joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4165ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test byte [ebp + 0x10], 7
push ebx
push esi
push edi
je 0x416625
push 0x288
push str.sshdes.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x8c]
mov ebx, dword [eax + 0x88]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jbe 0x4166f4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add ecx, 7
shr ecx, 3
mov dword [ebp - 8], ecx
movzx edx, byte [esi + 2]
xor ecx, ecx
push eax
mov cl, byte [esi + 1]
lea eax, [ebp - 0x10]
mov ch, byte [esi]
add esi, 4
shl ecx, 8
or ecx, edx
movzx edx, byte [esi - 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 2]
mov dword [ebp + 0x10], ecx
xor ecx, ecx
mov cl, byte [esi + 1]
mov ch, byte [esi]
add esi, 4
shl ecx, 8
or ecx, edx
movzx edx, byte [esi - 1]
shl ecx, 8
or ecx, edx
push ecx
mov dword [ebp + 0xc], ecx
push dword [ebp + 0x10]
push eax
call fcn.0041585f
xor ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
add esp, 0x10
mov ecx, ebx
mov byte [edi + 3], bl
shr ecx, 8
mov byte [edi + 2], cl
mov ecx, ebx
shr ecx, 0x10
shr ebx, 0x18
mov byte [edi + 1], cl
mov byte [edi], bl
mov ecx, eax
add edi, 4
shr ecx, 8
mov byte [edi + 2], cl
mov ebx, dword [ebp + 0x10]
mov byte [edi + 3], al
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
mov byte [edi], al
mov eax, dword [ebp + 0xc]
mov byte [edi + 1], cl
add edi, 4
dec dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
jne 0x416651
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax + 0x88], ebx
pop esi
mov dword [eax + 0x8c], ecx
pop ebx
leave
ret
Function at 0x416788
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test byte [ebp + 0x10], 7
push ebx
push esi
push edi
je 0x4167ad
push 0x2ad
push str.sshdes.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx + 0x84]
mov ecx, dword [ebx + 0x80]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jbe 0x4168a7
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add eax, 7
shr eax, 3
mov dword [ebp + 0x10], eax
movzx edx, byte [esi + 2]
xor eax, eax
push ebx
mov ah, byte [esi]
mov al, byte [esi + 1]
add esi, 4
shl eax, 8
or eax, edx
movzx edx, byte [esi - 1]
shl eax, 8
or eax, edx
movzx edx, byte [esi + 2]
xor ecx, eax
xor eax, eax
mov ah, byte [esi]
mov al, byte [esi + 1]
add esi, 4
shl eax, 8
or eax, edx
movzx edx, byte [esi - 1]
shl eax, 8
or eax, edx
xor dword [ebp + 0x14], eax
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push ecx
push eax
call fcn.00414e7a
add esp, 0x10
lea eax, [ebx + 0x90]
push eax
lea eax, [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 8]
push eax
call fcn.0041585f
add esp, 0x10
lea eax, [ebx + 0x120]
push eax
lea eax, [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 8]
push eax
call fcn.00414e7a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, eax
mov dword [ebp + 0xc], eax
shr edx, 8
mov byte [edi + 2], dl
mov byte [edi + 3], al
mov edx, eax
mov dword [ebp + 0x14], ecx
shr eax, 0x18
shr edx, 0x10
mov byte [edi], al
mov byte [edi + 1], dl
mov eax, ecx
add edi, 4
shr eax, 8
mov byte [edi + 2], al
mov eax, ecx
mov byte [edi + 3], cl
add esp, 0x10
shr eax, 0x10
shr ecx, 0x18
mov byte [edi + 1], al
mov byte [edi], cl
mov ecx, dword [ebp + 0xc]
add edi, 4
dec dword [ebp + 0x10]
jne 0x4167d9
mov eax, dword [ebp + 0x14]
pop edi
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x84], eax
pop esi
pop ebx
leave
ret
Function at 0x4168d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test byte [ebp + 0x10], 7
push ebx
push esi
push edi
je 0x4168fb
push 0x2d2
push str.sshdes.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x8c]
mov ebx, dword [eax + 0x88]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jbe 0x416a07
lea edx, [eax + 0x120]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x90
mov dword [ebp - 0x10], eax
lea eax, [ecx + 7]
shr eax, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
movzx ecx, byte [esi + 2]
xor eax, eax
push dword [ebp - 0xc]
mov ah, byte [esi]
mov al, byte [esi + 1]
add esi, 4
shl eax, 8
or eax, ecx
movzx ecx, byte [esi - 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 2]
mov dword [ebp + 0x10], eax
xor eax, eax
mov ah, byte [esi]
mov al, byte [esi + 1]
add esi, 4
shl eax, 8
or eax, ecx
movzx ecx, byte [esi - 1]
shl eax, 8
or eax, ecx
push eax
mov dword [ebp + 0xc], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.0041585f
add esp, 0x10
lea eax, [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
call fcn.00414e7a
add esp, 0x10
lea eax, [ebp - 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
call fcn.0041585f
xor ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x14]
add esp, 0x10
mov ecx, ebx
mov byte [edi + 3], bl
shr ecx, 8
mov byte [edi + 2], cl
mov ecx, ebx
shr ecx, 0x10
shr ebx, 0x18
mov byte [edi + 1], cl
mov byte [edi], bl
mov ecx, eax
add edi, 4
shr ecx, 8
mov byte [edi + 2], cl
mov ebx, dword [ebp + 0x10]
mov ecx, eax
mov byte [edi + 3], al
shr ecx, 0x10
shr eax, 0x18
mov byte [edi + 1], cl
mov byte [edi], al
mov eax, dword [ebp + 0xc]
add edi, 4
dec dword [ebp - 8]
mov dword [ebp - 4], eax
jne 0x416938
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax + 0x88], ebx
pop esi
mov dword [eax + 0x8c], ecx
pop ebx
leave
ret
Function at 0x417845
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x40
pop edi
lea eax, [ebp - 0x40]
push edi
push 0x36
push eax
call fcn.00428790
mov ebx, dword [ebp + 0x14]
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x417883
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x417883
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x417871
push dword [ebp + 8]
call fcn.0041767a
pop ecx
lea eax, [ebp - 0x40]
push edi
push eax
push dword [ebp + 8]
call fcn.00417693
add esp, 0xc
lea eax, [ebp - 0x40]
push edi
push 0x5c
push eax
call fcn.00428790
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x4178cb
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x4178cb
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x4178b9
push dword [ebp + 0xc]
call fcn.0041767a
pop ecx
lea eax, [ebp - 0x40]
push edi
push eax
push dword [ebp + 0xc]
call fcn.00417693
add esp, 0xc
lea eax, [ebp - 0x40]
push edi
push 0
push eax
call fcn.00428790
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418d90
Capabilities:
Encode data using xor

Disassembly:
push 0x50c
push 0
push 0x447168
call fcn.00428790
add esp, 0xc
mov dword [0x447674], 1
push 0x418db9
call fcn.0041a355
pop ecx
jmp fcn.00418c07
Function at 0x4192b1
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x40
pop edi
lea eax, [ebp - 0x40]
push edi
push 0x36
push eax
call fcn.00428790
mov ebx, dword [ebp + 0x14]
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x4192ef
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x4192ef
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x4192dd
push dword [ebp + 8]
call fcn.004190a9
pop ecx
lea eax, [ebp - 0x40]
push edi
push eax
push dword [ebp + 8]
call fcn.004190c2
add esp, 0xc
lea eax, [ebp - 0x40]
push edi
push 0x5c
push eax
call fcn.00428790
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x419337
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x419337
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x419325
push dword [ebp + 0xc]
call fcn.004190a9
pop ecx
lea eax, [ebp - 0x40]
push edi
push eax
push dword [ebp + 0xc]
call fcn.004190c2
add esp, 0xc
lea eax, [ebp - 0x40]
push edi
push 0
push eax
call fcn.00428790
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419b85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test bl, 7
je 0x419bac
push 0x135
push str.sshblowf.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov edi, dword [ebp + 0x10]
test ebx, ebx
mov edx, dword [edi + 0x1048]
mov eax, dword [edi + 0x104c]
jle 0x419c60
mov esi, dword [ebp + 8]
lea ecx, [ebx + 7]
shr ecx, 3
mov dword [ebp + 0xc], ecx
movzx ebx, byte [esi + 5]
lea ecx, [ebp - 8]
push edi
push ecx
xor ecx, ecx
mov ch, byte [esi + 7]
mov cl, byte [esi + 6]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 4]
shl ecx, 8
or ecx, ebx
xor ecx, eax
xor eax, eax
mov ah, byte [esi + 3]
push ecx
mov al, byte [esi + 2]
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
xor eax, edx
push eax
call fcn.004196d3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov edx, eax
shr ebx, 8
mov byte [esi + 1], bl
mov byte [esi], al
mov ebx, eax
mov dword [ebp + 0x10], ecx
shr eax, 0x18
mov byte [esi + 3], al
mov eax, ecx
shr ebx, 0x10
shr eax, 8
mov byte [esi + 2], bl
mov byte [esi + 5], al
mov eax, ecx
mov byte [esi + 4], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esi + 6], al
mov eax, dword [ebp + 0x10]
mov byte [esi + 7], cl
add esp, 0x10
add esi, 8
dec dword [ebp + 0xc]
jne 0x419bcf
mov dword [edi + 0x1048], edx
mov dword [edi + 0x104c], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x419c87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test byte [ebp + 0xc], 7
push ebx
push esi
push edi
je 0x419cad
push 0x151
push str.sshblowf.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x104c]
mov ebx, dword [edi + 0x1048]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x419d71
mov esi, dword [ebp + 8]
add eax, 7
shr eax, 3
mov dword [ebp - 4], eax
movzx ecx, byte [esi + 1]
xor eax, eax
push edi
mov ah, byte [esi + 3]
mov al, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 5]
mov dword [ebp + 0xc], eax
xor eax, eax
mov ah, byte [esi + 7]
mov al, byte [esi + 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 4]
shl eax, 8
or eax, ecx
mov dword [ebp + 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00419d85
xor ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
xor eax, dword [ebp - 8]
add esp, 0x10
mov ecx, ebx
mov byte [esi], bl
shr ecx, 8
mov byte [esi + 1], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 2], cl
mov ecx, eax
shr ebx, 0x18
shr ecx, 8
mov byte [esi + 3], bl
mov byte [esi + 5], cl
mov ebx, dword [ebp + 0xc]
mov ecx, eax
mov byte [esi + 4], al
add esi, 8
shr ecx, 0x10
shr eax, 0x18
dec dword [ebp - 4]
mov byte [esi - 2], cl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
jne 0x419cd6
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1048], ebx
mov dword [edi + 0x104c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a152
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test bl, 7
je 0x41a179
push 0x16d
push str.sshblowf.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov edi, dword [ebp + 0x10]
test ebx, ebx
mov eax, dword [edi + 0x1048]
mov ecx, dword [edi + 0x104c]
jle 0x41a22c
mov esi, dword [ebp + 8]
lea edx, [ebx + 7]
shr edx, 3
mov dword [ebp + 0xc], edx
movzx ebx, byte [esi + 6]
lea edx, [ebp - 8]
push edi
push edx
xor edx, edx
mov dh, byte [esi + 4]
mov dl, byte [esi + 5]
shl edx, 8
or edx, ebx
movzx ebx, byte [esi + 7]
shl edx, 8
or edx, ebx
xor edx, ecx
xor ecx, ecx
mov ch, byte [esi]
push edx
mov cl, byte [esi + 1]
movzx edx, byte [esi + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 3]
shl ecx, 8
or ecx, edx
xor ecx, eax
push ecx
call fcn.004196d3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, eax
mov byte [esi + 3], al
shr edx, 0x18
mov byte [esi], dl
mov edx, eax
shr edx, 0x10
mov byte [esi + 1], dl
mov edx, eax
shr edx, 8
mov byte [esi + 2], dl
mov edx, ecx
shr edx, 0x18
mov byte [esi + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 5], dl
mov edx, ecx
shr edx, 8
mov byte [esi + 6], dl
mov byte [esi + 7], cl
add esp, 0x10
add esi, 8
dec dword [ebp + 0xc]
mov dword [ebp + 0x10], ecx
jne 0x41a19c
mov dword [edi + 0x1048], eax
mov dword [edi + 0x104c], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a253
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test byte [ebp + 0xc], 7
push ebx
push esi
push edi
je 0x41a279
push 0x189
push str.sshblowf.c
push str._len__7___0
call fcn.0042a600
add esp, 0xc
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x104c]
mov ebx, dword [edi + 0x1048]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x41a341
mov esi, dword [ebp + 8]
add eax, 7
shr eax, 3
mov dword [ebp - 4], eax
movzx ecx, byte [esi + 2]
xor eax, eax
push edi
mov ah, byte [esi]
mov al, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 6]
mov dword [ebp + 0xc], eax
xor eax, eax
mov ah, byte [esi + 4]
mov al, byte [esi + 5]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl eax, 8
or eax, ecx
mov dword [ebp + 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00419d85
xor ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
xor eax, dword [ebp - 8]
add esp, 0x10
mov ecx, ebx
mov byte [esi + 3], bl
shr ecx, 0x18
mov byte [esi], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 1], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov ebx, dword [ebp + 0xc]
mov ecx, eax
mov byte [esi + 7], al
mov eax, dword [ebp + 8]
add esi, 8
shr ecx, 8
dec dword [ebp - 4]
mov byte [esi - 2], cl
mov dword [ebp + 0x10], eax
jne 0x41a2a2
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1048], ebx
mov dword [edi + 0x104c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a355
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
lea eax, [ebp - 0x108]
push 0x107
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push 0x440100
push eax
call fcn.00429380
pop ecx
lea eax, [ebp - 0x248]
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41a3c9
lea eax, [ebp - 0x248]
push 0x140
push eax
call dword [ebp + 8]
pop ecx
lea eax, [ebp - 0x248]
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a39f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call fcn.004128a4
and dword [0x449898], 0
pop ecx
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41a3f9
push str.GetSystemPowerStatus
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x449898], eax
pop esi
leave
ret

Function at 0x41c74e
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor ecx, ecx
lea edx, [ebp - 0x10]
or edi, 0xffffffff
mov eax, dword [ebp + 8]
mov al, byte [ecx + eax]
cmp al, 0x41
jl 0x41c774
cmp al, 0x5a
jg 0x41c774
movsx eax, al
sub eax, 0x41
jmp 0x41c7ab
cmp al, 0x61
jl 0x41c784
cmp al, 0x7a
jg 0x41c784
movsx eax, al
sub eax, 0x47
jmp 0x41c7ab
cmp al, 0x30
jl 0x41c794
cmp al, 0x39
jg 0x41c794
movsx eax, al
add eax, 4
jmp 0x41c7ab
cmp al, 0x2b
jne 0x41c79c
push 0x3e
jmp 0x41c7a2
cmp al, 0x2f
jne 0x41c7a5
push 0x3f
pop eax
jmp 0x41c7ab
cmp al, 0x3d
jne 0x41c7d0
mov eax, edi
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 4
jl 0x41c75e
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x41c7d0
cmp dword [ebp - 0xc], edi
je 0x41c7d0
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 4]
cmp edx, edi
jne 0x41c7d6
cmp esi, edi
je 0x41c7df
xor eax, eax
pop edi
pop esi
leave
ret
cmp esi, edi
je 0x41c7df
push 3
pop edi
jmp 0x41c7e9
xor eax, eax
cmp edx, edi
setne al
inc eax
mov edi, eax
shl ecx, 6
or ecx, dword [ebp - 0xc]
and edx, 0x3f
and esi, 0x3f
shl ecx, 6
or ecx, edx
mov edx, dword [ebp + 0xc]
shl ecx, 6
or ecx, esi
mov eax, ecx
shr eax, 0x10
cmp edi, 1
mov byte [edx], al
jle 0x41c816
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
cmp edi, 2
jle 0x41c81e
mov byte [edx + 2], cl
mov eax, edi
jmp 0x41c7d2
Function at 0x42832b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test bl, 0xf
je 0x428353
push 0x418
push str.sshaes.c
push str._len__15___0
call fcn.0042a600
add esp, 0xc
mov eax, dword [ebp + 0x10]
push 0x10
add eax, 0x3c8
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00429460
add esp, 0xc
test ebx, ebx
jle 0x4283f7
mov eax, dword [ebp + 8]
push 4
lea edi, [eax + 2]
lea eax, [ebx + 0xf]
shr eax, 4
mov dword [ebp + 8], eax
pop ebx
lea eax, [ebp - 0x14]
mov esi, edi
mov dword [ebp + 0xc], ebx
movzx edx, byte [esi]
xor ecx, ecx
mov cl, byte [esi - 1]
mov ch, byte [esi - 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 1]
shl ecx, 8
or ecx, edx
add esi, ebx
xor dword [eax], ecx
add eax, ebx
dec dword [ebp + 0xc]
jne 0x42838f
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.0042840d
pop ecx
mov eax, edi
pop ecx
mov dword [ebp + 0xc], ebx
lea ecx, [ebp - 0x14]
mov dl, byte [ecx]
mov edi, dword [ecx]
mov byte [eax + 1], dl
mov edx, edi
shr edx, 8
mov byte [eax], dl
mov edx, edi
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, edi
shr edx, 0x18
mov byte [eax - 2], dl
add ecx, ebx
add eax, ebx
dec dword [ebp + 0xc]
jne 0x4283c9
dec dword [ebp + 8]
mov edi, esi
jne 0x428387
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp - 4]
call fcn.00429460
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x428435
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test bl, 0xf
je 0x42845d
push 0x42e
push str.sshaes.c
push str._len__15___0
call fcn.0042a600
add esp, 0xc
mov eax, dword [ebp + 0x10]
push 0x10
add eax, 0x3c8
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00429460
add esp, 0xc
test ebx, ebx
jle 0x428530
mov eax, dword [ebp + 8]
lea esi, [eax + 2]
lea eax, [ebx + 0xf]
shr eax, 4
mov dword [ebp + 8], eax
mov ebx, esi
xor eax, eax
movzx edx, byte [ebx]
xor ecx, ecx
add eax, 4
mov cl, byte [ebx - 1]
mov ch, byte [ebx - 2]
add ebx, 4
shl ecx, 8
or ecx, edx
movzx edx, byte [ebx - 3]
shl ecx, 8
or ecx, edx
cmp eax, 0x10
mov dword [ebp + eax - 0x38], ecx
mov dword [ebp + eax - 0x18], ecx
jl 0x428492
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.00428546
pop ecx
mov eax, esi
pop ecx
xor edi, edi
mov dl, byte [ebp + edi - 0x24]
lea esi, [ebp + edi - 0x24]
xor dl, byte [ebp + edi - 0x14]
lea ecx, [ebp + edi - 0x14]
add edi, 4
mov ecx, dword [ecx]
mov byte [eax + 1], dl
mov edx, dword [esi]
mov dword [ebp + 0xc], ecx
shr edx, 8
shr ecx, 8
xor dl, cl
mov ecx, dword [ebp + 0xc]
mov byte [eax], dl
mov edx, dword [esi]
shr ecx, 0x10
shr edx, 0x10
xor cl, dl
mov edx, dword [esi]
mov byte [eax - 1], cl
mov ecx, dword [ebp + 0xc]
shr ecx, 0x18
shr edx, 0x18
xor cl, dl
mov byte [eax - 2], cl
mov ecx, dword [ebp + edi - 0x38]
add eax, 4
cmp edi, 0x10
mov dword [esi], ecx
jl 0x4284d0
dec dword [ebp + 8]
mov esi, ebx
jne 0x42848e
lea eax, [ebp - 0x24]
push 0x10
push eax
push dword [ebp - 4]
call fcn.00429460
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428e80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x452aa0]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x428e9f
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x452a9c], 1
mov byte [0x452a98], bl
jne 0x428ef9
mov ecx, dword [0x4565e8]
test ecx, ecx
je 0x428ee7
mov esi, dword [0x4565e4]
sub esi, 4
cmp esi, ecx
jb 0x428ee7
mov eax, dword [esi]
test eax, eax
je 0x428ee0
call eax
mov ecx, dword [0x4565e8]
sub esi, 4
cmp esi, ecx
jae 0x428ed2
push 0x43b01c
push 0x43b014
call fcn.00428f30
add esp, 8
push 0x43b024
push 0x43b020
call fcn.00428f30
add esp, 8
test ebx, ebx
jne 0x428f20
push ebp
mov dword [0x452aa0], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret

Function at 0x42b220
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42b237
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42b239
xor eax, eax
test eax, eax
je 0x42b24a
push eax
call fcn.0042fe30
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x42bda0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a328
push 0x4314c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x452a70], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x452a6c], ecx
shl ecx, 8
add ecx, edx
mov dword [0x452a68], ecx
shr eax, 0x10
mov dword [0x452a64], eax
call fcn.0042f600
test eax, eax
jne 0x42be0a
push 0x1c
call fcn.0042bf40
add esp, 4
mov dword [ebp - 4], 0
call fcn.004306f0
call fcn.004313c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4555c8], eax
call fcn.00430f90
mov dword [0x452ad4], eax
test eax, eax
je 0x42be3d
mov eax, dword [0x4555c8]
test eax, eax
jne 0x42be47
push 0xffffffffffffffff
call fcn.00428e40
add esp, 4
call fcn.00430ce0
call fcn.00430bf0
call fcn.00428e10
mov esi, dword [0x4555c8]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x42bf26
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x42be8e
test al, al
je 0x42be8e
and eax, 0xff
push eax
call fcn.00430b90
add esp, 4
test eax, eax
je 0x42be68
inc esi
mov dword [ebp - 0x64], esi
jmp 0x42be68
cmp byte [esi], 0x22
jne 0x42be97
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x42bea7
cmp al, 0x20
ja 0x42bea7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x42be97
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x42bec8
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x42becd
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00428e40
jmp 0x42bf0b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x42be97
inc esi
mov dword [ebp - 0x64], esi
jmp 0x42bf26