joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a0d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x471166
call fcn.0046f99c
sub esp, 0x2c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0xa
xor edi, edi
push eax
push edi
mov esi, ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
jne 0x42a129
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0042836c
pop ecx
pop ecx
mov dword [ebp - 4], edi
lea esi, [ebp - 0x1c]
call fcn.00404b2c
push 0x4914a0
mov eax, esi
push eax
call fcn.004535e6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp dword [ebp + 8], edi
jne 0x42a15e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0042836c
pop ecx
pop ecx
mov dword [ebp - 4], 1
jmp 0x42a114
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 8]
lea ecx, [eax + ebx]
push ecx
push eax
push esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0042da16
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42a70c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44bc], 1
jne 0x42a773
or dword [0x4a44bc], 1
mov dword [0x4a3668], 0x42674255
mov dword [0x4a366c], 0x4a674851
mov dword [0x4a3670], 0x5d5c595d
mov dword [0x4a3674], 0x5651674a
mov dword [0x4a3678], 0x5e674c51
mov dword [0x4a367c], 0x105d5451
mov dword [0x4a3680], 0x595e1811
mov dword [0x4a3684], 0x5c5d5451
mov byte [0x4a3688], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3668]
xor cl, 0x38
mov byte [eax + 0x4a3e58], cl
inc eax
cmp eax, 0x21
jb 0x42a775
mov eax, 0x4a3e58
ret

Function at 0x42a790
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44b8], 1
jne 0x42a7f7
or dword [0x4a44b8], 1
mov dword [0x4a368c], 0x42674255
mov dword [0x4a3690], 0x4a674851
mov dword [0x4a3694], 0x5d5c595d
mov dword [0x4a3698], 0x515e674a
mov dword [0x4a369c], 0x4b675d54
mov dword [0x4a36a0], 0x104c594c
mov dword [0x4a36a4], 0x595e1811
mov dword [0x4a36a8], 0x5c5d5451
mov byte [0x4a36ac], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a368c]
xor cl, 0x38
mov byte [eax + 0x4a3e7c], cl
inc eax
cmp eax, 0x21
jb 0x42a7f9
mov eax, 0x4a3e7c
ret

Function at 0x42a814
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44b4], 1
jne 0x42a892
or dword [0x4a44b4], 1
mov dword [0x4a36b0], 0x42674255
mov dword [0x4a36b4], 0x4a674851
mov dword [0x4a36b8], 0x5d5c595d
mov dword [0x4a36bc], 0x405d674a
mov dword [0x4a36c0], 0x5b594a4c
mov dword [0x4a36c4], 0x515e674c
mov dword [0x4a36c8], 0x4c675d54
mov dword [0x4a36cc], 0x5d506757
mov dword [0x4a36d0], 0x11104859
mov dword [0x4a36d4], 0x51595e18
mov dword [0x4a36d8], 0x385c5d54
xor eax, eax
mov cl, byte [eax + 0x4a36b0]
xor cl, 0x38
mov byte [eax + 0x4a3ea0], cl
inc eax
cmp eax, 0x2c
jb 0x42a894
mov eax, 0x4a3ea0
ret
Function at 0x42a9d3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44a8], 1
jne 0x42aa11
or dword [0x4a44a8], 1
mov dword [0x4a3720], 0x576f4b71
mov dword [0x4a3724], 0x680c0e4f
mov dword [0x4a3728], 0x5d5b574a
mov word [0x4a372c], 0x4b4b
mov byte [0x4a372e], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3720]
xor cl, 0x38
mov byte [eax + 0x4a3f10], cl
inc eax
cmp eax, 0xf
jb 0x42aa13
mov eax, 0x4a3f10
ret

Function at 0x42aa2e
Capabilities:
Get token membership

Disassembly:
mov eax, 0x47114c
call fcn.0046f99c
sub esp, 0x98
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
pop esi
push esi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x10], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x42aab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0042ab29
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00404b2c
push 0x4914a0
mov eax, esi
push eax
call fcn.004535e6
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x18]
test eax, eax
jne 0x42ab0d
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0042836c
pop ecx
pop ecx
push eax
mov dword [ebp - 4], esi
call fcn.0042abaf
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00405a43
add esp, 0xc
lea esi, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00404b2c
push 0x4914a0
mov eax, esi
jmp 0x42aaac
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0x1c], ebx
pop esi
setne al
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42ab29
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44a4], 1
jne 0x42ab92
or dword [0x4a44a4], 1
mov dword [0x4a3730], 0x57545479
mov dword [0x4a3734], 0x5d4c595b
mov dword [0x4a3738], 0x715c5679
mov dword [0x4a373c], 0x514c5156
mov dword [0x4a3740], 0x42515459
mov dword [0x4a3744], 0x5c516b5d
mov dword [0x4a3748], 0x51595e18
mov dword [0x4a374c], 0x25c5d54
mov word [0x4a3750], 0x3818
xor eax, eax
mov cl, byte [eax + 0x4a3730]
xor cl, 0x38
mov byte [eax + 0x4a3f20], cl
inc eax
cmp eax, 0x22
jb 0x42ab94
mov eax, 0x4a3f20
ret

Function at 0x42abaf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44a0], 1
jne 0x42ac0e
or dword [0x4a44a0], 1
mov dword [0x4a3754], 0x5b5d507b
mov dword [0x4a3758], 0x53576c53
mov dword [0x4a375c], 0x5d75565d
mov dword [0x4a3760], 0x4a5d5a55
mov dword [0x4a3764], 0x4851504b
mov dword [0x4a3768], 0x51595e18
mov dword [0x4a376c], 0x25c5d54
mov word [0x4a3770], 0x3818
xor eax, eax
mov cl, byte [eax + 0x4a3754]
xor cl, 0x38
mov byte [eax + 0x4a3f44], cl
inc eax
cmp eax, 0x1e
jb 0x42ac10
mov eax, 0x4a3f44
ret
Function at 0x42ac2b
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
xor ebx, ebx
mov esi, 0x114
push esi
lea eax, [ebp - 0x170]
push ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
call fcn.0044cca0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push 0x1a
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x10], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x42ad27
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
call edi
test eax, eax
je 0x42ad26
cmp dword [ebp - 0xc], ebx
jne 0x42ad26
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ad26
cmp dword [ebp - 0x16c], 6
jb 0x42ad26
lea eax, [ebp - 4]
push eax
push 1
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42acfc
call esi
cmp eax, 0x3f0
jne 0x42ad26
lea eax, [ebp - 4]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42ad26
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x13
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x42ad19
call esi
jmp 0x42ad26
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 8]
call edi
pop edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
je 0x42ad37
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], ebx
je 0x42ad41
push dword [ebp - 8]
call esi
xor eax, eax
cmp dword [ebp - 0xc], ebx
pop esi
setne al
pop ebx
leave
ret

Function at 0x42ae74
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4494], 1
jne 0x42aef9
or dword [0x4a4494], 1
mov dword [0x4a3788], 0x5656597b
mov dword [0x4a378c], 0x49184c57
mov dword [0x4a3790], 0x414a5d4d
mov dword [0x4a3794], 0xe185918
mov dword [0x4a3798], 0x515a180c
mov dword [0x4a379c], 0x514e184c
mov dword [0x4a37a0], 0x57184f5d
mov dword [0x4a37a4], 0xa0b1856
mov dword [0x4a37a8], 0x4c515a18
mov dword [0x4a37ac], 0x56514f18
mov dword [0x4a37b0], 0x4b4f575c
mov byte [0x4a37b4], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3788]
xor cl, 0x38
mov byte [eax + 0x4a3f78], cl
inc eax
cmp eax, 0x2d
jb 0x42aefb
mov eax, 0x4a3f78
ret

Function at 0x42b6bd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4468], 1
jne 0x42b712
or dword [0x4a4468], 1
mov dword [0x4a38f0], 0x7b5f5d6a
mov dword [0x4a38f4], 0x4c595d4a
mov dword [0x4a38f8], 0x415d735d
mov dword [0x4a38fc], 0x1110407d
mov dword [0x4a3900], 0x51595e18
mov dword [0x4a3904], 0x25c5d54
mov word [0x4a3908], 0x3818
xor eax, eax
mov cl, byte [eax + 0x4a38f0]
xor cl, 0x38
mov byte [eax + 0x4a4090], cl
inc eax
cmp eax, 0x1a
jb 0x42b714
mov eax, 0x4a4090
ret
Function at 0x42b877
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4460], 1
jne 0x42b8c3
or dword [0x4a4460], 1
mov dword [0x4a392c], 0x7d5f5d6a
mov dword [0x4a3930], 0x73554d56
mov dword [0x4a3934], 0x407d415d
mov dword [0x4a3938], 0x5e181110
mov dword [0x4a393c], 0x5d545159
mov dword [0x4a3940], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a392c]
xor cl, 0x38
mov byte [eax + 0x4a40cc], cl
inc eax
cmp eax, 0x18
jb 0x42b8c5
mov eax, 0x4a40cc
ret

Function at 0x42ba7a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4458], 1
jne 0x42bac6
or dword [0x4a4458], 1
mov dword [0x4a3954], 0x775f5d6a
mov dword [0x4a3958], 0x73565d48
mov dword [0x4a395c], 0x407d415d
mov dword [0x4a3960], 0x5e181110
mov dword [0x4a3964], 0x5d545159
mov dword [0x4a3968], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a3954]
xor cl, 0x38
mov byte [eax + 0x4a40f4], cl
inc eax
cmp eax, 0x18
jb 0x42bac8
mov eax, 0x4a40f4
ret

Function at 0x42bae3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4454], 1
jne 0x42bb3f
or dword [0x4a4454], 1
mov dword [0x4a396c], 0x695f5d6a
mov dword [0x4a3970], 0x414a5d4d
mov dword [0x4a3974], 0x575e5671
mov dword [0x4a3978], 0x10415d73
mov dword [0x4a397c], 0x595e1811
mov dword [0x4a3980], 0x5c5d5451
mov word [0x4a3984], 0x1802
mov byte [0x4a3986], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a396c]
xor cl, 0x38
mov byte [eax + 0x4a410c], cl
inc eax
cmp eax, 0x1b
jb 0x42bb41
mov eax, 0x4a410c
ret

Function at 0x42bcb0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a444c], 1
jne 0x42bd0c
or dword [0x4a444c], 1
mov dword [0x4a39a8], 0x695f5d6a
mov dword [0x4a39ac], 0x414a5d4d
mov dword [0x4a39b0], 0x575e5671
mov dword [0x4a39b4], 0x10415d73
mov dword [0x4a39b8], 0x595e1811
mov dword [0x4a39bc], 0x5c5d5451
mov word [0x4a39c0], 0x1802
mov byte [0x4a39c2], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a39a8]
xor cl, 0x38
mov byte [eax + 0x4a4148], cl
inc eax
cmp eax, 0x1b
jb 0x42bd0e
mov eax, 0x4a4148
ret

Function at 0x42bec0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4444], 1
jne 0x42bf0c
or dword [0x4a4444], 1
mov dword [0x4a39d4], 0x775f5d6a
mov dword [0x4a39d8], 0x73565d48
mov dword [0x4a39dc], 0x407d415d
mov dword [0x4a39e0], 0x5e181110
mov dword [0x4a39e4], 0x5d545159
mov dword [0x4a39e8], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a39d4]
xor cl, 0x38
mov byte [eax + 0x4a4174], cl
inc eax
cmp eax, 0x18
jb 0x42bf0e
mov eax, 0x4a4174
ret

Function at 0x42bf29
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4440], 1
jne 0x42bf85
or dword [0x4a4440], 1
mov dword [0x4a39ec], 0x695f5d6a
mov dword [0x4a39f0], 0x414a5d4d
mov dword [0x4a39f4], 0x575e5671
mov dword [0x4a39f8], 0x10415d73
mov dword [0x4a39fc], 0x595e1811
mov dword [0x4a3a00], 0x5c5d5451
mov word [0x4a3a04], 0x1802
mov byte [0x4a3a06], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a39ec]
xor cl, 0x38
mov byte [eax + 0x4a418c], cl
inc eax
cmp eax, 0x1b
jb 0x42bf87
mov eax, 0x4a418c
ret
Function at 0x42c34b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4434], 1
jne 0x42c397
or dword [0x4a4434], 1
mov dword [0x4a3a30], 0x775f5d6a
mov dword [0x4a3a34], 0x73565d48
mov dword [0x4a3a38], 0x407d415d
mov dword [0x4a3a3c], 0x5e181110
mov dword [0x4a3a40], 0x5d545159
mov dword [0x4a3a44], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a3a30]
xor cl, 0x38
mov byte [eax + 0x4a41d0], cl
inc eax
cmp eax, 0x18
jb 0x42c399
mov eax, 0x4a41d0
ret

Function at 0x42c3b4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4430], 1
jne 0x42c410
or dword [0x4a4430], 1
mov dword [0x4a3a48], 0x695f5d6a
mov dword [0x4a3a4c], 0x414a5d4d
mov dword [0x4a3a50], 0x4d54596e
mov dword [0x4a3a54], 0x10407d5d
mov dword [0x4a3a58], 0x595e1811
mov dword [0x4a3a5c], 0x5c5d5451
mov word [0x4a3a60], 0x1802
mov byte [0x4a3a62], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3a48]
xor cl, 0x38
mov byte [eax + 0x4a41e8], cl
inc eax
cmp eax, 0x1b
jb 0x42c412
mov eax, 0x4a41e8
ret

Function at 0x42c42d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a442c], 1
jne 0x42c489
or dword [0x4a442c], 1
mov dword [0x4a3a64], 0x695f5d6a
mov dword [0x4a3a68], 0x414a5d4d
mov dword [0x4a3a6c], 0x4d54596e
mov dword [0x4a3a70], 0x10407d5d
mov dword [0x4a3a74], 0x595e1811
mov dword [0x4a3a78], 0x5c5d5451
mov word [0x4a3a7c], 0x1802
mov byte [0x4a3a7e], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3a64]
xor cl, 0x38
mov byte [eax + 0x4a4204], cl
inc eax
cmp eax, 0x1b
jb 0x42c48b
mov eax, 0x4a4204
ret

Function at 0x42c605
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4428], 1
jne 0x42c651
or dword [0x4a4428], 1
mov dword [0x4a3a80], 0x775f5d6a
mov dword [0x4a3a84], 0x73565d48
mov dword [0x4a3a88], 0x407d415d
mov dword [0x4a3a8c], 0x5e181110
mov dword [0x4a3a90], 0x5d545159
mov dword [0x4a3a94], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a3a80]
xor cl, 0x38
mov byte [eax + 0x4a4220], cl
inc eax
cmp eax, 0x18
jb 0x42c653
mov eax, 0x4a4220
ret

Function at 0x42c66e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4424], 1
jne 0x42c6d4
or dword [0x4a4424], 1
mov dword [0x4a3a98], 0x6b5f5d6a
mov dword [0x4a3a9c], 0x596e4c5d
mov dword [0x4a3aa0], 0x7d5d4d54
mov dword [0x4a3aa4], 0x4c4b1040
mov dword [0x4a3aa8], 0x5f56514a
mov dword [0x4a3aac], 0x595e1811
mov dword [0x4a3ab0], 0x5c5d5451
mov word [0x4a3ab4], 0x1802
mov byte [0x4a3ab6], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3a98]
xor cl, 0x38
mov byte [eax + 0x4a4238], cl
inc eax
cmp eax, 0x1f
jb 0x42c6d6
mov eax, 0x4a4238
ret

Function at 0x42c840
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4420], 1
jne 0x42c88c
or dword [0x4a4420], 1
mov dword [0x4a3ab8], 0x775f5d6a
mov dword [0x4a3abc], 0x73565d48
mov dword [0x4a3ac0], 0x407d415d
mov dword [0x4a3ac4], 0x5e181110
mov dword [0x4a3ac8], 0x5d545159
mov dword [0x4a3acc], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a3ab8]
xor cl, 0x38
mov byte [eax + 0x4a4258], cl
inc eax
cmp eax, 0x18
jb 0x42c88e
mov eax, 0x4a4258
ret
Function at 0x42c8a9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a441c], 1
jne 0x42c908
or dword [0x4a441c], 1
mov dword [0x4a3ad0], 0x6b5f5d6a
mov dword [0x4a3ad4], 0x596e4c5d
mov dword [0x4a3ad8], 0x7d5d4d54
mov dword [0x4a3adc], 0x4f5c1040
mov dword [0x4a3ae0], 0x115c4a57
mov dword [0x4a3ae4], 0x51595e18
mov dword [0x4a3ae8], 0x25c5d54
mov word [0x4a3aec], 0x3818
xor eax, eax
mov cl, byte [eax + 0x4a3ad0]
xor cl, 0x38
mov byte [eax + 0x4a4270], cl
inc eax
cmp eax, 0x1e
jb 0x42c90a
mov eax, 0x4a4270
ret

Function at 0x42cb0c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4414], 1
jne 0x42cb58
or dword [0x4a4414], 1
mov dword [0x4a3b18], 0x775f5d6a
mov dword [0x4a3b1c], 0x73565d48
mov dword [0x4a3b20], 0x407d415d
mov dword [0x4a3b24], 0x5e181110
mov dword [0x4a3b28], 0x5d545159
mov dword [0x4a3b2c], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a3b18]
xor cl, 0x38
mov byte [eax + 0x4a42b8], cl
inc eax
cmp eax, 0x18
jb 0x42cb5a
mov eax, 0x4a42b8
ret

Function at 0x42cb75
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4410], 1
jne 0x42cbc7
or dword [0x4a4410], 1
mov dword [0x4a3b30], 0x5d7c706b
mov dword [0x4a3b34], 0x5d4c5d54
mov dword [0x4a3b38], 0x10415d73
mov dword [0x4a3b3c], 0x595e1811
mov dword [0x4a3b40], 0x5c5d5451
mov word [0x4a3b44], 0x1802
mov byte [0x4a3b46], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3b30]
xor cl, 0x38
mov byte [eax + 0x4a42d0], cl
inc eax
cmp eax, 0x17
jb 0x42cbc9
mov eax, 0x4a42d0
ret

Function at 0x42cd16
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a440c], 1
jne 0x42cd62
or dword [0x4a440c], 1
mov dword [0x4a3b48], 0x775f5d6a
mov dword [0x4a3b4c], 0x73565d48
mov dword [0x4a3b50], 0x407d415d
mov dword [0x4a3b54], 0x5e181110
mov dword [0x4a3b58], 0x5d545159
mov dword [0x4a3b5c], 0x3818025c
xor eax, eax
mov cl, byte [eax + 0x4a3b48]
xor cl, 0x38
mov byte [eax + 0x4a42e8], cl
inc eax
cmp eax, 0x18
jb 0x42cd64
mov eax, 0x4a42e8
ret

Function at 0x42cd7f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4408], 1
jne 0x42cdd2
or dword [0x4a4408], 1
mov dword [0x4a3b60], 0x5d7c706b
mov dword [0x4a3b64], 0x5d4c5d54
mov dword [0x4a3b68], 0x4d54596e
mov dword [0x4a3b6c], 0x1811105d
mov dword [0x4a3b70], 0x5451595e
mov dword [0x4a3b74], 0x18025c5d
mov byte [0x4a3b78], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3b60]
xor cl, 0x38
mov byte [eax + 0x4a4300], cl
inc eax
cmp eax, 0x19
jb 0x42cdd4
mov eax, 0x4a4300
ret
Function at 0x42d1ac
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0x42d1d6
mov dword [esi], eax
xor al, al
jmp 0x42d2ae
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0x49e9cc]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0x42d252
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0x42d200
cmp edx, dword [ebp + 8]
jae 0x42d2a1
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0x42d266
movzx edi, byte [edi + 1]
jmp 0x42d268
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0x42d295
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0x42d297
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42dc89
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x47006a
call fcn.0046f99c
and dword [ebp - 4], 0
test byte [0x4a4400], 1
jne 0x42dcbb
or dword [0x4a4400], 1
mov dword [0x4a4364], 0x5c5c5c55
mov dword [0x4a4368], 0x3a4e5653
xor eax, eax
mov cl, byte [eax + 0x4a4364]
xor cl, 0x3a
mov byte [eax + 0x4a43a8], cl
inc eax
cmp eax, 8
jb 0x42dcbd
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4a43a8
call esi
mov ebx, eax
test ebx, ebx
jne 0x42dcfa
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
call fcn.00417432
xor eax, eax
jmp 0x42dda8
push edi
call fcn.0042ddb6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ebx
call edi
test eax, eax
je 0x42dd76
call fcn.0042de14
push eax
push ebx
call edi
test eax, eax
jne 0x42dd76
call fcn.0042de5e
push eax
call esi
test eax, eax
jne 0x42dd76
test byte [0x4a43f0], 1
jne 0x42dd48
or dword [0x4a43f0], 1
mov dword [0x4a4394], 0x524e5f54
mov byte [0x4a4398], 0x3a
xor eax, eax
mov cl, byte [eax + 0x4a4394]
xor cl, 0x3a
mov byte [eax + 0x4a43d8], cl
inc eax
cmp eax, 5
jb 0x42dd4a
push 0x4a43d8
call esi
test eax, eax
je 0x42dd76
call fcn.0042de9f
push eax
call esi
test eax, eax
je 0x42dd86
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
call fcn.00417432
xor eax, eax
jmp 0x42dda7
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x42dd92
call fcn.004493ae
mov eax, dword [ecx]
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.00417432
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42ddb6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a43fc], 1
jne 0x42ddf7
or dword [0x4a43fc], 1
mov dword [0x4a436c], 0x7d56567e
mov dword [0x4a4370], 0x56794e5f
mov dword [0x4a4374], 0x7549495b
mov dword [0x4a4378], 0x595f5058
mov word [0x4a437c], 0x3a4e
xor eax, eax
mov cl, byte [eax + 0x4a436c]
xor cl, 0x3a
mov byte [eax + 0x4a43b0], cl
inc eax
cmp eax, 0x12
jb 0x42ddf9
mov eax, 0x4a43b0
ret

Function at 0x42de14
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a43f8], 1
jne 0x42de41
or dword [0x4a43f8], 1
mov dword [0x4a4380], 0x73485b6c
mov dword [0x4a4384], 0x94e5354
mov word [0x4a4388], 0x3a08
xor eax, eax
mov cl, byte [eax + 0x4a4380]
xor cl, 0x3a
mov byte [eax + 0x4a43c4], cl
inc eax
cmp eax, 0xa
jb 0x42de43
mov eax, 0x4a43c4
ret

Function at 0x42de5e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a43f4], 1
jne 0x42de82
or dword [0x4a43f4], 1
mov dword [0x4a438c], 0x575f5e53
mov dword [0x4a4390], 0x3a594c49
xor eax, eax
mov cl, byte [eax + 0x4a438c]
xor cl, 0x3a
mov byte [eax + 0x4a43d0], cl
inc eax
cmp eax, 8
jb 0x42de84
mov eax, 0x4a43d0
ret

Function at 0x42de9f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a43ec], 1
jne 0x42deca
or dword [0x4a43ec], 1
mov dword [0x4a439c], 0x49485f4c
mov dword [0x4a43a0], 0x8095652
mov byte [0x4a43a4], 0x3a
xor eax, eax
mov cl, byte [eax + 0x4a439c]
xor cl, 0x3a
mov byte [eax + 0x4a43e0], cl
inc eax
cmp eax, 9
jb 0x42decc
mov eax, 0x4a43e0
ret