joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b300
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x41b330
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x41b32b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov bh, 9
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x41b315
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x41b31d
cmp edx, ebx
jne 0x41b46b
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x41b2ec
add eax, dword [eax + 4]
jmp 0x41b2d9
mov dword [ebp + 0xc], ebx
jmp 0x41b33b
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41b353
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41b371
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41b3cf
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41b3b6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41b3bf
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41b3c9
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41b3ab
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x41b335
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41b41c
dec eax
je 0x41b413
sub eax, 3
je 0x41b40a
mov dword [ebp - 4], 0x40
jmp 0x41b439
mov dword [ebp - 4], 4
jmp 0x41b41f
mov dword [ebp - 4], 0x20
jmp 0x41b41f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41b46b
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x41b3eb
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041ac7c
mov edx, eax
mov eax, dword [0x1475ff5a]
push 1
push esi
call edi
mov eax, esi
jmp 0x41b477
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b320
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x41b330
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x41b32b
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov bh, 9
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x41b315
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x41b31d
cmp edx, ebx
jne 0x41b46b
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x41b2ec
add eax, dword [eax + 4]
jmp 0x41b2d9
mov dword [ebp + 0xc], ebx
jmp 0x41b33b
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41b353
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41b371
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41b3cf
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41b3b6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41b3bf
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41b3c9
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41b3ab
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x41b335
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41b41c
dec eax
je 0x41b413
sub eax, 3
je 0x41b40a
mov dword [ebp - 4], 0x40
jmp 0x41b439
mov dword [ebp - 4], 4
jmp 0x41b41f
mov dword [ebp - 4], 0x20
jmp 0x41b41f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41b46b
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x41b3eb
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041ac7c
mov edx, eax
mov eax, dword [0x1475ff5a]
push 1
push esi
call edi
mov eax, esi
jmp 0x41b477
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x41bb3a
cmp dword [ebp + 0xc], 1
je 0x41bb3a
cmp dword [ebp + 0xc], 8
jne 0x41bb02
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0041ac8c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041ac41
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.0041ac7c
mov eax, dword [0xff36722b]
mov ch, 0x68
stc
invalid
call fcn.0041ac7c
xor eax, 0x80ddea2a
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0041ac7c
add eax, 0xa5804e31
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041ac5a
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
invalid
invalid
Function at 0x41ce20
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x54
call fcn.0041ac7c
and byte [ebp + 0x5b], bh
in al, dx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x41ce40
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0041ac7c
ret 0x637

Function at 0x41e4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41e56a
cmp byte [esi + 0x3d], 0
je 0x41e56a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41e558
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41e520
sub eax, 1
je 0x41e524
sub eax, 2
jne 0x41e558
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41e541
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0047e0c4
add esp, 0x10
cmp edi, eax
jne 0x41e558
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0046c678
mov esp, ebp
pop ebp
ret
Function at 0x41f240
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x41f257
cmp esi, 0x20
jne 0x41f42b
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x41f42a
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x41f2c2
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x41f295
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x41f3aa
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x41f340
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x4ad2bc]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x4ad2e0]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x4ad2e0]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + 0x4ad2e0]
xor esi, eax
movzx ebx, byte [ebx + 0x4ad2e0]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x41f38d
cmp esi, 6
jbe 0x41f38d
cmp edx, 4
jne 0x41f38d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x4ad2e0]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x4ad2e0]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x4ad2e0]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x4ad2e0]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x41f2e0
xor esi, esi
sub ecx, 1
js 0x41f429
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x41f419
cmp ecx, 4
jb 0x41f419
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x4ad2e0]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4ae8e0]
movzx eax, byte [eax + 0x4ad2e0]
xor edx, dword [eax*4 + 0x4aece0]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x4ad2e0]
xor edx, dword [eax*4 + 0x4ae4e0]
movzx eax, bl
movzx eax, byte [eax + 0x4ad2e0]
xor edx, dword [eax*4 + 0x4af0e0]
mov eax, dword [ebp + 8]
jmp 0x41f41b
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x41f3b7
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41fa60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41fa96
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41fb1a
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41faac
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41fb1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41fb1a
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0041c510
add esp, 8
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x41fb39
lea eax, [ebp - 0x28]
push eax
call fcn.0041fa60
add esp, 4
test eax, eax
je 0x41fb39
cmp dword [esi + 0x14], 8
jb 0x41faf8
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41fb12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41fb39
lea ecx, [ebp - 0x28]
call fcn.00402340
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00402340
xor eax, eax
jmp 0x41fb1f
Function at 0x41fb50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x41fd28
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x41fd28
test bl, 3
jne 0x41fd28
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x41fb9a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x41fd28
cmp byte [eax], 0x3d
je 0x41fb87
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x41fd1d
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x41fbc2
sub al, 0x41
jmp 0x41fbf1
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x41fbce
sub al, 0x47
jmp 0x41fbf1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x41fbda
add al, 4
jmp 0x41fbf1
cmp al, 0x2b
jne 0x41fbe2
mov al, 0x3e
jmp 0x41fbf1
cmp al, 0x2f
jne 0x41fbea
mov al, 0x3f
jmp 0x41fbf1
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x41fc01
sub dl, 0x41
jmp 0x41fc35
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x41fc0e
sub dl, 0x47
jmp 0x41fc35
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x41fc1b
add dl, 4
jmp 0x41fc35
cmp dl, 0x2b
jne 0x41fc24
mov dl, 0x3e
jmp 0x41fc35
cmp dl, 0x2f
jne 0x41fc2d
mov dl, 0x3f
jmp 0x41fc35
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x41fc44
sub bl, 0x41
jmp 0x41fc78
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x41fc51
sub bl, 0x47
jmp 0x41fc78
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x41fc5e
add bl, 4
jmp 0x41fc78
cmp bl, 0x2b
jne 0x41fc67
mov bl, 0x3e
jmp 0x41fc78
cmp bl, 0x2f
jne 0x41fc70
mov bl, 0x3f
jmp 0x41fc78
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x41fc8a
sub ah, 0x41
jmp 0x41fcc2
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x41fc99
sub ah, 0x47
jmp 0x41fcc2
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x41fca8
add ah, 4
jmp 0x41fcc2
cmp ah, 0x2b
jne 0x41fcb1
mov ah, 0x3e
jmp 0x41fcc2
cmp ah, 0x2f
jne 0x41fcba
mov ah, 0x3f
jmp 0x41fcc2
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x41fd28
cmp dl, 0xff
je 0x41fd28
cmp bl, 0xff
je 0x41fd28
cmp ah, 0xff
je 0x41fd28
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x41fbb3
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4201a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x420313
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x420313
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x42030c
xor eax, eax
test ebx, ebx
je 0x420270
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x420200
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x4202d7
sub ecx, 1
jne 0x420309
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x420930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a47bc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4df2b0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4dac6c]
cmp eax, dword [ecx + 4]
jg 0x4209a3
jmp 0x420984
mov al, byte [ecx]
inc ecx
test al, al
je 0x420aa8
jmp 0x420977
mov eax, 0x4dac54
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret
push 0x4dac6c
call fcn.0046c8f4
add esp, 4
cmp dword [0x4dac6c], 0xffffffff
jne 0x420984
mov byte [ebp - 0x34], 0x69
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x4e
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x2c
mov byte [ebp - 0x2f], 0x11
mov byte [ebp - 0x2e], 0x25
mov byte [ebp - 0x2d], 0x4e
mov byte [ebp - 0x2c], 0x7d
mov byte [ebp - 0x2b], 0x2c
mov byte [ebp - 0x2a], 0x11
mov byte [ebp - 0x29], 0x2c
mov byte [ebp - 0x28], 0x54
mov byte [ebp - 0x27], 0x26
mov byte [ebp - 0x26], 0x18
mov byte [ebp - 0x25], 0x68
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0x18
mov byte [ebp - 0x22], 4
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x25
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x12
mov byte [ebp - 0x1b], 4
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x18
mov byte [ebp - 0x18], 0x7c
mov byte [ebp - 0x17], 4
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x34]
mov byte [ebp - 0x13], 0
cmp byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
jne 0x420a82
xor ecx, ecx
mov byte [ebp - 0x13], 1
lea esi, [ecx + 0x7f]
jmp 0x420a60
mov al, byte [ebp + ecx - 0x34]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x34], dl
inc ecx
cmp ecx, 0x20
jb 0x420a60
jmp 0x420a82
lea ecx, [ebp - 0x34]
mov dword [0x4dac64], 0
mov dword [0x4dac68], 0xf
lea edx, [ecx + 1]
mov byte [0x4dac54], 0
jmp 0x420977
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, 0x4dac54
call fcn.0041f750
push 0x4aa500
call fcn.0046c663
push 0x4dac6c
call fcn.0046c8aa
add esp, 8
jmp 0x420984
Function at 0x422c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d63e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x422c70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x422cac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x422cac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x422d91
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x422cd4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x422d07
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0047d74d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x422d91
cmp eax, 1
jle 0x422d64
cmp eax, 3
jne 0x422d91
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00417c00
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x422d81
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0047e0c4
add esp, 0x10
cmp edi, eax
jne 0x422d91
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x422c97
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c678
mov esp, ebp
pop ebp
ret 4