joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0bc6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x4e0d59
je 0x4e0d7f
cmp eax, 0xa1
jb 0x4e0dbd
cmp eax, 0xa2
jbe 0x4e0d7f
cmp eax, 0xa3
jbe 0x4e0dbd
cmp eax, 0xa5
jbe 0x4e0d7f
cmp eax, 0xa6
jbe 0x4e0dbd
cmp eax, 0xa8
jbe 0x4e0d7f
cmp eax, 0x100
jne 0x4e0dbd
cmp dword [edi + 0xc0], 0xffffffff
je 0x4e0d7f
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x4e0d7f
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x4e0cae
sub eax, 1
jne 0x4e0d7f
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x4e0c9d
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x5769ac]
mov ecx, edi
call esi
test eax, eax
jne 0x4e0cfa
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x4e0c73
jmp 0x4e0dd7
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x4e0dd7
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x5769ac]
mov ecx, edi
call esi
test eax, eax
jne 0x4e0cfa
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x4e0cc5
jmp 0x4e0dd7
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [0x5769ac]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [0x5769ac]
mov ecx, edi
call esi
mov ecx, eax
call fcn.0041c839
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [0x5769ac]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x4e0dd7
cmp eax, 0x200
jb 0x4e0dbd
cmp eax, 0x202
jbe 0x4e0d7f
cmp eax, 0x203
jbe 0x4e0dbd
cmp eax, 0x205
jbe 0x4e0d7f
add eax, 0xfffffdf9
cmp eax, 1
ja 0x4e0dbd
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x4e0d9e
cmp dword [eax + 0x20], ebx
je 0x4e0d9e
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x4e0dbd
cmp dword [eax + 0x20], ebx
je 0x4e0dbd
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 4], 0x203
jne 0x4e0ddc
lea eax, [edi + 0x2250]
test eax, eax
je 0x4e0dd3
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x4e0ddc
xor eax, eax
inc eax
jmp 0x4e0de4
push esi
mov ecx, edi
call fcn.00472705
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x50bba1
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 8
mov eax, 0x56af84
call fcn.00549e1c
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x50bc87
mov edi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x50bc87
cmp edi, 0x43
je 0x50bbe6
cmp edi, 0x2d
jne 0x50bc87
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x50bc87
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.00416e7d
push eax
lea ecx, [ebp - 0x10]
call fcn.00402080
movzx eax, byte [esi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [esi + 0xe5]
push eax
movzx eax, byte [esi + 0xe4]
push eax
lea eax, [ebp - 0x10]
push 0x596eb0
push eax
call fcn.00402430
mov esi, dword [ebp - 0x10]
add esp, 0x14
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00402620
mov esi, dword [ebp - 0x14]
push ebx
mov ecx, esi
call fcn.0041a8b0
call fcn.00549de5
ret 4
Function at 0x50f831
Capabilities:
Get file system object information

Disassembly:
push 0x6f4
mov eax, 0x5722b6
call fcn.00549e50
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x700], edi
test ecx, ecx
je 0x50f9c8
mov eax, dword [ebp + 0x10]
xor esi, esi
sub eax, esi
je 0x50f99a
sub eax, 1
je 0x50f8b0
sub eax, 1
je 0x50f888
sub eax, 1
je 0x50f8b0
push 0x5aa6e0
mov ecx, edi
call fcn.00404380
mov eax, edi
call fcn.00549dfa
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x50f872
lea eax, [ebp - 0x4e8]
push eax
jmp 0x50f877
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x50f872
push esi
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], esi
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], esi
push eax
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x434], esi
call fcn.004c2ef8
test eax, eax
je 0x50f872
call fcn.00416e7d
push eax
lea ecx, [ebp - 0x700]
call fcn.00402080
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x50f950
test byte [ebp - 0x428], 0x18
jne 0x50f972
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x430]
call dword [0x5769ac]
mov ecx, ebx
call esi
jmp 0x50f972
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x5769ac]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.00403cd0
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.00402620
jmp 0x50f87e
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x50f872
lea eax, [ebp - 0x6f0]
jmp 0x50f8ad
call fcn.004169a5
int3

Function at 0x50fb5b
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00544e81
call fcn.0041ae09
cmp dword [eax + 0x14], 0
jne 0x50fb76
mov ecx, esi
pop esi
jmp fcn.0050ee80
pop esi
ret

Function at 0x51001d
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005590b2
pop ecx
test eax, eax
jne 0x51005f
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00413289
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x510025
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x516ebe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c7fd4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
je 0x516fa1
cmp dword [ebp + 0xc], 0
je 0x516fa1
xor edi, edi
call fcn.0041adb5
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x516fa1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x516fa1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x516fb7
push ebx
call fcn.005523a0
pop ecx
lea edx, [eax + 1]
lea eax, [edx + edx]
mov dword [ebp - 8], edx
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
and eax, ecx
je 0x516f78
cmp eax, 0x400
ja 0x516f5d
call fcn.0054a220
mov esi, esp
test esi, esi
je 0x516f73
mov dword [esi], 0xcccc
jmp 0x516f70
push eax
call fcn.005513e4
mov esi, eax
pop ecx
test esi, esi
je 0x516f73
mov dword [esi], 0xdddd
add esi, 8
mov edx, dword [ebp - 8]
jmp 0x516f7a
mov esi, edi
test esi, esi
je 0x516fb7
push edx
push ebx
push esi
call fcn.00416e66
test eax, eax
je 0x516f96
mov ecx, dword [ebp - 0xc]
push eax
call fcn.00518839
xor edi, edi
inc edi
push esi
call fcn.00518855
pop ecx
mov eax, edi
jmp 0x516fa3
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00549772
leave
ret 8
call fcn.004169a5
int3
Function at 0x5428f9
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401f60
call fcn.0041ae09
cmp dword [eax + 0x14], 0
jne 0x542914
mov ecx, esi
pop esi
jmp fcn.0054216f
pop esi
ret
Function at 0x4092c0
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0xfe83c848
call fcn.0043c72c
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [0xfe801220]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x409324
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x409324
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x409324
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x409324
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x40932a
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.0043c767
ret
Function at 0x415e8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
dec eax
dec eax
je 0x415ef9
call fcn.00415dd7
test al, al
jne 0x415eaa
xor al, al
jmp 0x415f24
lea edi, [esi + 4]
xor ebx, ebx
cmp dword [edi], ebx
jne 0x415ee2
mov eax, dword [esi + 8]
sub eax, ebx
je 0x415ec9
dec eax
jne 0x415ec4
mov eax, 0x8004
jmp 0x415ece
mov eax, dword [ebp + 0xc]
jmp 0x415ece
mov eax, 0x8003
push edi
push ebx
push ebx
push eax
push dword [esi]
call dword [0xfe801028]
test eax, eax
jne 0x415ee2
mov dword [edi], ebx
jmp 0x415ea6
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [0xfe801030]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x415f24
mov ecx, dword [esi]
xor edx, edx
cmp dword [ebp + 0xc], edx
jbe 0x415f20
mov edi, dword [ebp + 8]
movzx eax, byte [edx + edi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 - 0x17bfef0]
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x415f05
mov dword [esi], ecx
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x416426
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor edx, edx
mov dword [0xfe840530], ecx
inc edx
mov ecx, 0xfe840530
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
add ecx, 4
imul eax, eax, 0x6c078965
add eax, edx
mov dword [ecx], eax
inc edx
cmp ecx, 0xfe840eec
jl 0x416434
mov dword [0xfe840510], edx
ret

Function at 0x416458
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0xfe840510]
cmp esi, 0x270
jl 0x41651d
xor esi, esi
push ebx
mov edx, esi
mov ebx, 0x7fffffff
mov ecx, dword [edx*4 - 0x17bfacc]
xor ecx, dword [edx*4 - 0x17bfad0]
and ecx, ebx
xor ecx, dword [edx*4 - 0x17bfad0]
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 - 0x17c0cb0]
xor ecx, dword [edx*4 - 0x17bf49c]
inc edx
mov dword [edx*4 - 0x17bfad4], ecx
cmp edx, 0xe3
jl 0x416475
cmp edx, 0x26f
jge 0x4164ee
push edi
lea edi, [edx*4 - 0x17bfad0]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, ebx
xor ecx, dword [edi]
mov eax, ecx
and eax, 1
shr ecx, 1
mov eax, dword [eax*4 - 0x17c0cb0]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0xfe840eec
jl 0x4164c1
pop edi
mov ecx, dword [0xfe840530]
xor ecx, dword [0xfe840eec]
and ecx, ebx
xor ecx, dword [0xfe840eec]
pop ebx
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 - 0x17c0cb0]
xor ecx, dword [0xfe840b60]
mov dword [0xfe840eec], ecx
mov ecx, dword [esi*4 - 0x17bfad0]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
inc esi
mov eax, ecx
shr eax, 0x12
mov dword [0xfe840510], esi
xor eax, ecx
pop esi
ret
Function at 0x41b462
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push 0x40
mov edi, edx
push ebx
push edi
mov esi, ecx
call dword [0xfe801264]
test eax, eax
je 0x41b4f3
mov ecx, dword [esi + 0x3c]
mov eax, edi
sub eax, esi
add ecx, esi
lea edx, [eax + ebx]
push edx
push eax
push dword [ecx + 0x34]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov edx, esi
mov ecx, esi
mov dword [ebp - 0xc], eax
call fcn.0041e1ee
xor ecx, ecx
mov edx, ecx
test ebx, ebx
je 0x41b4d0
and dword [ebp + 8], 0
movzx eax, cl
mov al, byte [ebp + eax + 0xc]
xor byte [edx + edi], al
inc cl
movzx eax, cl
cmp cl, 4
cmove eax, dword [ebp + 8]
inc edx
mov cl, al
cmp edx, ebx
jb 0x41b4af
push dword [ebp - 8]
mov edx, dword [ebp - 0x10]
push dword [ebp - 0xc]
mov edx, dword [edx + 0x34]
push esi
mov ecx, esi
call fcn.0041e1ee
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [0xfe801264]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41bec9
Capabilities:
Encode data using xor

Disassembly:
push esi
movzx esi, cx
push edi
mov edi, edx
xor eax, eax
xor edx, edx
cmp ax, word [esi*8 - 0x17f9c06]
jae 0x41bf02
mov eax, dword [esi*8 - 0x17f9c04]
movzx ecx, dx
mov al, byte [eax + ecx]
xor al, byte [esi*8 - 0x17f9c08]
xor al, dl
inc edx
mov byte [ecx + edi], al
cmp dx, word [esi*8 - 0x17f9c06]
jb 0x41bede
movzx eax, word [esi*8 - 0x17f9c06]
mov byte [eax + edi], 0
pop edi
pop esi
ret

Function at 0x41bf11
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx esi, cx
push edi
xor eax, eax
xor edi, edi
mov ebx, edx
cmp ax, word [esi*8 - 0x17f9c06]
jae 0x41bf5b
mov eax, dword [esi*8 - 0x17f9c04]
movzx edx, di
movsx cx, byte [eax + edx]
movzx eax, byte [esi*8 - 0x17f9c08]
xor cx, ax
xor cx, di
mov eax, 0xff
and cx, ax
inc edi
mov word [ebx + edx*2], cx
cmp di, word [esi*8 - 0x17f9c06]
jb 0x41bf27
movzx eax, word [esi*8 - 0x17f9c06]
pop edi
xor ecx, ecx
pop esi
mov word [ebx + eax*2], cx
pop ebx
ret

Function at 0x41e008
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, edx
mov edx, dword [ecx + 0x3c]
push esi
push edi
mov edi, dword [edx + ecx + 0x78]
add edi, ecx
xor esi, esi
mov ebx, dword [edi + 0x1c]
add ebx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], ebx
cmp ebp, 0xffff
jbe 0x41e0cd
mov eax, dword [edi + 0x24]
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x20]
add eax, ecx
mov ebx, esi
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], ebx
jbe 0x41e0ef
movzx edx, byte [ebp]
mov dword [esp + 0x24], edx
mov eax, dword [eax + ebx*4]
add eax, ecx
mov dword [esp + 0x14], eax
mov al, byte [eax]
mov byte [esp + 0x13], al
movzx eax, al
sub edx, eax
jne 0x41e09c
mov edi, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
mov esi, ebp
sub esi, edi
test cl, cl
je 0x41e092
inc edi
mov cl, byte [edi]
movzx edx, byte [esi + edi]
movzx eax, cl
sub edx, eax
je 0x41e080
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor esi, esi
test edx, edx
js 0x41e0ac
xor eax, eax
inc eax
test edx, edx
cmovg edx, eax
test edx, edx
je 0x41e0bc
inc ebx
cmp ebx, dword [edi + 0x18]
jae 0x41e0ec
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x41e05e
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
jmp 0x41e0e5
movzx edx, bp
cmp edx, dword [edi + 0x10]
jb 0x41e104
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp edx, eax
ja 0x41e104
sub edx, dword [edi + 0x10]
mov eax, dword [ebx + edx*4]
test eax, eax
je 0x41e104
lea esi, [eax + ecx]
mov edx, dword [ecx + 0x3c]
cmp esi, edi
jb 0x41e100
mov ecx, dword [edx + ecx + 0x7c]
add ecx, edi
xor eax, eax
cmp esi, ecx
cmovb esi, eax
mov eax, esi
jmp 0x41e106
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x41e45b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp + 4], 0
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, edx
mov bl, byte [edi + 0x100]
mov bh, byte [edi + 0x101]
mov eax, ecx
jbe 0x41e4ba
sub eax, ebp
mov dword [esp + 0x14], eax
push esi
inc bl
movzx esi, bl
mov dl, byte [esi + edi]
add bh, dl
movzx ecx, bh
mov al, byte [ecx + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
movzx ecx, byte [esi + edi]
movzx eax, dl
add ecx, eax
and ecx, 0xff
mov al, byte [ecx + edi]
mov ecx, dword [esp + 0x18]
xor al, byte [ecx + ebp]
mov byte [ebp], al
inc ebp
dec dword [esp + 0x14]
jne 0x41e480
pop esi
mov byte [edi + 0x100], bl
mov byte [edi + 0x101], bh
pop edi
pop ebp
pop ebx
ret 8

Function at 0x41e4cc
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x41e4f6
push ebx
mov ebx, dword [esp + 0x14]
sub ecx, edx
mov al, byte [ecx + edx]
xor al, byte [esi + ebx]
inc esi
mov byte [edx], al
xor eax, eax
cmp esi, dword [esp + 0x18]
cmove esi, eax
inc edx
dec edi
jne 0x41e4df
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x41e4fb
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edx
mov dword [esp + 0xc], eax
mov ebp, ecx
mov esi, eax
test edi, edi
je 0x41e5dd
lea eax, [esp + 0x14]
sub ebp, eax
push ebx
push 3
xor bl, bl
lea ecx, [esp + 0x1c]
pop edx
test edi, edi
je 0x41e533
mov al, byte [ecx + ebp]
dec edi
inc bl
mov byte [ecx], al
jmp 0x41e536
mov byte [ecx], 0
inc ecx
dec edx
jne 0x41e525
movzx ecx, byte [esp + 0x18]
movzx edx, byte [esp + 0x19]
mov eax, ecx
shr eax, 2
and ecx, 3
mov bh, byte [eax - 0x17f7400]
shl ecx, 4
mov eax, edx
shr eax, 4
or eax, ecx
mov cl, byte [esp + 0x1a]
mov ch, byte [eax - 0x17f7400]
add ebp, 3
cmp bl, 1
jbe 0x41e584
movzx eax, cl
and edx, 0xf
shl edx, 2
shr eax, 6
or eax, edx
mov dl, byte [eax - 0x17f7400]
jmp 0x41e586
mov dl, 0x3d
cmp bl, 2
jbe 0x41e599
movzx eax, cl
and eax, 0x3f
mov cl, byte [eax - 0x17f7400]
jmp 0x41e59b
mov cl, 0x3d
cmp byte [esp + 0x1c], 0
je 0x41e5c2
movzx eax, bh
mov word [esi], ax
movzx eax, ch
mov word [esi + 2], ax
movzx eax, dl
mov word [esi + 4], ax
movzx eax, cl
mov word [esi + 6], ax
add esi, 8
jmp 0x41e5d0
mov byte [esi], bh
mov byte [esi + 1], ch
mov byte [esi + 2], dl
mov byte [esi + 3], cl
add esi, 4
test edi, edi
jne 0x41e51c
mov eax, dword [esp + 0x10]
pop ebx
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x41e6ca
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
mov byte [edx], al
mov eax, dword [esp + 4]
cmp eax, 1
jbe 0x41e6ed
push esi
lea esi, [edx + 1]
sub ecx, edx
lea edx, [eax - 1]
mov al, byte [ecx + esi]
xor al, byte [esi - 1]
mov byte [esi], al
inc esi
dec edx
jne 0x41e6e0
pop esi
ret 4
Function at 0x41e6f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, dword [esp + 0xc]
cmp ecx, esi
je 0x41e708
push edi
push ecx
push esi
call dword [0xfe8014f4]
add esp, 0xc
lea ecx, [edi - 1]
test ecx, ecx
je 0x41e719
mov al, byte [ecx + esi - 1]
xor byte [ecx + esi], al
dec ecx
jne 0x41e70f
pop edi
pop esi
ret 4

Function at 0x41f335
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push esi
push edi
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x41f358
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x41f34f
cmp edi, 0x6a4abc5b
mov eax, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x41f345
pop edi
pop esi
ret

Function at 0x41fb8c
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, 0x5cc
push edi
mov esi, ecx
push 0xfe806cf8
push esi
call dword [0xfe8014f4]
mov ecx, dword [0xfe83fe84]
add ecx, dword [0xfe83f7dc]
add esp, 0xc
sub ecx, esi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
dec edi
jne 0x41fbb3
pop edi
pop esi
ret

Function at 0x41fc8a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
push edi
mov ebp, 0x114
push ebp
lea eax, [esp + 0x2c]
push 0xfe806af0
push eax
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x30], 0x3d1e671c
call dword [0xfe8014f4]
add esp, 0xc
xor edx, edx
xor ecx, ecx
mov al, byte [esp + ecx + 0x24]
xor byte [esp + edx + 0x28], al
inc ecx
xor eax, eax
cmp ecx, 4
cmove ecx, eax
inc edx
cmp edx, ebp
jb 0x41fcbd
push 1
lea ecx, [esp + 0x18]
call fcn.00415e00
and dword [esp + 0x20], 0
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042cc30
test al, al
je 0x41fd38
lea ecx, [esp + 0x14]
call fcn.0042cc7b
mov esi, eax
test esi, esi
je 0x41fd38
cmp edi, esi
jbe 0x41fd38
sub edi, esi
push edi
push ebx
lea ecx, [esp + 0x1c]
call fcn.00415e8e
test al, al
je 0x41fd38
push ecx
push esi
lea eax, [edi + ebx]
push eax
lea ecx, [esp + 0x20]
call fcn.0042ccba
test al, al
je 0x41fd38
lea ecx, [esp + 0x14]
call fcn.0042cc16
jmp 0x41fd43
lea ecx, [esp + 0x14]
call fcn.0042cc16
xor esi, esi
push ebp
lea eax, [esp + 0x2c]
push 0
push eax
call dword [0xfe8014f8]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
Function at 0x428083
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
mov ebp, ecx
lea ecx, [esp + 0x2c]
push 0x14
sub esi, edi
mov dword [esp + 0x14], ebp
mov edx, edi
sub ecx, edi
pop ebx
mov al, byte [esi + edx]
xor al, byte [edx]
mov byte [ecx + edx], al
inc edx
dec ebx
jne 0x4280a5
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x428113
lea edx, [esp + 0x18]
sub edx, edi
mov dword [esp + 0x14], edx
mov ebx, esi
mov eax, dword [ebp]
add eax, 8
add eax, ebx
sub eax, edi
push 0x14
mov ecx, edi
mov dword [esp + 0x48], eax
pop ebp
mov edi, eax
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
dec ebp
jne 0x4280d9
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x10]
push 0x14
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call dword [0xfe8014fc]
add esp, 0xc
test eax, eax
js 0x428120
mov edx, dword [esp + 0x14]
inc esi
add ebx, 0x38
cmp esi, dword [ebp + 4]
jl 0x4280c4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8
mov eax, esi
jmp 0x428116
Function at 0x42b7ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
push esi
push edi
push 0x10
push ecx
lea eax, [esp + 0x10]
push eax
mov esi, edx
call dword [0xfe8014f4]
xor dword [esp + 0x14], esi
xor word [esp + 0x18], si
shr esi, 0x10
xor word [esp + 0x1a], si
add esp, 0xc
xor edx, edx
xor ecx, ecx
mov al, byte [ebp + ecx + 8]
xor byte [esp + edx + 0x10], al
inc ecx
xor eax, eax
cmp ecx, 4
cmove ecx, eax
inc edx
cmp edx, 8
jb 0x42b835
cmp dword [ebp + 0x10], eax
je 0x42b871
push dword [ebp + 0x10]
and dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
call fcn.0041e798
lea eax, [esp + 8]
push 0x10
push eax
lea ecx, [esp + 0x20]
call fcn.0041e7f8
movzx eax, byte [ebp + 0x14]
sub eax, 0
je 0x42b8a1
dec eax
je 0x42b889
dec eax
jne 0x42b8a1
mov edx, 0xfe808fb0
push 7
jmp 0x42b890
mov edx, 0xfe808fc0
push 6
mov esi, dword [ebp + 0xc]
pop edi
push edi
mov ecx, esi
call fcn.0042a531
lea eax, [esi + edi*2]
jmp 0x42b8a4
mov eax, dword [ebp + 0xc]
push 0x28
push eax
lea eax, [esp + 0x10]
push eax
call dword [0xfe801554]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10