joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40733a
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 5
push ebx
push esi
call sub.KERNEL32.DLL_MoveFileExW
pop edx
test eax, eax
jne 0x407360
push eax
push eax
push ebx
push esi
call fcn.00407174
add esp, 0x10
inc dword [0x435a18]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x40736f
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ebx
call fcn.004070d8
add esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x4073cc
test edi, 1
je 0x4073a1
sub esp, 0xc
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
jmp 0x4073aa
sub esp, 0xc
push ebx
call sub.KERNEL32.DLL_DeleteFileW
add esp, 0xc
test eax, eax
jne 0x4073c5
and edi, 4
jne 0x4073cc
push edi
push edi
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
xor eax, eax
pop ebx
pop esi
jmp 0x4073ce
mov eax, 1
jmp 0x4073ce
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4073d8
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x278
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push esi
call fcn.00406fde
add esp, 0xc
mov dword [ebp - 0x260], eax
test edi, 8
je 0x407427
sub esp, 0xc
mov ebx, dword [0x435a10]
push esi
call sub.KERNEL32.DLL_DeleteFileW
add esp, 0xc
test eax, eax
sete al
movzx eax, al
add eax, ebx
mov dword [0x435a10], eax
jmp 0x407648
mov eax, edi
and eax, 4
mov dword [ebp - 0x268], eax
mov eax, edi
and eax, 1
mov dword [ebp - 0x270], eax
je 0x407458
cmp dword [ebp - 0x260], 0
je 0x407634
test edi, 2
je 0x4075e4
push ecx
push ecx
push esi
push 0x433bc8
call fcn.00406aea
mov al, byte [ebp - 0x270]
pop ebx
mov byte [ebp - 0x269], al
pop edx
test al, al
je 0x40748c
push ecx
push ecx
push 0x40b67c
push 0x433bc8
call fcn.00406a60
pop eax
pop edx
jmp 0x407498
sub esp, 0xc
push esi
call fcn.00406a72
add esp, 0xc
cmp word [esi], 0
jne 0x4074a8
cmp word [0x433bc8], 0x5c
jne 0x4074b7
push eax
push eax
push 0x40b62c
push esi
call fcn.00406a60
pop ebx
pop eax
sub esp, 0xc
push esi
call fcn.00406a69
sub esp, 0xc
lea eax, [esi + eax*2]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x25c]
push eax
push 0x433bc8
call sub.KERNEL32.DLL_FindFirstFileW
add esp, 0x18
mov ebx, eax
cmp eax, 0xffffffff
je 0x4075bd
mov eax, edi
and eax, 3
mov dword [ebp - 0x274], eax
cmp word [ebp - 0x230], 0x2e
jne 0x407520
mov ax, word [ebp - 0x22e]
test ax, ax
je 0x407598
cmp ax, 0x2e
jne 0x407520
cmp word [ebp - 0x22c], 0
je 0x407598
lea eax, [ebp - 0x230]
push ecx
push ecx
push eax
push dword [ebp - 0x264]
call fcn.00406aea
test byte [ebp - 0x25c], 0x10
pop eax
pop edx
je 0x407553
cmp dword [ebp - 0x274], 3
jne 0x407598
push eax
push eax
push edi
push esi
call fcn.004073d8
jmp 0x407596
push eax
push eax
push dword [ebp - 0x268]
push esi
call fcn.0040736f
pop edx
test eax, eax
pop ecx
jne 0x40758c
cmp dword [ebp - 0x268], 0
je 0x407584
push eax
push eax
push esi
push 0xfffffffffffffff1
call fcn.004042ef
push 0
push esi
call fcn.0040733a
jmp 0x407596
inc dword [0x435a10]
jmp 0x407598
push ecx
push ecx
push esi
push 0xfffffffffffffff2
call fcn.004042ef
pop eax
pop edx
push eax
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileW
pop edx
test eax, eax
pop ecx
jne 0x4074f6
sub esp, 0xc
push ebx
call sub.KERNEL32.DLL_FindClose
add esp, 0xc
cmp byte [ebp - 0x269], 0
je 0x4075d2
mov eax, dword [ebp - 0x264]
mov word [eax - 2], 0
cmp dword [ebp - 0x270], 0
je 0x407648
cmp dword [ebp - 0x260], 0
je 0x407634
sub esp, 0xc
push esi
call fcn.004068b8
add esp, 0xc
test eax, eax
je 0x407648
sub esp, 0xc
push esi
call fcn.00406aac
mov eax, dword [ebp - 0x268]
sub esp, 0xc
or eax, 1
push eax
push esi
call fcn.0040736f
add esp, 0x18
test eax, eax
jne 0x40763c
cmp dword [ebp - 0x268], 0
je 0x407634
push ebx
push ebx
push esi
push 0xfffffffffffffff1
call fcn.004042ef
push 0
push esi
call fcn.0040733a
jmp 0x407646
inc dword [0x435a10]
jmp 0x407648
push ecx
push ecx
push esi
push 0xffffffffffffffe5
call fcn.004042ef
pop eax
pop edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4076e9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x4343c8], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x4343c8
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.DLL_CreateProcessW
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x407734
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x40775f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x28
lea eax, [ebp - 0x14]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x28]
push eax
mov byte [ebp - 0x28], 1
mov byte [ebp - 0x27], 0
mov word [ebp - 0x26], 4
mov dword [ebp - 0x24], 0x40b69c
mov dword [ebp - 0x20], 0x40b69c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x40b68c
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryW
pop edx
xor edx, edx
pop ecx
test eax, eax
jne 0x4077e3
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
cmp eax, 0xb7
jne 0x4077e3
push eax
push ebx
push 0x80000007
push esi
call sub.ADVAPI32.DLL_SetFileSecurityW
xor edx, edx
pop ebx
test eax, eax
jne 0x4077e3
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
lea esp, [ebp - 8]
mov eax, edx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x4077f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x43441c], 0
push ebx
mov esi, dword [ebp + 0x10]
jne 0x40782d
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
cmp ecx, 8
jne 0x407807
mov dword [ebx*4 + 0x434418], edx
inc ebx
cmp ebx, 0x100
jne 0x407803
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not edx
jmp 0x407849
mov al, byte [ecx - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x434418]
dec esi
inc ecx
cmp esi, 0xffffffff
jne 0x407837
not edx
mov eax, edx
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x420bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x420bbf
pop dword [ebp - 0x44]
mov eax, 0x408c38d1
sub eax, 0x404a2d12
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3bfd2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3f8b
xor edx, edx
add edx, eax
mov ebx, 0xd92943b0
add ebx, 0x271a1050
add ebx, dword [ebp - 0x44]
mov esi, 0xd41296c
add esi, 0x8b3843f7
add dword [ebp - 0x18], 0xbffe88c
mov edi, dword [ebx]
xor dword [ebp - 0x14], 0x684aec2f
sub edi, esi
sub dword [ebp - 4], ecx
mov dword [edx], edi
add edx, 4
add ebx, 0x98694213
sub ebx, 0x9869420f
loop 0x420c15
add eax, 0xf0ff
mov ebx, eax
add eax, 0xdc231d1
add eax, 0xf23dce34
mov ecx, 0xbf1377c7
sub ecx, 0xbed377c7
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401824
Capabilities:
Create process on windows
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4055a8], 0
je 0x401901
xor edx, edx
push ebp
push 0x4018fa
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x405035], 0
je 0x401856
push 0x4055b0
call sub.KERNEL32.DLL_TlsSetValue
mov byte [0x4055a8], 0
mov eax, dword [0x405608]
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
xor eax, eax
mov dword [0x405608], eax
mov ebx, dword [0x4055d0]
jmp 0x401889
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_LocalAlloc
mov ebx, dword [ebx]
cmp ebx, 0x4055d0
jne 0x401877
mov eax, 0x4055d0
call fcn.00401124
mov eax, 0x4055e0
call fcn.00401124
mov eax, 0x40560c
call fcn.00401124
mov eax, dword [0x4055c8]
test eax, eax
je 0x4018cf
mov edx, dword [eax]
mov dword [0x4055c8], edx
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
mov eax, dword [0x4055c8]
test eax, eax
jne 0x4018b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401901
cmp byte [0x405035], 0
je 0x4018ef
push 0x4055b0
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x4055b0
call sub.KERNEL32.DLL_WinExec
ret
pop ebx
pop ebp
ret
Function at 0x401e4c
Capabilities:
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4055a8], 0
jne 0x401e69
call fcn.00401760
test al, al
je 0x401e71
cmp ebx, 0x7ffffff8
jle 0x401e7b
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x401fcf
xor ecx, ecx
push ebp
push 0x401fc8
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x405035], 0
je 0x401e9c
push 0x4055b0
call sub.KERNEL32.DLL_TlsSetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401eac
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401f4b
mov eax, ebx
test eax, eax
jns 0x401ec1
add eax, 3
sar eax, 2
mov edx, dword [0x405608]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401f4b
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401efc
mov eax, ebx
test eax, eax
jns 0x401eeb
add eax, 3
sar eax, 2
mov ecx, dword [0x405608]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401f22
mov ecx, ebx
test ecx, ecx
jns 0x401f05
add ecx, 3
sar ecx, 2
mov edi, dword [0x405608]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40559c]
sub ebx, 4
add dword [0x4055a0], ebx
call fcn.0040299c
jmp 0x401fcf
cmp ebx, dword [0x405600]
jg 0x401f9d
sub dword [0x405600], ebx
cmp dword [0x405600], 0xc
jge 0x401f6f
add ebx, dword [0x405600]
xor eax, eax
mov dword [0x405600], eax
mov eax, dword [0x405604]
add dword [0x405604], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40559c]
sub ebx, 4
add dword [0x4055a0], ebx
call fcn.0040299c
jmp 0x401fcf
mov eax, ebx
call fcn.00401d58
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401fcf
cmp byte [0x405035], 0
je 0x401fc7
push 0x4055b0
call sub.KERNEL32.DLL_GetSystemDirectoryA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x401fdc
Capabilities:
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4055ac], eax
cmp byte [0x4055a8], 0
jne 0x402014
call fcn.00401760
test al, al
jne 0x402014
mov dword [0x4055ac], 8
mov dword [ebp - 4], 8
jmp 0x402175
xor ecx, ecx
push ebp
push 0x40216e
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x405035], 0
je 0x402035
push 0x4055b0
call sub.KERNEL32.DLL_TlsSetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402050
mov dword [0x4055ac], 9
jmp 0x402145
dec dword [0x40559c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4055a0], eax
test bl, 1
je 0x4020b0
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402080
test edx, 0x80000003
je 0x40208f
mov dword [0x4055ac], 0xa
jmp 0x402145
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4020a7
mov dword [0x4055ac], 0xa
jmp 0x402145
add ebx, edx
mov esi, eax
call fcn.00401904
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x405604]
jne 0x4020f0
sub dword [0x405604], ebx
add dword [0x405600], ebx
cmp dword [0x405600], 0x3c00
jle 0x4020e1
call fcn.00401bf4
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0040299c
jmp 0x402175
mov edx, dword [eax]
test dl, 2
je 0x402113
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40210e
mov dword [0x4055ac], 0xb
jmp 0x402145
or dword [eax], 1
jmp 0x40213c
mov eax, edi
cmp dword [eax + 4], 0
je 0x402126
cmp dword [eax], 0
je 0x402126
cmp dword [eax + 8], 0xc
jge 0x402132
mov dword [0x4055ac], 0xb
jmp 0x402145
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401904
mov edx, ebx
mov eax, esi
call fcn.00401b6c
mov eax, dword [0x4055ac]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402175
cmp byte [0x405035], 0
je 0x40216d
push 0x4055b0
call sub.KERNEL32.DLL_GetSystemDirectoryA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4025e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402680
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402660
xor eax, eax
push ebp
push 0x402659
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40269c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402660
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40400c], ax
mov esp, ebp
pop ebp
ret
Function at 0x406030
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x406044
mov dword [esp + 0x18], 0x4053d0
jmp fcn.00409430
mov dword [esp + 0x18], fcn.00404e80
jmp fcn.00409180
Function at 0x408f50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.00404280
mov eax, dword [0x5014b4]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x408fb6
cmp edi, dword [esi]
je 0x408fad
test ebp, ebp
je 0x409030
test ebx, ebx
js 0x409030
mov eax, 1
mov dword [esi], edi
jmp 0x408fbc
mov edi, dword [esi]
test edi, edi
je 0x409030
test ebp, ebp
je 0x40914a
push edi
call fcn.0040db70
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x408ff0
push 0x28
push str.....openssl_1.1.0ecryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.0040e000
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x40904b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.0040e500
add esp, 0xc
test eax, eax
je 0x409030
push ebx
push ebp
push dword [esi + 4]
call fcn.0040e6b0
add esp, 0xc
test eax, eax
je 0x409030
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.0040e480
add esp, 0xc
test eax, eax
jne 0x409067
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040426d
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x409030
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.00499cb0
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x40908a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.004993f0
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x409090
push edx
push edi
push dword [esi + 8]
call fcn.0040e500
add esp, 0xc
test eax, eax
je 0x409030
push edi
call fcn.0040db70
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.0040e6b0
add esp, 0x10
test eax, eax
je 0x409030
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x4090e0
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.0040e500
add esp, 0xc
test eax, eax
je 0x409030
push edi
call fcn.0040db70
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.0040e6b0
add esp, 0x10
test eax, eax
je 0x409030
push dword [esi + 8]
push dword [esi + 4]
call fcn.0040e6c0
add esp, 8
test eax, eax
je 0x409030
mov eax, 1
jmp 0x409032
test eax, eax
je 0x40912a
jmp 0x40908e
Function at 0x488140
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x48822c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x4881bd
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x488211
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x4881d1
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x4881fb
lea eax, [esi + 0x3c]
jmp 0x488208
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x488160
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret

Function at 0x4af151
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004aefc7
Function at 0x401210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x401282
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.00401180
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x401230
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x4012f5
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x40129f
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.00419d00
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x4012b8
push eax
push 0
push ecx
call fcn.00419d30
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.00401180
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4036b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call fcn.0041a3f0
add esp, 0xc
test eax, eax
je 0x40371e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0041a3f0
add esp, 0xc
test eax, eax
jne 0x40379f
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041a3f0
add esp, 0xc
test eax, eax
jne 0x40379f
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.0041a3f0
add esp, 0xc
test eax, eax
jne 0x403795
push 2
lea edx, [ebp - 8]
push edx
push esi
call fcn.0041a3f0
add esp, 0xc
test eax, eax
jne 0x403795
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.0041a3f0
add esp, 0xc
test eax, eax
jne 0x403795
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call fcn.0041a3f0
add esp, 0xc
test eax, eax
jne 0x403795
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4046e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x27e]
push ecx
mov word [ebp - 0x280], ax
call fcn.00419d30
push 0x40
lea ecx, [ebp - 0x7c]
push 0
push ecx
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.00419d30
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], dx
call fcn.00409d50
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x280]
push eax
call fcn.0041a110
mov ecx, dword [esi + 0xba0]
push 0xad0121ab
push 0
push 0
push ecx
add esi, 0x1c
push esi
call fcn.00413e40
add esp, 0x44
pop esi
test eax, eax
je 0x4047e5
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x280]
push edx
push 0
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret