joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449d26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x42ea88], 1
jne 0x449e84
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0045455f
add esp, 0xc
jle 0x449d4e
inc edi
dec edi
je 0x449d5f
pushf
cmp eax, edx
popf
lea ebx, [ebx]
jl 0x449d5c
jne 0x449d5f
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cmp esp, 0x3f47
shr esp, 0
jb 0x449db7
lea esi, [esi + 0x6040]
lea esi, [esi - 0x6040]
jmp 0x449da4
lea edi, [edi + 0x3c86]
lea edi, [edi - 0x3c86]
jge 0x449db2
jae 0x449db7
jmp 0x4dcea465
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0045887a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x449e24
mov eax, dword [ebp + 8]
jmp 0x449f13
jno 0x449e26
jge 0x449e28
test ecx, 0x2793
jbe 0x449e49
pushf
rol eax, 0xe
rol eax, 0x12
popf
lea ebx, [ebx + 0x2365]
lea ebx, [ebx - 0x2365]
ja 0x449e49
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00454369
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0045455f
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x449e7a
mov edx, dword [ebp - 8]
mov dword [0x42ea88], edx
jmp 0x449e82
mov eax, dword [ebp + 8]
jmp 0x449f13
jmp 0x449e8c
mov eax, dword [0x42ea88]
mov dword [ebp - 8], eax
push edx
pop edx
rol esp, 0
jnp 0x449e93
jp 0x449e95
jo 0x449eac
pushf
rol esp, 0
call fcn.00449ea1
Function at 0x449f9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0045455f
add esp, 0xc
shr esi, 0
lea ebx, [ebx]
jnp 0x449fbf
jl 0x449fbc
jp 0x449fbf
call 0x4734e589
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
add esp, 0
push eax
add eax, 0x7dac
ror eax, 0x1b
pop eax
jo 0x44a006
xchg esp, esp
jp 0x44a002
jno 0x44a006
add eax, 0xf04d8adf
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
xchg edx, ecx
xchg edx, ecx
je 0x44a06c
jno 0x44a07e
lea edi, [edi + 0x5b1f]
lea edi, [edi - 0x5b1f]
jo 0x44a07e
lcall 0, 0xe7f7e865
call fcn.0045887a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44a090
xor eax, eax
jmp 0x44a0c1
xchg ebx, ebx
cmp esi, dword [esp]
jb 0x44a09e
jb 0x44a099
lea ebx, [ebx]
jae 0x44a09e
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00454369
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0045455f
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d4b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0045455f
add esp, 0xc
ror ecx, 0x1c
ror ecx, 4
clc
jb 0x44d4fc
pushf
test ebx, esi
call 0x44d4e9
add esp, 4
cld
test dword [esp + 0x10], edx
popf
je 0x44d4f5
lea ebx, [ebx]
jb 0x44d4f9
jae 0x44d4fc
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test eax, edi
add eax, 0
jae 0x44d5d1
pushf
mov esp, esp
not ebx
not ebx
call 0x44d5b9
add esp, 4
popf
jnp 0x44d5c0
lea eax, [eax + 0x4f9f]
lea eax, [eax - 0x4f9f]
jb 0x44d5ce
jb 0x44d5d1
sub eax, 0xb2a4e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.0045887a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d5e3
xor eax, eax
jmp 0x44d662
nop
jnp 0x44d5fa
pushf
cld
test esp, 0x3890
popf
jae 0x44d5f3
mov edi, edi
jno 0x44d5f7
jp 0x44d5fa
lcall 0x458b, 0x52e8558d
clc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00454369
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0045455f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x44d624
xor eax, eax
jmp 0x44d662
jl 0x44d626
lea esi, [esi + 0x705d]
sub esi, 0x705d
je 0x44d63b
xchg ecx, ecx
jl 0x44d638
jne 0x44d63b
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0044001d
add esp, 4
and esp, 0xffffffff
js 0x44d657
jp 0x44d64e
jne 0x44d650
jo 0x44d652
ja 0x44d654
jns 0x44d657
or dword [ebx - 0x74aff3bb], 0xff51084d
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44f81d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0045455f
add esp, 0xc
or esi, esi
jno 0x44f846
pushf
add ecx, 0
popf
mov eax, eax
jo 0x44f846
mov esp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor eax, ecx
xor eax, ecx
shr esp, 0
jle 0x44f887
ja 0x44f881
jg 0x44f883
jg 0x44f887
jmp 0xec9282d2
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0045887a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44f8f9
xor eax, eax
jmp 0x44f976
shr esp, 0
xor ecx, 0x7944
xor ecx, 0x7944
test esi, edx
jae 0x44f913
nop
jo 0x44f90f
jb 0x44f913
mov edi, 0xec458d7d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00454369
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0045455f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x44f93d
xor eax, eax
jmp 0x44f976
jle 0x44f93f
jns 0x44f94a
jnp 0x44f943
xchg ebx, edx
xchg ebx, edx
js 0x44f94a
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0044001d
add esp, 4
ror esi, 0x1c
ror esi, 4
neg edi
neg edi
shl esi, 0
jno 0x44f96f
mov esp, esp
jne 0x44f969
jne 0x44f96b
jo 0x44f96f
mov eax, 0x84d8bc1
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451e86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0045455f
add esp, 0xc
push ebx
add ebx, 0x6923
ror ebx, 9
pop ebx
neg esi
neg esi
jno 0x451eb0
add ebx, 0x28b1
sub ebx, 0x28b1
jae 0x451ed6
pushf
add eax, 0x43be
sub eax, 0x43be
stc
jbe 0x451ecd
popf
jne 0x451ed1
xchg ecx, eax
xchg ecx, eax
jb 0x451ed6
lcall 0x45c6, 0x7aec45c6
call 0xe98ae529
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
je 0x451f10
xchg ebx, ebx
jge 0x451f25
pushf
jp 0x451f18
cld
std
cld
cmp eax, dword [esp]
popf
jge 0x451f22
jl 0x451f25
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
and edx, edx
jge 0x451fa0
jmp 0x451f9c
jl 0x451fa0
mov eax, 0x68d5e85e
add byte [eax], al
call fcn.0045887a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x451fb3
jmp 0x45203b
mov esp, esp
jns 0x451fcd
pushf
jbe 0x451fbb
jmp 0x451fbd
nop
not ebx
not ebx
popf
je 0x451fc6
jmp 0x451fc8
xchg esp, esp
js 0x451fcd
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00454369
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0045455f
add esp, 0xc
ror ecx, 0
add esp, 0
jns 0x452001
pushf
jbe 0x451ff9
popf
nop
jo 0x451ffe
js 0x452001
mov ecx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x452009
jmp 0x45203b
std
cld
neg esi
neg esi
jg 0x452011
jns 0x45201a
jg 0x452015
mov edx, edx
js 0x45201a
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0044001d
add esp, 4
sub esp, 0
lea ebx, [ebx]
jae 0x452034
jno 0x45202f
jp 0x452031
jb 0x452034
ljmp 0x55ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4588cb
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4300c8
call fcn.004554b1
add esp, 0xc
mov byte [0x4300c8], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4036e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x4036f8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x403750
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x403719
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x403741
mov eax, dword [ebp - 4]
and eax, 1
je 0x403737
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x40373f
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x403710
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x66fb58], ecx
jmp 0x4036ef
mov esp, ebp
pop ebp
ret
Function at 0x411a50
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x411a6b
mov edx, dword [esi + 0xf4]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x411a9f
cmp eax, 2
jg 0x411a9f
mov ecx, dword [esi + 0xf0]
push ecx
push 1
lea edx, [eax + eax*2 + 0x5e705c]
push 2
push edx
call fcn.005a789c
mov eax, dword [esi + 0xf0]
push eax
push 1
push edi
push ebx
call fcn.005a789c
add esp, 0x20
xor eax, eax
ret
Function at 0x42d9b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.005aa4e5
add esp, 0x18
test eax, eax
je 0x42d9d3
cmp eax, 0xffffffff
jne 0x42d9d5
xor eax, eax
ret

Function at 0x430d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.005aaa30
mov eax, dword [0x66ad10]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x430da7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.005a57f9
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.005aaad5
add esp, 8
test eax, eax
jl 0x430d90
mov eax, 8
call fcn.005aaa30
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.00430bd0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x430d90
push 0x5ed484
push esi
call fcn.005a90a7
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x430e81
jmp 0x430e04
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x430e12
cmp ebx, 0x400
mov esi, ebx
jl 0x430e17
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.005a7728
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x430e65
fild dword [esp + 0x44]
mov eax, 8
call fcn.005aaa30
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.00430bd0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x430e00
sub ebx, esi
test ebx, ebx
jg 0x430e00
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005a8e3f
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.005c5970
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005a57f9
mov esp, ebp
pop ebp
ret

Function at 0x43cde0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.005a5ed0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x468570
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x468653
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x4685ee
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x6092c8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x6092c8]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6092c8]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x6092c8]
mov byte [ecx], dl
jmp 0x468640
shl edx, 0x10
cmp edi, 2
jne 0x4685ff
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x6092c8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x6092c8]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x46862d
lea edx, [edi + 0x3c]
jmp 0x46863a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x6092c8]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x468590
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x4759e7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.005aaa30
mov eax, dword [0x66ad10]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x475b54
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.0043c600
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.0043c700
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.005c6800
push ebp
call fcn.0043c600
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.0043c700
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.005c6800
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x475a03
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.005a57f9
add esp, 0xa0
ret
Function at 0x487960
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x487979
mov esi, edi
mov edi, eax
jmp 0x48797b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x48798b
mov eax, ebx
jmp 0x487995
push eax
push ebx
call fcn.0043a980
add esp, 8
test eax, eax
jne 0x48799d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4879b9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4879a4
cmp eax, dword [esi + 4]
jge 0x4879d0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4879c0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4879f1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4879ee
dec eax
test eax, eax
jg 0x4879e0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x582a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004ac360
call fcn.004a729f
cmp eax, esi
pop esi
jne 0x582a9c
mov ecx, 0x6742b8
jmp fcn.004be808
ret
Function at 0x5c32e0
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x65e8b0
push 0x5a58a0
mov eax, dword fs:[0]
push eax
add esp, 0xffffff8c
mov eax, dword [0x66ad10]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
cmp dword [ebp + 0xc], 0
jne 0x5c3325
mov dword [ebp - 0x1c], 0x10000
jmp 0x5c3330
mov eax, dword [ebp + 0xc]
add eax, 0x10000
mov dword [ebp - 0x1c], eax
push 0x1c
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.005a5ed0
add esp, 0xc
jmp 0x5c334b
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x5e34cc]
test eax, eax
ja 0x5c3368
jmp 0x5c3473
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1c]
jae 0x5c3378
jmp 0x5c3473
cmp dword [ebp - 0x28], 0x1000
jne 0x5c339a
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
cmp ecx, 1
je 0x5c339a
mov edx, dword [ebp - 0x24]
and edx, 0x100
je 0x5c339c
jmp 0x5c3342
mov dword [ebp - 4], 0
push 0
push 0x40
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x5e34c8]
test eax, eax
jne 0x5c33c9
mov dword [ebp - 4], 0xfffffffe
jmp 0x5c3342
movzx eax, word [ebp - 0x80]
cmp eax, 0x5a4d
jne 0x5c33e2
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x2c]
ja 0x5c33e2
cmp dword [ebp - 0x44], 0x40
jae 0x5c33ee
mov dword [ebp - 4], 0xfffffffe
jmp 0x5c3342
push 0
push 0xf8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x5e34c8]
test eax, eax
jne 0x5c341a
mov dword [ebp - 4], 0xfffffffe
jmp 0x5c3342
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
je 0x5c3431
mov dword [ebp - 4], 0xfffffffe
jmp 0x5c3342
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x84]
jmp 0x5c3475
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.005a57f9
mov esp, ebp
pop ebp
ret 0xc