joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499ed8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x499ee0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x499ffe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [ebx + 4]
call fcn.0040a634
push dword [ebp - 4]
push 0x49a014
lea edx, [ebp - 8]
mov eax, dword [ebx + 8]
call fcn.0040a634
push dword [ebp - 8]
push 0x49a014
lea ecx, [ebp - 0xc]
mov dl, 0x3b
mov eax, dword [ebx + 0xc]
call fcn.005a4468
push dword [ebp - 0xc]
push 0x49a014
lea ecx, [ebp - 0x10]
mov dl, 0x3b
mov eax, dword [ebx + 0x10]
call fcn.005a4468
push dword [ebp - 0x10]
push 0x49a014
lea ecx, [ebp - 0x14]
mov dl, 0x3b
mov eax, dword [ebx + 0x14]
call fcn.005a4468
push dword [ebp - 0x14]
push 0x49a014
fld qword [ebx + 0x18]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea ecx, [ebp - 0x18]
mov dl, 0x2e
mov eax, 0xa
call fcn.005a53c4
push dword [ebp - 0x18]
push 0x49a014
fld qword [ebx + 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea ecx, [ebp - 0x1c]
mov dl, 0x2e
mov eax, 0xa
call fcn.005a53c4
push dword [ebp - 0x1c]
push 0x49a014
lea edx, [ebp - 0x20]
movzx eax, byte [ebx + 0x28]
call fcn.0040a634
push dword [ebp - 0x20]
push 0x49a014
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x2c]
call fcn.0040a634
push dword [ebp - 0x24]
push 0x49a014
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x30]
call fcn.0040a634
push dword [ebp - 0x28]
mov eax, esi
mov edx, 0x13
call fcn.00405814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a005
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004054b4
ret
Function at 0x4a1edc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405944
xor eax, eax
push ebp
push 0x4a2157
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.004057a0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004058a0
je 0x4a2134
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405528
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4a1f4b
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004059b4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x4a2170
call fcn.004057a0
xor eax, eax
push ebp
push 0x4a1f9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405954
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405954
push eax
call sub.kernel32.dll_MoveFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1fb2
xor eax, eax
push ebp
push 0x4a1fe1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405954
push eax
mov eax, dword [ebp - 4]
call fcn.00405954
push eax
call sub.kernel32.dll_MoveFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1ff5
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00405528
mov eax, dword [ebp - 4]
call fcn.0040ac10
test al, al
je 0x4a2134
mov eax, dword [ebp - 8]
call fcn.0040ac10
test al, al
je 0x4a2023
mov ebx, 2
jmp 0x4a2028
mov ebx, 0xffff
xor eax, eax
push ebp
push 0x4a2115
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41bd8c]
call fcn.00421c20
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a2104
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a20d0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41bd8c]
call fcn.00421c20
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4a20bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00421980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a20c6
lea eax, [ebp - 0x14]
call fcn.00411b68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a215e
lea eax, [ebp - 0x18]
call fcn.00405490
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004054b4
ret
Function at 0x4a7da0
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff60
mov esi, eax
xor ebx, ebx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, 0x300
call fcn.00403b84
push esi
mov esi, 0x4a7ed0
mov edi, 0x60badc
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x94
call fcn.00403b84
mov dword [esp + 0xc], 0x94
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 2
jne 0x4a7e24
mov eax, esi
call fcn.004a7938
mov ebx, eax
test bl, bl
jne 0x4a7e44
mov eax, esi
call fcn.004a7bdc
mov ebx, eax
jmp 0x4a7e44
xor edi, edi
jmp 0x4a7e32
mov eax, esi
call fcn.004a7af8
mov ebx, eax
inc edi
cmp edi, 0xa
jge 0x4a7e44
test bl, bl
jne 0x4a7e44
cmp byte [0x60badc], 0
je 0x4a7e28
cmp bl, 1
jne 0x4a7ec1
mov esi, 0x60badc
jmp 0x4a7eb8
cmp byte [esi], 0x2d
jne 0x4a7e58
inc esi
jmp 0x4a7eb8
push 0
push 0xa
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00406698
mov dword [esp], eax
mov dword [esp + 4], edx
movzx ebx, byte [esi]
mov eax, ebx
add al, 0xd0
sub al, 0xa
jb 0x4a7e89
add al, 0xf9
sub al, 0x1a
jb 0x4a7e99
add al, 0xfa
sub al, 0x1a
jb 0x4a7ea9
jmp 0x4a7eb7
movzx eax, bl
sub eax, 0x30
cdq
add dword [esp], eax
adc dword [esp + 4], edx
jmp 0x4a7eb7
movzx eax, bl
sub eax, 0x37
cdq
add dword [esp], eax
adc dword [esp + 4], edx
jmp 0x4a7eb7
movzx eax, bl
sub eax, 0x57
cdq
add dword [esp], eax
adc dword [esp + 4], edx
inc esi
test esi, esi
je 0x4a7ec1
cmp byte [esi], 0
jne 0x4a7e50
mov eax, dword [esp]
add esp, 0xa0
pop edi
pop esi
pop ebx
ret
Function at 0x4c2cf0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x4c2d0a
add esp, 0xfffffff0
call fcn.00404898
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405944
xor eax, eax
push ebp
push 0x4c2e9c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 4]
mov edx, dword [ebp - 4]
call fcn.004054e4
lea eax, [edi + 0x4c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4c2d73
push 0x4c2ecc
push dword [ebp - 4]
push 0x4c2f00
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405814
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x409040]
call fcn.0040f2d4
call fcn.00404de8
push 0x4c2f04
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 0x44], esi
test esi, esi
je 0x4c2db2
push 0x4c2f10
push esi
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
mov dword [edi + 0x48], ebx
test ebx, ebx
jne 0x4c2dc8
mov ecx, 0x4c2f2c
mov dl, 1
mov eax, dword [0x409040]
call fcn.0040f2d4
call fcn.00404de8
jmp 0x4c2dc8
mov ecx, 0x4c2f58
mov dl, 1
mov eax, dword [0x409040]
call fcn.0040f2d4
call fcn.00404de8
lea eax, [edi + 8]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403b84
mov dword [edi + 8], 0x3c
mov eax, pe_nt_image_headers32
call fcn.00402f00
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], pe_nt_image_headers32
mov eax, 0x80
call fcn.00402f00
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0x80
mov eax, 0x80
call fcn.00402f00
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0x80
mov eax, 0x800
call fcn.00402f00
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], 0x800
mov eax, 0x800
call fcn.00402f00
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], 0x800
mov esi, dword [edi + 4]
test esi, esi
je 0x4c2e4e
sub esi, 4
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push 0x80000000
push esi
mov eax, dword [edi + 4]
call fcn.00405954
push eax
call dword [edi + 0x48]
test eax, eax
jne 0x4c2e7e
mov ecx, 0x4c2f7c
mov dl, 1
mov eax, dword [0x409040]
call fcn.0040f2d4
call fcn.00404de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2ea3
lea eax, [ebp - 0xc]
call fcn.00405490
lea eax, [ebp - 4]
call fcn.00405490
ret
Function at 0x4c32b4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
test dl, dl
je 0x4c32ce
add esp, 0xfffffff0
call fcn.00404898
mov byte [ebp - 0x35], dl
mov dword [ebp - 0x34], eax
mov ecx, 0xc
lea eax, [ebp - 0x30]
mov edx, dword [0x401120]
call fcn.004060f0
xor eax, eax
push ebp
push 0x4c343b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b5f4]
call fcn.00404544
mov edx, dword [ebp - 0x34]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x34]
add eax, 8
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4c3332
mov ecx, 0x4c346c
mov dl, 1
mov eax, dword [0x409040]
call fcn.0040f2d4
call fcn.00404de8
lea edx, [ebp - 0x30]
mov eax, dword [0x5bf6f4]
call fcn.00407814
lea edx, [ebp - 0x2c]
mov eax, dword [0x5c0508]
call fcn.00407814
lea edx, [ebp - 0x28]
mov eax, dword [0x5bf198]
call fcn.00407814
lea edx, [ebp - 0x24]
mov eax, dword [0x5bfee0]
call fcn.00407814
lea edx, [ebp - 0x20]
mov eax, dword [0x5bf9bc]
call fcn.00407814
lea edx, [ebp - 0x1c]
mov eax, dword [0x5c026c]
call fcn.00407814
lea edx, [ebp - 0x18]
mov eax, dword [0x5c00bc]
call fcn.00407814
lea edx, [ebp - 0x14]
mov eax, dword [0x5bf6c4]
call fcn.00407814
lea edx, [ebp - 0x10]
mov eax, dword [0x5bf804]
call fcn.00407814
lea edx, [ebp - 0xc]
mov eax, dword [0x5c0128]
call fcn.00407814
lea edx, [ebp - 8]
mov eax, dword [0x5bf280]
call fcn.00407814
lea edx, [ebp - 4]
mov eax, dword [0x5c0038]
call fcn.00407814
mov edi, 0xc
lea ebx, [ebp - 0x30]
mov ecx, dword [ebx]
mov dl, 1
mov eax, dword [0x4c3160]
call fcn.004c31dc
mov esi, eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
mov edx, esi
call fcn.0041de58
lea edx, [ebp - 0x3c]
mov eax, esi
call fcn.004c328c
mov ecx, dword [ebp - 0x3c]
mov dl, 1
mov eax, dword [0x4c30ec]
call fcn.004c3c0c
add ebx, 4
dec edi
jne 0x4c33d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3442
lea eax, [ebp - 0x3c]
call fcn.00405490
lea eax, [ebp - 0x30]
mov ecx, 0xc
mov edx, dword [0x401120]
call fcn.004061dc
ret

Function at 0x4c3d78
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405944
xor eax, eax
push ebp
push 0x4c3e06
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.0040ac10
test al, al
je 0x4c3df0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405954
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4c3df0
mov eax, ebx
call fcn.00402f18
mov dword [edi], eax
mov eax, dword [edi]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405954
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4c3de9
mov esi, ebx
jmp 0x4c3df0
mov eax, dword [edi]
call fcn.00402f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3e0d
lea eax, [ebp - 4]
call fcn.00405490
ret
Function at 0x4c7028
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c7056
mov eax, ebx
call fcn.004c7adc
cmp dword [ebx + 0x40], 0
je 0x4c704f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c70c7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c70b9
cmp dword [ebx + 8], 0
je 0x4c7078
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c708a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c70b9
cmp dword [ebx + 8], 0
je 0x4c706b
cmp eax, 3
je 0x4c709d
dec eax
jne 0x4c706b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c706b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c706b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c70e5
cmp dword [ebx + 0x14], 0xcc
je 0x4c70e5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c70f0
pop ebx
ret

Function at 0x4e2388
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x4e23a2
add esp, 0xfffffff0
call fcn.00404898
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e24ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp + 0x14]
call fcn.004054e4
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
xor eax, eax
push ebp
push 0x4e2444
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4ddd0c]
call fcn.004db03c
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 4]
call fcn.004e252c
push 0
push 0
push 0xf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0046a764
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2495
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e24b2
lea eax, [ebp - 0xc]
call fcn.00405490
ret
Function at 0x4e8234
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00405490
cmp edi, 0xffffffff
jne 0x4e8262
mov edi, 6
test esi, esi
jge 0x4e826f
mov dword [ebp - 0xc], 1
neg esi
cmp dword [ebp + 0xc], 1
jl 0x4e82a0
cmp dword [ebp + 0xc], 9
jg 0x4e82a0
cmp dword [ebp - 8], 8
jne 0x4e82a0
cmp esi, 8
jl 0x4e82a0
cmp esi, 0xf
jg 0x4e82a0
test edi, edi
jl 0x4e82a0
cmp edi, 9
jg 0x4e82a0
cmp dword [ebp + 8], 0
jl 0x4e82a0
cmp dword [ebp + 8], 2
jle 0x4e82aa
mov eax, 0xfffffffe
jmp 0x4e8399
mov eax, 0x16bc
call fcn.00402f18
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov eax, esi
mov dword [ebx + 0x28], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x24], edx
dec edx
mov dword [ebx + 0x2c], edx
mov eax, dword [ebp + 0xc]
add eax, 7
mov dword [ebx + 0x48], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x44], edx
dec edx
mov dword [ebx + 0x4c], edx
mov eax, dword [ebx + 0x48]
add eax, 3
dec eax
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x24]
add eax, eax
call fcn.00402f18
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x24]
add eax, eax
call fcn.00402f18
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x44]
add eax, eax
call fcn.00402f18
mov dword [ebx + 0x3c], eax
mov ecx, dword [ebp + 0xc]
add ecx, 6
mov eax, 1
shl eax, cl
mov dword [ebx + 0x1690], eax
add eax, eax
add eax, eax
call fcn.00402f18
mov dword [ebx + 8], eax
mov edx, dword [ebx + 0x1690]
add edx, edx
add edx, edx
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 0x1690]
shr edx, 1
lea eax, [eax + edx*2]
mov dword [ebx + 0x1698], eax
mov eax, dword [ebx + 0x1690]
lea eax, [eax + eax*2]
mov edx, dword [ebx + 8]
lea eax, [edx + eax]
mov dword [ebx + 0x168c], eax
mov dword [ebx + 0x78], edi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x7c], eax
movzx eax, byte [ebp - 8]
mov byte [ebx + 0x1d], al
mov eax, dword [ebp - 4]
call fcn.004e83b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4ec294
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ec30c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ec2f6
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ac10
test al, al
je 0x4ec2f2
mov eax, dword [ebp - 4]
call fcn.00405954
push eax
call sub.kernel32.dll_DeleteFileA
inc esi
dec ebx
jne 0x4ec2c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec313
lea eax, [ebp - 4]
call fcn.00405490
ret
Function at 0x4f7aa8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
xor eax, eax
push ebp
push 0x4f7cf2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x616e98], eax
xor eax, eax
mov dword [0x616e94], eax
xor eax, eax
mov dword [fcn.00616e8c], eax
push 0x4f7d00
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x5be91c], eax
cmp dword [0x5be91c], 0
je 0x4f7b76
push 0x4f7d08
mov eax, dword [0x5be91c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.00616e8c], eax
cmp dword [fcn.00616e8c], 0
jne 0x4f7cd4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x4f7b4a
cmp dword [ebp - 0x90], 4
je 0x4f7b4e
xor eax, eax
jmp 0x4f7b50
mov al, 1
test al, al
jne 0x4f7b69
push 0x4f7d1c
mov eax, dword [0x5be91c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.00616e8c], eax
cmp dword [fcn.00616e8c], 0
jne 0x4f7cd4
lea ecx, [ebp - 0x98]
mov edx, 0x4f7d34
mov eax, 0x4f7d40
call fcn.004f79e0
mov edx, dword [ebp - 0x98]
mov eax, 0x5be918
call fcn.004054e4
mov edx, dword [0x5be918]
mov eax, 0x65
call fcn.004f790c
mov eax, dword [0x5be918]
call fcn.00405954
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5be914], eax
cmp dword [0x5be914], 0
jne 0x4f7bfe
push 0x4f7d4c
push dword [0x5be918]
push 0x4f7d5c
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.00405814
mov eax, dword [ebp - 0x9c]
mov ecx, 0xd9
mov edx, 0x4f7d80
call fcn.004053bc
push 0x4f7db0
mov eax, dword [0x5be914]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x616e90], eax
push 0x4f7db8
mov eax, dword [0x5be914]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x616e94], eax
push 0x4f7dc4
mov eax, dword [0x5be914]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x616e98], eax
cmp dword [0x616e90], 0
je 0x4f7c58
cmp dword [0x616e94], 0
je 0x4f7c58
cmp dword [0x616e98], 0
jne 0x4f7c8d
push 0x4f7d4c
push dword [0x5be918]
push 0x4f7dd4
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.00405814
mov eax, dword [ebp - 0xa0]
mov ecx, 0xe3
mov edx, 0x4f7d80
call fcn.004053bc
cmp dword [0x616e90], 0
je 0x4f7cc6
cmp dword [0x616e94], 0
je 0x4f7cc6
cmp dword [0x616e98], 0
je 0x4f7cc6
call dword [0x616e90]
test al, al
jne 0x4f7cd4
call dword [0x616e94]
test al, al
je 0x4f7cc6
call dword [0x616e90]
test al, al
jne 0x4f7cd4
xor eax, eax
mov dword [0x616e98], eax
xor eax, eax
mov dword [0x616e94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7cf9
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.004054b4
ret
Function at 0x4f7e74
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
cmp dword [0x5be918], 0
je 0x4f7ef9
mov dword [ebp - 4], 0xa
xor eax, eax
push ebp
push 0x4f7ed4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5be918]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405954
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4f7eca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7ef9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7ede
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x5bfe5c]
mov eax, dword [eax]
call fcn.0045ac8c
dec dword [ebp - 4]
jne 0x4f7e8d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f7f3c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405944
xor eax, eax
push ebp
push 0x4f80e9
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
jmp 0x4f7f78
lea eax, [ebp - 4]
mov edx, 0x4f8100
call fcn.0040575c
inc esi
mov eax, dword [ebp - 4]
call fcn.00405750
cmp eax, 3
jl 0x4f7f6a
jmp 0x4f7f95
lea eax, [ebp - 4]
mov edx, 0x4f8100
call fcn.0040575c
inc esi
mov eax, dword [ebp - 4]
call fcn.00405750
mov ecx, 3
cdq
idiv ecx
test edx, edx
jne 0x4f7f87
mov eax, edi
call fcn.00405490
mov ebx, 1
jmp 0x4f8081
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shr eax, 2
and al, 0x3f
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shl eax, 4
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
shr edx, 4
or al, dl
mov byte [ebp - 6], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
add eax, eax
add eax, eax
and al, 0x3f
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx + 1]
shr edx, 6
or al, dl
mov byte [ebp - 7], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx + 1]
and al, 0x3f
mov byte [ebp - 8], al
push dword [edi]
lea eax, [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov ecx, 0x4f810c
movzx edx, byte [ecx + edx]
call fcn.00405678
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
movzx edx, byte [ebp - 6]
mov ecx, 0x4f810c
movzx edx, byte [ecx + edx]
call fcn.00405678
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
movzx edx, byte [ebp - 7]
mov ecx, 0x4f810c
movzx edx, byte [ecx + edx]
call fcn.00405678
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
movzx edx, byte [ebp - 8]
mov ecx, 0x4f810c
movzx edx, byte [ecx + edx]
call fcn.00405678
push dword [ebp - 0x18]
mov eax, edi
mov edx, 5
call fcn.00405814
add ebx, 3
mov eax, dword [ebp - 4]
call fcn.00405750
sub eax, 2
cmp ebx, eax
jle 0x4f7fba
test esi, esi
jle 0x4f80c6
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4f80a9
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
cmp ebx, 1
jl 0x4f80c6
mov eax, edi
call fcn.004059ac
mov byte [eax + ebx - 1], 0x3d
dec esi
test esi, esi
je 0x4f80c6
dec ebx
test ebx, ebx
jne 0x4f80b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f80f0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004054b4
lea eax, [ebp - 4]
call fcn.00405490
ret