joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406dd8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x3a
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xd
jl 0x406de6
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x406fb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.00401fa4
mov edx, eax
lea ecx, [ebp - 4]
call fcn.00407052
push eax
lea ecx, [ebp + 8]
call fcn.0040709d
lea ecx, [ebp - 4]
call fcn.00407035
lea edi, [esi + 4]
xor ebx, ebx
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00401b74
push eax
push 0x4070c4
push ebx
push ebx
call fcn.0040fc10
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x407019
pop edi
pop esi
pop ebx
lea ecx, [ebp + 8]
call fcn.00407023
call fcn.00407035
leave
ret 4
push 6
mov dword [edi], ebx
call fcn.0040a7f5
int3

Function at 0x4078d7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x32
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 4
jl 0x4078e5
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40791c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x33
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 2
jl 0x40792a
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x408101
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xb
jl 0x40810f
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x408130
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 7
jl 0x40813e
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40815f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xe
jl 0x40816d
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x408255
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 7
jl 0x408263
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409297
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x15
jl 0x4092a5
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4092c6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xa
jl 0x4092d4
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4092f5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x16
jl 0x409303
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409324
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x25
jl 0x409332
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409425
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 7
jl 0x409433
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409454
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 8
jl 0x409462
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409483
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 6
jl 0x409491
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4094b2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x34
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 9
jl 0x4094c0
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4097e2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x18
jl 0x4097f0
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409811
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 4
jl 0x40981f
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 8
jl 0x40984e
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40986f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x34
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 9
jl 0x40987d
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409906
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xb
jl 0x409914
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409935
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 4
jl 0x409943
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409964
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xc
jl 0x409972
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x409993
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1a
jl 0x4099a1
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4099c2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 5
jl 0x4099d0
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409a5f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1b
jl 0x409a6d
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409a8e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 4
jl 0x409a9c
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409abd
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xb
jl 0x409acb
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409aec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xa
jl 0x409afa
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409b1b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x24
jl 0x409b29
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409b4a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xc
jl 0x409b58
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x409b79
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x18
jl 0x409b87
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409ba8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 6
jl 0x409bb6
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409bd7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x2a
jl 0x409be5
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409c06
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 9
jl 0x409c14
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409c35
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1e
jl 0x409c43
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409c64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x16
jl 0x409c72
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409c93
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x36
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x21
jl 0x409ca1
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409e0c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x32
jl 0x409e1a
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x409e3b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xf
jl 0x409e49
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409e6a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 3
jl 0x409e78
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409e99
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 5
jl 0x409ea7
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x409ec8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x35
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 4
jl 0x409ed6
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40b529
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b568
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b568
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b568
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b568
cmp dword [ecx + 0x74], 0xe
jbe 0x40b568
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x413ad2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f96c
push 0x42f964
push str.FlsAlloc
push 0x1f
call fcn.004139ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x413b06
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d134]
call esi
jmp 0x413b0c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x413b50
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f97c
push 0x42f974
push str.FlsGetValue
push 0x21
call fcn.004139ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x413b87
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x413b8f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f984
push 0x42f97c
push str.FlsSetValue
push 0x22
call fcn.004139ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x413bc9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42d134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x416ec8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x416f65
push ebx
push esi
call fcn.00416e91
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00416e25
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x416f12
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x416f64
push edi
push eax
call fcn.00413785
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x416f32
call fcn.0041374b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x416f63
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00416e25
add esp, 0x20
test eax, eax
jne 0x416f51
push edi
call fcn.0041374b
jmp 0x416f59
push ebx
call fcn.0041374b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41dc00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dc2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dc2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x421acf
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x37]
mov edi, edx
push eax
mov dword [esp + 0x1c], edi
mov ebp, ecx
call fcn.00421ab7
mov ecx, eax
call fcn.00404ccf
push eax
lea ecx, [esp + 0x20]
call fcn.00402d59
mov ecx, ebp
call fcn.00401e96
mov ecx, edi
call fcn.00404cee
mov ebx, eax
xor edx, edx
push 3
pop ecx
lea eax, [ebx + 2]
div ecx
mov ecx, ebp
shl eax, 2
push eax
call fcn.00404dee
test ebx, ebx
je 0x421c02
push 2
pop esi
lea eax, [esi - 1]
cmp eax, ebx
jae 0x421b41
push eax
mov ecx, edi
call fcn.00404ce5
movzx eax, byte [eax]
mov dword [esp + 0x14], eax
jmp 0x421b46
and dword [esp + 0x14], 0
cmp esi, ebx
jae 0x421b57
push esi
mov ecx, edi
call fcn.00404ce5
movzx edx, byte [eax]
jmp 0x421b59
xor edx, edx
lea eax, [esi - 2]
mov ecx, edi
push eax
call fcn.00404ce5
lea ecx, [esp + 0x1c]
movzx edi, byte [eax]
shl edi, 8
add edi, dword [esp + 0x14]
shl edi, 8
add edi, edx
mov eax, edi
shr eax, 0x12
push eax
call fcn.00402cd8
mov ecx, ebp
movzx eax, byte [eax]
push eax
call fcn.00402f64
mov eax, edi
lea ecx, [esp + 0x1c]
shr eax, 0xc
and eax, 0x3f
push eax
call fcn.00402cd8
mov ecx, ebp
movzx eax, byte [eax]
push eax
call fcn.00402f64
lea eax, [esi - 1]
cmp eax, ebx
jae 0x421bc7
mov eax, edi
lea ecx, [esp + 0x1c]
shr eax, 6
and eax, 0x3f
push eax
call fcn.00402cd8
mov al, byte [eax]
jmp 0x421bc9
mov al, 0x3d
push eax
mov ecx, ebp
call fcn.00402f64
cmp esi, ebx
jae 0x421be6
and edi, 0x3f
lea ecx, [esp + 0x1c]
push edi
call fcn.00402cd8
mov al, byte [eax]
jmp 0x421be8
mov al, 0x3d
push eax
mov ecx, ebp
call fcn.00402f64
mov edi, dword [esp + 0x18]
add esi, 3
lea eax, [esi - 2]
cmp eax, ebx
jb 0x421b29
lea ecx, [esp + 0x1c]
call fcn.00401e6f
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x6c
ret