joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42accb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42acef
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42ad0a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x42eb9e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42ebd6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00431af3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00431acb
jmp 0x42ebe2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x42ebe6
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x44bca8
mov ecx, edi
call fcn.0043185e
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x42ec39
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x42ec4c
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00431af3
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00431acb
jmp 0x42ec4c
mov ecx, esi
call fcn.004310b2
test eax, eax
je 0x42ec4c
push edi
mov ecx, eax
call fcn.0042eb9e
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x430334
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x430376
call fcn.0043a17a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x430376
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x43036d
xor eax, eax
jmp 0x43037e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00430384
pop edi
pop esi
pop ebx
ret 4
Function at 0x7fb2b2
Capabilities:
Parse pe header

Disassembly:
jmp 0x845071
lea esp, [esp + 4]
jmp fcn.0084522d

Function at 0x7fe004
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x7fe03c
jmp 0x7fe020
lea esp, [esp + 4]
jmp 0x7fdfe7
jmp 0x7fe058
jmp 0x7fe074
push ebx
jmp 0x7fe090
jmp 0x7fe0ac
push ebp
jmp 0x7fe0c8
jmp 0x7fe0e4
push esi
jmp 0x7fe100
jmp 0x84a786
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
jmp 0x84a7ff
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
jmp 0x84a88b
xor edx, esi
movzx esi, byte [eax + 2]
jmp 0x84a7ce
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
jmp 0x84af37
movzx edx, byte [eax + 8]
jmp 0x84a844
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
jmp 0x84a86c
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x807984]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x807984]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x807984]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x807984]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.008342c8
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x807984]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x807984]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x807984]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x807984]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x8091ac
jne 0x84afe0
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x800148
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x84ce17
lea esp, [esp + 4]
jmp fcn.0084cdeb
Function at 0x839897
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.008000c4
jmp 0x800143
Function at 0x87a478
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dh, pe_nt_image_headers32
fisub dword [ebx + 0x52]
cmp ebx, dword [ecx - 0x4b73b92c]
cmc
xchg ebp, eax
scasb al, byte es:[edi]
lodsd eax, dword [esi]
retf
jne 0x877ff3
xchg esp, eax
add eax, 0x950e70a0
push esp
cmp dword [ebx], esi
push eax
mov dword [0xa3f55862], eax
dec edi
adc eax, 0x202ff87c
mov cl, 0xc1
jg 0x8780a2
lds esp, [edi + edi*8]
dec edi
shl byte [ebp - 0x766af8bd], 1
iretd
invalid
call 0x879e27
pop eax
sub eax, 0x879e27
cmp dword [eax + 0x7f77a1], 0
je 0x87a279
lea esp, [esp + 8]
popal
jmp 0x878036
inc dword [eax + 0x7f77a1]
push 0xaca99049
add dword [esp], 0x53d53917
push 0
push 0
push 0xb61f5605
add dword [esp], 0x4a5f6c0c
call fcn.00804d3e
jmp 0x87a5ac
call 0x87a2aa
jmp 0x87a419
push eax
jmp 0x879e22
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x87a49a
sub eax, 0x10000
jmp 0x87a41d
je 0x87a3e5
jmp 0x87a424
call 0x87a478
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x87a4d7
jb 0x87a48a
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x87a2a5
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x87a431
add dword [esp], 0xfffff898
call 0x802af4
call fcn.0080410f
popal
jmp 0x878036
cli
adc ah, byte [ecx]
mov dl, 0x20
inc edi
mov dl, 0x47
pushfd
or al, 0x82
in eax, 0x14
mov bl, 0x81
adc byte [esi + 0x8d310e1], al
ror dword [eax], cl
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
inc esp
cli
jae 0x87a4d7
xchg byte [ebp - 0x67], dh
adc byte [esi], 0x84
jecxz 0x87a51a
mul cl
je 0x87a4ea
lea edi, [ebx + ebx*8 - 0x2b]
dec ebp
frstor dword [edi + edx*2 - 0x6ffd665c]
test dword [edx], 0x3dad37b4
inc esp
mov bh, 0x1c
sahf
add eax, 0xb20ffc95
push edx
mov dl, 0x52
int3
call 0x87a5b1
jmp 0x87a4bc
Function at 0x403b30
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
mov eax, dword [0x40e0d4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
mov esi, dword [esp + 0x110]
mov dword [esp + 0x108], eax
cmp byte [esi], 0
je 0x403b8b
push edi
lea edi, [esp + 0xc]
sub edi, esi
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x5c
je 0x403b6a
cmp al, 0x2f
jne 0x403b79
cmp byte [esi - 1], 0x3a
je 0x403b79
push 0
lea eax, [esp + 0x10]
push eax
call ebp
mov cl, byte [esi]
mov al, byte [esi + 1]
mov byte [edi + esi], cl
inc esi
test al, al
mov byte [edi + esi], 0
jne 0x403b60
pop edi
push 0
lea edx, [esp + 0xc]
push edx
call ebp
mov ecx, dword [esp + 0x108]
pop esi
pop ebp
call fcn.00403d76
add esp, 0x104
ret

Function at 0x404f8e
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x40c300
call fcn.004061f8
mov edi, 0x94
mov eax, edi
call fcn.004048d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40e80c], ecx
mov eax, dword [esi + 4]
mov dword [0x40e818], eax
mov edx, dword [esi + 8]
mov dword [0x40e81c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40e810], esi
cmp ecx, 2
je 0x404fee
or esi, 0x8000
mov dword [0x40e810], esi
shl eax, 8
add eax, edx
mov dword [0x40e814], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x405027
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405027
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40503f
cmp eax, 0x20b
je 0x40502c
mov dword [ebp - 0x1c], edi
jmp 0x405053
cmp dword [ecx + 0x84], 0xe
jbe 0x405027
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40504d
cmp dword [ecx + 0x74], 0xe
jbe 0x405027
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.00407514
pop ecx
test eax, eax
jne 0x40507f
cmp dword [0x40e7f4], 2
je 0x40506c
call fcn.00408daf
push 0x1c
call fcn.00408c38
push 0xff
call fcn.004064b5
pop ecx
pop ecx
call fcn.00409350
mov dword [ebp - 4], edi
call fcn.004088bc
test eax, eax
jge 0x405098
push 0x1b
call fcn.00404f69
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40fddc], eax
call fcn.0040922e
mov dword [0x40e7ec], eax
call fcn.0040918c
test eax, eax
jge 0x4050be
push 8
call fcn.00404f69
pop ecx
call fcn.00408f59
test eax, eax
jge 0x4050cf
push 9
call fcn.00404f69
pop ecx
push 1
call fcn.004064e5
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x4050e5
push eax
call fcn.00404f69
pop ecx
mov eax, dword [0x40e82c]
mov dword [0x40e830], eax
push eax
push dword [0x40e824]
push dword [0x40e820]
call fcn.00401780
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x405114
push esi
call fcn.00406610
call fcn.00406632
jmp 0x405146
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.00406233
ret
Function at 0x40654f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40e84c], esi
push edi
jne 0x40656f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40e848], esi
mov byte [0x40e844], al
jne 0x4065d5
mov ecx, dword [0x40fdd0]
test ecx, ecx
je 0x4065b6
mov eax, dword [0x40fdcc]
sub eax, 4
cmp eax, ecx
jmp 0x4065af
mov eax, dword [eax]
test eax, eax
je 0x4065a1
call eax
mov eax, dword [0x40fdcc]
sub eax, 4
cmp eax, dword [0x40fdd0]
mov dword [0x40fdcc], eax
jae 0x406599
mov eax, 0x40e028
mov esi, 0x40e030
cmp eax, esi
mov edi, eax
jae 0x4065d5
mov eax, dword [edi]
test eax, eax
je 0x4065ce
call eax
add edi, 4
cmp edi, esi
jb 0x4065c6
mov eax, 0x40e034
mov esi, 0x40e03c
cmp eax, esi
mov edi, eax
jae 0x4065f4
mov eax, dword [edi]
test eax, eax
je 0x4065ed
call eax
add edi, 4
cmp edi, esi
jb 0x4065e5
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x40660e
push dword [ebp + 8]
mov dword [0x40e84c], 1
call fcn.004064b5
pop ebp
ret
Function at 0x40835b
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x40837d
mov eax, 0xfffffffd
jmp 0x40845d
mov ebx, dword [0x7dc880]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x40842b
mov ebx, dword [0x7dc880]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x4083cc
mov ebx, dword [0x7dc880]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x4083cc
mov eax, 1
jmp 0x4083d1
mov eax, 0
test eax, eax
je 0x4083fd
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4083e6
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x7dc880]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x408453
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x40845d
mov esp, ebp
pop ebp
ret 4

Function at 0x40865e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x408711
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x4091af
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.0040865e
test eax, eax
je 0x4091f2
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x4091f2
cmp word [eax], 0x5a4d
jne 0x4091f2
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x4091f2
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00408730
mov eax, dword [ebp + 8]
jmp 0x40920b
mov esp, ebp
pop ebp
ret 4
Function at 0x40d17b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
test esi, esi
jne 0x40d1a0
xor eax, eax
jmp 0x40d1a5
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x5cd570
call fcn.005cb7f9
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40d1db
push ebx
call fcn.005cb7e1
add esp, 4
pop eax
mov dword [ebp - 4], eax
test esi, esi
je 0x40d1e8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40d23d
lea edx, [esi + 8]
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x42413938
mov dword [ebp - 8], 0x46454443
test edx, edx
je 0x40d23d
test eax, eax
je 0x40d23d
lea esi, [edx + ecx]
cmp edx, esi
jae 0x40d23d
nop
movzx ecx, byte [edx]
shr ecx, 4
inc edx
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax], cl
movzx ecx, byte [edx - 1]
and ecx, 0xf
lea eax, [eax + 2]
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax - 1], cl
cmp edx, esi
jb 0x40d219
pop esi
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x453890
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], 8
fild dword [ebp - 8]
fild dword [eax + 4]
fprem
fistp dword [ebp - 8]
fninit
cmp dword [ebp - 8], 0
je 0x4538fa
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
cmp dword [ebx + 4], 0x10
je 0x45390c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
jne 0x453920
mov eax, 0x678929
jmp 0x453a6a
mov eax, dword [ebx + 8]
bswap eax
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0xc]
bswap eax
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x10]
bswap eax
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x14]
bswap eax
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov eax, dword [ebx + 8]
bswap eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
bswap eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0xe3779b90
mov ecx, 0x10
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov edx, eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
xor edx, eax
mov eax, dword [ebp - 0x20]
shr eax, 5
add eax, dword [ebp - 0x1c]
xor edx, eax
mov eax, dword [ebp - 0x24]
sub eax, edx
mov dword [ebp - 0x24], eax
shl eax, 4
add eax, dword [ebp - 0x10]
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
xor edx, eax
mov eax, dword [ebp - 0x24]
shr eax, 5
add eax, dword [ebp - 0x14]
xor edx, eax
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x20], eax
sub dword [ebp - 0x28], 0x9e3779b9
loop 0x453969
xor ecx, ecx
bswap eax
mov cl, al
and cl, 7
mov dword [ebp - 0x30], ecx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, ecx
sub eax, 0xa
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], ecx
push dword [ebp - 4]
call fcn.004260e2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x453a04
push ebx
call fcn.005cb7e1
add esp, 4
pop eax
mov dword [ebp - 8], eax
push dword [ebp - 0x30]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00453a82
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x453a60
mov eax, dword [ebp - 8]
test eax, eax
je 0x453a56
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.005cb7e7
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x453a6a
mov eax, 0x678929
jmp 0x453a6a
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x453a7b
push ebx
call fcn.005cb7e1
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x454199
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x24]
mov ebx, dword [eax + 4]
mov ecx, dword [eax]
mov eax, ebx
shr eax, 4
xor eax, ecx
and eax, 0xf0f0f0f
xor ecx, eax
shl eax, 4
xor ebx, eax
mov eax, ecx
shr eax, 4
xor eax, ebx
and eax, 0x1010101
xor ebx, eax
shl eax, 4
xor ecx, eax
mov eax, ecx
shr eax, 9
xor eax, ecx
and eax, 0x550055
mov edx, eax
shl edx, 9
xor edx, eax
xor ecx, edx
mov eax, ebx
shr eax, 9
xor eax, ebx
and eax, 0x550055
mov edx, eax
shl edx, 9
xor edx, eax
xor ebx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, 0x3333
mov edx, eax
shl edx, 0x12
xor edx, eax
mov eax, ebx
shr eax, 0x12
xor eax, ebx
and eax, 0x3333
xor ecx, edx
mov edx, eax
shl edx, 0x12
xor edx, eax
xor ebx, edx
mov eax, ebx
shr eax, 0x10
xor eax, ebx
and eax, 0xff
mov edx, eax
shl edx, 0x10
xor edx, eax
mov eax, dword [esp + 0x28]
xor ebx, edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0x10
jmp 0x454261
mov esi, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x24]
and ecx, 0xfffffff
and ebx, 0xfffffff
cmp byte [eax + edx], 0
mov edx, ecx
mov eax, ebx
je 0x45428c
shl edx, 0x1a
shr ecx, 2
shl eax, 0x1a
shr ebx, 2
jmp 0x454296
shl edx, 0x1b
shr ecx, 1
shl eax, 0x1b
shr ebx, 1
or ebx, eax
or ecx, edx
mov esi, dword [esi + 8]
mov edx, ecx
shr edx, 0x10
movzx edi, dl
mov eax, ecx
shr eax, 8
movzx eax, al
mov dword [esp + 0x18], eax
shr eax, 5
movzx edx, cl
mov dword [esp + 0x1c], edx
and edx, 0xc0
or edx, eax
mov ebp, edi
shr edx, 2
mov eax, ecx
shr eax, 0x18
and eax, 0xe
or edx, eax
mov edx, dword [esi + edx*4 + 0x300]
mov eax, edi
shr eax, 5
and eax, 4
and edi, 0x1d
and ebp, 0x40
or eax, ebp
shr eax, 1
or eax, edi
or edx, dword [esi + eax*4 + 0x200]
mov eax, dword [esp + 0x18]
shr eax, 1
and eax, 0x3f
or edx, dword [esi + eax*4 + 0x100]
mov eax, dword [esp + 0x1c]
and eax, 0x3f
or edx, dword [esi + eax*4]
mov eax, ebx
shr eax, 0x10
movzx edi, al
mov dword [esp + 0x1c], edi
and edi, 0xc0
movzx ebp, bl
mov dword [esp + 0x18], ebp
shr ebp, 4
and ebp, 8
or ebp, edi
mov eax, ebx
shr eax, 8
movzx eax, al
mov edi, ebx
shr edi, 0x18
and edi, 0xd
shr ebp, 2
or ebp, edi
mov edi, eax
shr edi, 6
and edi, 2
and eax, 0x3d
or edi, eax
mov eax, dword [esi + ebp*4 + 0x700]
or eax, dword [esi + edi*4 + 0x500]
mov edi, dword [esp + 0x1c]
and edi, 0x3f
or eax, dword [esi + edi*4 + 0x600]
mov edi, dword [esp + 0x18]
and edi, 0x3f
or eax, dword [esi + edi*4 + 0x400]
movzx esi, dx
mov edi, eax
shl edi, 0x10
and eax, 0xffff0000
or edi, esi
mov esi, dword [esp + 0x28]
shr edx, 0x10
or eax, edx
mov dword [esi + 4], eax
mov eax, 1
add dword [esp + 0x24], eax
mov dword [esi], edi
add esi, 8
sub dword [esp + 0x10], eax
mov dword [esp + 0x28], esi
jne 0x45425d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8