joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aa3d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x41ab3a
push ebx
inc esi
lea ecx, [esp + 0x34]
push esi
call fcn.0040adcf
push esi
lea ecx, [esp + 0x34]
call fcn.00401ee4
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
call fcn.004022e5
mov edi, eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x18]
push eax
call fcn.004022aa
mov esi, eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x1c]
push eax
call fcn.004022e5
push dword [edi]
lea ecx, [esp + 0x24]
push dword [esi]
push dword [eax]
call fcn.00409291
sub esp, 0xc
mov ecx, esp
push 0x46aa90
call fcn.0040415e
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.004086d0
lea ecx, [esp + 0x54]
call fcn.0041a5b7
add esp, 0x30
lea ecx, [esp + 0x24]
mov edi, ebx
call fcn.004021da
test eax, eax
je 0x41ab28
mov esi, ebx
push ebx
push esi
lea ecx, [esp + 0x2c]
call fcn.00401e45
push eax
lea ecx, [esp + 0x38]
call fcn.00409114
cmp eax, 0xffffffff
jne 0x41ab4b
inc edi
lea ecx, [esp + 0x24]
movzx esi, di
call fcn.004021da
cmp esi, eax
jb 0x41aafd
lea ecx, [esp + 0x24]
call fcn.00406150
lea ecx, [esp + 0x30]
call fcn.00401ee9
lea ecx, [ebp + 8]
call fcn.00401ee9
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x10]
test esi, esi
je 0x41ab65
lea ecx, [esp + 0x30]
call fcn.00401ee4
push eax
push esi
call fcn.0043dc64
pop ecx
pop ecx
lea ecx, [esp + 0x24]
call fcn.00406150
lea ecx, [esp + 0x30]
call fcn.00401ee9
mov bl, 1
jmp 0x41ab3a
Function at 0x41aece
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x41af7a
sub ecx, 1
je 0x41af6c
sub ecx, 1
je 0x41af5e
sub ecx, 1
je 0x41af2b
sub ecx, 1
jne 0x41afbc
push 1
sub esp, 0x18
mov ecx, esp
push 0x4640ec
call fcn.00402073
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.00412909
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x4640e8
jmp 0x41afa8
push 1
sub esp, 0x18
mov ecx, esp
push 0x46a5b8
call fcn.00402073
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.00412909
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x4640ec
jmp 0x41afa8
push 1
sub esp, 0x18
mov ecx, esp
push 0x46a9ac
jmp 0x41af37
push 1
sub esp, 0x18
mov ecx, esp
push 0x4640d4
jmp 0x41af37
push 1
sub esp, 0x18
mov ebx, 0x4640ec
mov ecx, esp
push ebx
call fcn.00402073
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.00412909
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402073
push str.TileWallpaper
mov edx, esi
call fcn.00412909
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x41b1f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [0x472b04]
test bl, bl
mov dword [0x472b08], eax
pop ebx
jne 0x41b21c
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0043a5f8
push eax
push 0x46ad30
push str.CONOUT_
call fcn.00440082
add esp, 0x10
push 0x4e4
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call fcn.0041b1b1
push 0x64
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00435320
lea eax, [ebp - 0x64]
push str._n_tRemcos_v
push eax
call fcn.004403c0
lea eax, [ebp - 0x64]
push str.4.3.0_Pro
push eax
call fcn.004403c0
lea eax, [ebp - 0x64]
push 0x46ae38
push eax
call fcn.004403c0
lea eax, [ebp - 0x64]
push eax
call fcn.00406874
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x42047c
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x4204a7
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x4204a7
cmp al, 0xc0
je 0x4204a7
cmp al, 0xcc
je 0x4204a7
add edx, 2
cmp dx, cx
jb 0x42048c
pop esi
ret

Function at 0x422f56
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
call fcn.00422ef3
mov edx, dword [esp + 0x10]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x422f71
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x422f7f
pop edi
pop esi
ret

Function at 0x4251da
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4251f2
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x4251e5
pop esi
ret

Function at 0x4251f4
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or eax, edx
push esi
mov esi, dword [esp + 8]
or eax, esi
test al, 3
jne 0x42520f
shr esi, 2
push esi
call fcn.004251da
pop ecx
pop esi
ret
test esi, esi
je 0x425220
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x425215
pop esi
ret

Function at 0x425222
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x425246
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x425235
pop edi
pop esi
pop ebx
ret

Function at 0x42524a
Capabilities:
Encrypt data using aes

Disassembly:
xor eax, eax
mov ecx, 0x4666e0
push 0x20
pop edx
and eax, dword [ecx]
add ecx, 0x20
sub edx, 1
jne 0x425254
cmp ecx, str.SHA256wECDSA
jl 0x425251
ret
Function at 0x429cb1
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [edx + 0x3f]
push esi
shr eax, 6
mov esi, edx
sub esi, eax
mov dword [esp + 0x10], edx
push edi
xor edi, edi
mov ebx, ecx
and dword [esp + 0x18], edi
inc esi
imul eax, esi, 3
shr eax, 2
cmp eax, dword [ebp]
jbe 0x429ce8
mov eax, 0xffffff53
jmp 0x429ebb
mov esi, dword [esp + 0x20]
cmp edx, 3
jbe 0x429ea9
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea edx, [esp + 0x18]
call fcn.00429c53
add esp, 4
test eax, eax
jne 0x429ea2
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], eax
test cl, cl
je 0x429ea9
dec dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.00429c53
add esp, 4
test eax, eax
jne 0x429ebb
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x12], cl
mov ecx, ebx
push eax
call fcn.00429c53
add esp, 4
test eax, eax
jne 0x429ebb
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x24], cl
mov ecx, ebx
push eax
call fcn.00429c53
add esp, 4
test eax, eax
jne 0x429ebb
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
mov dh, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp dl, 0x2b
jb 0x429e9b
mov cl, byte [esp + 0x12]
cmp cl, 0x2b
jb 0x429e9b
mov al, byte [esp + 0x24]
cmp al, 0x2b
jb 0x429e9b
cmp dh, 0x2b
jb 0x429e9b
cmp dl, 0x7a
ja 0x429e9b
cmp cl, 0x7a
ja 0x429e9b
cmp al, 0x7a
ja 0x429e9b
cmp dh, 0x7a
ja 0x429e9b
xor ecx, ecx
cmp al, 0x3d
setne cl
xor eax, eax
inc ecx
cmp dh, 0x3d
setne al
add ecx, edi
add eax, ecx
cmp eax, dword [ebp]
ja 0x429cde
mov cl, byte [esp + 0x12]
movzx eax, dl
mov al, byte [eax + 0x467825]
mov byte [esp + 0x13], al
movzx eax, cl
mov ch, byte [eax + 0x467825]
mov al, byte [esp + 0x24]
cmp al, 0x3d
jne 0x429e3e
xor cl, cl
jmp 0x429e47
movzx eax, al
mov cl, byte [eax + 0x467825]
cmp dh, 0x3d
jne 0x429e50
xor al, al
jmp 0x429e59
movzx eax, dh
mov al, byte [eax + 0x467825]
mov ah, byte [esp + 0x13]
mov dl, cl
shl dl, 6
or dl, al
shl ah, 2
mov al, ch
shr al, 4
or al, ah
mov byte [edi + esi], al
inc edi
cmp byte [esp + 0x24], 0x3d
je 0x429e85
shr cl, 2
shl ch, 4
or cl, ch
mov byte [edi + esi], cl
inc edi
cmp dh, 0x3d
je 0x429ea9
mov byte [edi + esi], dl
inc edi
cmp dword [esp + 0x14], 3
ja 0x429cf5
jmp 0x429ea9
mov eax, 0xffffff66
jmp 0x429ebb
cmp eax, 0xffffff7c
jne 0x429ebb
test esi, esi
je 0x429eb6
cmp dword [ebp], edi
jbe 0x429eb6
mov byte [edi + esi], 0
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x42d5b7
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x42d6b1
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x42d5d8
test esi, esi
jne 0x42d6b1
cmp edx, 3
je 0x42d60e
cmp edx, 4
je 0x42d60e
cmp edx, 5
je 0x42d60e
cmp edx, 6
je 0x42d60e
cmp edx, 7
je 0x42d60e
cmp edx, 8
je 0x42d60e
cmp edx, 0xa
je 0x42d60e
cmp edx, 0xb
je 0x42d60e
cmp edx, 0xc
je 0x42d60e
cmp edx, 0xd
jne 0x42d6b1
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.0042d59a
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42d6b6
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x42d6b1
cmp esi, 0x40
ja 0x42d654
cmp dword [esp + 0x14], ebx
je 0x42d67d
push esi
push dword [esp + 0x18]
push ecx
call fcn.00434da0
add esp, 0xc
jmp 0x42d67a
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.00432499
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42d6ad
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.00432574
mov ebp, eax
test ebp, ebp
jne 0x42d6ad
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x42d695
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00435320
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x42d695
mov eax, ebp
jmp 0x42d6b6
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x431535
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.00434da0
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x431673
lea ecx, [esp + 0x74]
call fcn.004325b3
mov esi, eax
test esi, esi
jne 0x431673
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.00432499
mov esi, eax
pop ecx
test esi, esi
jne 0x431673
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00432574
mov esi, eax
test esi, esi
jne 0x431673
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00434da0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x43161e
cmp eax, dword [edi + 4]
jne 0x43161e
cmp byte [edi + 0x76], 1
je 0x431691
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x431625
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x431660
test ebx, ebx
je 0x431660
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x431653
push 0x20
push eax
push ebp
call fcn.00434da0
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00431526
jmp 0x431660
push ebx
push eax
push ebp
call fcn.00434da0
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x431593
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.0041bae7
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x431686

Function at 0x431d8d
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x431d39
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00435320
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x431d97
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x431d2b
Function at 0x4324b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x4324c6
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x432513
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00435320
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.00431d01
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00431d9f
test eax, eax
jne 0x43256f
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00435320
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.00431d01
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00434da0
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00434da0
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00431d9f
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x432574
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4325ab
test edi, edi
je 0x4325ab
call fcn.004324b8
test eax, eax
jne 0x4325b0
push 0x20
mov edx, esi
mov ecx, esi
call fcn.00431d01
push 0x20
push esi
push edi
call fcn.00434da0
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x431d2b
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x432663
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x4326fd
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4326fd
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0042dd46
mov dword [esp + 0xc], eax
test eax, eax
jne 0x432702
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x4326c3
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.0043264d
mov ecx, ebx
mov esi, eax
call fcn.0043264d
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x43269d
jmp 0x4326e8
mov ecx, dword [esp + 0x10]
jmp 0x4326e8
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.0043264d
mov ecx, ebx
mov esi, eax
call fcn.0043264d
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x4326c9
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x432702
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x44a4b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044a335

Function at 0x44df10
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d87e

Function at 0x44df1b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044dab9
Function at 0x40b3b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
test eax, eax
jne 0x40b3ca
push edi
call fcn.0040b020
mov eax, dword [edi + 4]
add esp, 4
cmp eax, 1
jne 0x40b3e4
push dword [ebp + 0x10]
lea eax, [edi + 8]
push dword [ebp + 0xc]
push eax
call fcn.0040d910
add esp, 0xc
pop edi
pop ebp
ret
cmp eax, 2
jne 0x40b41d
push dword [edi]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0048ffaf
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jae 0x40b41d
push edi
call fcn.0040afd0
push str.Disabled_writing_session_log_due_to_error_while_writing
push dword [edi + 0x18]
mov dword [edi + 4], 3
call fcn.00455ac0
add esp, 0xc
pop edi
pop ebp
ret

Function at 0x40d770
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x40d7a2
movsx eax, cl
sub eax, 0x41
jmp 0x40d7e4
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x40d7b1
movsx eax, cl
sub eax, 0x47
jmp 0x40d7e4
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x40d7c0
movsx eax, cl
add eax, 4
jmp 0x40d7e4
cmp cl, 0x2b
jne 0x40d7cc
mov eax, 0x3e
jmp 0x40d7e4
cmp cl, 0x2f
jne 0x40d7d8
mov eax, 0x3f
jmp 0x40d7e4
cmp cl, 0x3d
jne 0x40d861
or eax, 0xffffffff
mov dword [ebp + edx*4 - 0x14], eax
inc edx
cmp edx, 4
jl 0x40d790
mov edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
je 0x40d861
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x40d861
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x40d812
cmp eax, ecx
jne 0x40d861
lea ebx, [ecx + 2]
jmp 0x40d81d
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x40d846
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x40d84e
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046addd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046addd
mov esp, ebp
pop ebp
ret

Function at 0x40e5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x40e5e5
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
nop word [eax + eax]
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x40e5d0
pop ebx
mov eax, 0x100
sub eax, edi
pop edi
shr eax, 8
pop esi
pop ebp
ret

Function at 0x412d70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0x34
push dword [ebp + 8]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
je 0x412d8e
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040ddc0
push 0x35
push dword [ebp + 8]
call fcn.004030c0
add esp, 8
test eax, eax
je 0x412da5
pop ebp
jmp fcn.00461fe0
xor eax, eax
pop ebp
ret
Function at 0x413070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00454a40
add esp, 8
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004675b0
Function at 0x428e60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
lea edx, [eax + 2]
mov cl, byte [eax + 1]
mov bh, byte [eax]
mov dword [ebp - 8], edx
mov byte [ebp - 1], cl
cmp dword [ebp + 0x10], edi
jle 0x428ec2
mov al, cl
push esi
inc bh
movzx esi, bh
add esi, edx
mov bl, byte [esi]
add al, bl
movzx ecx, al
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx edx, byte [esi]
mov esi, dword [ebp + 0xc]
movzx ecx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [ebp - 8]
movzx ecx, byte [ecx + edx]
xor byte [edi + esi], cl
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x428e83
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
pop esi
pop edi
mov byte [eax], bh
mov byte [eax + 1], cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428f40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
lea ebx, [eax + 2]
mov word [eax], 0
mov edi, ebx
mov dword [ebp - 0x108], ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
sub edi, eax
mov eax, ecx
lea esi, [ebp - 0x104]
xor edx, edx
add esi, ecx
div dword [ebp + 0x10]
mov byte [edi + esi], cl
inc ecx
mov al, byte [edx + ebx]
mov byte [esi], al
cmp ecx, 0x100
jb 0x428f76
mov esi, dword [ebp - 0x108]
lea ebx, [ebp - 0x104]
xor edi, edi
mov dword [ebp - 0x10c], 0x100
sub ebx, esi
mov dl, byte [esi]
lea esi, [esi + 1]
movzx eax, byte [ebx + esi - 1]
add eax, edi
movzx ecx, dl
add ecx, eax
sub dword [ebp - 0x10c], 1
movzx edi, cl
mov ecx, dword [ebp - 0x108]
mov al, byte [edi + ecx]
mov byte [esi - 1], al
mov byte [edi + ecx], dl
jne 0x428fb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046addd
mov esp, ebp
pop ebp
ret
Function at 0x4368f0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 0x40
push 0x36
push eax
mov dword [ebp - 0x48], ebx
call fcn.0046c6a0
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
xor edx, edx
test esi, esi
jle 0x436947
mov ebx, edi
lea eax, [ebp - 0x44]
sub ebx, eax
nop dword [eax]
cmp edx, 0x40
jge 0x436944
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [ebx + ecx]
xor byte [ecx], al
cmp edx, esi
jl 0x436930
mov ebx, dword [ebp - 0x48]
push ebx
call fcn.00435b50
push 0x40
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.00435be0
push 0x40
lea eax, [ebp - 0x44]
push 0x5c
push eax
call fcn.0046c6a0
add esp, 0x1c
xor edx, edx
test esi, esi
jle 0x436988
lea eax, [ebp - 0x44]
sub edi, eax
cmp edx, 0x40
jge 0x436988
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor byte [ecx], al
cmp edx, esi
jl 0x436974
lea esi, [ebx + 0x5c]
push esi
call fcn.00435b50
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00435be0
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004621c0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046addd
mov esp, ebp
pop ebp
ret
Function at 0x43a040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4e63d8], 0
push edi
mov edi, dword [ebp + 8]
je 0x43a1b8
mov ecx, dword [0x4e68e8]
mov eax, 0x40
push esi
mov esi, dword [ebp + 0xc]
sub eax, ecx
cmp esi, eax
jl 0x43a1a0
nop dword [eax]
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + 0x4e68a8]
push edi
push eax
call fcn.0046c120
mov ecx, dword [0x4e68e8]
mov eax, 0x40
sub eax, ecx
add ecx, 0xffffffc0
push 0x4e68a8
push 0x4e6894
add edi, eax
add esi, ecx
call fcn.0043ebf0
mov edx, dword [0x4e6890]
add esp, 0x14
xor eax, eax
nop dword [eax]
nop word [eax + eax]
movzx ecx, byte [eax + 0x4e6894]
xor byte [edx + 0x4e63e0], cl
xor ecx, ecx
mov edx, dword [0x4e6890]
inc edx
cmp edx, 0x4b0
cmovge edx, ecx
mov dword [0x4e6890], edx
movzx ecx, byte [eax + 0x4e6895]
xor byte [edx + 0x4e63e0], cl
xor ecx, ecx
mov edx, dword [0x4e6890]
inc edx
cmp edx, 0x4b0
cmovge edx, ecx
mov dword [0x4e6890], edx
movzx ecx, byte [eax + 0x4e6896]
xor byte [edx + 0x4e63e0], cl
xor ecx, ecx
mov edx, dword [0x4e6890]
inc edx
cmp edx, 0x4b0
cmovge edx, ecx
mov dword [0x4e6890], edx
movzx ecx, byte [eax + 0x4e6897]
xor byte [edx + 0x4e63e0], cl
xor ecx, ecx
mov edx, dword [0x4e6890]
inc edx
cmp edx, 0x4b0
cmovge edx, ecx
mov dword [0x4e6890], edx
movzx ecx, byte [eax + 0x4e6898]
xor byte [edx + 0x4e63e0], cl
xor ecx, ecx
mov edx, dword [0x4e6890]
inc edx
cmp edx, 0x4b0
cmovge edx, ecx
add eax, 5
mov dword [0x4e6890], edx
cmp eax, 0x14
jl 0x43a0c0
cmp edx, 0x14
jge 0x43a18f
call fcn.0043a2a0
xor ecx, ecx
mov dword [0x4e68e8], ecx
cmp esi, 0x40
jge 0x43a070
push esi
lea eax, [ecx + 0x4e68a8]
push edi
push eax
call fcn.0046c120
add esp, 0xc
add dword [0x4e68e8], esi
pop esi
pop edi
pop ebp
ret