joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41de70
Capabilities:
Encode data using base64

Disassembly:
test ecx, 0x4000
jb 0x426f2e
jne 0x42f9b8
je 0x41da49
sub eax, 0x2f810f64
jge 0x41da4e
jno 0x42577e
add byte [eax + 4], dh
jo 0x41da55
cpuid
cli
ret
jo 0x42577e
lea esp, [esp + 4]
mov di, di
jne 0x41da31
je 0x41de83
pop eax
add dl, byte [esi + 0x24]
mov esi, esi
jne 0x417348
je 0x41de8f
mov eax, dword [esi + 4]
js 0x42aca6
jns 0x42578d
ret 0xb093
jns 0x42aca6
invalid
or ax, ax
add esi, 8
add edi, eax
stc
test ecx, 0x80000000
jb 0x43fba4
shl edx, 0x20
jne 0x427245
je 0x42accd
add eax, esp
pop eax
jge 0x42acd7
or ebp, ebp
in eax, dx
add esi, 4
popfd
jmp 0x42f9ad
ror byte [eax + eax], cl
sbb byte [edi + 0x424648d], 0x5e
lea esp, [esp + 4]
pop esi
xor eax, eax
jb 0x4211c4
pop ebx
shl cl, 0x20
pop ebp
ret
xor al, 9

Function at 0x41e7de
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x420cbf
je 0x41e7f9
and al, 0xc5
je 0x420cbf
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x420cc7
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.00411122
shl eax, 0x20
call fcn.00438a9d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret

Function at 0x42011f
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
jmp 0x40bc43

Function at 0x4226d0
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.00413c40
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid

Function at 0x427706
Capabilities:
Check os version
Encode data using base64

Disassembly:
lea esp, [esp + 4]
lea esi, [esi + 4]
push 0xd30569ff
mov dword [esp], ebx
pushfd
mov ebx, 0xf597a04e
sub ebx, 0x800edc60
popfd
push eax
pop eax
call fcn.0041915a
xor eax, 0xee850f71
mov al, 0xfd
push dword [edx + eax - 0x68]

Function at 0x42bd21
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov ebx, dword [ebp + 8]
xchg di, bx
xchg bx, di
lea ecx, [ebp - 0x100]
push ebx
xchg al, cl
xchg cl, al
shr dx, 0x40
push ecx
call fcn.0042a282
lea edx, [ebp - 0x100]
js 0x42484c
jns 0x42bd53
sub eax, 0xf3890f0b
mov bh, bh
inc dword [0xd4850fdf]
jns 0x42484c
add eax, 0xd4850fdf
jo 0x42bd60
add byte [ebx + eax + 0x35], dh
sahf
outsb dx, byte [esi]

Function at 0x42be00
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jmp 0x40bc43
Function at 0x42fba0
Capabilities:
Packed with generic packer

Disassembly:
jle 0x41ad24
xchg bp, ax
xchg bp, ax
jg 0x41ad19
retf 0xa8e8
lea esi, [esi + 8]
shl di, 0x20
jmp dword [esi]
mov esi, dword [esi + 4]
mov esi, dword [ebp + esi]
mov esi, dword [esi]
jmp dword [esi]
ret
pop dword [esp - 4]
mov esp, ebp
pop ebp
mov al, al
jne 0x41cbf6
je 0x42fbb4
outsb dx, byte [esi]
pop es
xchg esi, eax
je 0x41cbf6
xor al, 0x6a
ja 0x41ad09
jbe 0x42fbc8
sbb al, 0x3e
insb byte es:[edi], dx
ja 0x42fbd8
jbe 0x41ad09
xchg byte [ebx], bh
mov cl, 0xfe
invalid
fnstcw word [ebx + 0x4c481]
add byte [eax], al
xor word [ebp + ebx], ax
jb 0x4354d2
inc esp
sbb eax, 0xf1820f00
pop eax
add byte [eax], al
jmp dword [esi]
mov ch, 0x25
je 0x435e4f
and eax, 0x42aab62e
add byte [eax], bh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebx], cl
inc esp
inc eax
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebx + edi + 0xbb40041], dl
inc ecx
add byte [ecx], al
loopne 0x435540
add cl, ah
jns 0x435543
add byte [0x30004333], dh
add byte [eax], al
add byte [eax + eax], cl
add byte [0x4c004333], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edx + 0x2600439e], dl
push ebp
inc ebx
add byte [eax + 0x12], al
xchg edx, eax
sahf
inc ebx
add cl, ah
jns 0x43556d
add byte [0xe8c68050], ah
sub dh, 0xe8
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x441abc
add byte [eax], al
or byte [edi], 0x82
jo 0x43550f
add byte [eax], al
jne 0x429996
je 0x435558
and byte [edx], 0x1c
imul esp, dword [esi - 0x77], 0xffffffdb
mov bx, bx
call fcn.00425c2f
mov di, di
add edi, dword [ecx + 0x6870fb5]
popfd
cld
push dword [esi + 4]
jae 0x441add
leave
pop ebx
jbe 0x40b7cb
add byte [esi - 0x3f], ah
ljmp 0xd340
Function at 0x431810
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5800f0e
add byte [ecx], 0
fst dword [ecx + 0x40277768]
add bl, al
xor al, 0xb0
push 0xe37fa68f
mov dword [esp], ebx
push 0x62
mov dword [esp], edx
call fcn.004324e8
xor al, 0x35
fst dword [ecx + 0x66]
mov esi, esi
mov bp, bp
mov ax, ax
mov al, byte [esi]
xchg ebx, eax
sbb cl, byte [ebx - 0x3779fbba]
xchg cl, al
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
lea esi, [esi + 0xc]
sub dword [ebp + ebx], eax
mov ax, ax
jmp dword [esi]
cmc
cdq
push 0x404440
ret
cmp al, 0x50
jne 0x4375f9
je 0x4317d9
push esp
daa
mov word [edi + 0x5e], ds
pop edi
pop esi
push 0x4375ec
ret
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, esp
pushfd
push 0x2f
mov dword [esp], ecx
pushfd
mov dword [esp], eax
js 0x41f3a9
shl dl, 0x20
jns 0x431808
jp 0x4317cc
call 0xdbdea11b
invalid
jns 0x41f3a9
sbb byte [eax - 0x3dbbb71], 0x85
dec dword [edi]
sub byte [edi + 0x27], 0xff
dec dword [edi]
test dword [edx], esp
jb 0x431821
add byte [ecx + 0x320374db], cl
dec ebp
inc edi
jno 0x4389ef
jo 0x431835
cpuid
nop
ret
jo 0x4389ef
xor al, 5
jne 0x425f47
je 0x431847
lodsb al, byte [esi]
je 0x425f47
fmul dword [edx - 0x73]
jbe 0x43185e
shr cx, 0x40
mov word [ebp + ebx], ax
cmp bh, 0xff
test ebx, 0x2b3a2199
cmp al, 0x45
jne 0x436570
je 0x43654a
sub al, 0xe6
mov al, byte [esi + 1]
test al, al
jb 0x40445f
jne 0x4365ac
je 0x43655f
sbb bl, byte [esi + 0x5f]
pop edi
pop esi
push eax
pop eax
xor eax, eax
jb 0x41c670
pop ebx
pop ebp
ret
cmp al, 0x53
jne 0x43658d
je 0x43657e
cpuid
nop
ret
pop edi
pop esi
xor eax, eax
jb 0x41c678
pop ebx
pop ebp
ret
cmp al, 0x58
jne 0x4365ac
je 0x43659b
push ebx
pop es
jae 0x436606
pop edi
lea esi, [esi]
pop esi
xor eax, eax
mov esi, esi
jmp 0x429a32
and bh, 0x1f
invalid
cmp al, 0x49
jne 0x437618
je 0x437605
scasd eax, dword es:[edi]
xchg ebp, eax
pop edi
pop esi
xor eax, eax
jb 0x42dbbf
pop ebx
pop ebp
mov bh, bh
ret
test ah, 0xf0
cmp al, 0x43
jne 0x436537
je 0x437628
sbb byte [ebx + esi], dh
mov al, byte [esi + 1]
test al, al
jb 0x42dbdb
jne 0x4365ac
shl bh, 0x20
je 0x437640
mov ah, 0xca
push 0x436520
ret
cmpsb byte [esi], byte es:[edi]
cld
mov edx, dword [esi]
push 0x25
shl bh, 0x20
jmp 0x437ec0
push edx
call fcn.004225b5
add esp, 8
pop edi
pop esi
pop ebx
mov ebx, ebx
mov esp, ebp
ja 0x4033e2
jbe 0x437edf
xchg edi, eax
push ds
or cl, byte [edi]
xchg ch, bh
mov ah, 0xfc
invalid
jbe 0x4033e2
fimul dword [ebx + 0xf]
mov byte [esi + 0x79fffde8], ch
add al, 0xf
mov byte [0x890fc3eb], al
mov byte [0x35fffde8], al
sbb dword [ebx - 0x77], 0x5f575dec
js 0x41679b
jns 0x437ef3
cpuid
jmp 0x437eb6
jns 0x41679b
xor eax, 0xec895b81
pop ebp
push edi
pop edi
ret
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
cmp dword [eax], 0
je 0x438a44
jne 0x438a0c
xchg edx, eax
aam 0x1a
add dword [ebp - 0xe003bb3], ecx
lea ecx, [ebp - 0x3c]
push ecx
push 0x437881
push 1
jmp 0x438a19
push eax
push ebx
mov bx, bx
call fcn.0044db50
mov edi, eax
test esi, 0xe2305fe0
add esp, 0x14
test edi, edi
jb 0x4288bd
je 0x431829
jne 0x438a44
sbb bh, byte [eax + ebp*8 - 8]
dec edx
add byte [eax], al
call fcn.0043d541
fldenv [edi + 0x1b]
jmp 0x838a91
Function at 0x432871
Capabilities:
Encode data using base64

Disassembly:
add esp, 4
xor eax, eax
jb 0x42dbb1
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x4226e6
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x432885
jge 0x4328b4
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.0043212c
Function at 0x435600
Capabilities:
Check os version
Encode data using base64

Disassembly:
xchg edi, eax
sbb esi, edx
jbe 0x42db98
fldenv [ebx + 0x83826ff]
shr ch, 0x40
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov al, byte [ebp + eax]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
jmp dword [esi]
mov ecx, dword [esi + 4]
mov bx, bx
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
shr word [ebx], cl
jmp dword [esi]
clc
lodsb al, byte [esi]
call fcn.004226d0
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
pop dword [esp - 4]
je 0x43bfa8
jne 0x43560f
pop ebx
out 0x6e, al
xor eax, eax
jb 0x42b2c9
pop esi
mov esp, ebp
jne 0x43bfa1
je 0x435624
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x43bfa1
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x43bffd
je 0x43bfba
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x42b2d2
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x42dbaa
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x43bfcb
jge 0x43bff6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
xchg ecx, edx
xchg edx, ecx
mov eax, edx
shr bl, 0x40
shr eax, 0x1f
add edx, eax
shr ah, 0x40
mov eax, ecx
shr eax, 0x40
mov edi, edx
shl bl, 0x20
cdq
and edx, 3
jb 0x42574c
jmp fcn.0043212c
cmp al, 2
mov esi, esi
call 0x440a10
invalid
add eax, edx
sar ebx, 2
jne 0x415067
je 0x43c041
shr bl, 0x70
clc
je 0x415067
invalid

Function at 0x4379aa
Capabilities:
Encode data using base64

Disassembly:
push 0x4129d9
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x417b44
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x408789
je 0x4236d9
push cs
sub byte [eax], ch
jmp 0x402af0
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x423685
shr edi, 0x40
je 0x4379c3
push ebx
out dx, al
je 0x423685
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]

Function at 0x4396d5
Capabilities:
Encode data using base64

Disassembly:
pop ebp
ret
mov eax, 1
adc byte [ecx + 0xf], 0x8e
mov ch, 0x46
pop dword [esp - 4]
shr ax, 0x40
je 0x42b49b
jne 0x4396e8
add al, 0x16
xchg ecx, edx
xchg ecx, edx
xchg edx, ecx
shl ax, 0x20
inc eax
cmp eax, 0x43
jb 0x43b339
jae 0x439702
rcl ch, cl
mov ecx, ebp
xor eax, eax
jb 0x431cd3
js 0x421e3b
jns 0x439716
mov byte [0xfa8949b], al
mov dword [edi], ebx
xchg esi, edi
push dword [ecx + edi*4]
jns 0x421e3b
xor al, 0xb9

Function at 0x43afc1
Capabilities:
Packed with generic packer

Disassembly:
add esp, 4
and edx, 7
jb 0x4133a3
and bp, bp
sub eax, edx
push eax
push esi
mov si, si
xchg edi, eax
xchg edi, eax
call fcn.00440188
jmp 0x40bc43
Function at 0x43c25d
Capabilities:
Query environment variable

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jb 0x410ddb
xchg bh, dl
xchg dl, bh
js 0x424cee
jns 0x40d267
fiadd dword [edi + 0x6a]
sbb cl, ch
xor eax, 0xf70001a7
test al, 0x68
pop ds
outsd dx, dword [esi]
inc ebx
add bl, al
fst dword [eax]
mov bp, bp
mov eax, dword [0x463c51]
test eax, eax
jb 0x40f620
jne 0x43c281
je 0x43c279
dec esp
push ecx
jecxz 0x43c2b2
mov eax, dword [0x463a60]
ret
push 0x58
push 0x463a08
push 0x463c45
shr ah, 0x40
mov dword [0x463c51], 0
shl si, 0x20
ja 0x40d249
jbe 0x43c2aa
nop
cpuid
ret
jbe 0x40d249
mov dword [esi - 0x7f], 0x5176f1
add byte [edi], cl
or byte [esi], 0x9e
cld
dec dword [edi]
test dword [eax], esp
adc ch, bh
jmp dword [esi - 0x77]
xor ecx, 0x5176
jb 0x4060cc
jne 0x40d2e4
mov bp, bp
shl ecx, 0x20
je 0x43c2cf
movsb byte es:[edi], byte [esi]
fxch st(3)
je 0x40d2e4
fiadd dword [edi + 0x485c26ff]
jmp 0x4070ce

Function at 0x43ee50
Capabilities:
Get file size

Disassembly:
pop ebp
ret
jne 0x42e975
je 0x4280c8
and al, bh
je 0x42e975
invalid
push 8
lea ecx, [ebp - 0x10]
push 0x463a64
push ecx
call fcn.00410e14
add esp, 0xc
test al, al
jb 0x411be8
jne 0x43c0da
je 0x42e9a0
mov dl, byte [ecx - 0x13]
ret 0x86a
push 8
lea edx, [ebp - 8]
push 0
push edx
call fcn.0040c5cf
mov eax, dword [esi]
push 0x100
js 0x43ac98
shr edi, 0x40
jns 0x42e9c3
pop esi
xchg eax, edi
dec ecx
jns 0x43ac98
fiadd dword [ebx - 0x77f4ba76]
fcmovnb st(0), st(0)
loope fcn.0042e9f3
jmp 0x42e9d4
push esi
mov ah, ah
mov bh, bh
mov byte [esi + 0xba], bl
jno 0x4078d8
jo 0x42e9eb
pop esi
sti
sbb al, 0xf
and bh, 0x8e
std
inc dword [edx + 0x24448f4d]
pop dword [esp - 4]
jo 0x4078d8
or byte [ebp - 0x71], 0x44
and al, 0xfc
fidiv dword [edx - 0x3dbbb71]
lea ecx, [ebp - 0x11c]
push eax
shr ax, 0x40
push ecx
call fcn.00438ce6
lea edx, [ebp - 0x11c]
push 0
push edx
call fcn.0043b993
lea eax, [ebp - 0x11c]
jmp 0x43e6b4
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
jb 0x42c59c
xor eax, ebx
jb 0x40840b
sub ecx, edx
shr edi, 0x40
mov ebx, eax
shr ebx, cl
mov ecx, edx
push 0x4074df
ret
push 0
mov bl, bl
jmp 0x43e6b9
push eax
call fcn.00412163
lea ecx, [ebp - 0x11c]
ja 0x404aaa
jbe 0x43e6d2
nop
cpuid
ret 0x860f
jbe 0x404aaa
sbb byte [ebx + 0x8c681], 0
add byte [ecx - 0x2ff6f78b], cl
jb 0x42a8ff
shl ah, 0x20
mov edx, dword [esi - 8]
sub eax, edx
mov edx, eax
ja 0x43ba3f
xchg al, dh
xchg dh, al
jbe 0x43e704
aad 0x80
jne 0x43e714
jbe 0x43ba3f
xchg byte [0xd8ffffd3], dh
cmp al, 0x66
fdivr dword [esi]
add ebp, 0x1f300000
jb 0x43aad1
cmp byte [eax - 0x3d], 0x26
iretd
jmp dword [esi]
add esp, 4
cmp word [ebp + 0xa], ax
je 0x4280be
jne 0x43e822
mov dl, 0x55
xor eax, eax
jb 0x438d13
pop esi
mov esp, ebp
ja 0x4280ba
jbe 0x43e839
cpuid
ret
jbe 0x4280ba
xor al, 0xb8
jne 0x40da36
shr ecx, 0x40
shl edi, 0x20
mov bp, bp
je 0x43e854
mov ch, 0xcc
je 0x40da36
invalid
push ebp
mov ebp, esp
js 0x409626
jns 0x43ee5f
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x409626
fisubr dword [edi - 0x75]
push es
jmp 0x43ee6a
push eax
call fcn.0042a50e
jno 0x43e80e
jo 0x43ee7d
cpuid
test ebx, 0xf98b800f
invalid
jo 0x43e80e
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x43eeaf
Function at 0x441aac
Capabilities:
Check os version
Encode data using base64
Encode data using xor

Disassembly:
pop dword [esp - 4]
jne 0x42210a
shl ax, 0x20
je 0x441abf
ja 0x40b7cb
jbe 0x441acb
Function at 0x442610
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x442634
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x44264e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.00451f30
add esp, 0xc
cmp si, 0xfc
jbe 0x442699
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.0044ed20
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x442747
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4426c9
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4426e5
jmp 0x44280a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.00451f30
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.00451f30
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x442781
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4427a0
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.00451f10
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.0044ed70
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x442970
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x44299c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.00442610
add esp, 0xc
test ax, ax
jne 0x442ae8
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x4429e4
cmp eax, 1
je 0x442a5e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x442a05
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0044ed70
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.0044eed0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x442a1b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x442a46
mov eax, dword [esp + 8]
jmp 0x442acf
mov eax, dword [esp + 0x188]
test eax, eax
je 0x442a7f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0044ed70
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.0044eed0
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x442a95
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x442abd
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.00451f10
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x4432e0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x443347
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x464670]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x464670]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x464670]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x464670]
dec esi
jne 0x4432f3
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x443350
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x443372
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x443470
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x443429
mov ecx, 3
cmp ecx, 1
jne 0x443437
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x443459
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x44344e
mov byte [esi], 0x3d
jmp 0x443459
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x443380
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x443aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x443ad8
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x443ac0
pop esi
pop ebx
ret