joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c14d8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5c1552
mov eax, dword [ebx + 8]
call fcn.0052e274
mov ecx, eax
mov dl, 1
mov eax, dword [0x53c364]
call fcn.005285a0
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00543e70
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5c0dd0
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052e274
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052e274
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5c15c8
mov eax, dword [ebx + 8]
call fcn.0052e274
mov ecx, eax
mov dl, 1
mov eax, dword [0x53c364]
call fcn.005285a0
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00543e70
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5c0e1c
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052e274
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052e274
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5c1634
mov eax, dword [ebx + 8]
call fcn.0052e274
mov ecx, eax
mov dl, 1
mov eax, dword [0x53cdd4]
call fcn.005285a0
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052e274
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052e274
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5c8418
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x618750], 0
jne 0x5c842f
call fcn.005c83d4
mov eax, edi
dec eax
test eax, eax
jl 0x5c8457
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x618350]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5c8439
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x5cb118
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5cb1b2.0
jmp dword [ecx*4 + 0x5cb14b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5cb17d
sub dl, 8
je 0x5cb18c
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5cade4
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5cae38
jmp case.0x5cb1b2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5cb1b2.0
movzx ecx, byte [ecx + 0x5cb1b9]
jmp dword [ecx*4 + 0x5cb1ca]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5caed8
jmp case.0x5cb1b2.0
cmp dl, 3
jne 0x5cb1f7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5caf30
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5caeec
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5caf74
jmp case.0x5cb1b2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5cb222
sub dl, 8
je 0x5cb22e
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5cafa0
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5cb004
jmp case.0x5cb1b2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5cb24d
sub dl, 8
je 0x5cb259
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5cb0b4
jmp case.0x5cb1b2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5cb0dc
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x5cb2fb
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005ca31c
test eax, eax
je 0x5cb2fb
mov eax, ebx
call fcn.005cb304
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5cb294
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5cb304
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5cb335
dec al
je 0x5cb370
dec al
je 0x5cb3b5
dec al
je 0x5cb41e
jmp 0x5cb4a8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5cb4a8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5cb345
jmp 0x5cb4a8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5cb4a8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5cb380
jmp 0x5cb4a8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5cb4a8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5cb3e4
xor ebp, ebp
jmp 0x5cb3f4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5cb3fd
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5cb3c5
jmp 0x5cb4a8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5cb4a8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5cb477
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005c8460
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5cb432
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d2634
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040abc4
xor eax, eax
push ebp
push 0x5d26ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00423aa8
test al, al
je 0x5d26ac
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00407738
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x5d26e4
mov edx, dword [ebp - 4]
call fcn.0040b9e0
mov eax, dword [ebp - 0x28]
call fcn.0040b774
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d26d1
lea eax, [ebp - 0x28]
call fcn.0040aae0
lea eax, [ebp - 4]
call fcn.0040aae0
ret

Function at 0x5d27c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040abc4
xor eax, eax
push ebp
push 0x5d284f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00423d80
mov eax, dword [ebp - 8]
call fcn.00406914
call fcn.004068d8
mov eax, dword [ebp - 8]
call fcn.0040b774
push eax
call sub.kernel32.dll_GetModuleHandleW_2
test eax, eax
jne 0x5d282c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040b474
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040b3e4
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d2856
lea eax, [ebp - 0xc]
call fcn.0040ab04
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ab40
ret
Function at 0x5fdccc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040abc4
xor eax, eax
push ebp
push 0x5fdda9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
mov eax, dword [ebp - 4]
call fcn.0040b774
push eax
push 0
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x5fdd26
push 0x10
push 0x5fddb8
push 0x5fddd4
push 0
call sub.user32.dll_MessageBoxW
mov eax, dword [0x612ae0]
mov eax, dword [eax]
call fcn.005bbd40
jmp 0x5fdd93
push ebx
push 0
call sub.kernel32.dll_LoadResource
test eax, eax
jne 0x5fdd53
push 0x10
push 0x5fdde4
push 0x5fddd4
push 0
call sub.user32.dll_MessageBoxW
mov eax, dword [0x612ae0]
mov eax, dword [eax]
call fcn.005bbd40
jmp 0x5fdd93
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push 0
call sub.kernel32.dll_SizeofResource
push eax
push esi
call sub.gdi32.dll_AddFontMemResourceEx
test eax, eax
jne 0x5fdd93
push 0x10
push 0x5fde00
push 0x5fddd4
push 0
call sub.user32.dll_MessageBoxW
mov eax, dword [0x612ae0]
mov eax, dword [eax]
call fcn.005bbd40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fddb0
lea eax, [ebp - 4]
call fcn.0040aae0
ret
Function at 0x4044bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029ee
and dword [ebp - 4], 0
cmp dword [0x40e9b0], 0
mov ebx, eax
jne 0x40456c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40461d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40461d
push eax
call fcn.0040297c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e9b0], eax
call esi
push eax
call fcn.0040297c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e9b4], eax
call esi
push eax
call fcn.0040297c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e9b8], eax
call esi
push eax
call fcn.0040297c
pop ecx
mov dword [0x40e9c0], eax
test eax, eax
je 0x40456c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040297c
pop ecx
mov dword [0x40e9bc], eax
mov eax, dword [0x40e9bc]
cmp eax, ebx
je 0x4045c4
cmp dword [0x40e9c0], ebx
je 0x4045c4
push eax
call fcn.004029f7
push dword [0x40e9c0]
mov esi, eax
call fcn.004029f7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4045c4
test edi, edi
je 0x4045c4
call esi
test eax, eax
je 0x4045bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4045bb
test byte [ebp - 0xc], 1
jne 0x4045c4
or dword [ebp + 0x10], 0x200000
jmp 0x4045fd
mov eax, dword [0x40e9b4]
cmp eax, ebx
je 0x4045fd
push eax
call fcn.004029f7
pop ecx
test eax, eax
je 0x4045fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4045fd
mov eax, dword [0x40e9b8]
cmp eax, ebx
je 0x4045fd
push eax
call fcn.004029f7
pop ecx
test eax, eax
je 0x4045fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e9b0]
call fcn.004029f7
pop ecx
test eax, eax
je 0x40461d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40461f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x404920
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a870
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x464014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x465058
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00419e30
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x464a88
push eax
call fcn.00419e30
mov esi, dword [0x465068]
xor ebx, ebx
mov edi, dword [0x46506c]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x468270], bl
mov eax, ebx
mov ecx, 0x465058
cmovae ecx, dword [0x465058]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x468380], al
inc ebx
cmp ebx, 0x100
jl 0x4049a0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x468270]
movzx eax, byte [esi + 0x468380]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4049f4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x468270]
mov byte [esi + 0x468270], al
inc esi
mov byte [edi + 0x468270], dl
cmp esi, 0x100
jl 0x4049d0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404570
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a49
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a3f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a9f
push edx
push ecx
call fcn.0041f3db
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404a8b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404a9f
push edx
push ecx
call fcn.0041f3db
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004389a7
int3
Function at 0x404ab0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.00419cf0
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x404b03
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x404bae
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x404b41
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x404c25
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x404bd8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x404bdd
mov ecx, eax
sar eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x404bf4
sar eax, 4
and eax, 0x3f
jmp 0x404bfa
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
test edx, edx
je 0x404c1f
and ecx, 0xf
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404c30
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x464014]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], esi
mov eax, dword [eax]
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
push edi
test eax, eax
jne 0x404c8b
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
push 0x45a19b
mov byte [esi], al
call fcn.00419e30
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0041ed61
mov esp, ebp
pop ebp
ret
mov ecx, eax
xor edi, edi
and ecx, 3
jne 0x404ca5
cmp byte [eax + edx - 1], 0x3d
je 0x404ca5
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
jmp 0x404cc7
mov dword [esp + 0x18], 1
cmp ecx, 2
ja 0x404cbf
cmp byte [eax + edx - 2], 0x3d
jne 0x404cbf
mov dword [esp + 0x20], edi
jmp 0x404cc7
mov dword [esp + 0x20], 1
sub eax, dword [esp + 0x18]
and eax, 0xfffffffc
mov dword [esp + 0x40], edi
mov ecx, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
shr ecx, 2
push 0
mov dword [esp + 0x48], 0xf
mov byte [esp + 0x34], 0
lea eax, [eax + ecx*2]
add eax, ecx
lea ecx, [esp + 0x34]
add eax, dword [esp + 0x1c]
push eax
call fcn.00419cf0
cmp dword [esp + 0x44], 0x10
lea eax, [esp + 0x30]
mov edx, dword [esp + 0x14]
cmovae eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
test edx, edx
je 0x404d95
mov esi, dword [esp + 0x2c]
lea eax, [edx - 1]
shr eax, 2
add esi, 2
inc eax
mov dword [esp + 0x28], eax
nop dword [eax]
movzx eax, byte [esi - 2]
lea esi, [esi + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x45af20]
movzx eax, byte [esi - 5]
shl ecx, 6
or ecx, dword [eax*4 + 0x45af20]
movzx eax, byte [esi - 4]
shl ecx, 6
or ecx, dword [eax*4 + 0x45af20]
movzx eax, byte [esi - 3]
shl ecx, 6
or ecx, dword [eax*4 + 0x45af20]
mov eax, ecx
sar eax, 0x10
mov byte [edx + edi], al
mov eax, ecx
sar eax, 8
mov byte [edx + edi + 1], al
mov eax, edx
mov byte [eax + edi + 2], cl
add edi, 3
sub dword [esp + 0x28], 1
jne 0x404d30
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x18], 0
je 0x404df2
mov eax, dword [esp + 0x2c]
add eax, edx
mov dword [esp + 0x24], eax
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
mov edx, dword [eax*4 + 0x45af20]
shl edx, 6
or edx, dword [ecx*4 + 0x45af20]
mov ecx, dword [esp + 0x1c]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
cmp dword [esp + 0x20], 0
mov byte [ecx + edi], al
je 0x404df2
mov eax, dword [esp + 0x24]
sar edx, 8
movzx eax, byte [eax + 2]
mov eax, dword [eax*4 + 0x45af20]
shl eax, 6
sar eax, 8
or al, dl
mov byte [ecx + edi + 1], al
movups xmm0, xmmword [esp + 0x30]
mov ecx, dword [esp + 0x5c]
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [esp + 0x3c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.0041ed61
mov esp, ebp
pop ebp
ret
Function at 0x405460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a980
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x464014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00435e60
add esp, 0xc
mov dword [ebp - 0x414], 0x400
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x418]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405510
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405536
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.00419e30
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40557e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405574
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4055dd
push edx
push ecx
call fcn.0041f3db
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4055c0
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4055dd
push edx
push ecx
call fcn.0041f3db
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ed61
mov esp, ebp
pop ebp
ret
call fcn.004389a7
int3