joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e30ac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004d7100
mov eax, dword [ebp - 4]
cmp byte [eax + 0x351], 0
jne 0x4e30df
mov eax, dword [ebp - 4]
cmp byte [eax + 0x350], 1
je 0x4e30df
mov eax, dword [ebp - 4]
cmp byte [eax + 0x350], 2
jne 0x4e310e
push 0
call sub.user32.dll_GetKeyboardLayout
push eax
call sub.imm32.dll_ImmIsIME
test al, al
je 0x4e3104
mov byte [0x6c5d84], 1
push 0x10
mov eax, dword [0x6ed4a0]
push eax
call sub.imm32.dll_ImmSimulateHotKey
mov byte [0x6c5d84], 0
pop ecx
pop ebp
ret
mov byte [0x6c5d84], 1
cmp dword [0x6c5d90], 0
je 0x4e312b
push 1
mov eax, dword [0x6c5d90]
push eax
call sub.user32.dll_ActivateKeyboardLayout
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
add eax, 0x14
mov dword [0x6c5d88], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov dword [0x6c5d8c], eax
pop ecx
pop ebp
ret

Function at 0x4e318c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004d5b9c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x351], 0
jne 0x4e31cb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x350], 1
je 0x4e31cb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x350], 2
je 0x4e31cb
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [0x6c5d90], eax
push 0
call sub.user32.dll_GetKeyboardLayout
push eax
call sub.imm32.dll_ImmIsIME
test al, al
je 0x4e31f0
mov byte [0x6c5d84], 1
push 0x10
mov eax, dword [0x6ed4a0]
push eax
call sub.imm32.dll_ImmSimulateHotKey
mov byte [0x6c5d84], 0
pop ecx
pop ebp
ret

Function at 0x4e36f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jle 0x4e377b
cmp dword [ebx + 0x10], 0
jle 0x4e377b
mov ecx, edx
mov eax, dword [0x4e34bc]
mov dl, 1
call fcn.004e3944
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e3774
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
call fcn.00403268
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004e3b64
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 4]
call fcn.00422498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e377b
mov eax, dword [ebp - 4]
call fcn.00404454
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4e9b54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e9be6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00405af4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405864
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405694
test eax, eax
jns 0x4e9b9b
call fcn.0040431c
push eax
call sub.kernel32.dll_GetTempPathA
test eax, eax
jns 0x4e9baa
call fcn.0040431c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405af4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004e977c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00405428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9bed
lea eax, [ebp - 0xc]
call fcn.004053d4
ret

Function at 0x4e9bf4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405854
xor eax, eax
push ebp
push 0x4e9c9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, 0x105
call fcn.00405af4
mov eax, dword [ebp - 4]
call fcn.00405694
test eax, eax
jne 0x4e9c40
lea eax, [ebp - 4]
mov edx, dword [0x6de43c]
call fcn.0040546c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00405864
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405864
push eax
mov eax, dword [ebp - 4]
call fcn.00405864
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
setne al
neg al
sbb eax, eax
call fcn.004e9fc8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00405864
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004055cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9ca3
lea eax, [ebp - 4]
call fcn.004053d4
ret

Function at 0x4e9ca8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x90], 5
jb 0x4e9cee
cmp dword [ebp - 0x8c], 0
jbe 0x4e9ce5
mov byte [0x6de438], 8
jmp 0x4e9d68
mov byte [0x6de438], 7
jmp 0x4e9d68
cmp dword [ebp - 0x90], 3
jbe 0x4e9d68
cmp dword [ebp - 0x84], 2
jne 0x4e9d09
mov byte [0x6de438], 1
jmp 0x4e9d68
and dword [ebp - 0x88], 0xffff
cmp dword [ebp - 0x8c], 0x5a
jb 0x4e9d25
mov byte [0x6de438], 6
jmp 0x4e9d68
cmp dword [ebp - 0x8c], 0xa
jb 0x4e9d4c
cmp dword [ebp - 0x88], 0x8ae
jb 0x4e9d43
mov byte [0x6de438], 5
jmp 0x4e9d68
mov byte [0x6de438], 4
jmp 0x4e9d68
cmp dword [ebp - 0x88], 0x3e8
jb 0x4e9d61
mov byte [0x6de438], 3
jmp 0x4e9d68
mov byte [0x6de438], 2
mov esp, ebp
pop ebp
ret
Function at 0x4ef65c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4ef7eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x6e3970]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4ef800
call fcn.004056ec
mov eax, dword [ebp - 4]
call fcn.00405864
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x6ed9bc], eax
cmp dword [0x6ed9bc], 0
jne 0x4ef6e1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6e3970]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
mov eax, dword [0x6e4638]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0040b9d8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x409034]
call fcn.0040eb20
call fcn.00404d08
jmp 0x4ef7c8
push 0x4ef80c
mov eax, dword [0x6ed9bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6ed9c8], eax
push 0x4ef81c
mov eax, dword [0x6ed9bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6ed9cc], eax
push 0x4ef824
mov eax, dword [0x6ed9bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6ed9d0], eax
push 0x4ef830
mov eax, dword [0x6ed9bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6ed9d8], eax
push 0x4ef838
mov eax, dword [0x6ed9bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6ed9d4], eax
cmp dword [0x6ed9c8], 0
je 0x4ef796
cmp dword [0x6ed9cc], 0
je 0x4ef796
cmp dword [0x6ed9d0], 0
je 0x4ef796
cmp dword [0x6ed9d8], 0
je 0x4ef796
cmp dword [0x6ed9d4], 0
je 0x4ef796
call dword [0x6ed9d4]
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004055cc
mov eax, dword [ebp - 0x14]
mov edx, 0x4ef84c
call fcn.004057fc
je 0x4ef7af
mov ecx, dword [0x6e4580]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x409034]
call fcn.0040eb20
call fcn.00404d08
call dword [0x6ed9d4]
mov edx, eax
mov eax, 0x6ed9c0
call fcn.004055cc
mov byte [0x6ed9b8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef7f2
lea eax, [ebp - 0x14]
call fcn.004053d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053f8
ret
Function at 0x4fa458
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4089a0]
call fcn.0040604c
xor eax, eax
push ebp
push 0x4fa5f9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6de9dc], 0
jne 0x4fa4b3
mov ecx, dword [0x6e3a4c]
mov dl, 1
mov eax, dword [0x409034]
call fcn.0040ebdc
call fcn.00404d08
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403bb4
mov eax, ebx
call fcn.00405d70
mov dword [ebp - 0x24], eax
mov esi, 0x4fa608
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407360
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405d80
test eax, eax
jle 0x4fa59c
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4fa588
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405644
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4fa52e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.0040565c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4fa544
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.0040565c
mov eax, dword [ebp - 0x54]
call fcn.00405864
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405644
mov eax, dword [ebp - 0x58]
call fcn.00405864
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4fa58a
xor eax, eax
test al, al
je 0x4fa595
mov ebx, 0x15
jmp 0x4fa5a1
mov ebx, 0x10
jmp 0x4fa5a1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x6de9dc]
call fcn.004fa2d8
mov eax, dword [ebp - 4]
call fcn.004fa2d8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa600
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004053f8
lea eax, [ebp - 0xc]
mov edx, dword [0x4089a0]
call fcn.0040611c
ret
Function at 0x500e80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500f07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00405af4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405864
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405694
test eax, eax
jns 0x500ec7
call fcn.0040431c
push eax
call sub.kernel32.dll_GetTempPathA
test eax, eax
jns 0x500ed6
call fcn.0040431c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405af4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004f15d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500f0e
lea eax, [ebp - 0xc]
call fcn.004053d4
ret

Function at 0x5016f8
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + 0xc0]
mov ecx, 0x40
neg ecx
mov eax, dword [edi + ecx*4]
xor eax, dword [edi + ecx*4 + 8]
xor eax, dword [edi + ecx*4 + 0x20]
xor eax, dword [edi + ecx*4 + 0x34]
rol eax, 1
mov dword [edi + ecx*4 + 0x40], eax
inc ecx
jne 0x501705
ret
Function at 0x504b3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x504bfc
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x504bd7
test edi, edi
je 0x504bd7
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0050215c
lea edx, [ebp - 8]
mov eax, edi
call fcn.0050215c
mov ebx, 1
lea eax, [ebp - 4]
call fcn.004058c4
mov edx, dword [ebp - 8]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
cmp ebx, 0x15
jne 0x504b7c
mov edx, dword [esi]
mov eax, dword [ebp - 4]
call fcn.0040a1c0
test al, al
je 0x504baf
xor ebx, ebx
jmp 0x504bb2
or ebx, 0xffffffff
mov edx, dword [esi]
mov eax, dword [ebp - 4]
call fcn.0040a1c0
test al, al
jne 0x504bc9
mov eax, esi
call fcn.004053d4
jmp 0x504be1
mov eax, esi
mov edx, 0x504c18
call fcn.00405428
jmp 0x504be1
or ebx, 0xffffffff
mov eax, esi
call fcn.004053d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504c03
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053f8
ret

Function at 0x5063ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x506468
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
movzx edx, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x5063ec
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.00403268
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x506443
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.0041ef50
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x506443
lea edx, [ebp - 4]
mov eax, dword [0x6e42ac]
call fcn.004078ac
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00506240
mov eax, dword [ebx + 0x20]
movzx eax, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50646f
lea eax, [ebp - 4]
call fcn.004053d4
ret
Function at 0x53ce58
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53cf0f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405864
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x53ce9a
call fcn.00404db4
jmp 0x53cf16
mov eax, ebx
call fcn.00402ff4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405864
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x53cec3
call fcn.00404db4
jmp 0x53cf16
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x53cf24
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x53cee4
call fcn.00404db4
jmp 0x53cf16
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53cf16
mov eax, dword [ebp - 8]
call fcn.00403010
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5493c0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov al, byte [ebp - 2]
and al, 0x20
mov dl, byte [ebp - 2]
and dl, 0x1e
and edx, 0xff
shr edx, 1
or al, dl
mov dl, byte [ebp - 2]
and dl, 1
shl edx, 4
or al, dl
mov byte [ebp - 4], al
xor eax, eax
mov al, byte [ebp - 4]
xor edx, edx
mov dl, byte [ebp - 1]
shl edx, 3
lea edx, [edx*8 + 0x6dfaac]
mov al, byte [edx + eax]
and al, 0xf
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x549410
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x549428
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x549421
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403bb4
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x6dfcac]
and al, 7
and eax, 0xff
mov ecx, 7
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 0x6dfcac]
shr edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
and eax, edx
je 0x54949a
mov eax, dword [ebp - 0xc]
and eax, 7
mov ecx, 7
sub ecx, eax
mov al, 1
shl al, cl
mov edx, dword [ebp - 0xc]
shr edx, 3
mov ecx, dword [ebp - 8]
or byte [ecx + edx], al
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x38
jne 0x549447
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x549748
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x549761
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x54975a
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x549773
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x54976c
mov eax, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 5
lea ecx, [ebp - 0x12]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00549288
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0x20]
xor byte [ebp + edx - 0x12], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jne 0x549793
xor eax, eax
mov al, byte [ebp - 0x12]
shr eax, 2
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x12]
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x11]
shr edx, 4
or al, dl
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x10]
shr edx, 6
or al, dl
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x10]
and al, 0x3f
mov byte [ebp - 0x17], al
xor eax, eax
mov al, byte [ebp - 0xf]
shr eax, 2
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xf]
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0xe]
shr edx, 4
or al, dl
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0xe]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0xd]
shr edx, 6
or al, dl
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0xd]
and al, 0x3f
mov byte [ebp - 0x13], al
xor eax, eax
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov dl, byte [ebp + edx - 0x1a]
call fcn.005493c0
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x1a], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jne 0x54982b
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, eax
mov al, byte [ebp + eax - 0x1a]
shl eax, 4
mov edx, dword [ebp - 0x20]
add edx, edx
or al, byte [ebp + edx - 0x19]
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x12], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jne 0x54984f
lea eax, [ebp - 0x12]
mov edx, 5
call fcn.00549324
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov al, byte [ebp + eax - 0x12]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jne 0x549886
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x54a920
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00403bb4
pop ecx
pop ecx
pop ebp
ret

Function at 0x54ad50
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e0
push ebx
xor ebx, ebx
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405854
xor eax, eax
push ebp
push 0x54ae91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004053d4
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405864
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x54ae69
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405864
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x54ae4b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x819]
xor ecx, ecx
mov edx, 0x801
call fcn.00403bb4
lea eax, [ebp - 0x18]
push eax
push 0x800
lea eax, [ebp - 0x819]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x18], 0
jbe 0x54ae2e
lea edx, [ebp - 0x820]
lea eax, [ebp - 0x819]
call fcn.0040b4e8
mov edx, dword [ebp - 0x820]
mov eax, dword [ebp - 0xc]
call fcn.004056a0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], 0
ja 0x54addb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ae52
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x552f44
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x552f78
add eax, 3
sar eax, 2
test eax, eax
jle 0x5530d6
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x552fb5
je 0x55301b
sub eax, 0x2b
je 0x553007
sub eax, 4
je 0x553011
dec eax
sub eax, 0xa
jb 0x552ff1
jmp 0x553023
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x552fc7
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x552fdb
jmp 0x553023
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x553023
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x553023
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x553023
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x553023
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x553023
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x552f92
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x553087
cmp byte [ebp - 0x21], 0xff
jne 0x553087
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x5530c7
cmp byte [ebp - 0x22], 0xff
je 0x5530c7
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x552f8d
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret