joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x401ef3
mov esi, 1
mov edx, 0x44e200
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x44e228
jl 0x401f30
mov eax, 1
mov byte [0x44ea30], 0x63
mov byte [0x44c963], 0
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x44ea30], bl
mov byte [ebx + 0x44c900], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x401f70
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x44ea30]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x44ca00], ecx
rol ecx, 8
mov dword [esi*4 + 0x44ce00], ecx
rol ecx, 8
mov dword [esi*4 + 0x44d200], ecx
rol ecx, 8
mov dword [esi*4 + 0x44d600], ecx
movzx ecx, byte [esi + 0x44c900]
test ecx, ecx
je 0x40209f
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x4020a8
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x44da00], eax
rol eax, 8
mov dword [esi*4 + 0x44de00], eax
rol eax, 8
mov dword [esi*4 + 0x44e230], eax
rol eax, 8
mov dword [esi*4 + 0x44e630], eax
inc esi
cmp esi, 0x100
jl 0x401fe5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403120
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call sub.ntdll.dll_memset
push dword [ebp + 8]
lea eax, [esp + 0x20]
push esi
lea edi, [ebx + 8]
push eax
mov dword [ebx + 4], edi
call fcn.004021a0
add esp, 0x18
mov dword [esp + 0xc], eax
test eax, eax
jne 0x403310
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x4032fa
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x44ea30]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x44e630]
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44e230]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44de00]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44da00]
mov dword [edi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x44ea30]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x44e230]
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44de00]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44e630]
movzx eax, bl
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44da00]
mov dword [edi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x44ea30]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x44e230]
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44de00]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44e630]
movzx eax, bl
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44da00]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x44ea30]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x44e230]
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44de00]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44e630]
movzx eax, bl
movzx eax, byte [eax + 0x44ea30]
xor edx, dword [eax*4 + 0x44da00]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x4031a0
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
push 0x118
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [sub.ntdll.dll_memset]
call eax
mov eax, dword [esp + 0x18]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4049f0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 0x30], edx
mov dword [ecx + 0xc], 0
push ebx
push esi
push edi
test edx, edx
jne 0x404a85
mov eax, 0x137e2179
mov dword [ebp - 0x20], 0x2b3e6c1f
mov esi, 0x5be0cd19
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, 0xfb41bd6b
mov ebx, 0x1f83d9ab
mov dword [ebp - 0x24], 0x9b05688c
mov dword [ebp - 0x1c], 0x510e527f
mov edx, 0xade682d1
mov dword [ebp - 0x14], 0x5f1d36f1
mov esi, 0xfe94f82b
mov dword [ebp - 0x18], 0xa54ff53a
mov eax, 0xf3bcc908
mov dword [ebp - 0x10], 0x3c6ef372
mov dword [ebp - 8], 0x84caa73b
mov dword [ebp - 0xc], 0xbb67ae85
mov dword [ebp - 4], 0x6a09e667
jmp 0x404aed
mov eax, 0xbefa4fa4
mov dword [ebp - 0x20], 0x68581511
mov esi, 0x47b5481d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, 0x64f98fa7
mov ebx, 0xdb0c2e0d
mov dword [ebp - 0x24], 0x8eb44a87
mov edx, 0xffc00b31
mov dword [ebp - 0x1c], 0x67332667
mov dword [ebp - 0x14], 0xf70e5939
mov esi, 0x3070dd17
mov dword [ebp - 0x18], 0x152fecd8
mov eax, 0xc1059ed8
mov dword [ebp - 0x10], 0x9159015a
mov dword [ebp - 8], 0x367cd507
mov dword [ebp - 0xc], 0x629a292a
mov dword [ebp - 4], 0xcbbb9d5d
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ecx + 0x20], esi
mov esi, dword [ebp - 0x10]
mov dword [ecx + 0x24], esi
mov esi, dword [ebp - 0x14]
mov dword [ecx + 0x28], esi
mov esi, dword [ebp - 0x18]
mov dword [ecx + 0x2c], esi
mov esi, dword [ebp - 0x2c]
mov dword [ecx + 0x30], edx
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x34], edx
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x40], edi
mov dword [ecx + 0x44], ebx
mov dword [ecx + 0x48], eax
xor eax, eax
pop edi
mov dword [ecx + 0x4c], esi
pop esi
mov dword [ecx + 0xd0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov dword [ebp - 0x10], edx
push 0x30
mov eax, edi
mov dword [ebp - 4], ecx
push 0
push eax
mov dword [ebp - 8], edi
call sub.ntdll.dll_memset
mov edx, dword [ebp - 4]
mov esi, 1
add esp, 0xc
xor ebx, ebx
sub esi, edx
lea ecx, [edx + 0x20]
lea eax, [edx + 0xf]
mov dword [ebp - 0xc], ecx
nop dword [eax]
add byte [eax], 1
jne 0x4063ad
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x4063a0
mov ecx, dword [ebp - 0xc]
push edi
call fcn.00403450
mov edi, eax
add esp, 4
test edi, edi
jne 0x406420
mov edi, dword [ebp - 8]
add ebx, 0x10
mov edx, dword [ebp - 4]
add edi, 0x10
mov dword [ebp - 8], edi
lea eax, [edx + 0xf]
cmp ebx, 0x30
jl 0x4063a0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x40]
xor ecx, ecx
sub edx, eax
lea eax, [ebp - 0x40]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x30
jl 0x4063e0
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
push pe_nt_image_headers32
push eax
push ecx
call fcn.004021a0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x406420
mov ecx, dword [ebp - 4]
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [ecx], xmm0
push 0x30
lea eax, [ebp - 0x40]
push 0
push eax
mov eax, dword [sub.ntdll.dll_memset]
call eax
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407d00
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
xorps xmm0, xmm0
movq qword [eax], xmm0
push eax
mov dword [eax + 8], 0
lea eax, [ebp - 0xc]
push eax
call fcn.00412260
add esp, 8
test eax, eax
je 0x407d31
add eax, 0xffffc580
mov esp, ebp
pop ebp
ret
cmp dword [0x444660], 0
push ebx
push esi
push edi
mov edi, 0x444660
mov edx, edi
je 0x407da5
mov ebx, dword [ebp - 8]
cmp dword [edx + 4], ebx
jne 0x407d9b
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [ebp - 4]
sub esi, 4
jb 0x407d69
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x407d6e
add edx, 4
add eax, 4
sub esi, 4
jae 0x407d58
cmp esi, 0xfffffffc
je 0x407db1
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x407d9b
cmp esi, 0xfffffffd
je 0x407db1
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x407d9b
cmp esi, 0xfffffffe
je 0x407db1
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x407d9b
cmp esi, 0xffffffff
je 0x407db1
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x407db1
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x407d47
pop edi
pop esi
mov eax, 0xffffc380
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x407da5
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov dword [eax], ecx
cmp ecx, 1
jne 0x407de2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp eax, 5
je 0x407dd0
test eax, eax
jne 0x407dd6
cmp dword [ecx + 4], 0
je 0x407de2
pop edi
pop esi
mov eax, 0xffffc580
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov eax, ecx
xor dl, dl
xor edi, edi
mov dword [ebp - 4], eax
test esi, esi
je 0x4090a2
cmp esi, 0x20
jb 0x409087
mov ecx, esi
mov edx, ebx
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
sub edx, eax
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edx + eax - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ecx
jb 0x409021
mov eax, dword [ebp - 4]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd edx, xmm2
cmp edi, esi
jae 0x4090a2
sub ebx, dword [ebp - 4]
add eax, edi
sub esi, edi
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x409092
pop edi
pop esi
movzx eax, dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ab50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push 0x40
xor ebx, ebx
mov dword [ebp - 8], edx
lea eax, [ebp - 0x4c]
mov esi, ecx
push ebx
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
test ecx, ecx
jne 0x40ab7e
xor cl, cl
jmp 0x40ab81
mov cl, byte [ecx + 8]
movzx edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
test ecx, ecx
je 0x40accd
push edi
cmp ecx, edx
mov edi, ecx
mov ecx, dword [eax]
cmovae edi, edx
test ecx, ecx
je 0x40acc7
push dword [eax + 4]
mov eax, dword [ecx + 0x10]
call eax
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40accc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x40acc7
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax + 4]
mov eax, dword [ecx + 0x14]
call eax
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x40accc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x40acc7
push 4
lea edx, [ebp - 4]
push edx
push dword [eax + 4]
mov eax, dword [ecx + 0x14]
call eax
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x40accc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x40acc7
lea edx, [ebp - 0x4c]
push edx
push dword [eax + 4]
mov eax, dword [ecx + 0x18]
call eax
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40accc
xor ecx, ecx
test edi, edi
je 0x40acaf
cmp edi, 0x40
jb 0x40ac9f
lea edx, [esi - 1]
lea eax, [ebp + edi - 0x4d]
add edx, edi
cmp esi, eax
ja 0x40ac4e
lea eax, [ebp - 0x4c]
cmp edx, eax
jae 0x40ac9f
mov eax, edi
and eax, 0xffffffc0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebp + ecx - 0x4c]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 0x3c]
pxor xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [ebp + ecx - 0x2c]
pxor xmm1, xmm0
movups xmmword [esi + 0x20], xmm1
movups xmm0, xmmword [esi + 0x30]
movups xmm1, xmmword [ebp + ecx - 0x1c]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
add esi, 0x40
cmp ecx, eax
jb 0x40ac53
cmp ecx, edi
jae 0x40acaf
mov al, byte [ebp + ecx - 0x4c]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, edi
jb 0x40aca3
mov ecx, dword [ebp - 8]
inc byte [ebp - 1]
sub ecx, edi
mov dword [ebp - 8], ecx
je 0x40accc
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x40ab93
mov ebx, 0xffffaf00
pop edi
push 0x40
lea eax, [ebp - 0x4c]
push 0
push eax
mov eax, dword [sub.ntdll.dll_memset]
call eax
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418ed0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x5c]
mov dword [ebp - 8], ecx
push 0
push eax
mov edi, edx
call sub.ntdll.dll_memset
mov ebx, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
test ebx, ebx
je 0x418f38
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x74]
push ebx
call fcn.00421b90
mov esi, eax
add esp, 4
test esi, esi
jne 0x419005
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x74]
push 8
call fcn.00421b90
mov esi, eax
add esp, 4
test esi, esi
jne 0x419005
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x74]
call fcn.00421c50
mov esi, eax
test esi, esi
jne 0x419005
cmp edi, 0x10
ja 0x418f79
lea eax, [ebp - 0x18]
push edi
push eax
mov eax, dword [ebp - 8]
jmp 0x418ffc
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x74]
movups xmm0, xmmword [ebp - 0x18]
movups xmmword [eax], xmm0
call fcn.00421310
mov esi, eax
test esi, esi
jne 0x419005
push 0x10
lea edx, [ebp - 0x18]
call fcn.00421b90
mov esi, eax
add esp, 4
test esi, esi
jne 0x419005
test ebx, ebx
je 0x418fbd
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x74]
push ebx
call fcn.00421b90
mov esi, eax
add esp, 4
test esi, esi
jne 0x419005
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x74]
push 8
call fcn.00421b90
mov esi, eax
add esp, 4
test esi, esi
jne 0x419005
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x74]
call fcn.00421c50
mov esi, eax
test esi, esi
jne 0x419005
cmp edi, 0x20
lea eax, [edi - 0x10]
mov ecx, 0x10
cmovae eax, ecx
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
add eax, ecx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0x58
lea eax, [ebp - 0x74]
push 0
push eax
mov eax, dword [sub.ntdll.dll_memset]
call eax
push 0x10
lea eax, [ebp - 0x18]
push 0
push eax
mov eax, dword [sub.ntdll.dll_memset]
call eax
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a640
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x444510
mov edx, edi
test eax, eax
je 0x41a6c4
cmp dword [0x444510], 0
je 0x41a6c4
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x41a6ba
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x41a685
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41a68a
add edx, 4
add eax, 4
sub esi, 4
jae 0x41a674
cmp esi, 0xfffffffc
je 0x41a6cd
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41a6b7
cmp esi, 0xfffffffd
je 0x41a6cd
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41a6b7
cmp esi, 0xfffffffe
je 0x41a6cd
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41a6b7
cmp esi, 0xffffffff
je 0x41a6cd
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x41a6cd
mov eax, dword [ebp - 4]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x41a663
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov eax, dword [ebx]
test eax, eax
jne 0x41b79c
mov byte [ebp - 1], al
jmp 0x41b7a2
mov al, byte [eax + 8]
mov byte [ebp - 1], al
cmp dword [ebp + 0x18], 0
mov dword [ebp - 8], 0
mov byte [ebp - 5], 1
je 0x41b9a5
nop word [eax + eax]
push dword [ebp + 8]
mov ecx, ebx
call fcn.0040d8e0
add esp, 4
test eax, eax
jne 0x41b9a7
mov eax, dword [ebx]
test eax, eax
je 0x41b999
cmp dword [ebx + 8], 0
je 0x41b999
push dword [ebp + 0x10]
mov eax, dword [eax + 0x14]
push dword [ebp + 0xc]
push dword [ebx + 4]
call eax
add esp, 0xc
test eax, eax
jne 0x41b9a7
mov eax, dword [ebx]
test eax, eax
je 0x41b999
cmp dword [ebx + 8], 0
je 0x41b999
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 8]
push 4
push ecx
push dword [ebx + 4]
call eax
add esp, 0xc
test eax, eax
jne 0x41b9a7
lea edx, [ebp - 0x4c]
mov ecx, ebx
call fcn.0040db00
test eax, eax
jne 0x41b9a7
movzx edi, byte [ebp - 1]
lea eax, [ebp - 0x4c]
push edi
push eax
lea eax, [ebp - 0x8c]
push eax
call sub.ntdll.dll_memcpy
mov esi, 1
add esp, 0xc
cmp dword [ebp + 0x14], esi
jbe 0x41b94a
push dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov ecx, ebx
call fcn.0040d8e0
add esp, 4
test eax, eax
jne 0x41b9a7
mov eax, dword [ebx]
test eax, eax
je 0x41b999
cmp dword [ebx + 8], 0
je 0x41b999
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x8c]
push edi
push ecx
push dword [ebx + 4]
call eax
add esp, 0xc
test eax, eax
jne 0x41b9a7
lea edx, [ebp - 0x8c]
mov ecx, ebx
call fcn.0040db00
test eax, eax
jne 0x41b9a7
test edi, edi
je 0x41b927
cmp edi, 0x40
jb 0x41b927
mov ecx, edi
and ecx, 0xffffffc0
movups xmm0, xmmword [ebp + eax - 0x4c]
movups xmm1, xmmword [ebp + eax - 0x8c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x4c], xmm1
movups xmm0, xmmword [ebp + eax - 0x3c]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
movups xmm0, xmmword [ebp + eax - 0x2c]
movups xmm1, xmmword [ebp + eax - 0x6c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x2c], xmm1
movups xmm0, xmmword [ebp + eax - 0x1c]
movups xmm1, xmmword [ebp + eax - 0x5c]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x1c], xmm1
add eax, 0x40
cmp eax, ecx
jl 0x41b8d1
cmp eax, edi
jge 0x41b940
nop dword [eax + eax]
mov cl, byte [ebp + eax - 0x8c]
xor byte [ebp + eax - 0x4c], cl
inc eax
cmp eax, edi
jl 0x41b930
inc esi
cmp esi, dword [ebp + 0x14]
jb 0x41b867
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x4c]
cmp esi, edi
cmovae esi, edi
push esi
push eax
push dword [ebp + 0x1c]
call sub.ntdll.dll_memcpy
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 5]
add dword [ebp + 0x1c], esi
sub edi, esi
mov edx, 4
mov dword [ebp + 0x18], edi
mov eax, ecx
add esp, 0xc
sub edx, eax
nop dword [eax]
add byte [ecx], 1
jne 0x41b98d
dec ecx
lea eax, [edx + ecx]
test eax, eax
jne 0x41b980
test edi, edi
je 0x41b9a5
mov edx, dword [ebp - 0xc]
jmp 0x41b7c0
pop edi
pop esi
mov eax, 0xffffaf00
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e160
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
push edi
test esi, esi
je 0x41e2fb
mov edi, dword [ebp + 0xc]
xor edx, edx
cmp eax, esi
jae 0x41e19e
nop dword [eax]
cmp byte [eax + edi], 0x20
jne 0x41e19c
inc eax
inc edx
cmp eax, esi
jb 0x41e190
cmp eax, esi
je 0x41e20e
mov ecx, esi
sub ecx, eax
cmp ecx, 2
jb 0x41e1b6
cmp byte [eax + edi], 0xd
jne 0x41e1b6
cmp byte [eax + edi + 1], 0xa
je 0x41e202
mov cl, byte [eax + edi]
cmp cl, 0xa
je 0x41e202
test edx, edx
jne 0x41e2de
cmp cl, 0x3d
jne 0x41e1d1
inc ebx
cmp ebx, 2
jmp 0x41e1d4
cmp cl, 0x7f
ja 0x41e2de
movzx ecx, cl
mov cl, byte [ecx + 0x444a50]
cmp cl, 0x7f
je 0x41e2de
cmp cl, 0x40
jae 0x41e1f9
test ebx, ebx
jne 0x41e2de
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
jmp 0x41e205
mov ecx, dword [ebp - 4]
inc eax
cmp eax, esi
jb 0x41e186
test ecx, ecx
je 0x41e2fb
and ecx, 7
lea ecx, [ecx + ecx*2]
lea edx, [ecx*2 + 7]
mov ecx, dword [ebp - 4]
shr ecx, 3
shr edx, 3
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*2]
mov edx, dword [ebp - 8]
sub ecx, ebx
test edx, edx
je 0x41e2ea
cmp dword [ebp - 0xc], ecx
jb 0x41e2ea
xor ecx, ecx
mov dword [ebp - 4], 3
xor ebx, ebx
mov dword [ebp + 0x10], ecx
mov esi, edx
test eax, eax
je 0x41e2ce
nop dword [eax]
mov cl, byte [edi]
cmp cl, 0xd
je 0x41e2c5
cmp cl, 0xa
je 0x41e2c5
cmp cl, 0x20
je 0x41e2c5
movzx ecx, cl
mov dl, byte [ecx + 0x444a50]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub dword [ebp - 4], ecx
movzx ecx, dl
mov edx, dword [ebp + 0x10]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0x10], edx
cmp edx, 4
jne 0x41e2c5
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp + 0x10], ecx
test edx, edx
je 0x41e2b0
mov ecx, ebx
shr ecx, 0x10
mov byte [esi], cl
inc esi
cmp edx, 1
jbe 0x41e2bd
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
inc esi
cmp edx, 2
jbe 0x41e2c5
mov byte [esi], bl
inc esi
inc edi
sub eax, 1
jne 0x41e260
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
sub esi, edx
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffd4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret