joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17ea876
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov edx, dword [esi + eax*2 - 0x73116b34]
sub eax, eax
shr eax, 0xb4
mov ecx, 0xd12c23ae
lea esi, [esi + eax + 4]
mov dword [esp + eax*2], ecx
shr cx, 0xe9
jb 0x17ed60b
pop eax
add eax, 0x36e7b
jmp eax
xor edx, ebx
or dword [esp + eax], ecx
not edx
sub cx, word [esp + eax + 2]
neg al
bswap edx
shl dword [esp + eax], cl
rol edx, 1
mov dword [esp + eax], ecx
rol dword [esp + eax], 0x93
xor eax, ecx
adc edx, 0x1350b9d
xor eax, ecx
sub word [esp + eax*8 + 2], cx
xor ebx, edx
add edi, edx
sal ax, 0x41
movsx edx, cx
pop ecx
jae fcn.017c92a6

Function at 0x17f3f6d
Capabilities:
Authenticate hmac

Disassembly:
not ecx
not ax
lea edx, [edx + eax - 0x56985504]
push eax
add cl, 0xb2
xor edx, 0xae306782
shr dword [esp + eax - 0x546a02f1], 0xe2
ror edx, 3
lea ecx, [ecx*8 - 0x7b50f34d]
xor cx, cx
xor ebx, edx
mov dword [esp + eax - 0x546a02ed], ecx
xor cl, 0xa7
adc esi, edx
mov eax, dword [eax + edi - 0x546a02f1]
movsx edx, byte [esp + ecx - 0x1a8800a4]
inc dl
mov dx, word ss:[ecx + eax - 0x1a8800a7]
js fcn.0183cd91
lea edi, [edi + ecx - 0x1a8800a5]
mov word [edi + ecx*2 - 0x3510014e], dx
movsx eax, cl
mov dword [esp + ecx - 0x1a8800a7], esi
ret 4

Function at 0x17f6607
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
neg eax
sub dl, dh
xadd cl, ch
push edx
ror eax, 1
rol ecx, cl
ror cl, 0x85
xadd cl, dh
lea eax, [eax + ecx*2 + 0x2aa003f6]
add cx, cx
sbb cl, 0x8c
neg eax
bswap eax
mov dword [esp + ecx - 0x371a4], edx
dec eax
ror cx, cl
ror ecx, 0x5e
xor ebx, eax
call fcn.018648e7

Function at 0x17f71c8
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + ecx + 0x5b0556ce]
not edi
lea edi, [edi + edi*4 + 0x1291d5ad]
or di, 0x2820
sub edi, 0xa62350bf
jo 0x17d9f70
mov edi, dword [esp + 0xc]
mov ebx, 0xdf8d86ae
not ebx
jns 0x17f07ce

Function at 0x17fdd35
Capabilities:
Parse pe header

Disassembly:
push edi
push 0xc917fb2b
call fcn.0184ef1c
Function at 0x181430d
Capabilities:
Parse pe header

Disassembly:
inc ecx
call fcn.01866b86
push 0x3598ee10
mov ax, word [esi]
mov dx, word [esi + 2]
mov ecx, 0x5213bb95
mov cl, byte [ecx + esi - 0x5213bb91]
rol byte [esp + 2], 0x82
adc esi, 4
jmp 0x17f081c

Function at 0x181bcc3
Capabilities:
Parse pe header

Disassembly:
xor eax, ebx
mov dword [esp + 8], 0xa68fef0d
mov edx, dword [esp + 0xc]
not eax
movsx ecx, dx
xadd cx, dx
neg eax
add word [esp + ecx - 0xb13a], cx
jge fcn.017de038
mov dword [esp + ecx*8 - 0x58a0c], edx
lea eax, [eax + edx + 0x45e4b103]
ror eax, cl
neg dword [esp + ecx - 0xb138]
xor ebx, eax
not dword [esp + ecx - 0xb136]
mov dword [esp + ecx*2 - 0x16284], 0xf8a1ea22
add ebp, eax
jmp 0x1843d79
inc ecx
lea ecx, [edx + ecx*2 + 0x5969481]
mov ecx, dword [esi]
mov dx, word [esi + 4]
call fcn.017d9406
lea eax, [eax*2 - 0x4e6fd26d]
sal dword [esp + eax - 0x6b946b71], 0x17
not edx
dec eax
xor edx, 0xf6b3d58f
inc edx
xor edx, 0x1095cf07
dec dword [esp + eax - 0x6b946b70]

Function at 0x182edae
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esi + 4]
mov eax, 0x2e231d27
mov dword [esp + eax - 0x2e231d27], eax
sub word [esp + eax - 0x2e231d27], 0x2e39
lea esi, [esi + eax*2 - 0x5c463a46]
ror ax, 0xe9
and byte [esp + eax*2 - 0x5c47271a], al
mov dword es:[ecx + eax*2 - 0x5c47271c], edx
ror dword [esp + eax - 0x2e23938e], 0x50
mov edx, dword [ebp + eax - 0x2e23938e]
xchg word [esp + eax - 0x2e23938d], ax
sbb eax, dword [esp + eax - 0x2e23ee2e]
lea ebp, [ebp + eax*2 - 0x7f20c052]
setnp al
push eax
xor edx, ebx
push eax
not edx
movzx ecx, ax
lea eax, [eax*4 + 0x642d7c94]
rol edx, 2
shl eax, 0x37
shr eax, 0x3c
push eax
neg edx
neg al
xor edx, 0xa708a3a0
ror cx, 0xcd
adc eax, 0x44825e80
inc dword [esp + ecx - 2]
rol edx, 1
call fcn.01823a6c

Function at 0x183ccb7
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
lea edx, [edx + eax - 0x15dcbc4c]
shr ecx, cl
ror eax, cl
cmova cx, ax
not edx
mov dword [esp + eax - 0x7cc9b1f8], 0x29a28016
or ecx, ecx
bswap edx
call fcn.017d126f
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0x3e04c219
rol cx, 0x28
xor edx, ebx
dec cx
lea eax, [ecx + ecx*8 + 0x5c88d1ac]
neg edx
and ecx, eax
push ecx
adc eax, ecx
bswap edx
neg edx
and al, byte [esp + ecx - 0xa04193e]
xadd word [esp + ecx*8 - 0x5020ca08], cx
or ax, word [esp + ecx - 0xa041941]
rol edx, cl
or al, ch
bswap edx
call fcn.0179b509
mov edx, 0x3c1dabb7
mov edx, dword [ebp + edx - 0x3c1dabb7]
mov cl, byte [ebp + 4]
mov eax, 0xe9b1b333
lea eax, [eax - 0x74c3c669]
lea ebp, [ebp + eax - 0x74edecc8]
inc eax
shr edx, cl
mov dword [eax + ebp - 0x74edeccb], edx
mov ecx, dword [eax + esi - 0x74edeccb]
shl eax, 0x9d
lea esi, [eax + esi - 0x5ffffffc]
adc ax, ax
rol eax, 0x83
xor ecx, ebx
lea edx, [eax + eax - 0x576edee1]
xor edx, eax
ror ecx, 3
call fcn.01828561

Function at 0x18476ed
Capabilities:
Parse pe header

Disassembly:
neg ecx
bswap ecx
add dx, dx
call fcn.01868271
mov eax, 0xd0eb411
lea edx, [eax + eax*2 - 0x23cb8b46]
mov eax, dword [esi + eax*2 - 0x1a1d6822]
call fcn.0179e102
mov eax, ebp
lea eax, [ebp + eax*2 - 0x16f7c6de]
lea esi, [esi + ebp - 0x79cd222]
movsx edx, bp
neg ebp
setae al
xchg ecx, esi
mov ebp, ecx
jb 0x17d61f4
Function at 0x185d0b0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, 0x82a5a229
bswap esi
mov dword [esp + 8], 0x4a4556bd
mov esi, dword [esp]
lea esp, [esp + 8]
call fcn.01798cb4

Function at 0x1861cb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jmp 0x182614e
push 0x9002738b
and eax, 0xfffffffc
jmp 0x17a6c24
mov ecx, 0x9e84cb12
mov edx, esp
mov ecx, 0x6c
lea eax, [edi - 0x80]
jmp 0x17ead79
lea esp, [esp + 8]
ja 0x1778433
jmp 0x179a95c
jmp 0x1852fb7
Function at 0x100b79f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
call fcn.100b7c60
shr eax, 8
pop ecx
test al, al
je 0x100b7a0d
pop ebp
jmp fcn.100b718c
pop ebp
jmp fcn.100b6ab0
Function at 0x100d3de4
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0x100d3e4a
push ebp
mov ebp, dword [esp + 0x18]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x1c]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x18]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, edi
xor cl, byte [esi + ebp]
mov byte [esi], cl
inc esi
sub dword [esp + 0x10], 1
jne 0x100d3e0a
mov esi, dword [esp + 0x24]
pop edi
pop ebp
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
pop ecx
ret

Function at 0x100d4444
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
lea eax, [edx + ecx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx], 0
jne 0x100d447d
xor eax, eax
jmp 0x100d4559
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 0xc]
cdq
and eax, 0xffff0000
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x30]
or ecx, dword [ebp - 0x2c]
jne 0x100d44b4
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
jmp 0x100d452a
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], 0
jmp 0x100d44d9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x18]
jae 0x100d450b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
push eax
call fcn.100d4064
add esp, 8
test eax, eax
jne 0x100d4509
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
jmp 0x100d450b
jmp 0x100d44d0
cmp dword [ebp - 0x10], 0
jl 0x100d452a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + ecx*2]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x100d453b
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x14]
jb 0x100d453f
xor eax, eax
jmp 0x100d4559
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x1cf7d18
Capabilities:
Encode data using xor

Disassembly:
sub ebx, edi
shl di, cl
dec al
shrd di, bp, cl
rol di, 0xc
add ebx, esp
push edi
pushal
mov edi, ebx
xor al, bl
stc
mov al, 0x2e
clc
cmc
bt esp, 0x18
repne scasb al, byte es:[edi]
mov word [esp], 0xb159
pushal
pushfd
lea esp, [esp + 0x48]
jne 0x219dee4
add byte [esi + eax*8 - 0x17ff00b9], bl
or eax, 0x4960000
cdq
pushfd
mov byte [edi - 1], 0
call fcn.01b8b901
xchg esi, eax
add al, 0x99
cmp eax, 0x31cee561
push esi
sbb al, 0x39
jno 0x1b8ac10
jp 0x1b8abb8
mov eax, edx
mov byte [0x286a1753], al
pop ebp
jne 0x1b8ac4c
fiadd dword [edi + 0x1b]
rcr ebx, 0x85
popfd
dec edi
sub dword es:[ebx - 0x541d3509], ebp
arpl sp, si
insd dword es:[edi], dx
out dx, eax
ret
adc al, 0x6f
cmp byte [ecx], al
cld
pop edi
movsd dword es:[edi], dword [esi]
loope 0x1b8ac46
push ecx
loopne 0x1b8abe3
sal byte [eax + 0x4194eef0], cl
mov al, 0xf0
out dx, al
xchg esp, eax
inc ecx
dec dword [esi + 0x1300b707]
adc ch, dl
mov esp, 0x8131af40
mov al, 0x41
clc
cmc
rcl byte [edx + ecx*8], cl
cli
push eax
je 0x1b8ac4d
mov eax, dword [0xa09804c9]
xor byte [edi + 0x5a609b47], dl
invalid
push edx
das
xchg edi, ebp
into
or al, 0xf5
cmc
test eax, 0xf915628a
push ds
xchg byte fs:[esi + 0x3617ff11], bh
adc al, 0x66
out dx, al
mov dl, bh
dec ecx
and dword [ecx - 0x75], ebx
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
jnp 0x1b8ac04
retf 0xfff3
stc
clc
push dword [esp]
push dword [edi]
pop dword [esp + 0x28]
test dx, 0x1b2a
bt cx, 4
cmp edi, ebx
lea esp, [esp + 0x28]
jge 0x1df8c81
pushal
lea esp, [esp + 0x20]
ja 0x1dfad81
cmp edi, 0x358d3024
stc
jmp 0x1b8ab85
Function at 0x10005071
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10005161
xor ecx, ecx
mov dword [esi + 8], 0x100151b0
mov dword [esi + 0xc], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
inc eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 4], eax
mov dword [esi], 0x400
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x24], 7
mov dword [esi + 0x28], 0x100151b8
mov dword [esi + 0x20], 0x2000
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov ecx, 0x10003324
call 0x10020dc6
test eax, eax
jne 0x1000514d
mov ecx, 0x1000333c
call 0x10020dc6
test eax, eax
jne 0x1000514d
mov ecx, 0x10003354
call 0x10020dc6
test eax, eax
jne 0x1000514d
mov ecx, 0x1000336c
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x1000337c
call fcn.10004f40
test eax, eax
jne 0x1000514d
mov ecx, 0x10003394
call fcn.10004f40
test eax, eax
je 0x10005136
or dword [esi + 0x44], 0x1000000
jmp 0x10005154
mov ecx, 0x100033b0
call fcn.10004f40
test eax, eax
je 0x10005154
or dword [esi + 0x44], 0x10000
jmp 0x10005154
or dword [esi + 0x44], 0x100000
push esi
push dword [0x100151dc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
lea eax, [esi - 0x7ff8fff2]
pop esi
ret

Function at 0x10005310
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100151d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [0x100151dc]
mov dword [ebp - 0x18], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10005352
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x100053e2
push ebx
push dword [0x100151dc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
sub eax, edi
je 0x1000538b
sub eax, 1
je 0x1000537f
sub eax, 1
jne 0x100053df
push dword [ebp + 8]
mov ecx, ebx
call fcn.100063c3
jmp 0x10005387
push dword [ebp + 8]
call fcn.10006348
mov edi, eax
jmp 0x100053df
push 1
push 0x10
push esi
mov esi, dword [0x100156d0]
mov ecx, esi
call dword [0x10016308]
call esi
mov esi, eax
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100061d5
push eax
call sym.OLETHK32.dll_TransformHRESULT_3216
mov esi, dword [0x100156d0]
mov edi, eax
push 1
push 0x10
push dword [ebp - 0x18]
mov ecx, esi
call dword [0x10016308]
call esi
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100132f0
leave
ret 0xc
Function at 0x401670
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x1a8
call sym.___main
lea eax, [ebp - 0x18f]
mov ebx, 0x40506c
mov edx, 0x163
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
call sym._InitRC4
mov dword [esp + 4], 6
mov dword [esp], str.inc0d3
call sym._DoKSA
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x163
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40171a
call sym._printLastError
mov eax, 1
jmp 0x401820
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0x162
jmp 0x401754
call sym._GetPRGAOutput
mov byte [ebp - 0x25], al
lea edx, [ebp - 0x18f]
mov eax, dword [ebp - 0x1c]
add eax, edx
movzx eax, byte [eax]
xor al, byte [ebp - 0x25]
lea ecx, [ebp - 0x18f]
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jb 0x40172a
mov eax, dword [ebp - 0x20]
mov edx, eax
lea eax, [ebp - 0x18f]
mov ecx, 0x163
mov ebx, dword [eax]
mov dword [edx], ebx
mov ebx, dword [eax + ecx - 4]
mov dword [edx + ecx - 4], ebx
lea ebx, [edx + 4]
and ebx, 0xfffffffc
sub edx, ebx
sub eax, edx
add ecx, edx
and ecx, 0xfffffffc
shr ecx, 2
mov edx, ecx
mov edi, ebx
mov esi, eax
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x194]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4017e1
call sym._printLastError
mov eax, 1
jmp 0x401820
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
cmp eax, 0xffffffff
jne 0x401808
call sym._printLastError
mov eax, 1
jmp 0x401820
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
call sym._getchar
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x4e80c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x85000]
push edi
jmp 0x4e80da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e80e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e80d0
mov eax, 1
add ebx, ebx
jne 0x4e80f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e8104
jne 0x4e8123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e8123
dec eax
add ebx, ebx
jne 0x4e8110
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e80e8
add ebx, ebx
jne 0x4e811f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e8175
xor ecx, ecx
sub eax, 3
jb 0x4e813b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e81aa
sar eax, 1
mov ebp, eax
jmp 0x4e8146
add ebx, ebx
jne 0x4e8146
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e8114
inc ecx
add ebx, ebx
jne 0x4e8154
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e8114
add ebx, ebx
jne 0x4e8161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e8156
jne 0x4e8172
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e8156
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e8194
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e8186
jmp 0x4e80d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e8194
add edi, ecx
jmp 0x4e80d6
pop esi
mov edi, esi
mov ecx, 0x2510
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e81b2
cmp byte [edi], 0x21
jne 0x4e81b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e81b7
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4e822f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe8000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe8190]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e81e4
mov ecx, edi
jns 0x4e8213
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe8198]
or eax, eax
je 0x4e8229
mov dword [ebx], eax
add ebx, 4
jmp 0x4e8201
call dword [esi + 0xe8194]
mov ebp, dword [esi + 0xe819c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e8263
sub esp, 0xffffff80
jmp 0x4479be
Function at 0x404940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ca10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x467014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x468070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041b500
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x467a88
push eax
call fcn.0041b500
mov esi, dword [0x468080]
xor ebx, ebx
mov edi, dword [0x468084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46b280], bl
mov eax, ebx
mov ecx, 0x468070
cmovae ecx, dword [0x468070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46b390], al
inc ebx
cmp ebx, 0x100
jl 0x4049c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46b280]
movzx eax, byte [esi + 0x46b390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46b280]
mov byte [esi + 0x46b280], al
inc esi
mov byte [edi + 0x46b280], dl
cmp esi, 0x100
jl 0x4049f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.00420aab
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.00420aab
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043a0ab
int3
Function at 0x404ad0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.0041b3c0
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x404b23
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x404bce
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x404b61
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x404c45
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x404bf8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x404bfd
mov ecx, eax
sar eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x404c14
sar eax, 4
and eax, 0x3f
jmp 0x404c1a
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
test edx, edx
je 0x404c3f
and ecx, 0xf
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret