joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ae0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x437c24]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00417c50
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x406be5
mov eax, 0x431750
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x406b25
sub eax, edx
sar eax, 1
je 0x406be5
cmp dword [0x438f90], 3
jne 0x406b6c
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x431720
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.004157f4
add esp, 0xc
jmp 0x406b7c
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x431750
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.004157f4
push 0x431724
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00415a07
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x406be5
push eax
push 1
push 0x200
push esi
call fcn.00416014
mov edx, dword [esp + 0x14]
push edx
call fcn.004160a8
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004155fc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.004155fc
add esp, 0x214
ret

Function at 0x406c00
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x437c24]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00417c50
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x406ccf
mov eax, 0x431734
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x406c45
sub eax, edx
sar eax, 1
je 0x406ccf
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x431734
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.004157f4
push 0x43172c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00415a07
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x406ccf
push eax
push 1
push 0x200
push esi
call fcn.00416014
mov eax, dword [esp + 0x14]
push eax
call fcn.004160a8
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004155fc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.004155fc
add esp, 0x214
ret
Function at 0x406e30
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
je 0x406e83
push esi
call edi
cmp eax, 0xffffffff
je 0x406e7e
test al, 1
je 0x406e4e
xor eax, 1
test al, 4
je 0x406e55
xor eax, 4
test al, 2
je 0x406e5c
xor eax, 2
test al, 0x20
je 0x406e63
xor eax, 0x20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x406e83
or eax, 0xffffffff
pop edi
ret
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
ret
Function at 0x408d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x408d97
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x408e74
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x430a48]
inc ecx
sub edx, 8
sub esi, 1
jne 0x408db0
pop edi
test edx, edx
je 0x408e9b
jmp 0x408e80
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x430a48]
inc ecx
sub edx, 1
jne 0x408e80
not eax
pop esi
ret

Function at 0x408ea0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x430a48]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x430a48]
mov dword [edx + 8], ecx
ret

Function at 0x408ef0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x430a48]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x430a48]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x409600
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x409632
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409628
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x409645
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0041d1b0
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x409660
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x409693
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40968d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x4096bf
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x4096a5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0041d1b0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x4096d6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x4096d0
cmp byte [esi + 8], 0
je 0x4096d0
or eax, 0xffffffff
add esp, 8
ret
Function at 0x409770
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x4097b5
cmp byte [esi + 1], 0
je 0x4097bd
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x4097d2
cmp byte [esi + 1], 0
je 0x4097c4
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x4097db
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x40978e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x4097db
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x4097ef
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0041565a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40980d
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x409921
jmp 0x409830
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x409841
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x40985a
mov ebp, 0x404
cmp byte [esi], 0
je 0x40987f
cmp byte [esi + 1], 0
je 0x409921
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x409882
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x4098aa
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4098a4
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x4098d0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x4098bb
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.0041d1b0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x409921
lea eax, [ebp - 3]
test eax, eax
jl 0x40990c
dec eax
cmp byte [eax + ebx], 0x50
jne 0x4098fc
cmp byte [eax + ebx + 1], 0x4b
jne 0x4098fc
cmp byte [eax + ebx + 2], 5
jne 0x4098fc
cmp byte [eax + ebx + 3], 6
je 0x409902
test eax, eax
jge 0x4098e0
jmp 0x40990c
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x409921
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x409824
push ebx
call fcn.00415724
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x40a2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x40a30e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x40a302
cmp dword [edi + 0x7c], ebx
je 0x40a31d
call fcn.0040a6e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040a060
add esp, 0xc
test eax, eax
je 0x40a344
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.0041565a
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40a385
push 0x4000
call fcn.0041565a
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x40a392
push esi
call fcn.00415724
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x40a3da
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004091b0
test eax, eax
jne 0x40a3da
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x40a404
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x40a40d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0x40a447
mov cl, byte [ebp]
cmp cl, bl
je 0x40a447
call fcn.00408ea0
add ebp, 1
jne 0x40a436
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x40a840
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push edi
jne 0x40a8f3
cmp dword [esi + 4], 0xffffffff
jne 0x40a8f3
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x40a870
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a870
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
je 0x40a8a9
cmp ax, 0x2f
je 0x40a8a9
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40a896
mov eax, dword [0x430ee0]
mov dword [edi], eax
push 0x20
call fcn.0040b192
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0x10], 0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.00409940
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
ret 8
mov eax, 0x1000000
pop edi
ret 8

Function at 0x4155fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437c24]
jne 0x415606
repz ret
jmp fcn.0041a12b

Function at 0x423b5a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041d587
and dword [ebp - 4], 0
cmp dword [0x43bfc8], 0
mov ebx, eax
jne 0x423c0b
push 0x42d6ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423cbc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42d6e0
push edi
call esi
test eax, eax
je 0x423cbc
push eax
call fcn.0041d515
mov dword [esp], 0x42d6d0
push edi
mov dword [0x43bfc8], eax
call esi
push eax
call fcn.0041d515
mov dword [esp], 0x42d6bc
push edi
mov dword [0x43bfcc], eax
call esi
push eax
call fcn.0041d515
mov dword [esp], 0x42d6a0
push edi
mov dword [0x43bfd0], eax
call esi
push eax
call fcn.0041d515
pop ecx
mov dword [0x43bfd8], eax
test eax, eax
je 0x423c0b
push 0x42d688
push edi
call esi
push eax
call fcn.0041d515
pop ecx
mov dword [0x43bfd4], eax
mov eax, dword [0x43bfd4]
cmp eax, ebx
je 0x423c63
cmp dword [0x43bfd8], ebx
je 0x423c63
push eax
call fcn.0041d590
push dword [0x43bfd8]
mov esi, eax
call fcn.0041d590
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423c63
test edi, edi
je 0x423c63
call esi
test eax, eax
je 0x423c5a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423c5a
test byte [ebp - 0xc], 1
jne 0x423c63
or dword [ebp + 0x10], 0x200000
jmp 0x423c9c
mov eax, dword [0x43bfcc]
cmp eax, ebx
je 0x423c9c
push eax
call fcn.0041d590
pop ecx
test eax, eax
je 0x423c9c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423c9c
mov eax, dword [0x43bfd0]
cmp eax, ebx
je 0x423c9c
push eax
call fcn.0041d590
pop ecx
test eax, eax
je 0x423c9c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43bfc8]
call fcn.0041d590
pop ecx
test eax, eax
je 0x423cbc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423cbe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xe910b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push ecx
push 1
pop eax
cpuid
test ecx, 0x40000000
setne al
test al, al
je 0xe910cd
rdrand eax
rdrand edx
pop ecx
pop ebx
ret
push 7
pop eax
xor ecx, ecx
cpuid
test ebx, 0x40000
setne al
test al, al
je 0xe910ea
rdseed eax
rdseed edx
pop ecx
pop ebx
ret
rdtsc
mov ecx, eax
ror ecx, 0xd
rdtsc
mov edx, eax
rol edx, 0xd
mov eax, ecx
pop ecx
pop ebx
ret

Function at 0xe9123c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
nop
xor dword [ecx], 0x19039ff6
not dword [ecx]
nop
add ecx, 4
dec edx
jne 0xe91248
pop edx
pop ecx
pop ebp
ret 8

Function at 0xe912e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x104]
xor al, al
stosb byte es:[edi], al
mov ecx, 0x2a
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3e
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3f
stosb byte es:[edi], al
mov ecx, 0xa
mov al, 0x34
stosb byte es:[edi], al
inc al
loop 0xe91316
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
xor al, al
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
xor al, al
stosb byte es:[edi], al
inc al
loop 0xe91337
mov dl, al
mov ecx, 6
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
mov al, dl
stosb byte es:[edi], al
inc al
loop 0xe9134e
mov ecx, 0x85
mov al, 0xff
rep stosb byte es:[edi], al
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, edi
mov al, byte [edi]
add edi, 4
test al, al
jne 0xe91363
lea ebx, [edi - 4]
mov eax, 0x3d
sub ebx, esi
je 0xe913f5
cmp al, byte [esi + ebx - 1]
sete dl
jne 0xe91385
mov byte [esi + ebx - 1], ah
cmp al, byte [esi + ebx - 2]
sete al
jne 0xe91392
mov byte [esi + ebx - 2], ah
add al, dl
mov edi, dword [ebp + 0xc]
shr ebx, 2
lea edx, [ebx + ebx*2]
sub edx, eax
push edx
mov dword [ebp - 4], ebx
mov ecx, dword [esi]
movzx edx, cl
movzx ebx, ch
push edi
lea edi, [ebp - 0x104]
mov al, byte [edx + edi]
mov ah, byte [ebx + edi]
shr ecx, 0x10
add esi, 4
movzx edx, cl
movzx ecx, ch
mov bl, byte [edx + edi]
mov bh, byte [ecx + edi]
pop edi
mov dl, ah
mov dh, bl
shl al, 2
shr bl, 2
shl dh, 6
shl ah, 4
shr dl, 4
or bh, dh
or al, dl
or ah, bl
mov byte [edi], al
mov byte [edi + 2], bh
mov byte [edi + 1], ah
dec dword [ebp - 4]
lea edi, [edi + 3]
jne 0xe913a3
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xe91400
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x44]
mov eax, 0x44434241
stosd dword es:[edi], eax
mov eax, 0x48474645
stosd dword es:[edi], eax
mov eax, 0x4c4b4a49
stosd dword es:[edi], eax
mov eax, 0x504f4e4d
stosd dword es:[edi], eax
mov eax, 0x54535251
stosd dword es:[edi], eax
mov eax, 0x58575655
stosd dword es:[edi], eax
mov eax, 0x62615a59
stosd dword es:[edi], eax
mov eax, 0x66656463
stosd dword es:[edi], eax
mov eax, 0x6a696867
stosd dword es:[edi], eax
mov eax, 0x6e6d6c6b
stosd dword es:[edi], eax
mov eax, 0x7271706f
stosd dword es:[edi], eax
mov eax, 0x76757473
stosd dword es:[edi], eax
mov eax, 0x7a797877
stosd dword es:[edi], eax
mov eax, 0x33323130
stosd dword es:[edi], eax
mov eax, 0x37363534
stosd dword es:[edi], eax
mov eax, 0x2f2b3938
stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0xe91482
jmp 0xe914dd
mov al, byte [esi]
mov dl, byte [esi + 1]
mov bl, byte [esi + 2]
mov ah, al
mov dh, dl
mov bh, bl
and ah, 3
and dh, 0xf
and bh, 0x3f
shr al, 2
shr dl, 4
shr bl, 6
shl ah, 4
shl dh, 2
or ah, dl
or bl, dh
movzx edx, al
movzx ecx, ah
push esi
lea esi, [ebp - 0x44]
mov al, byte [edx + esi]
mov ah, byte [ecx + esi]
movzx edx, bl
movzx ecx, bh
mov bl, byte [edx + esi]
mov bh, byte [ecx + esi]
pop esi
and eax, 0xffff
shl ebx, 0x10
add esi, 3
or eax, ebx
stosd dword es:[edi], eax
sub dword [ebp - 4], 3
jns 0xe9147a
cmp dword [ebp - 4], 0
je 0xe914ef
add edi, dword [ebp - 4]
mov byte [edi], 0x3d
inc edi
inc dword [ebp - 4]
jne 0xe914e6
mov eax, edi
mov word [eax], 0
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xe98d98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov eax, 0x74dd0d95
xor eax, 0x19039ff6
push eax
call fcn.00e997c8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0xe98eb2
push 1
push 0
push 0
call dword [0xeb561c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xe98e94
lea eax, [ebp - 0x54]
mov dword [eax], 0x19719fa2
mov dword [eax + 4], 0x19709f83
mov dword [eax + 8], 0x19669f82
mov dword [eax + 0xc], 0x194a9f92
mov dword [eax + 0x10], 0x19709f98
mov dword [eax + 0x14], 0x19629f82
mov dword [eax + 0x18], 0x196f9f9a
mov dword [eax + 0x1c], 0x19719f93
mov dword [eax + 0x20], 0x19039ff6
mov ecx, 9
xor dword [eax], 0x19039ff6
add eax, 4
dec ecx
jne 0xe98e2f
push 0x14
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 4]
call dword [0xeb5624]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0xe98e94
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 8]
call dword [0xeb5634]
test eax, eax
jne 0xe98e75
jmp 0xe98e94
cmp dword [ebp - 0x2c], 1
jne 0xe98e90
push 0
push 0
push dword [ebp - 8]
call dword [0xeb562c]
test eax, eax
jne 0xe98e8e
jmp 0xe98e94
jmp 0xe98e53
jmp 0xe98e94
cmp dword [ebp - 8], 0
je 0xe98ea3
push dword [ebp - 8]
call dword [0xeb5640]
cmp dword [ebp - 4], 0
je 0xe98eb2
push dword [ebp - 4]
call dword [0xeb5640]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0xea7738
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
test dword [ebx + 0x44], 0x40000000
je 0xea7756
ror ebx, 1
lea esi, str.c0aZ1h_
push dword [esi - 4]
call fcn.00e96830
mov edi, eax
test edi, edi
je 0xea77f4
push esi
push edi
mov ecx, dword [esi - 4]
lodsb al, byte [esi]
xor al, 0x30
stosb byte es:[edi], al
dec ecx
test ecx, ecx
jne 0xea7773
pop edi
pop esi
mov esi, dword [esi - 4]
push dword [ebp + 0xc]
pop dword [ebp - 8]
lea eax, [esi*2]
push eax
push 8
push ebx
call dword [ebp - 8]
mov esi, eax
test esi, esi
je 0xea77ee
push esi
push edi
call fcn.00ea8c44
add esp, 8
lea esi, [esi + 0x83]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.00ea7800
mov dword [0xeb519c], eax
lea esi, [esi + 0x41]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.00ea7800
mov dword [0xeb5194], eax
lea esi, [esi + 0xd7]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.00ea7800
mov dword [0xeb5198], eax
mov dword [ebp - 4], 1
push edi
call fcn.00e96858
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8