joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474410
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov ebx, 0x4f7978
mov esi, dword [esp]
mov esi, dword [esi]
mov edi, dword [esp + 4]
mov edi, dword [edi]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dx, 4
mov eax, edi
call fcn.00474244
mov edx, dword [esp + 0x10]
shl edx, 2
mov ecx, dword [esp + 0xc]
xor eax, dword [ecx + edx*4]
mov edx, eax
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x600]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x400]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor esi, dword [ebx + eax*4]
mov eax, dword [esp + 0x10]
shl eax, 2
mov edx, dword [esp + 0xc]
mov eax, dword [edx + eax*4 + 4]
xor eax, edi
mov edx, eax
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x700]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x500]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor esi, dword [ebx + eax*4 + 0x100]
mov dx, 4
mov eax, esi
call fcn.00474244
mov edx, dword [esp + 0x10]
shl edx, 2
mov ecx, dword [esp + 0xc]
xor eax, dword [ecx + edx*4 + 8]
mov edx, eax
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x600]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x400]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edi, dword [ebx + eax*4]
mov eax, dword [esp + 0x10]
shl eax, 2
mov edx, dword [esp + 0xc]
mov eax, dword [edx + eax*4 + 0xc]
xor eax, esi
mov edx, eax
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x700]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x500]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edi, dword [ebx + eax*4 + 0x100]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jne 0x47443f
mov eax, dword [esp]
mov dword [eax], esi
mov eax, dword [esp + 4]
mov dword [eax], edi
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x47458c
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, 0x4f7978
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
mov eax, dword [esp]
call fcn.00474290
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
call fcn.004742d0
xor ebx, ebx
mov dx, 4
mov eax, dword [esp + 0x10]
call fcn.00474244
movzx edx, bx
mov edi, edx
shl edi, 2
mov edx, dword [esp + 8]
xor eax, dword [edx + edi*4]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x600]
xor edx, dword [esp + 0xc]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x400]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 8]
mov eax, dword [eax + edi*4 + 4]
xor eax, dword [esp + 0x10]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x700]
xor edx, dword [esp + 0xc]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x500]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4 + 0x100]
mov dword [esp + 0xc], edx
mov dx, 4
mov eax, dword [esp + 0xc]
call fcn.00474244
mov edx, dword [esp + 8]
xor eax, dword [edx + edi*4 + 8]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x600]
xor edx, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x400]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 8]
mov eax, dword [eax + edi*4 + 0xc]
xor eax, dword [esp + 0xc]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x700]
xor edx, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x500]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4 + 0x100]
mov dword [esp + 0x10], edx
inc ebx
cmp bx, 8
jne 0x4745c1
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
call fcn.00474370
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
call fcn.004742b0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x474764
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x474789
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x4748d2
mov eax, dword [ebx + 0x610]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x4747b5
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x4748d2
test eax, eax
jbe 0x474857
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4747e7
lea edx, [ebx + eax + 0x608]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c84
add dword [ebx + 0x610], edi
xor edi, edi
jmp 0x474857
lea edx, [ebx + eax + 0x608]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402c84
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x608]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x60c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x608]
call fcn.00474730
lea eax, [ebx + 0x600]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x604]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x600], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x604], eax
xor eax, eax
mov dword [ebx + 0x610], eax
cmp edi, 8
jb 0x4748ae
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00474730
lea eax, [ebx + 0x600]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x604]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x600], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x604], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x47485c
test edi, edi
jbe 0x4748c8
lea edx, [ebx + 0x608]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c84
mov dword [ebx + 0x610], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x474b1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x474b3d
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x474c83
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x474b69
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x474c83
test eax, eax
jbe 0x474c0a
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x474b9a
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.00402c84
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x474c0a
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.00402c84
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x1208]
mov eax, dword [eax]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x120c]
mov eax, dword [eax]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004749d4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x474c60
mov eax, dword [esi]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004749d4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x474c0f
test edi, edi
jbe 0x474c79
lea edx, [ebx + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.00402c84
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x474c8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x474cb1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x474dfa
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x474cdd
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x474dfa
test eax, eax
jbe 0x474d7f
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x474d0f
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c84
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x474d7f
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402c84
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x1208]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x120c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x1208]
call fcn.00474a4c
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x474dd6
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00474a4c
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x474d84
test edi, edi
jbe 0x474df0
lea edx, [ebx + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c84
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4750b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov cx, word [ecx]
movzx edi, cx
shr edi, 8
shl ecx, 8
or di, cx
lea ecx, [eax + 2]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov cx, word [ecx]
movzx esi, cx
shr esi, 8
shl ecx, 8
or si, cx
lea ecx, [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov cx, word [ecx]
movzx ebx, cx
shr ebx, 8
shl ecx, 8
or bx, cx
add eax, 6
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ax, word [eax]
movzx ebp, ax
shr ebp, 8
shl eax, 8
or bp, ax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 8
mov eax, dword [esp + 0xc]
mov dx, word [eax]
mov eax, edi
call fcn.00474e3c
mov edi, eax
mov eax, dword [esp + 0xc]
add si, word [eax + 2]
mov eax, dword [esp + 0xc]
add bx, word [eax + 4]
mov eax, dword [esp + 0xc]
mov dx, word [eax + 6]
mov eax, ebp
call fcn.00474e3c
mov ebp, eax
mov word [esp + 0xa], bx
mov eax, dword [esp + 0xc]
mov dx, word [eax + 8]
mov eax, edi
xor ax, bx
call fcn.00474e3c
mov ebx, eax
mov word [esp + 8], si
mov eax, dword [esp + 0xc]
mov dx, word [eax + 0xa]
mov eax, ebp
xor ax, si
add ax, bx
call fcn.00474e3c
mov esi, eax
add bx, si
xor di, si
xor bp, bx
xor si, word [esp + 0xa]
xor bx, word [esp + 8]
add dword [esp + 0xc], 0xc
dec dword [esp + 4]
jne 0x47512f
mov eax, dword [esp + 0xc]
mov dx, word [eax]
mov eax, edi
call fcn.00474e3c
mov edi, eax
mov eax, dword [esp + 0xc]
add bx, word [eax + 2]
mov eax, dword [esp + 0xc]
add si, word [eax + 4]
mov eax, dword [esp + 0xc]
mov dx, word [eax + 6]
mov eax, ebp
call fcn.00474e3c
mov ebp, eax
movzx eax, di
shr eax, 8
shl edi, 8
or ax, di
mov edx, dword [esp]
mov word [edx], ax
movzx eax, bx
shr eax, 8
shl ebx, 8
or ax, bx
mov edx, dword [esp]
add edx, 2
mov word [edx], ax
movzx eax, si
shr eax, 8
shl esi, 8
or ax, si
mov edx, dword [esp]
add edx, 4
mov word [edx], ax
movzx eax, bp
shr eax, 8
shl ebp, 8
or ax, bp
mov edx, dword [esp]
add edx, 6
mov word [edx], ax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4774ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
call fcn.004054f0
cmp eax, 0x10
je 0x477515
mov ecx, 0x4775ac
mov dl, 1
mov eax, dword [0x407830]
call fcn.0040bfe0
call fcn.00403cfc
xor ebx, ebx
lea eax, [esi + 0x40]
xor edx, edx
mov dl, bl
add edx, edx
movzx edx, byte [edi + edx + 1]
shl edx, 8
xor ecx, ecx
mov cl, bl
add ecx, ecx
movzx ecx, byte [edi + ecx]
or edx, ecx
mov dword [eax], edx
inc ebx
add eax, 4
cmp bl, 8
jne 0x47751a
mov byte [esi + 0x60], 0
mov eax, esi
call fcn.0047743c
mov bl, 4
mov eax, esi
call fcn.00476be4
mov eax, esi
call fcn.00476cec
dec bl
jne 0x47754c
xor ebx, ebx
lea eax, [esi + 0x20]
xor edx, edx
mov dl, bl
add edx, 4
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ebx
add eax, 4
cmp bl, 8
jne 0x477563
mov bl, 8
mov eax, esi
mov edx, dword [eax]
mov dword [eax + 0x61], edx
mov edx, dword [eax + 0x20]
mov dword [eax + 0x81], edx
add eax, 4
dec bl
jne 0x47757f
mov al, byte [esi + 0x60]
mov byte [esi + 0xc1], al
pop edi
pop esi
pop ebx
ret
Function at 0x487784
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffffa0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00460344
mov bx, 0x19
lea esi, [esp + 8]
mov eax, pe_nt_image_headers32
call fcn.00460420
mov byte [esi], al
inc esi
dec bx
jne 0x48779d
lea ecx, [esp + 0x35]
lea eax, [esp + 8]
mov edx, 0x19
call fcn.0045c734
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov al, byte [eax + 0x18]
inc eax
mov byte [esp + 0x20], al
lea ecx, [esp + 0x49]
lea eax, [esp + 8]
mov edx, 0x19
call fcn.0045c734
xor ebx, ebx
lea eax, [esp + 0x21]
movzx edx, bx
lea ecx, [esp + 0x35]
mov cl, byte [ecx + edx]
lea esi, [esp + 0x49]
xor cl, byte [esi + edx]
mov byte [eax], cl
inc ebx
inc eax
cmp bx, 0x14
jne 0x4877e7
or byte [esp + 0x21], 0x80
or byte [esp + 0x34], 1
lea edx, [esp + 0x21]
mov eax, dword [esp]
mov ecx, 0x14
call fcn.0045da90
mov edx, dword [esp + 4]
mov edx, dword [edx]
lea eax, [esp + 8]
mov ecx, 0x19
call fcn.00402c84
add esp, 0x60
pop esi
pop ebx
ret
Function at 0x4ad5ac
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x4ad5b5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4adb07
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0xc], 0
sete byte [ebp - 0x4d]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0045de48
mov eax, dword [ebp - 0x14]
call fcn.0040464c
test eax, eax
jne 0x4ad607
mov dword [ebp - 0x10], 0x1f0b
jmp 0x4adadf
mov dl, 1
mov eax, dword [0x459f78]
call fcn.0045a948
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x4ad891
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x38]
mov byte [eax + 4], 0x30
mov dl, 1
mov eax, dword [ebp - 0x38]
call fcn.0045b008
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.0045b0ac
mov esi, eax
mov byte [esi + 4], 0x30
xor edx, edx
mov eax, esi
call fcn.0045b008
mov edx, eax
mov eax, esi
call fcn.0045b0ac
mov ebx, eax
mov byte [ebx + 4], 6
mov edx, dword [0x4f9ad0]
mov eax, ebx
call fcn.0045a35c
mov dl, 1
mov eax, esi
call fcn.0045b008
mov edx, eax
mov eax, esi
call fcn.0045b0ac
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov byte [eax + 4], 0xa0
mov dl, 1
mov eax, esi
call fcn.0045b008
mov edx, eax
mov eax, esi
call fcn.0045b0ac
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x4998b8]
call fcn.00499918
mov dword [ebp - 0x4c], eax
xor eax, eax
push ebp
push 0x4ad778
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.00499a20
mov ecx, 0x4adb24
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.004999cc
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.004999f4
push eax
push 0x4adb38
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x30]
mov edx, ebx
shr edx, 0x18
and edx, 0xff
call fcn.00404574
push dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
mov edx, ebx
shr edx, 0x10
and edx, 0xff
call fcn.00404574
push dword [ebp - 0x5c]
lea eax, [ebp - 0x60]
mov edx, ebx
shr edx, 8
and edx, 0xff
call fcn.00404574
push dword [ebp - 0x60]
lea eax, [ebp - 0x64]
mov edx, ebx
and edx, 0xff
call fcn.00404574
push dword [ebp - 0x64]
lea eax, [ebp - 0x54]
mov edx, 5
call fcn.0040470c
mov edx, dword [ebp - 0x54]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov cl, 0x31
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
call fcn.00499ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad77f
mov eax, dword [ebp - 0x4c]
call fcn.0040355c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adb0e
lea eax, [ebp - 0x68]
mov edx, 6
call fcn.004043b0
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.004043b0
ret
Function at 0x4bc23c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bc2c1
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4bc273
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
mov eax, esi
call fcn.00416654
sub ebx, eax
push ebx
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4bc210]
call fcn.004056cc
add esp, 4
mov edx, dword [ebp - 8]
mov ecx, ebx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
mov edx, dword [ebp - 8]
mov ecx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc2c8
lea eax, [ebp - 8]
mov edx, dword [0x4bc210]
call fcn.004057d8
ret

Function at 0x4df2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4df3df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040464c
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
fdiv dword [0x4df3f0]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.00424cac
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004048ac
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.0040464c
mov edx, eax
sub edx, dword [ebp - 0x24]
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.004048ac
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404698
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004def3c
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004df0f4
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.004049d8
mov eax, dword [ebp + 8]
call fcn.004048a4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4df3bc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dl, byte [edx + ecx - 1]
xor al, dl
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx - 1], al
inc dword [ebp - 0x20]
dec dword [ebp - 0x30]
jne 0x4df394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df3e6
lea eax, [ebp - 0x2c]
call fcn.0040438c
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004043b0
ret
Function at 0x4e2f88
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov esi, eax
mov eax, esi
call fcn.0040464c
mov ebx, eax
mov eax, esi
call fcn.0040464c
add eax, 3
mov ecx, 3
cdq
idiv ecx
add ebx, eax
mov edx, ebx
add edx, 4
mov eax, ebp
call fcn.004049d8
mov edi, 1
mov ebx, 1
xor eax, eax
mov dword [esp], eax
jmp 0x4e3065
mov eax, ebp
call fcn.004048a4
xor edx, edx
mov dl, byte [esi + edi - 1]
shr edx, 2
mov dl, byte [edx + 0x4fbfe4]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, ebp
call fcn.004048a4
xor edx, edx
mov dl, byte [esi + edi - 1]
shl edx, 4
and edx, 0x30
xor ecx, ecx
mov cl, byte [esi + edi]
shr ecx, 4
and ecx, 0xf
or edx, ecx
mov dl, byte [edx + 0x4fbfe4]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, ebp
call fcn.004048a4
xor edx, edx
mov dl, byte [esi + edi]
shl edx, 2
and edx, 0x3c
xor ecx, ecx
mov cl, byte [esi + edi + 1]
shr ecx, 6
and ecx, 3
or edx, ecx
mov dl, byte [edx + 0x4fbfe4]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, ebp
call fcn.004048a4
mov dl, byte [esi + edi + 1]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4fbfe4]
mov byte [eax + ebx - 1], dl
inc ebx
add edi, 3
add dword [esp], 3
mov eax, esi
call fcn.0040464c
cmp eax, dword [esp]
jg 0x4e2fce
mov eax, esi
call fcn.0040464c
inc eax
cmp eax, dword [esp]
jne 0x4e3090
mov eax, ebp
call fcn.004048a4
mov byte [eax + ebx - 2], 0x3d
jmp 0x4e30b7
mov eax, esi
call fcn.0040464c
add eax, 2
cmp eax, dword [esp]
jne 0x4e30b7
mov eax, ebp
call fcn.004048a4
mov byte [eax + ebx - 2], 0x3d
mov eax, ebp
call fcn.004048a4
mov byte [eax + ebx - 3], 0x3d
mov edx, ebx
dec edx
mov eax, ebp
call fcn.004049d8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret