joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42af10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5955e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x42b04c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x42af91
test edi, 0xffff0000
jne 0x42af73
movzx eax, di
lea ecx, [ebp - 0x10]
push eax
call fcn.004295b0
jmp 0x42af9d
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x42af80
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42af80
sub ecx, edx
sar ecx, 1
jmp 0x42af93
xor ecx, ecx
push ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.00429870
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42b012
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42b012
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42b012
lea eax, [ebp - 0x10]
push eax
call fcn.0042c8b0
mov esi, dword [ebp - 0x10]
add esp, 4
cmp dword [esi - 0xc], 0
jne 0x42afe3
xor edi, edi
jmp 0x42b01a
push esi
call fcn.0042af10
add esp, 4
test eax, eax
jne 0x42aff4
xor edi, edi
jmp 0x42b01a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42b015
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42b015
xor edi, edi
jmp 0x42b01a
mov esi, dword [ebp - 0x10]
mov edi, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42b039
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004293d0
int3
Function at 0x42c030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x633954]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x210], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6315b8]
cmp eax, dword [ecx + 4]
jg 0x42c13a
mov ecx, dword [0x6315b4]
cmp dword [ecx - 0xc], 0
je 0x42c082
add ecx, 0xfffffff0
push ecx
jmp 0x42c112
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42c109
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c0a1
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x6315b4
call fcn.00429870
mov eax, dword [0x6315b4]
mov edx, dword [eax - 0xc]
test edx, edx
je 0x42c0f8
lea ecx, [edx - 1]
test ecx, ecx
js 0x42c130
cmp ecx, edx
jg 0x42c130
movzx eax, word [eax + ecx*2]
cmp eax, 0x5c
je 0x42c0f8
cmp eax, 0x2f
je 0x42c0f8
push 1
push 0x5ad728
mov ecx, 0x6315b4
call fcn.00429240
push 8
push str.drivers_
mov ecx, 0x6315b4
call fcn.00429240
mov eax, dword [0x6315b4]
add eax, 0xfffffff0
push eax
call fcn.004293f0
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [esi], eax
mov eax, esi
pop esi
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004293d0
push 0x6315b8
call fcn.00546388
add esp, 4
cmp dword [0x6315b8], 0xffffffff
jne 0x42c06d
call fcn.00428a90
mov ecx, eax
test ecx, ecx
jne 0x42c169
push 0x80004005
call fcn.004293d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x5a90f0
mov dword [0x6315b4], eax
call fcn.0054669a
push 0x6315b8
call fcn.0054633e
add esp, 8
jmp 0x42c06d
Function at 0x42d0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595898
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, 0x80004005
cmp dword [eax + 0x14], 0
je 0x42d20d
mov esi, dword [eax + 0x1c]
mov dword [ebp - 0x10], esi
test esi, esi
je 0x42d2a6
mov eax, dword [esi + 4]
mov ebx, dword [ebp + 0x10]
add eax, ebx
cmp eax, 0x1f400000
ja 0x42d2a1
push 0xc
call fcn.00546014
mov edi, eax
add esp, 4
test edi, edi
je 0x42d161
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x42d163
xor edi, edi
add dword [esi + 4], ebx
mov eax, dword [edi + 4]
mov ecx, eax
mov edx, dword [edi]
sub ecx, edx
mov byte [ebp + 0x13], 0
mov dword [ebp + 8], eax
cmp ebx, ecx
jae 0x42d17f
lea eax, [edx + ebx]
jmp 0x42d1b2
jbe 0x42d1b5
mov eax, dword [edi + 8]
sub eax, edx
cmp ebx, eax
jbe 0x42d198
lea eax, [ebp + 0x13]
mov ecx, edi
push eax
push ebx
call fcn.00429f50
jmp 0x42d1b5
mov esi, ebx
sub esi, ecx
push esi
push 0
push dword [ebp + 8]
call fcn.0054b380
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 0x10]
mov dword [edi + 4], eax
push ebx
push dword [ebp + 0xc]
push dword [edi]
call fcn.0054ae00
mov ebx, dword [esi + 8]
add esi, 8
add esp, 0xc
cmp dword [esi + 4], 0x15555555
je 0x42d2bc
mov dword [ebp - 0x18], esi
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00546014
mov ecx, eax
add esp, 4
mov dword [ecx + 8], edi
inc dword [esi + 4]
mov eax, dword [ebx + 4]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov dword [ebx + 4], ecx
xor ebx, ebx
mov dword [eax], ecx
jmp 0x42d2a6
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x42d2a6
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov edi, ecx
push 0
push edx
push ecx
push esi
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42d25d
mov edi, edi
add esi, dword [ebp - 0x10]
sub edi, dword [ebp - 0x10]
je 0x42d29a
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42d240
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.795_tCommonFuncs::WriteFile_tWriteFile_Faild_with_lastError:__u
push str.H:_rc_v11_i18n_20230711_branchCoding_support_newsetup3rdparty7zCPP7zipArchiveks_package7zExtractImpl.cpp
push str._INFO_
push 0x631888
call fcn.004677c0
add esp, 0x14
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x42d291
push dword [ebp + 0x10]
call eax
xor eax, eax
test esi, esi
cmovne ebx, eax
jmp 0x42d2a6
mov esi, 1
jmp 0x42d282
mov ebx, 0x80004005
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.list_too_long
call fcn.005479d1
int3
Function at 0x435f40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x435fcf
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x435fcf
push ebx
push edi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov edx, 2
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea ebx, [ebx]
lea ecx, [edx - 2]
mov eax, esi
shr eax, cl
lea ecx, [edx - 1]
and eax, 1
add edi, eax
mov eax, esi
shr eax, cl
mov ecx, edx
and eax, 1
add dword [ebp - 8], eax
mov eax, esi
shr eax, cl
lea ecx, [edx + 1]
and eax, 1
add edx, 4
add dword [ebp - 4], eax
mov eax, esi
shr eax, cl
and eax, 1
lea ecx, [edx - 2]
add ebx, eax
cmp ecx, 0x20
jb 0x435f80
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add ecx, ebx
add eax, ecx
add eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4360b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x4360cc
mov eax, dword [ebp - 4]
jmp 0x4361a7
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x436182
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5ae430]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x5ae430]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5ae430]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x5ae430]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5ae430]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x5ae430]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x5ae430]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x5ae430]
dec ebp
jne 0x4360ec
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x43619e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x5ae430]
dec ecx
jne 0x43618c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437ec0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595dfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x62819c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 6
lea edi, [esi + 4]
mov dword [esi], 0
mov dword [edi], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
push 0
mov dword [esi + 0x10], 0x80004005
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [esi + 0x10], eax
push esi
push 0x5ae97c
push 1
push 0
push 0x5ae96c
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esi]
test ecx, ecx
je 0x437f44
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x48]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43dd30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x43dd45
mov eax, 1
pop edi
pop ebp
ret 4
mov eax, dword [ebp + 8]
push esi
push dword [eax]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x43dd7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43dd75
mov dword [edi], esi
mov eax, 1
pop esi
pop edi
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x43e390
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5964b8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
cmp esi, edi
je 0x43e4d9
nop
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x14]
call fcn.0043e510
lea eax, [ebp - 0x40]
push eax
call fcn.0043e6a0
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x43e3f8
mov eax, dword [eax]
push eax
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0043e510
lea eax, [ebp - 0x28]
push eax
call fcn.0043e6a0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x43e418
mov eax, dword [eax]
push eax
call fcn.00555852
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
sete bl
cmp edx, 8
jb 0x43e460
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43e456
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e500
push edx
push ecx
call fcn.00546044
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x43e4b1
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43e4a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e500
push edx
push ecx
call fcn.00546044
add esp, 8
test bl, bl
je 0x43e4cb
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43e4bf
mov eax, dword [esi]
push eax
mov eax, dword [ebp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esi, 0x18
cmp esi, edi
jne 0x43e3d0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
call fcn.00555394
int3
Function at 0x43e8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596568
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x234], 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
push 0x20019
push 0
push str.SoftwareKingsoftOfficewpscloudsvr_refs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43eaee
push 0x208
xor edi, edi
mov dword [ebp - 0x238], 0x104
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0054b380
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x238]
add esp, 0xc
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push dword [ebp - 0x234]
call ebx
test eax, eax
jne 0x43eaee
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e9f6
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042daa0
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 2
cmp ecx, dword [esi + 8]
je 0x43ea6d
mov eax, dword [ebp - 0x230]
mov edx, 7
mov dword [ecx], eax
mov eax, dword [ebp - 0x22c]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x224]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x220]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x21c]
mov dword [ecx + 0x14], eax
xor eax, eax
add dword [esi + 4], 0x18
mov word [ebp - 0x230], ax
jmp 0x43ea82
lea eax, [ebp - 0x230]
push eax
push ecx
mov ecx, esi
call fcn.0043dfb0
mov edx, dword [ebp - 0x21c]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x43eabc
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43eab2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43eb22
push edx
push ecx
call fcn.00546044
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x104
push eax
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push dword [ebp - 0x234]
call ebx
test eax, eax
je 0x43e9d0
mov ecx, dword [ebp - 0x234]
test ecx, ecx
je 0x43eb04
cmp ecx, 0xffffffff
je 0x43eb04
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
call fcn.00555394
int3
Function at 0x4419d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x4419e7
cmp esi, 0x20
jne 0x441bbb
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x441bba
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x441a52
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x441a25
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x441b3a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x441ad0
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x5b11f8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x5b1218]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x5b1218]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + 0x5b1218]
xor esi, eax
movzx ebx, byte [ebx + 0x5b1218]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x441b1d
cmp esi, 6
jbe 0x441b1d
cmp edx, 4
jne 0x441b1d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5b1218]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5b1218]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x5b1218]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x5b1218]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x441a70
xor esi, esi
sub ecx, 1
js 0x441bb9
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x441ba9
cmp ecx, 4
jb 0x441ba9
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x5b1218]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x5b2818]
movzx eax, byte [eax + 0x5b1218]
xor edx, dword [eax*4 + 0x5b2c18]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x5b1218]
xor edx, dword [eax*4 + 0x5b2418]
movzx eax, bl
movzx eax, byte [eax + 0x5b1218]
xor edx, dword [eax*4 + 0x5b3018]
mov eax, dword [ebp + 8]
jmp 0x441bab
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x441b47
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x441d80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x441f58
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x441f58
test bl, 3
jne 0x441f58
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x441dca
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x441f58
cmp byte [eax], 0x3d
je 0x441db7
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x441f4d
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x441df2
sub al, 0x41
jmp 0x441e21
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x441dfe
sub al, 0x47
jmp 0x441e21
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x441e0a
add al, 4
jmp 0x441e21
cmp al, 0x2b
jne 0x441e12
mov al, 0x3e
jmp 0x441e21
cmp al, 0x2f
jne 0x441e1a
mov al, 0x3f
jmp 0x441e21
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x441e31
sub dl, 0x41
jmp 0x441e65
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x441e3e
sub dl, 0x47
jmp 0x441e65
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x441e4b
add dl, 4
jmp 0x441e65
cmp dl, 0x2b
jne 0x441e54
mov dl, 0x3e
jmp 0x441e65
cmp dl, 0x2f
jne 0x441e5d
mov dl, 0x3f
jmp 0x441e65
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x441e74
sub bl, 0x41
jmp 0x441ea8
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x441e81
sub bl, 0x47
jmp 0x441ea8
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x441e8e
add bl, 4
jmp 0x441ea8
cmp bl, 0x2b
jne 0x441e97
mov bl, 0x3e
jmp 0x441ea8
cmp bl, 0x2f
jne 0x441ea0
mov bl, 0x3f
jmp 0x441ea8
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x441eba
sub ah, 0x41
jmp 0x441ef2
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x441ec9
sub ah, 0x47
jmp 0x441ef2
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x441ed8
add ah, 4
jmp 0x441ef2
cmp ah, 0x2b
jne 0x441ee1
mov ah, 0x3e
jmp 0x441ef2
cmp ah, 0x2f
jne 0x441eea
mov ah, 0x3f
jmp 0x441ef2
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x441f58
cmp dl, 0xff
je 0x441f58
cmp bl, 0xff
je 0x441f58
cmp ah, 0xff
je 0x441f58
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x441de3
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442240
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x4423b3
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4423b3
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x4423ac
xor eax, eax
test ebx, ebx
je 0x442310
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + 0x5b3418]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x5b3418]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + 0x5b3418]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x5b3418]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x4422a0
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x442377
sub ecx, 1
jne 0x4423a9
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + 0x5b3418]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x5b3418]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + 0x5b3418]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + 0x5b3418]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + 0x5b3418]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret