joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b3b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x4c]
mov eax, dword [edi]
mov dword [esp], eax
call fcn.007b8300
mov ecx, eax
test ecx, ecx
jne 0x7b3c55
mov esi, dword [edi + 4]
lea eax, [esi - 1]
mov ecx, 0x16
cmp eax, 0x7f
ja 0x7b3c55
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
xor edx, edx
div esi
mov eax, esi
and eax, 3
or eax, edx
jne 0x7b3c55
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
imul eax, dword [edi], 0x58
mov ecx, dword [eax + 0x8199e4]
test ecx, ecx
je 0x7b3bf3
lea eax, [edi + 0x88]
mov dword [esp + 0x14], eax
add edi, 8
xor edx, edx
mov eax, dword [esp + 0x48]
div esi
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ebp
call ecx
mov ecx, eax
jmp 0x7b3c55
xor ecx, ecx
cmp dword [esp + 0x48], 0
je 0x7b3c55
lea esi, [edi + 0x88]
jmp 0x7b3c0b
add ebx, eax
add ebp, eax
imul eax, dword [edi], 0x58
mov dword [esp + 8], esi
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], ebp
call dword [eax + 0x8199cc]
mov ecx, eax
test ecx, ecx
jne 0x7b3c55
mov eax, dword [edi + 4]
xor ecx, ecx
test eax, eax
jle 0x7b3c4d
nop
mov eax, dword [esp + ecx + 0x1c]
xor eax, dword [edi + ecx + 8]
mov edx, dword [ebp + ecx]
mov dword [edi + ecx + 8], edx
mov dword [ebx + ecx], eax
add ecx, 4
mov eax, dword [edi + 4]
cmp ecx, eax
jl 0x7b3c30
xor ecx, ecx
sub dword [esp + 0x18], eax
jne 0x7b3c04
mov eax, ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7b3c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x40]
mov eax, dword [edi]
mov dword [esp], eax
call fcn.007b8300
mov ecx, eax
test ecx, ecx
jne 0x7b3dbe
mov esi, dword [edi + 4]
lea eax, [esi - 1]
mov ecx, 0x16
cmp eax, 0x7f
ja 0x7b3dbe
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
xor edx, edx
div esi
mov eax, esi
and eax, 3
or eax, edx
jne 0x7b3dbe
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
imul eax, dword [edi], 0x58
mov ecx, dword [eax + 0x8199e0]
test ecx, ecx
je 0x7b3d24
lea eax, [edi + 0x88]
mov dword [esp + 0x18], eax
add edi, 8
xor edx, edx
mov eax, dword [esp + 0x3c]
div esi
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], ebx
call ecx
jmp 0x7b3dc0
xor ecx, ecx
cmp dword [esp + 0x3c], 0
je 0x7b3dbe
lea eax, [edi + 0x88]
mov dword [esp + 0x18], eax
lea eax, [edi + 8]
mov dword [esp + 0x14], eax
nop word cs:[eax + eax]
xor eax, eax
test esi, esi
jle 0x7b3d6f
nop word cs:[eax + eax]
mov ecx, dword [ebx + eax]
xor dword [edi + eax + 8], ecx
add eax, 4
cmp eax, dword [edi + 4]
jl 0x7b3d60
imul eax, dword [edi], 0x58
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
call dword [eax + 0x8199c8]
mov ecx, eax
test ecx, ecx
jne 0x7b3dbe
mov esi, dword [edi + 4]
xor eax, eax
test esi, esi
jle 0x7b3db2
nop word [eax + eax]
mov ecx, dword [ebp + eax]
mov dword [edi + eax + 8], ecx
add eax, 4
mov esi, dword [edi + 4]
cmp eax, esi
jl 0x7b3da0
add ebp, esi
add ebx, esi
xor ecx, ecx
sub dword [esp + 0x1c], esi
jne 0x7b3d50
mov eax, ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7b9410
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov eax, dword [esi]
mov dword [esp], eax
call fcn.007b8300
test eax, eax
jne 0x7b959c
mov ecx, dword [esi + 4]
mov eax, 0x16
cmp ecx, 0x80
ja 0x7b959c
mov edx, dword [esi + 8]
cmp edx, 0x80
jg 0x7b959c
cmp ecx, edx
jg 0x7b959c
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
cmp edi, 0x11
jb 0x7b94f5
test ecx, ecx
jne 0x7b94f5
imul eax, dword [esi], 0x58
mov ebp, dword [eax + 0x8199bc]
cmp ebp, edi
jae 0x7b94f5
xor eax, eax
cmp ebp, edi
je 0x7b94f3
mov eax, edi
sub eax, ebp
mov dword [esp + 0xc], eax
lea eax, [esi + 0x210]
mov dword [esp + 0x14], eax
lea eax, [esi + 0x8c]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x18], eax
test ebp, ebp
mov eax, 0
je 0x7b94c1
nop
mov ecx, dword [ebx + eax]
xor dword [esi + eax + 0x8c], ecx
add eax, 4
cmp eax, ebp
jb 0x7b94b0
imul eax, dword [esi], 0x58
mov ecx, dword [esp + 0x14]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp], ecx
call dword [eax + 0x8199c8]
test eax, eax
jne 0x7b959c
add ebx, ebp
mov eax, dword [esp + 0x18]
add eax, ebp
cmp eax, dword [esp + 0xc]
jb 0x7b94a2
sub edi, eax
test edi, edi
je 0x7b959a
lea eax, [esi + 0x210]
mov dword [esp + 0x18], eax
lea eax, [esi + 0x8c]
mov dword [esp + 0x14], eax
lea eax, [esi + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
nop dword [eax + eax]
mov ebp, dword [esi + 8]
cmp eax, ebp
jne 0x7b9571
xor ecx, ecx
test eax, eax
je 0x7b9541
nop dword [eax]
mov al, byte [esi + ecx + 0x8c]
xor byte [esi + ecx + 0xc], al
inc ecx
cmp ecx, dword [esi + 8]
jb 0x7b9530
imul eax, dword [esi], 0x58
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call dword [eax + 0x8199c8]
test eax, eax
jne 0x7b959c
mov dword [esi + 4], 0
mov ebp, dword [esi + 8]
xor eax, eax
sub ebp, eax
cmp edi, ebp
cmovb ebp, edi
lea eax, [esi + eax + 0xc]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], ebp
call fcn.007c51d0
mov eax, dword [esi + 4]
add eax, ebp
mov dword [esi + 4], eax
add ebx, ebp
sub edi, ebp
jne 0x7b9520
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7b95b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov dword [esp], eax
call fcn.007b8300
test eax, eax
jne 0x7b96c3
mov ecx, dword [esi + 4]
mov eax, 0x16
cmp ecx, 0x80
ja 0x7b96c3
mov edx, dword [esi + 8]
cmp edx, 0x80
jg 0x7b96c3
cmp ecx, edx
jg 0x7b96c3
xor eax, eax
cmp ecx, edx
je 0x7b9635
lea eax, [ecx + 1]
mov dword [esi + 4], eax
mov byte [esi + ecx + 0xc], pe_nt_image_headers32
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov eax, 1
jmp 0x7b9631
lea ecx, [edx + 1]
mov dword [esi + 4], ecx
mov byte [esi + edx + 0xc], 0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp edx, ecx
jl 0x7b9620
test ecx, ecx
je 0x7b9664
shl eax, 7
lea eax, [eax + esi + 0x10c]
xor ecx, ecx
nop word cs:[eax + eax]
mov dl, byte [eax + ecx]
xor dl, byte [esi + ecx + 0x8c]
xor byte [esi + ecx + 0xc], dl
inc ecx
cmp ecx, dword [esi + 8]
jb 0x7b9650
imul eax, dword [esi], 0x58
lea ebx, [esi + 0x210]
lea ecx, [esi + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], ecx
call dword [eax + 0x8199c8]
test eax, eax
jne 0x7b96c3
mov edi, dword [esp + 0x24]
imul eax, dword [esi], 0x58
mov dword [esp], ebx
call dword [eax + 0x8199d0]
xor eax, eax
cmp dword [esi + 8], 0
mov ecx, 0
je 0x7b96c1
mov edx, dword [esp + 0x20]
xor ecx, ecx
nop dword [eax + eax]
cmp ecx, dword [edi]
jae 0x7b96c1
mov bl, byte [esi + ecx + 0xc]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, dword [esi + 8]
jb 0x7b96b0
mov dword [edi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
ret

Function at 0x7b9a10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x18]
mov eax, 0x16
cmp edx, 4
jb 0x7b9b08
mov ebp, dword [esp + 0x14]
mov bl, byte [ebp]
and bl, 0x1f
mov eax, 0x20005
movzx esi, bl
cmp esi, 3
jne 0x7b9b08
movzx ebx, byte [ebp + 1]
mov edi, ebx
and edi, 0x7f
mov esi, 2
test bl, bl
jns 0x7b9a98
lea esi, [edi - 1]
cmp esi, 1
ja 0x7b9b08
test edi, edi
je 0x7b9b08
and ebx, 0x7f
mov esi, ebx
neg esi
lea ebp, [ebp + 2]
xor edi, edi
nop word cs:[eax + eax]
mov ecx, edi
shl ecx, 8
movzx edi, byte [ebp]
or edi, ecx
inc ebp
inc esi
jne 0x7b9a80
add ebx, 2
mov esi, ebx
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x7b9b08
lea ecx, [esi + edi]
cmp ecx, edx
ja 0x7b9b08
mov eax, dword [esp + 0x20]
lea edi, [edi*8 - 8]
movzx ebx, byte [ebp + esi]
and ebx, 7
mov edx, edi
sub edx, ebx
cmp edx, dword [eax]
jbe 0x7b9ac7
mov dword [eax], edx
mov eax, 0x20004
jmp 0x7b9b08
cmp edi, ebx
je 0x7b9b00
inc esi
xor ebx, ebx
nop
movzx ecx, byte [ebp + esi]
mov eax, ebx
and eax, 7
mov edi, ebp
mov ebp, eax
xor ebp, 7
bt ecx, ebp
mov ebp, edi
setb cl
cmp eax, 7
sete al
movzx eax, al
add esi, eax
mov eax, dword [esp + 0x1c]
mov byte [eax + ebx], cl
inc ebx
cmp ebx, edx
jb 0x7b9ad0
mov eax, dword [esp + 0x20]
mov dword [eax], edx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7ba520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
xor eax, eax
test edx, edx
mov ebx, 0
je 0x7ba6af
mov esi, dword [esp + 0x90]
xor ebx, ebx
cmp edx, 8
jae 0x7ba559
xor ebp, ebp
jmp 0x7ba675
mov edi, edx
and edi, 0xfffffff8
mov ebp, 0
je 0x7ba675
lea ebx, [esi + 8]
mov ebp, edx
and ebp, 0xfffffff8
pxor xmm7, xmm7
pxor xmm1, xmm1
nop dword [eax]
movdqu xmmword [esp + 0x60], xmm1
movsd xmm3, qword [ebx - 8]
movsd xmm4, qword [ebx]
pxor xmm1, xmm1
punpcklwd xmm3, xmm1
punpcklwd xmm4, xmm1
movdqa xmm1, xmmword [0x7e2160]
movdqa xmm5, xmm1
pxor xmm3, xmm5
movdqa xmm1, xmmword [0x7f24c0]
movdqa xmm2, xmm1
pcmpgtd xmm2, xmm3
pxor xmm4, xmm5
pcmpgtd xmm1, xmm4
movdqa xmm5, xmmword [0x7f24d0]
movdqa xmm6, xmm5
pcmpgtd xmm6, xmm3
movdqa xmm3, xmm5
pcmpgtd xmm3, xmm4
movdqa xmm4, xmmword [0x7f24f0]
movdqa xmm0, xmm4
pand xmm4, xmm6
movdqa xmm5, xmmword [0x7f24e0]
pandn xmm6, xmm5
por xmm6, xmm4
pand xmm0, xmm3
pandn xmm3, xmm5
por xmm3, xmm0
movdqa xmm0, xmmword [0x7e2ca0]
movdqa xmm4, xmm0
pand xmm4, xmm2
pandn xmm2, xmm6
por xmm2, xmm4
movdqa xmm4, xmm0
pand xmm4, xmm1
pandn xmm1, xmm3
por xmm1, xmm4
paddd xmm7, xmm2
movdqu xmm2, xmmword [esp + 0x60]
paddd xmm2, xmm1
movdqu xmmword [esp + 0x60], xmm2
movdqu xmm1, xmmword [esp + 0x60]
add ebx, 0x10
add ebp, 0xfffffff8
jne 0x7ba580
paddd xmm1, xmm7
pshufd xmm0, xmm1, 0x4e
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
paddd xmm1, xmm0
movd ebx, xmm1
cmp edi, edx
mov ebp, edi
je 0x7ba6a3
lea esi, [esi + ebp*2]
sub edx, ebp
mov edi, 1
nop
movzx ebp, word [esi]
cmp ebp, 0x7ff
seta cl
movzx ecx, cl
or ecx, 2
cmp ebp, 0x80
cmovb ecx, edi
add ebx, ecx
add esi, 2
dec edx
jne 0x7ba680
cmp ebx, 0x7f
ja 0x7ba6b6
mov ecx, dword [esp + 0x98]
add ebx, 2
mov dword [ecx], ebx
jmp 0x7ba6eb
cmp ebx, 0xff
mov ecx, dword [esp + 0x98]
ja 0x7ba6ca
add ebx, 3
jmp 0x7ba6e7
cmp ebx, 0xffff
ja 0x7ba6d7
add ebx, 4
jmp 0x7ba6e7
mov eax, 0x16
cmp ebx, 0xffffff
ja 0x7ba6eb
add ebx, 5
mov dword [ecx], ebx
xor eax, eax
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x7c3eb0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.007cd9a0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
cmp eax, 1
sbb eax, eax
or eax, dword [esp + 0x14]
add esp, 0x18
pop esi
pop edi
ret
Function at 0x7c4ff0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.007cd9a0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
cmp eax, 1
sbb eax, eax
or eax, dword [esp + 0x14]
add esp, 0x18
pop esi
pop edi
ret

Function at 0x7c5920
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7cd9b0
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x18]
mov eax, 0xe
test ebx, ebx
je 0x7cdac9
mov dword [esp], 0x3c
call fcn.00492770
mov esi, eax
mov eax, 0xc
test esi, esi
je 0x7cdac9
mov dword [esi], 0
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov edi, eax
cmp edi, 0xffffffff
je 0x7cda95
mov dword [esp], edi
mov dword [esp + 4], str.AcquireSRWLockShared
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esi + 0x28], eax
mov dword [esp], edi
mov dword [esp + 4], str.ReleaseSRWLockShared
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esi + 0x2c], eax
mov dword [esp], edi
mov dword [esp + 4], str.AcquireSRWLockExclusive
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esi + 0x30], eax
mov dword [esp], edi
mov dword [esp + 4], str.ReleaseSRWLockExclusive
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esi + 0x34], eax
mov dword [esp], edi
mov dword [esp + 4], str.InitializeSRWLock
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esi + 0x38], eax
cmp dword [esi + 0x28], 0
je 0x7cda95
cmp dword [esi + 0x2c], 0
je 0x7cda95
cmp dword [esi + 0x30], 0
je 0x7cda95
test eax, eax
je 0x7cda95
mov eax, dword [esi + 0x34]
test eax, eax
je 0x7cda95
mov dword [esi], 1
jmp 0x7cda9a
cmp dword [esi], 0
je 0x7cdaa7
mov eax, esi
add eax, 0x1c
mov dword [esp], eax
call dword [esi + 0x38]
jmp 0x7cdab4
mov eax, esi
add eax, 4
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebx], esi
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x7c60a0
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x110
mov ebx, dword [esp + 0x124]
mov eax, dword [0x81aa48]
cmp eax, 0xffffffff
je 0x7c6118
test eax, eax
jne 0x7c60ee
mov dword [esp], str.KERNEL32.DLL
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test eax, eax
je 0x7c610e
mov dword [esp], eax
mov dword [esp + 4], str.SetDefaultDllDirectories
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x7c610e
mov dword [0x81aa48], eax
mov dword [esp], ebx
mov dword [esp + 8], 0x800
mov dword [esp + 4], 0
call sub.KERNEL32.dll_LoadLibraryExA
add esp, 0x104
jmp 0x7c618a
mov dword [0x81aa48], 0xffffffff
lea ebp, [esp + 0xc]
mov dword [esp], ebp
mov dword [esp + 4], 0x104
call sub.KERNEL32.dll_GetSystemDirectoryA
sub esp, 8
mov edi, eax
xor esi, esi
test edi, edi
je 0x7c6182
mov dword [esp], ebx
call fcn.007c3e70
lea ecx, [edi + eax + 2]
cmp ecx, 0x104
ja 0x7c6182
mov byte [esp + edi + 0xc], 0x5c
inc eax
lea ecx, [esp + edi + 0xd]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ecx
call fcn.007c51d0
mov dword [esp], ebp
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call sub.KERNEL32.dll_LoadLibraryExA
sub esp, 0xc
mov esi, eax
mov eax, esi
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7c7530
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
xor esi, esi
test ebp, ebp
je 0x7c7693
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x7c7693
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x7c7693
mov eax, dword [esp + 0x18]
lea eax, [eax + 2]
mov ecx, 0xaaaaaaab
mul ecx
and edx, 0x7ffffffe
lea eax, [edx + edx + 1]
cmp dword [ebx], eax
jb 0x7c7693
mov esi, dword [esp + 0x18]
mov eax, esi
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
xor ecx, ecx
test edx, edx
jne 0x7c7594
mov eax, edi
jmp 0x7c762c
mov eax, edi
xor ebx, ebx
nop dword [eax + eax]
mov esi, ecx
movzx ecx, byte [ebp + esi]
shr ecx, 2
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movzx ecx, byte [ebp + esi]
shl ecx, 4
and ecx, 0x30
movzx edi, byte [ebp + esi + 1]
shr edi, 4
mov cl, byte [ecx + edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movzx ecx, byte [ebp + esi + 1]
and ecx, 0xf
movzx edi, byte [ebp + esi + 2]
shr edi, 6
mov cl, byte [edi + ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [ebp + esi + 2]
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
movzx ecx, bl
cmp ecx, 0x10
jb 0x7c7610
mov word [eax + 4], 0xa0d
add eax, 6
xor ebx, ebx
jmp 0x7c7615
add eax, 4
inc bl
lea ecx, [esi + 3]
cmp ecx, edx
jb 0x7c75a0
lea ebp, [ebp + esi + 3]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
cmp ecx, esi
jae 0x7c7687
mov edi, esi
movzx esi, byte [ebp]
inc ecx
xor edx, edx
cmp ecx, edi
jae 0x7c7641
movzx edx, byte [ebp + 1]
mov edi, esi
shr edi, 2
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
shl esi, 4
and esi, 0x30
mov edi, edx
shr edi, 4
mov bl, byte [edi + esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], bl
mov bl, 0x3d
cmp ecx, dword [esp + 0x18]
jae 0x7c7675
and edx, 0xf
mov bl, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], bl
mov byte [eax + 3], 0x3d
add eax, 4
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov byte [eax], 0
sub eax, edi
mov dword [ebx], eax
mov esi, 1
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7c79e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
lea eax, [ebp + 2]
mov edi, 0xaaaaaaab
mul edi
and edx, 0x7ffffffe
lea edx, [edx + edx + 1]
mov eax, 0x54
cmp dword [ecx], edx
jb 0x7c7afd
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, ebp
mul edi
shr edx, 1
lea ebp, [edx + edx*2]
xor edi, edi
mov edx, esi
test ebp, ebp
je 0x7c7a9a
nop word cs:[eax + eax]
mov eax, edi
movzx edi, byte [ebx + eax]
shr edi, 2
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
movzx ecx, byte [ebx + eax]
shl ecx, 4
movzx edi, byte [ebx + eax + 1]
shr edi, 4
and ecx, 0x30
mov cl, byte [ecx + edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
movzx ecx, byte [ebx + eax + 1]
movzx edi, byte [ebx + eax + 2]
shr edi, 6
and ecx, 0xf
mov cl, byte [edi + ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], cl
movzx ecx, byte [ebx + eax + 2]
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 3], cl
add edx, 4
lea edi, [eax + 3]
cmp edi, ebp
jb 0x7c7a30
lea ebx, [ebx + eax + 3]
mov ecx, dword [esp + 0x20]
mov eax, esi
mov esi, dword [esp + 0x18]
cmp edi, esi
jae 0x7c7af6
movzx ebp, byte [ebx]
inc edi
xor eax, eax
cmp edi, esi
jae 0x7c7ab2
movzx eax, byte [ebx + 1]
mov ecx, ebp
shr ecx, 2
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
shl ebp, 4
mov ecx, eax
shr ecx, 4
and ebp, 0x30
mov cl, byte [ecx + ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov bl, 0x3d
cmp edi, esi
jae 0x7c7ae4
and eax, 0xf
mov bl, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], bl
mov byte [edx + 3], 0x3d
add edx, 4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov byte [edx], 0
sub edx, eax
xor eax, eax
mov dword [ecx], edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x7c7b10
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x81c
mov edi, dword [esp + 0x82c]
mov dword [esp + 0x18], edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], esi
lea ebx, [esp + 0x81c]
mov dword [esp], edi
call fcn.007c3e70
lea eax, [edi + eax + 1]
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 0x10], 0
call fcn.007c5b50
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x7c7b86
mov dword [esp], esi
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateDirectoryW
sub esp, 8
cmp eax, 1
sbb eax, eax
add esp, 0x81c
pop esi
pop edi
pop ebx
ret
Function at 0x7c9f10
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x38]
mov eax, ebx
and eax, 4
shl eax, 0xf
test bl, 8
mov ebp, 0x100000
cmove ebp, eax
mov dword [esp], 0x14
call fcn.00492770
mov esi, eax
mov eax, 0xc
test esi, esi
je 0x7ca00c
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], 0
test edi, edi
sete al
movzx eax, al
mov dword [esi + 0xc], eax
test ebp, ebp
lea ecx, [eax*4 + 0x10000]
lea eax, [eax*4]
cmove ecx, eax
test bl, 0x10
cmovne ecx, eax
mov eax, dword [0x807e14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp + 0x14], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
je 0x7c9fff
test bl, 2
je 0x7c9fd0
mov dword [esp], eax
mov dword [esp + 4], 2
call sub.KERNEL32.dll_SetThreadPriority
sub esp, 8
test edi, edi
je 0x7c9fda
mov dword [edi], esi
xor eax, eax
jmp 0x7ca00c
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_ResumeThread
sub esp, 4
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
jne 0x7ca00c
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], esi
call fcn.004936c0
mov eax, 0xffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x7ca060
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.KERNEL32.dll_TerminateThread
sub esp, 8
xor eax, eax
add esp, 8
ret