joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bad0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x1003baf2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x1003bae0
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x1003bb00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x1003bb22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x23
jb 0x1003bb10
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x1003bb30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x1003bb57
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x1a4
jb 0x1003bb40
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x1003bb60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x1003bb82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x2b
jb 0x1003bb70
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x1003bb90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x1003bbb2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x1003bba0
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x1003bbc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1003bbe2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x1003bbd0
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1003bbf0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x1003bc12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x5e
jb 0x1003bc00
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x1003bc20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x1003bc42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x3b
jb 0x1003bc30
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x1003bc50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x1003bc72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x1003bc60
mov byte [esi + 0x2b], 0
pop esi
ret

Function at 0x1003bc80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x1003bca2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x67
jb 0x1003bc90
mov byte [esi + 0x68], 0
pop esi
ret
Function at 0x1003bcb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x1003bcd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x40
jb 0x1003bcc0
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x1003bce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x1003bd07
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x8a
jb 0x1003bcf0
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x1003bd10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x1003bd32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x1003bd20
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x1003bd40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1003bd62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x50]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x1003bd50
mov byte [esi + 0x17], 0
pop esi
ret
Function at 0x100491c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f916
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1009f040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.100492f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004a8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1004aa90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004a9ad
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1004a92a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1009f004]
ja 0x1004a92a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004a8fa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004a950
jmp 0x1004a9ad
cmp dword [ebp - 0x14], 0x10000
jne 0x1004a993
cmp dword [ebp - 0x18], 0x10000
jb 0x1004a993
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004a986
mov eax, dword [ebp - 8]
jmp 0x1004a9af
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004a9a8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1004aa90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004a8fa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1004a9c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1004aac0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1004aa85
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1004aa05
mov eax, dword [ebp - 4]
cmp eax, dword [0x1009f004]
ja 0x1004aa05
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004a9d5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004aa2b
jmp 0x1004aa85
cmp dword [ebp - 0x14], 0x10000
jne 0x1004aa6e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004aa6e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004aa61
mov eax, dword [ebp - 8]
jmp 0x1004aa87
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004aa80
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1004aac0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004a9d5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x80b4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x80b4c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80b4c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80b4b8
mov eax, 1
add ebx, ebx
jne 0x80b4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80b4d0
jne 0x80b4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b4d0
xor ecx, ecx
sub eax, 3
jb 0x80b500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80b572
mov ebp, eax
add ebx, ebx
jne 0x80b50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x80b518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x80b53c
inc ecx
add ebx, ebx
jne 0x80b528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80b51d
jne 0x80b539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b51d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80b55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80b54d
jmp 0x80b4be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80b55c
add edi, ecx
jmp 0x80b4be
pop esi
mov edi, esi
mov ecx, 0x147
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80b57a
cmp byte [edi], 1
jne 0x80b57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x80b57f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x80b5f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb58c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80b5ac
mov ecx, edi
jns 0x80b5db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb590]
or eax, eax
je 0x80b5f1
mov dword [ebx], eax
add ebx, 4
jmp 0x80b5c9
call dword [esi + 0xb594]
popal
jmp 0x802d68

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x438380
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x574870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x110], eax
lea ecx, [esi + esi*4 + 0xa]
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
push edi
mov edi, dword [ebp + 0x10]
shr ecx, 1
cmp dword [ebp - 0x110], 0
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x120], edi
je 0x4383e3
lea eax, [ecx + ecx]
xor edx, edx
div dword [ebp - 0x110]
lea ecx, [ecx + eax + 3]
jmp 0x4383e6
add ecx, 3
push ecx
mov ecx, edi
call fcn.00415b90
test esi, esi
je 0x4385ed
test ebx, ebx
je 0x4385ed
mov eax, 0xaaaaaaab
mul dword [ebp + 0xc]
xor ecx, ecx
xor esi, esi
shr edx, 1
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x124], edx
je 0x438527
mov dword [ebp - 0x11c], edx
jmp 0x438436
mov ebx, dword [ebp - 0x114]
movzx eax, byte [ebx + esi]
movzx edx, byte [ebx + esi + 2]
movzx edi, byte [ebx + esi + 1]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x533f20]
mov byte [ebp + ecx - 0x10c], bl
and eax, 3
shl eax, 4
mov ebx, edi
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + 0x533f20]
mov byte [ebp + ecx - 0x10b], al
mov eax, edx
sar eax, 6
and edi, 0xf
and eax, 3
add edi, edi
add edi, edi
or eax, edi
movzx eax, byte [eax + 0x533f20]
and edx, 0x3f
mov dl, byte [edx + 0x533f20]
mov byte [ebp + ecx - 0x10a], al
mov eax, dword [ebp - 0x110]
mov byte [ebp + ecx - 0x109], dl
mov edx, dword [ebp - 0x118]
add eax, 4
add esi, 3
add ecx, 4
mov dword [ebp - 0x110], eax
cmp eax, dword [edx + 4]
jb 0x4384dd
mov word [ebp + ecx - 0x10c], 0xa0d
add ecx, 2
mov dword [ebp - 0x110], 0
mov edi, dword [ebp - 0x120]
cmp ecx, 0x100
jl 0x4384fc
push ecx
lea eax, [ebp - 0x10c]
push eax
mov ecx, edi
call fcn.00415f20
xor ecx, ecx
dec dword [ebp - 0x11c]
jne 0x438430
test ecx, ecx
je 0x43851b
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, edi
call fcn.00415f20
mov edx, dword [ebp - 0x124]
mov ebx, dword [ebp - 0x114]
mov eax, dword [ebp + 0xc]
lea edx, [edx + edx*2]
sub eax, edx
sub eax, 0
je 0x4385db
dec eax
je 0x438599
dec eax
jne 0x4385ed
movzx eax, byte [ebx + esi]
movzx esi, byte [ebx + esi + 1]
mov dword [ebp - 0x118], eax
sar eax, 2
and eax, 0x3f
movzx eax, byte [eax + 0x533f20]
push eax
mov ecx, edi
call fcn.00418de0
mov eax, dword [ebp - 0x118]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + 0x533f20]
push edx
mov ecx, edi
call fcn.00418de0
and esi, 0xf
movzx eax, byte [esi*4 + 0x533f20]
push eax
jmp 0x4385cb
movzx esi, byte [ebx + esi]
mov ecx, esi
sar ecx, 2
and ecx, 0x3f
movzx edx, byte [ecx + 0x533f20]
push edx
mov ecx, edi
call fcn.00418de0
and esi, 3
shl esi, 4
movzx eax, byte [esi + 0x533f20]
push eax
mov ecx, edi
call fcn.00418de0
push 0x3d
mov ecx, edi
call fcn.00418de0
push 0x3d
mov ecx, edi
call fcn.00418de0
push 0xd
mov ecx, edi
call fcn.00418de0
push 0xa
mov ecx, edi
call fcn.00418de0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e8c8a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4389d0
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x574870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x11c], edi
test esi, esi
je 0x438bb8
test eax, eax
je 0x438bb8
lea ecx, [esi + esi*4 + 0xa]
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
shr ecx, 1
lea eax, [ecx + ecx]
xor edx, edx
div esi
lea ecx, [ecx + eax + 3]
push ecx
mov ecx, edi
call fcn.00415b90
mov eax, 0xaaaaaaab
mul dword [ebp + 0xc]
xor esi, esi
xor ecx, ecx
shr edx, 1
mov dword [ebp - 0x120], edx
je 0x438b12
mov dword [ebp - 0x118], edx
mov edx, dword [ebp - 0x110]
movzx eax, byte [edx + esi]
movzx edi, byte [edx + esi + 1]
movzx edx, byte [edx + esi + 2]
mov dword [ebp - 0x114], edx
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + ebx]
mov byte [ebp + ecx - 0x10c], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
movzx eax, byte [edx + ebx]
mov byte [ebp + ecx - 0x10b], al
mov eax, dword [ebp - 0x114]
and edi, 0xf
mov edx, eax
sar edx, 6
add edi, edi
and edx, 3
add edi, edi
or edx, edi
movzx edx, byte [edx + ebx]
mov edi, dword [ebp - 0x11c]
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [ebp + ecx - 0x10a], dl
mov byte [ebp + ecx - 0x109], al
add ecx, 4
add esi, 3
cmp ecx, 0x100
jl 0x438aed
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, edi
call fcn.00415f20
xor ecx, ecx
dec dword [ebp - 0x118]
jne 0x438a50
test ecx, ecx
je 0x438b0c
push ecx
lea edx, [ebp - 0x10c]
push edx
mov ecx, edi
call fcn.00415f20
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp + 0xc]
lea ecx, [edx + edx*2]
sub eax, ecx
dec eax
je 0x438b77
dec eax
jne 0x438bb8
mov ecx, dword [ebp - 0x110]
movzx eax, byte [ecx + esi]
movzx esi, byte [ecx + esi + 1]
mov dword [ebp - 0x114], eax
sar eax, 2
and eax, 0x3f
movzx edx, byte [eax + ebx]
push edx
mov ecx, edi
call fcn.00418de0
mov eax, dword [ebp - 0x114]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + ebx]
push edx
mov ecx, edi
call fcn.00418de0
and esi, 0xf
movzx eax, byte [ebx + esi*4]
push eax
jmp 0x438ba8
mov ecx, dword [ebp - 0x110]
movzx esi, byte [ecx + esi]
mov edx, esi
sar edx, 2
and edx, 0x3f
movzx eax, byte [edx + ebx]
push eax
mov ecx, edi
call fcn.00418de0
and esi, 3
add esi, esi
movzx ecx, byte [ebx + esi*8]
push ecx
mov ecx, edi
call fcn.00418de0
push 0x3d
mov ecx, edi
call fcn.00418de0
push 0x3d
mov ecx, edi
call fcn.00418de0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e8c8a
mov esp, ebp
pop ebp
ret
Function at 0x4396a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0xc
test ecx, ecx
jne 0x4396b5
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ecx], 0
test eax, eax
je 0x43984f
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43984f
lea edx, [eax + eax*4]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + 4]
push esi
push eax
mov dword [ecx], eax
call fcn.0043bbe0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4396fb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xaaaaaaab
mul dword [ebp + 0xc]
push edi
xor edi, edi
xor ecx, ecx
shr edx, 1
mov dword [ebp - 0xc], edx
je 0x43979a
mov dword [ebp - 4], edx
jmp 0x439720
movzx eax, byte [edi + ebx]
movzx edx, byte [edi + ebx + 1]
movzx ebx, byte [edi + ebx + 2]
mov dword [ebp - 8], ebx
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x533fd8]
mov byte [ecx + esi], bl
mov ebx, edx
sar ebx, 4
and eax, 3
and ebx, 0xf
shl eax, 4
or ebx, eax
movzx eax, byte [ebx + 0x533fd8]
mov byte [ecx + esi + 1], al
mov eax, dword [ebp - 8]
and edx, 0xf
mov ebx, eax
sar ebx, 6
add edx, edx
and ebx, 3
add edx, edx
or ebx, edx
mov dl, byte [ebx + 0x533fd8]
mov ebx, dword [ebp + 8]
mov byte [ecx + esi + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x533fd8]
mov byte [ecx + esi + 3], al
add edi, 3
add ecx, 4
dec dword [ebp - 4]
jne 0x439720
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
lea edx, [edx + edx*2]
sub eax, edx
dec eax
je 0x43980c
dec eax
jne 0x43983b
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x533fd8]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x533fd8]
mov byte [ecx + esi + 1], al
and edi, 0xf
movzx edx, byte [edi*4 + 0x533fd8]
mov byte [ecx + esi + 2], dl
mov edx, dword [ebp + 0x10]
mov byte [ecx + esi + 3], 0x3d
add ecx, 4
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x533fd8]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x533fd8]
mov byte [ecx + esi + 1], al
mov word [ecx + esi + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x10]
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43bf20
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x57662c], 0
jne 0x43c0d7
cmp byte [0x57662d], 0
jne 0x43c0cf
cmp dword [0x576630], 0
jne 0x43c0d7
push esi
push 0x400
mov byte [0x57662d], 1
call fcn.004e8f96
add esp, 4
push ebx
mov esi, eax
xor eax, eax
push edi
xor ecx, ecx
test al, 1
je 0x43bf6d
mov ecx, 0x80
mov edx, eax
shr edx, 1
test dl, 1
je 0x43bf79
or ecx, 0x40
shr edx, 1
test dl, 1
je 0x43bf83
or ecx, 0x20
shr edx, 1
test dl, 1
je 0x43bf8d
or ecx, 0x10
shr edx, 1
test dl, 1
je 0x43bf97
or ecx, 8
shr edx, 1
test dl, 1
je 0x43bfa1
or ecx, 4
shr edx, 1
test dl, 1
je 0x43bfab
or ecx, 2
test dl, 2
je 0x43bfb3
or ecx, 1
shl ecx, 0x18
mov edx, ecx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
xor edi, edi
mov dword [esi + eax*4], edx
lea ecx, [edi + 0x1f]
mov edi, edi
test dl, 1
je 0x43c07e
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x43c070
mov dword [esi + eax*4], edi
inc eax
cmp eax, 0xff
jbe 0x43bf62
cmp dword [0x576630], 0
pop edi
pop ebx
jne 0x43c0b6
mov dword [0x576630], esi
mov byte [0x57662c], 1
mov byte [0x57662d], 0
pop esi
ret
push esi
call fcn.004e8f90
add esp, 4
mov byte [0x57662c], 1
mov byte [0x57662d], 0
pop esi
ret
push 1
call fcn.00433830
pop ecx
ret
Function at 0x43c100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x574870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x408], eax
test edi, edi
jne 0x43c13a
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e8c8a
mov esp, ebp
pop ebp
ret
push esi
call fcn.0043bf20
or esi, 0xffffffff
cmp dword [ebp - 0x408], 0
jne 0x43c16d
mov eax, dword [0x576630]
movzx edx, byte [ebx]
mov ecx, esi
and ecx, 0xff
xor ecx, edx
shr esi, 8
xor esi, dword [eax + ecx*4]
inc ebx
dec edi
jne 0x43c151
jmp 0x43c272
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004e8fc8
mov ecx, dword [0x576630]
add esp, 0xc
lea esp, [esp]
movzx eax, byte [ebx]
inc dword [ebp + eax*4 - 0x404]
mov edx, esi
and edx, 0xff
xor edx, eax
shr esi, 8
xor esi, dword [ecx + edx*4]
inc ebx
dec edi
jne 0x43c190
mov ecx, dword [ebp - 0x404]
add ecx, dword [ebp - 0x400]
xor ebx, ebx
add ecx, dword [ebp - 0x3fc]
mov eax, 7
add ecx, dword [ebp - 0x3f8]
add ecx, dword [ebp - 0x3f4]
add ecx, dword [ebp - 0x3f0]
add ecx, dword [ebp - 0x3ec]
xor edx, edx
add edx, dword [ebp + eax*4 - 0x404]
add edi, dword [ebp + eax*4 - 0x400]
add eax, 2
cmp eax, 0x7f
jl 0x43c1e1
cmp eax, 0x80
jge 0x43c206
mov ebx, dword [ebp + eax*4 - 0x404]
inc eax
add edi, edx
add ebx, edi
xor edx, edx
xor edi, edi
mov dword [ebp - 0x40c], ebx
cmp eax, 0x100
jge 0x43c260
mov ebx, 0x100
sub ebx, eax
cmp ebx, 2
jl 0x43c248
jmp 0x43c230
add edx, dword [ebp + eax*4 - 0x404]
add edi, dword [ebp + eax*4 - 0x400]
add eax, 2
cmp eax, 0xff
jl 0x43c230
cmp eax, 0x100
jge 0x43c256
add ecx, dword [ebp + eax*4 - 0x404]
mov ebx, dword [ebp - 0x40c]
add edi, edx
add ecx, edi
mov eax, dword [ebp - 0x408]
shr ebx, 2
cmp ebx, ecx
sbb edx, edx
neg edx
mov word [eax], dx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
not eax
pop ebx
call fcn.004e8c8a
mov esp, ebp
pop ebp
ret