joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f4f8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45f562
mov eax, ebx
call fcn.0046184c
test al, al
jne 0x45f562
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405140
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45f54f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45f56f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004050a4
jmp 0x45f56f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004050a4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x460a60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x460ace
mov eax, esi
call fcn.00449860
test al, al
je 0x460ace
mov eax, dword [ebx + 0x84]
call fcn.00449564
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x460ace
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x460ac2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449564
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00441608
jmp 0x460ace
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046089c
pop esi
pop ebx
ret
Function at 0x464454
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x464647
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x46462e
mov eax, dword [edi + 0x30]
test eax, eax
je 0x464492
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4644b2
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4644a2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4644b2
mov eax, edi
call fcn.004646e8
jmp 0x46462e
cmp dword [edi + 0xa0], 0
jne 0x4644e9
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040a36c
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cbed0]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x464520
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040a36c
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cbed0]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00464728
mov ebx, eax
test bl, bl
jne 0x4645e3
mov eax, dword [edi + 0x30]
test eax, eax
je 0x464549
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x464563
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x46455c
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x464565
xor eax, eax
test al, al
jne 0x4645e3
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x464578
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x46458f
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040a36c
jmp 0x4645bb
push dword [edi + 0x30]
push 0x464664
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004053f4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040a36c
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4645e3
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00464728
mov ebx, eax
test bl, bl
jne 0x4645f0
mov eax, edi
call fcn.004646e8
jmp 0x46462e
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4645ff
mov dword [edi + 0xa8], eax
jmp 0x464609
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004647a0
test al, al
je 0x46462e
mov eax, edi
mov si, 0xffee
call fcn.00404384
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00464850
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46464e
lea eax, [ebp - 0x108]
call fcn.00405050
ret
Function at 0x465e7c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054e0
xor eax, eax
push ebp
push 0x465f28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405050
mov eax, dword [ebp - 4]
call fcn.00409d24
test al, al
je 0x465f12
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004054f0
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x465f12
mov eax, dword [ebp - 8]
call fcn.00402ed4
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465f38
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x465f08
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405258
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00402f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465f2f
lea eax, [ebp - 4]
call fcn.00405050
ret

Function at 0x465f5c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054e0
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x4660dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050e8
xor edx, edx
mov eax, 2
call fcn.00465e1c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00465e3c
mov ebx, eax
jmp 0x4660a4
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004052d0
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.0040a0c4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004092d8
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 8]
call fcn.004092d8
mov edx, dword [ebp - 0x140]
pop eax
call fcn.00405488
je 0x466084
lea eax, [ebp - 0x148]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004052d0
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004092d8
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.004092d8
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.00405488
jne 0x466099
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00465e5c
mov ebx, eax
test ebx, ebx
jne 0x465fe5
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4660e4
lea eax, [ebp - 0x14c]
mov edx, 7
call fcn.00405074
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405074
ret
Function at 0x4663d8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00466fbc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x466eb8
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x466efd
lea eax, [ebp - 0x60]
call fcn.004663d8
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.00466404
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004664f0
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x466eff
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x466f28
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x466f2e
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x466f0d
lea eax, [ebp - 0x60]
call fcn.004663d8
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00466404
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.00466d98
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004664f0
lea eax, [ebp - 0x60]
call fcn.004663d8
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00466404
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.00466404
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004664f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x468988
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 9], 0
or esi, 0xffffffff
mov eax, dword [ebx + 0x40]
mov dword [ebp - 8], eax
jmp 0x468a7a
inc esi
cmp esi, dword [ebx + 0x70]
jl 0x468a09
cmp dword [ebx + 0x48], 0xfde9
je 0x4689c7
movzx eax, byte [ebp - 2]
movzx eax, al
bt dword [ebx + 0x4c], eax
jb 0x4689c7
mov byte [ebp - 0xb], 1
jmp 0x4689ed
cmp dword [ebx + 0x48], 0xfde9
jne 0x4689e2
movzx eax, byte [ebp - 2]
add al, 0x80
sub al, 0x40
setb al
xor al, 1
mov byte [ebp - 0xa], al
jmp 0x4689e6
mov byte [ebp - 0xa], 0
movzx eax, byte [ebp - 0xa]
mov byte [ebp - 0xb], al
cmp byte [ebp - 0xb], 0
je 0x468a09
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov byte [ebp - 1], 1
jmp 0x468aac
lea ecx, [ebp - 8]
lea edx, [esi + 1]
mov eax, ebx
call fcn.004691d8
movzx eax, byte [ebp - 2]
sub al, 0xa
je 0x468a24
sub al, 3
je 0x468a31
jmp 0x468a57
mov eax, dword [ebp - 8]
mov byte [eax + esi], 0
mov byte [ebp - 1], 1
jmp 0x468aac
cmp byte [ebp - 9], 0
je 0x468a4a
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov byte [ebp - 1], 1
jmp 0x468aac
mov eax, dword [ebp - 8]
mov byte [eax + esi], 0
mov byte [ebp - 9], 1
jmp 0x468a7a
cmp byte [ebp - 9], 0
je 0x468a70
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov byte [ebp - 1], 1
jmp 0x468aac
mov eax, dword [ebp - 8]
movzx edx, byte [ebp - 2]
mov byte [eax + esi], dl
lea edx, [ebp - 2]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
dec eax
je 0x4689a5
test esi, esi
jl 0x468aa2
mov eax, dword [ebp - 8]
mov byte [eax + esi + 1], 0
mov byte [ebp - 1], 1
jmp 0x468aac
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a804
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x94
call fcn.00403928
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
xor eax, eax
cmp dword [ebp - 0x84], 2
jne 0x46a879
mov edx, dword [ebp - 0x90]
sub edx, 3
je 0x46a853
dec edx
je 0x46a857
dec edx
je 0x46a85b
jmp 0x46a8b9
mov al, 4
jmp 0x46a8b9
mov al, 5
jmp 0x46a8b9
mov edx, dword [ebp - 0x8c]
sub edx, 1
jb 0x46a86d
je 0x46a871
dec edx
je 0x46a875
jmp 0x46a8b9
mov al, 6
jmp 0x46a8b9
mov al, 7
jmp 0x46a8b9
mov al, 8
jmp 0x46a8b9
cmp dword [ebp - 0x90], 4
jne 0x46a88f
cmp dword [ebp - 0x8c], 0
jne 0x46a88f
mov al, 1
jmp 0x46a8b9
cmp dword [ebp - 0x90], 4
jne 0x46a8a5
cmp dword [ebp - 0x8c], 0xa
jne 0x46a8a5
mov al, 2
jmp 0x46a8b9
cmp dword [ebp - 0x90], 4
jne 0x46a8b9
cmp dword [ebp - 0x8c], 0x5a
jne 0x46a8b9
mov al, 3
mov esp, ebp
pop ebp
ret
Function at 0x46a8c0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
call fcn.0046a804
mov ebx, eax
push 0
push 0x46a91c
call sub.user32.dll_FindWindowA
push 0
push 0x46a92c
push 0
push eax
call sub.user32.dll_FindWindowExA
mov edx, ebx
add dl, 0xf9
sub dl, 2
jae 0x46a8ff
push 0
push 0x46a93c
push 0
push eax
call sub.user32.dll_FindWindowExA
add bl, 0xfa
sub bl, 3
jae 0x46a916
push 0
push 0x46a948
push 0
push eax
call sub.user32.dll_FindWindowExA
pop ebx
pop ebp
ret

Function at 0x46aa48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004054e0
xor eax, eax
push ebp
push 0x46ab73
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.0046a9e0
mov esi, eax
test esi, esi
jle 0x46ab58
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405558
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.004054f0
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_2
test eax, eax
jne 0x46ab58
mov edi, dword [ebp - 4]
test edi, edi
je 0x46aacc
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405558
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004054f0
mov edi, eax
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_2
test eax, eax
jne 0x46ab4f
mov eax, dword [ebp - 0x18]
call fcn.00402f08
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_2
test eax, eax
jne 0x46ab48
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x46ab3f
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x46ab4f
mov eax, esi
call fcn.00402f24
jmp 0x46ab4f
mov eax, esi
call fcn.00402f24
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ab7a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405074
ret
Function at 0x470ba8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov ebx, dword [ebp - 8]
jmp 0x470bc1
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x470bc0
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.00405780
xor ebx, ebx
cmp esi, dword [ebp - 8]
jge 0x470d38
inc ebx
mov eax, edi
call fcn.00405550
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [ebp - 8]
jge 0x470cef
inc ebx
mov eax, edi
call fcn.00405550
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi]
and dl, 3
movzx edx, dl
shl edx, 4
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [ebp - 8]
jge 0x470cbb
inc ebx
mov eax, edi
call fcn.00405550
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405550
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x470d2c
inc ebx
mov eax, edi
call fcn.00405550
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405550
mov byte [eax + ebx - 1], 0x3d
jmp 0x470d2c
inc ebx
mov eax, edi
call fcn.00405550
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405550
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00405550
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [ebp - 8]
jl 0x470bf3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x47209c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x4c2a74
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4720bb
mov esi, 1
mov edx, 0x4c2b7c
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x472134
dec ebx
je 0x472156
dec ebx
je 0x472178
dec ebx
je 0x472199
jmp 0x4721b3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4721b3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4721b3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4721b3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x472124
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4720d7
mov esi, 0x20
mov eax, 0x4c2aa4
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4721d8
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x472214
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x4c2b2b]
test bl, bl
jbe 0x472249
lea eax, [esi + 0x3e0]
call fcn.004721f0
lea eax, [esi + 0x3fc]
call fcn.004721f0
dec bl
jne 0x47222f
mov cl, 0x30
mov edx, 0x4c2afc
mov eax, dword [ebp - 4]
movzx ebx, byte [edx]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0x1c
ja 0x47226f
movzx ebx, byte [ebp - 5]
movzx ebx, byte [esi + ebx + 0x3df]
mov byte [eax], bl
jmp 0x47227d
movzx ebx, byte [ebp - 5]
movzx ebx, byte [esi + ebx + 0x3df]
mov byte [eax], bl
inc eax
inc edx
dec cl
jne 0x472253
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x47228c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.00472034
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4722a8
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.00472034
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.00472034
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4722c4
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.00472214
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4722ee
mov bl, 1
mov eax, 0x4c29f4
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x472327
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x472334
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x472313
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x47235e
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.0047209c
jmp 0x472385
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.0047209c
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x47238d
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x472346
mov bl, 0x40
mov esi, 0x4c2a34
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x4723f3
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x472400
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4723dc
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0047205c
inc ebx
inc esi
cmp bl, 0x41
jne 0x47240e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4725f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [ebp - 0x10], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [ebp - 0xf], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [ebp - 0xe], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [ebp - 0xd], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [ebp - 0xb], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [ebp - 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [ebp - 9], al
mov edi, 8
lea eax, [ebp - 0x10]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x47269b
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x472696
mov eax, dword [ebp - 8]
mov edx, 8
call fcn.00405780
push 1
mov eax, dword [ebp - 8]
call fcn.00405550
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0047228c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret