joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7d0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x27c
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov ecx, 0x3f
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], al
mov esi, dword [esp + 0x288]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xa4]
push 0
push eax
push 0
push 0
push esi
call fcn.00423b43
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0x14
lea ecx, [esp + 0xa4]
push str.ugs_router
push ecx
call edi
test eax, eax
jne 0x40b847
pop edi
pop esi
add esp, 0x27c
ret 4
lea edx, [esp + 0xa4]
push str.proe
push edx
call edi
test eax, eax
jne 0x40b865
pop edi
pop esi
add esp, 0x27c
ret 4
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b892
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x6c]
push 0x40
push ecx
push esi
call edi
test eax, eax
jne 0x40b8c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
cmp word [esp + 0x64], 0x5a4d
je 0x40b8de
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
lea edx, [esp + 8]
push 0
push edx
lea eax, [esp + 0x2c]
push 0x40
push eax
push esi
call edi
test eax, eax
jne 0x40b907
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
mov ecx, dword [esp + 0xa0]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40b933
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
lea edx, [esp + 8]
push 0
push edx
lea eax, [esp + 0x14]
push 4
push eax
push esi
call edi
test eax, eax
jne 0x40b95c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
cmp dword [esp + 0xc], 0x4550
je 0x40b97a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
lea ecx, [esp + 8]
push 0
push ecx
lea edx, [esp + 0x18]
push 0x14
push edx
push esi
call edi
test eax, eax
jne 0x40b9a3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x1ac]
push 0xe0
push ecx
push esi
call edi
test eax, eax
push esi
jne 0x40b9d2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x27c
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp word [esp + 0x1e8], 2
pop edi
pop esi
sete al
add esp, 0x27c
ret 4
Function at 0x40ba90
Capabilities:
Acquire debug privileges
Create thread
Inject dll
Inject thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [esp + 0x18], eax
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x10], eax
lea esi, [ecx + ecx]
push esi
call fcn.0043b7dd
mov ebp, eax
mov eax, esi
add esp, 4
shr eax, 1
push eax
push ebp
push 0xffffffffffffffff
push ebx
push 0
push 0
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x10]
push ecx
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40baff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0040ba00
test eax, eax
je 0x40bba9
mov eax, dword [esp + 0x20]
push eax
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40bba9
cmp edi, 0xffffffff
je 0x40bba9
push 4
push 0x1000
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x40bb9d
push 0
push esi
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40bb9d
push str.LoadLibraryW
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x40bb9d
cmp eax, 0xffffffff
mov dword [esp + 0x18], 1
je 0x40bb9d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x40bba9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bbd2
cmp eax, 0xffffffff
je 0x40bbd2
mov ecx, dword [esp + 0x14]
push 0
push str.SeDebugPrivilege
push eax
call fcn.0040ba00
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x40bbdf
push ebp
call fcn.0043b806
add esp, 4
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x40ce40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x64]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
dec ecx
cmp byte [esp + ecx + 7], 0x5c
je 0x40ce95
lea edx, [esp + 8]
push str.NC.
push edx
call edi
lea eax, [esp + 8]
push str.PCID.DAT
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 8]
push ecx
push 0
push str.Auto
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x110]
mov edi, dword [esp + 0x114]
lea edx, [esp + 8]
push edx
push 0x104
mov dword [ecx], eax
mov eax, dword [esi + 0x68]
push edi
push 0
push str.Pcid
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
pop edi
test eax, eax
setg cl
mov eax, ecx
pop esi
add esp, 0x104
ret 8

Function at 0x40d080
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x44d620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.004402e7
mov eax, dword [0x46514c]
mov dword [esp + 0x10], eax
push 0x128
mov byte [esp + 0x20], 1
call fcn.0043b7dd
mov esi, eax
add esp, 4
mov dword [esi], 0x128
mov ecx, dword [edi + 4]
push esi
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40d191
lea ebp, [esi + 0x24]
lea edx, [esp + 0x10]
push ebp
push 0x463548
push edx
call fcn.0043996a
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004402e7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call fcn.0042344d
add esp, 8
test eax, eax
jne 0x40d143
mov edi, dword [esi + 8]
push esi
call fcn.0043b806
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0043fdfc
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043fdfc
mov eax, edi
jmp 0x40d1bb
mov edx, dword [edi + 4]
push esi
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40d191
push ebp
lea eax, [esp + 0x14]
push 0x463548
push eax
call fcn.0043996a
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004402e7
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
push ecx
push edx
call fcn.0042344d
add esp, 8
test eax, eax
je 0x40d115
mov eax, dword [edi + 4]
push esi
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40d151
push esi
call fcn.0043b806
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.0043fdfc
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043fdfc
or eax, 0xffffffff
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40d560
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44d646
push eax
mov eax, 0x1824
mov dword fs:[0], esp
call fcn.004239e0
push ebx
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x82d]
mov byte [esp + 0x82c], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4000080
push 3
stosb byte es:[edi], al
mov eax, dword [esp + 0x1850]
push ebx
push 3
push SysReAllocStringLen
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40d5e5
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1824]
mov dword fs:[0], ecx
add esp, 0x1830
ret
push ebp
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x40d7a0
cmp esi, 0xffffffff
je 0x40d7a0
mov ecx, dword [esp + 0x1850]
mov ebp, 0x1000
cmp esi, ebp
mov dword [ecx], esi
jbe 0x40d6ce
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x834]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push ebx
push edx
lea eax, [esp + 0x83c]
push ebp
push eax
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], ebp
jne 0x40d7a0
lea ecx, [esp + 0x428]
call fcn.00414240
mov edx, dword [esp + 0x1848]
push 0x10
push edx
lea eax, [esp + 0x83c]
push ebp
push eax
lea ecx, [esp + 0x438]
mov dword [esp + 0x184c], ebx
call fcn.00414390
mov eax, dword [esp + 0x1844]
lea ecx, [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x83c]
push ebp
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], ebp
jne 0x40d77d
lea ecx, [esp + 0x428]
sub esi, ebp
mov dword [esp + 0x183c], 0xffffffff
call fcn.00414270
cmp esi, ebp
ja 0x40d618
cmp esi, ebx
jbe 0x40d79b
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x834]
push ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x83c]
push esi
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, dword [esp + 0x10]
jne 0x40d7a0
lea ecx, [esp + 0x1c]
call fcn.00414240
mov ecx, dword [esp + 0x1848]
push 0x10
push ecx
lea edx, [esp + 0x83c]
push esi
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x184c], 1
call fcn.00414390
mov edx, dword [esp + 0x1844]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x83c]
push esi
push ecx
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x183c], 0xffffffff
cmp esi, eax
lea ecx, [esp + 0x1c]
je 0x40d796
call fcn.00414270
jmp 0x40d7a0
lea ecx, [esp + 0x428]
mov dword [esp + 0x183c], 0xffffffff
call fcn.00414270
jmp 0x40d7a0
call fcn.00414270
mov ebx, 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1834]
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1830
ret
Function at 0x40f8e0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x550
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x151]
mov byte [esp + 0x150], bl
mov byte [esp + 0x358], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x359]
mov ebp, dword [esp + 0x564]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp - 1], 0x5c
je 0x40f946
push str.NC.
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x358]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x4635a4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x358]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x50
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x358]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x40fa88
cmp edi, ebx
je 0x40fa88
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x3c]
push 0x4635a0
push edx
call fcn.0042344d
add esp, 8
test eax, eax
je 0x40fa56
lea eax, [esp + 0x3c]
push 0x46359c
push eax
call fcn.0042344d
add esp, 8
test eax, eax
je 0x40fa56
lea ecx, [esp + 0x150]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3c]
lea eax, [esp + 0x150]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x150]
push ecx
call esi
test al, 0x10
je 0x40fa37
lea edx, [esp + 0x150]
push edx
call fcn.0040f8e0
add esp, 4
jmp 0x40fa56
test al, 1
je 0x40fa48
and al, 0xfe
push eax
lea eax, [esp + 0x154]
push eax
call ebx
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f9c9
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x550
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x550
ret
Function at 0x40faa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x544
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x151]
mov byte [esp + 0x150], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x554]
lea edx, [esp + 0x150]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x558]
push eax
push ecx
push 0x400
push edx
call fcn.0042440a
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0x10
stosb byte es:[edi], al
lea eax, [esp + 0x4c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x4c]
push str.CDGOUT.LOG
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x4c]
push 0x463eb0
push edx
call fcn.004243f7
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40fb96
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x150]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0042434d
add esp, 4
lea edx, [esp + 0x10]
push eax
push edx
call fcn.004242c9
add esp, 4
push eax
push str._s__s____s_n
push esi
call fcn.0042428d
push esi
call fcn.00424210
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x544
ret
Function at 0x412ab0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
xor edx, edx
mov eax, dword [edi + 0x3cc]
test eax, eax
jle 0x412ae0
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov cl, byte [esi]
mov bl, byte [eax]
xor bl, cl
inc esi
mov byte [eax], bl
mov ecx, dword [edi + 0x3cc]
inc eax
inc edx
cmp edx, ecx
jl 0x412ac9
pop esi
pop ebx
pop edi
ret 8
Function at 0x412b60
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, 0x55555556
xor ebp, ebp
imul esi
mov eax, edx
xor ebx, ebx
shr eax, 0x1f
add edx, eax
mov eax, esi
mov ecx, edx
mov esi, 3
cdq
idiv esi
test ecx, ecx
push edi
mov dword [esp + 0x14], edx
jle 0x412c8e
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
add edx, 0xfffffffc
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ecx
mov cl, byte [edi]
mov dl, byte [edi + 1]
inc edi
mov byte [esp + 0x20], cl
inc edi
mov byte [esp + 0x1c], dl
mov esi, dword [esp + 0x1c]
add ebx, 4
mov cl, byte [edi]
and esi, 0xff
mov byte [esp + 0x28], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
inc edi
mov edx, ecx
and ecx, 3
shr edx, 2
shl ecx, 4
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ebp, 4
mov byte [eax], dl
mov edx, esi
shr edx, 4
or edx, ecx
inc eax
and esi, 0xf
inc eax
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 1], cl
mov ecx, dword [esp + 0x28]
and ecx, 0xff
mov edx, ecx
and ecx, 0x3f
shr edx, 6
shl esi, 2
or edx, esi
inc eax
inc eax
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 2], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 1], cl
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jle 0x412c44
mov byte [eax], 0xd
inc eax
xor ebx, ebx
mov byte [eax], 0xa
inc eax
add ebp, 2
mov ecx, dword [esp + 0x24]
dec ecx
mov dword [esp + 0x24], ecx
jne 0x412bac
mov edx, dword [esp + 0x14]
cmp edx, 1
jne 0x412c98
mov dl, byte [edi]
mov byte [esp + 0x20], dl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
mov edx, ecx
and ecx, 3
shr edx, 2
shl ecx, 4
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
jmp 0x412cef
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x412c57
cmp edx, 2
jne 0x412cf7
mov dl, byte [edi]
mov cl, byte [edi + 1]
mov byte [esp + 0x20], dl
mov byte [esp + 0x1c], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
mov edx, ecx
and ecx, 3
shr edx, 2
shl ecx, 4
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
mov edx, dword [esp + 0x1c]
and edx, 0xff
inc eax
mov esi, edx
shr esi, 4
or esi, ecx
inc eax
and edx, 0xf
mov cl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 1], cl
mov dl, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
inc eax
mov byte [eax], 0x3d
inc eax
add ebp, 4
mov byte [eax], 0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x412fb0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
mov ebx, ecx
push 0x46b4b4
call fcn.00413310
push 0x40
push 0x454b58
push 0x46b4b4
push 0x46b4b4
mov ecx, ebx
call fcn.00413230
mov al, byte [esp + 0x20]
test al, al
jne 0x413048
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x10
mov eax, dword [0x464040]
mov ecx, 8
mov esi, eax
mov edi, 0x46b494
rep movsd dword es:[edi], dword [esi]
push ebp
push eax
mov ecx, ebx
call fcn.00413170
mov ecx, dword [0x46403c]
mov edx, dword [0x464040]
push 0x20
push ecx
push edx
mov ecx, ebx
call fcn.00413280
mov eax, dword [esp + 0x20]
mov edi, dword [0x46403c]
add ebp, 0x30
mov ecx, 8
mov esi, 0x46b494
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], eax
jne 0x412ff3
jmp 0x4130ad
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x10
lea ebp, [eax + 0x2d0]
mov eax, dword [0x46403c]
mov ecx, 8
mov esi, eax
mov edi, 0x46b494
rep movsd dword es:[edi], dword [esi]
push ebp
push eax
mov ecx, ebx
call fcn.00413170
mov ecx, dword [0x464040]
mov edx, dword [0x46403c]
push 0x20
push ecx
push edx
mov ecx, ebx
call fcn.00413280
mov eax, dword [esp + 0x20]
mov edi, dword [0x464040]
sub ebp, 0x30
mov ecx, 8
mov esi, 0x46b494
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], eax
jne 0x41305a
push 0x40
push 0x454b98
push 0x46b4b4
push 0x46b4b4
mov ecx, ebx
call fcn.00413230
mov eax, dword [esp + 0x14]
push 0x40
push 0x46b4b4
push eax
mov ecx, ebx
call fcn.00413350
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x4130e0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
push 0x40
push eax
mov edi, ecx
push 0x46b454
call fcn.00413310
push 0x38
push str.91__
push 0x46b454
push 0x46b454
mov ecx, edi
call fcn.00413230
mov ebx, dword [esp + 0x10]
xor esi, esi
movsx ecx, byte [esi + 0x454c90]
mov edx, dword [0x464044]
push ecx
push 0x1c
push edx
mov ecx, edi
call fcn.004132b0
movsx eax, byte [esi + 0x454c90]
mov ecx, dword [0x464048]
push eax
push 0x1c
push ecx
mov ecx, edi
call fcn.004132b0
push 0x30
push 0x454c60
push 0x46b454
push ebx
mov ecx, edi
call fcn.00413230
inc esi
add ebx, 0x30
cmp esi, 0x10
jl 0x413114
pop edi
pop esi
pop ebx
ret 8

Function at 0x413170
Capabilities:
Encrypt data using des

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x30
push 0x454bd8
push edi
mov esi, ecx
push 0x46b424
call fcn.00413230
mov eax, dword [esp + 0x10]
push 0x30
push eax
push 0x46b424
mov ecx, esi
call fcn.00413280
push 0x46b424
push edi
mov ecx, esi
call fcn.004131c0
push 0x20
push 0x454c08
push edi
push edi
mov ecx, esi
call fcn.00413230
pop edi
pop esi
ret 8

Function at 0x413280
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x4132a2
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x413294
pop ebx
pop esi
ret 0xc