joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c050
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x6dc]
call fcn.00434c20
cmp byte [esi + 0x7f8], 0
lea eax, [esi + 0x6e8]
jne 0x43c07e
mov eax, dword [esi + 0x6e4]
add esi, 0x800
add eax, 4
mov edx, esi
call fcn.00434c20
mov eax, esi
call fcn.00435720
pop edi
mov al, 1
pop esi
ret

Function at 0x43cec0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004cab10
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43cf27
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004c31a1
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004cab10
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x43cf87
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004c31a1
add esp, 0x424
ret
push edi
push esi
call fcn.004c328d
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x43cf9e
xor al, al
jmp 0x43d048
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43d03d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43d03d
cmp dword [esp + 0x10], 4
jb 0x43d03d
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04xCompanyName
lea edx, [esp + 0x234]
call fcn.00410c10
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x230]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43d03d
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x43d03d
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x43d031
mov edx, ebp
call fcn.00434c20
jmp 0x43d03b
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00434c80
mov bl, 1
push edi
call fcn.004c31b0
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c31a1
add esp, 0x424
ret

Function at 0x43d9c0
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.00442f60
Function at 0x43dac0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0043db20
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.004427b0
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x43db20
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5030fb
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x37c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38c]
lea esi, [esp + 0x1c]
mov ebx, ecx
mov edi, edx
call fcn.0043a2a0
xor esi, esi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], esi
mov dword [esp + 0x370], esi
push esi
push ebx
lea eax, [esp + 0x24]
push eax
mov eax, edi
mov dword [esp + 0x390], esi
call fcn.0043a3e0
test al, al
je 0x43dc98
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x43dbd6
mov esi, edi
push 0x100000
mov dword [esp + 0x370], esi
call fcn.004c328d
mov edi, eax
mov eax, dword [esp + 0x370]
add esp, 4
sub eax, dword [esp + 0x370]
je 0x43dc3e
mov esi, eax
cmp eax, 0x100000
jb 0x43dc0a
mov esi, 0x100000
push esi
push edi
push ebx
lea ecx, [esp + 0x374]
call fcn.00441fe0
push edi
test al, al
je 0x43dcd3
mov eax, esi
mov ecx, ebp
call fcn.00442510
mov eax, dword [esp + 0x370]
add esp, 4
sub eax, dword [esp + 0x370]
jne 0x43dbfc
push edi
call fcn.004c31b0
mov dword [esp + 0x388], 0xffffffff
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
mov al, 1
mov ecx, dword [esp + 0x37c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x360]
xor ecx, esp
call fcn.004c31a1
add esp, 0x374
ret
push 0x5208f4
push ebx
call fcn.00433e60
mov dword [esp + 0x38c], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov bl, al
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
mov al, bl
jmp 0x43dc70
call fcn.004c31b0
add esp, 4
mov ecx, ebx
call fcn.00433db0
push 0x5208f4
push 0x51620c
mov edx, eax
call fcn.004351e0
mov dword [esp + 0x38c], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043a310
xor al, al
jmp 0x43dc70
Function at 0x43fff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x44011b
test ebx, ebx
je 0x4400c7
cmp word [ebx], 0
je 0x4400c7
cmp byte [esi + 0x128], 0
je 0x440059
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x440060
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00433db0
mov esi, eax
call fcn.004345f0
mov ecx, ebp
call fcn.00433db0
mov esi, eax
push 0x520d48
push 0x51620c
mov edx, esi
call fcn.004351e0
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x51620c
mov edx, esi
call fcn.004351e0
push 0x516164
push 0x51620c
mov edx, esi
call fcn.004351e0
push ebx
push 0x51620c
mov edx, esi
call fcn.004351e0
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4400d6
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00433db0
mov esi, eax
call fcn.004345f0
mov ecx, ebp
call fcn.00433db0
mov esi, eax
push 0x520d48
push 0x51620c
mov edx, esi
call fcn.004351e0
add ebx, 4
push ebx
push 0x51620c
mov edx, esi
call fcn.004351e0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x4401fc
test ebx, ebx
je 0x4401b4
cmp word [ebx], 0
je 0x4401b4
cmp byte [esi + 0x128], 0
je 0x440149
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x440150
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00433db0
xor edi, edi
mov esi, eax
call fcn.004345f0
mov ecx, ebp
call fcn.00433db0
mov esi, eax
push 0x520d58
push 0x51620c
mov edx, esi
call fcn.004351e0
mov ecx, dword [esp + 0x28]
add ecx, 4
add esp, 8
push ecx
mov ecx, esi
call fcn.00434720
mov esi, eax
push 0x516164
push 0x51620c
mov edx, esi
call fcn.004351e0
add esp, 8
push ebx
mov ecx, esi
call fcn.00434720
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
je 0x4401c2
add esi, 0x18
jmp 0x4401c5
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.00433db0
mov edi, eax
push 0x520d58
push 0x51620c
mov edx, edi
call fcn.004351e0
add esi, 4
push esi
push 0x51620c
mov edx, edi
call fcn.004351e0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4410b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44111e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x4410ef
cmp eax, 2
jne 0x44110a
mov eax, dword [esp]
test esi, esi
je 0x441118
test eax, eax
je 0x441113
test al, 1
jne 0x44110a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x441118
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x4412c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5011b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x11
mov esi, ecx
xor ebx, ebx
xor eax, eax
push str.SoftwareClasses_
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
call fcn.00426db0
mov eax, esi
mov dword [esp + 0x38], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x441320
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.004419e0
push 6
push str.Shell
call fcn.004419e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00426cb0
push reloc.WS2_32.dll_accept
push edi
call fcn.004414a0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x44138e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004c55cd
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004c31a1
add esp, 0x30
ret
Function at 0x4413b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5011b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x441400
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00426db0
push 6
push str.Shell
lea esi, [esp + 0x18]
mov dword [esp + 0x40], ebx
call fcn.004419e0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00426cb0
push closesocket
push edi
call fcn.004414a0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x441476
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004c55cd
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004c31a1
add esp, 0x30
ret
Function at 0x441710
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5021d6
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x3e
xor ebx, ebx
mov word [esp + 0x30], cx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
call fcn.00426db0
mov eax, str.http
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x441790
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x441790
sub eax, edx
sar eax, 1
push eax
push str.http
lea esi, [esp + 0x30]
call fcn.004419e0
push 0xb
push 0x520ea8
call fcn.004419e0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x4417d9
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4418b7
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.004cab10
add esp, 0xc
push str.Progid
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.004410b0
test eax, eax
jne 0x4418a8
xor ecx, ecx
cmp cx, word [esp + 0x44]
jne 0x441865
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x44185a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call fcn.00426a80
jmp 0x4418cb
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x44]
call fcn.004412c0
test al, al
jne 0x441885
lea ecx, [esp + 0x44]
call fcn.004413b0
mov byte [esp + 0x13], al
jmp 0x44188a
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x441899
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call fcn.00426a80
mov al, byte [esp + 0x13]
jmp 0x4418cd
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4418b7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x4418cb
mov edx, dword [esp + 0x2c]
push edx
call fcn.004c55cd
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004c31a1
mov esp, ebp
pop ebp
ret

Function at 0x441f90
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push 0
push eax
mov eax, dword [esp + 0x14]
push edi
call fcn.0043a3e0
test al, al
jne 0x441fa8
pop esi
pop ecx
ret 4
mov edx, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x441fd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x441fd2
xor esi, esi
mov dword [edi + 0x350], esi
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x443490
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.00442f60
test eax, eax
jl 0x4436c8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4434fd
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4434c0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4436c4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x51bff0]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51bff0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51cbf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51d3f0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51bff0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51d7f0]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x51bff0]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51cff0]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x51bff0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51bff0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51cbf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51d3f0]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x51bff0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51cff0]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51bff0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51d7f0]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x51bff0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51bff0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51cbf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51d3f0]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x51bff0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51cff0]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51bff0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51d7f0]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x51bff0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x51bff0]
and esi, 0xff
mov esi, dword [esi*4 + 0x51cbf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51d3f0]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x51bff0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51bff0]
and edi, 0xff
xor esi, dword [edi*4 + 0x51cff0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x51d7f0]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x443511
pop edi
xor eax, eax
pop esi
ret
Function at 0x444210
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x4442a1
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
mov edi, edi
movzx eax, byte [esi]
shr eax, 2
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + 2], ax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
add ecx, 2
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 2
mov word [ecx], ax
movzx eax, byte [esi + 2]
and eax, 0x3f
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 2
mov word [ecx], ax
add ecx, 2
add esi, 3
sub edx, 1
jne 0x444230
pop ebx
test edi, edi
jle 0x444312
movzx edx, byte [esi]
shr edx, 2
movsx ax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
mov al, byte [esi]
and al, 3
add ecx, 2
shl al, 4
cmp edi, 1
jle 0x4442cd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
movsx dx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], dx
add ecx, 2
cmp edi, 2
jge 0x4442ea
mov eax, 0x3d
jmp 0x4442f9
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add ecx, 2
mov edx, 0x3d
mov word [ecx], dx
add ecx, 2
xor eax, eax
pop edi
mov word [ecx], ax
pop esi
ret
xor edx, edx
pop edi
mov word [ecx], dx
pop esi
ret
Function at 0x444320
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x4443a5
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x444340
pop ebx
test edi, edi
jle 0x444405
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x4443cd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x4443ef
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x444580
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x444592
mov esi, 0x53bde0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00442510
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.004427b0
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x445200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ff868
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004c328d
mov dword [eax + 0x24], fcn.004c53b2
mov dword [eax + 0x28], fcn.004c31b0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0xc

Function at 0x446e10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [esp + 0x80c]
push esi
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x53d260]
lea ecx, [esi + esi]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004c31a1
add esp, 0x808
ret