 0x7c]
push 0x511da8
push edx
call fcn.0046a814
add esp, 8
test eax, eax
je 0x425382
lea eax, [esp + 0x7c]
push 0x511da4
push eax
call fcn.0046a814
add esp, 8
test eax, eax
je 0x425382
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425312
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047a17c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x425bc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x425c22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc