joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b2f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ea644]
test eax, eax
je 0x46b30d
mov eax, 1
jmp 0x46b3e4
mov dword [esp], str.mlang.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46b331
mov eax, 0
jmp 0x46b3e4
mov dword [esp + 4], str.ConvertINetString
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6ea644], eax
mov dword [esp + 4], str.ConvertINetMultiByteToUnicode
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6ea648], eax
mov dword [esp + 4], str.ConvertINetUnicodeToMultiByte
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6ea64c], eax
mov dword [esp + 4], str.IsConvertINetStringAvailable
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6ea650], eax
mov dword [esp + 4], str.LcidToRfc1766A
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6ea654], eax
mov dword [esp + 4], str.Rfc1766ToLcidA
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6ea658], eax
mov eax, 1
leave
ret
Function at 0x46e510
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
call fcn.0046f570
mov edi, eax
call fcn.0046e300
mov esi, eax
jmp 0x46e5b6
mov dword [esp + 4], 0x200
mov dword [esp], esi
call fcn.00617270
test eax, eax
je 0x46e5d0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
mov ebp, eax
jne 0x46e59e
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x46e5c6
mov dword [esp], ebx
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x46e5d0
mov dword [esp + 8], 0xa9
mov dword [esp + 4], str.libexpat_metalink_parser.c
mov dword [esp], 0x66533f
call fcn.00626410
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.006170f0
test eax, eax
je 0x46e5d0
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
je 0x46e530
xor ebx, ebx
jmp 0x46e5d5
mov ebx, 0xc9
mov dword [esp], esi
call fcn.00615f70
mov eax, dword [esp + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0046f4b0
mov dword [esp], edi
mov ebx, eax
call fcn.0046f510
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4bbca0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x6ea6e8]
test eax, eax
je 0x4bbcb0
ret
push edi
push esi
push ebx
sub esp, 0x20
mov dword [0x6ea6e8], 1
mov dword [esp], str.OPENSSL_ia32cap
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x4bbe10
cmp byte [eax], 0x7e
sete al
mov edi, eax
mov esi, eax
and esi, 0xff
add esi, ebx
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str._I64i
mov dword [esp], esi
call sub.msvcrt.dll_sscanf
test eax, eax
je 0x4bbd90
mov eax, edi
test al, al
jne 0x4bbdc0
cmp byte [ebx], 0x3a
je 0x4bbe30
mov dword [0x6ef530], 0
mov dword [esp + 4], 0x3a
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4bbd70
cmp byte [eax + 1], 0x7e
sete bl
mov dword [esp + 8], 0
mov dword [esp + 4], 0
xor edx, edx
mov dl, bl
lea eax, [eax + edx + 1]
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
test bl, bl
je 0x4bbdf0
not eax
and dword [0x6ef530], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
or ah, 4
mov dword [0x6ef528], eax
mov dword [0x6ef52c], edx
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_strtoul
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
jmp 0x4bbd08
mov dword [esp], 0x6ef528
call fcn.004c0050
mov esi, dword [esp + 0x18]
not esi
mov ecx, dword [esp + 0x1c]
not ecx
and eax, esi
mov dword [esp + 0x18], eax
and edx, ecx
mov dword [esp + 0x1c], edx
jmp 0x4bbd1b
mov dword [0x6ef530], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
jmp 0x4bbd78
mov dword [esp], 0x6ef528
call fcn.004c0050
jmp 0x4bbd78
mov dword [esp], 0x6ef528
call fcn.004c0050
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jmp 0x4bbd1b
Function at 0x4bbfc0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x144
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ecx
mov ebx, eax
test eax, eax
je 0x4bbfee
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
push edx
test eax, eax
jne 0x4bc0f0
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
lea esi, [esp + 0x40]
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov byte [esp + 0x13f], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4bc0c0
call fcn.004bbe50
test eax, eax
jle 0x4bc0c0
mov dword [esp + 4], str.OpenSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x4bc0b4
mov dword [esp + 0x3c], esi
mov dword [esp + 0x20], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
sub esp, 0x24
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push eax
add esp, 0x144
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
add esp, 0x144
pop ebx
pop esi
ret
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
lea esi, [esp + 0x40]
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnprintf]
test eax, eax
js 0x4bc150
mov dword [esp + 0x10], 0
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
add esp, 0x144
pop ebx
pop esi
ret
mov eax, 0x100
jmp 0x4bc11f
Function at 0x4bc380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4bc450
mov eax, ebx
or eax, esi
test al, 3
jne 0x4bc420
cmp ecx, 8
jbe 0x4bc420
lea eax, [ecx - 4]
shr eax, 2
lea ebp, [eax + 1]
lea edi, [ebp*4]
xor eax, eax
xor edx, edx
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + eax*4]
or edx, ecx
inc eax
cmp ebp, eax
ja 0x4bc3bd
mov ecx, dword [esp + 0x1c]
movzx eax, dh
or eax, edx
mov ebp, edx
shr ebp, 0x10
or eax, ebp
shr edx, 0x18
mov ebp, edx
or ebp, eax
cmp ecx, edi
je 0x4bc40f
mov al, byte [esi + edi]
xor al, byte [ebx + edi]
or ebp, eax
lea eax, [edi + 1]
cmp ecx, eax
jbe 0x4bc40f
mov dl, byte [esi + edi + 1]
xor dl, byte [ebx + edi + 1]
mov al, dl
or ebp, eax
add edi, 2
cmp ecx, edi
jbe 0x4bc40f
mov al, byte [esi + edi]
xor al, byte [ebx + edi]
or ebp, eax
mov eax, ebp
and eax, 0xff
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
xor eax, eax
mov edx, ebp
mov edi, ecx
nop
lea esi, [esi]
mov cl, byte [esi + eax]
xor cl, byte [ebx + eax]
or edx, ecx
inc eax
cmp eax, edi
jne 0x4bc430
mov ebp, edx
jmp 0x4bc40f
xor eax, eax
jmp 0x4bc416
Function at 0x4c3c30
Capabilities:
Hash data with md5

Disassembly:
push edi
mov edx, dword [esp + 8]
mov dword [edx + 0x58], 0
lea edi, [edx + 4]
and edi, 0xfffffffc
mov ecx, edx
sub ecx, edi
add ecx, 0x5c
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov al, 1
pop edi
ret
Function at 0x4ed5c0
Capabilities:
Check if file exists

Disassembly:
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
call fcn.004ecd30
mov esi, eax
test eax, eax
je 0x4ed630
mov dword [esp], 0x63a5a0
call fcn.004eaad0
mov ebx, eax
test eax, eax
je 0x4ed720
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004eae50
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6a
mov dword [esp], ebx
call fcn.004eb770
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], 0xaf
mov dword [esp + 0xc], str.bss_file.c
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 2
call fcn.004f5490
mov dword [esp + 0x14], 0x6833af
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6833b2
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], str.fopen_
mov dword [esp], 5
call fcn.004f5e00
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 2
je 0x4ed6e0
mov dword [esp + 0x10], 0xb4
mov dword [esp + 0xc], str.bss_file.c
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6d
mov dword [esp], 0x20
call fcn.004f5490
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 0x10], 0xb2
mov dword [esp + 0xc], str.bss_file.c
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x6d
mov dword [esp], 0x20
call fcn.004f5490
xor eax, eax
jmp 0x4ed61c
mov dword [esp], esi
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x4ed61c
Function at 0x4f1d50
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
test esi, esi
je 0x4f1d9c
lea edi, [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__stat]
test eax, eax
js 0x4f1d9c
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x24
mov dword [esp], edi
call fcn.004f2390
test ebx, ebx
jne 0x4f1db0
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x6836e0
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x4f1d9c
test word [esp + 0x32], 0x3000
je 0x4f1df8
cmp ebx, 0xffffffff
je 0x4f1ef0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll_setvbuf
xor ebp, ebp
test ebx, ebx
jle 0x4f1e90
mov esi, ebx
cmp ebx, 0x400
jle 0x4f1e11
mov esi, 0x400
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], 0x6eab40
call sub.msvcrt.dll_fread
test eax, eax
jle 0x4f1e60
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
mov dword [esp + 4], esi
mov dword [esp], 0x6eab40
call fcn.004f2390
mov eax, dword [esp + 0x1c]
add ebp, eax
sub ebx, esi
test ebx, ebx
jg 0x4f1dfa
lea esi, [esi]
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x400
mov dword [esp], 0x6eab40
call fcn.004c0350
mov eax, ebp
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp], 0x6eab40
call sub.msvcrt.dll_fread
test eax, eax
jle 0x4f1e60
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
mov dword [esp + 4], 0x400
mov dword [esp], 0x6eab40
call fcn.004f2390
mov eax, dword [esp + 0x1c]
add ebp, eax
jmp 0x4f1dfa
mov ebx, 0x800
jmp 0x4f1dd8
Function at 0x4f2050
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
call fcn.0056c740
test eax, eax
je 0x4f20a0
call fcn.0056c740
test eax, eax
je 0x4f20cf
mov esi, 0x6836e6
cmp byte [esi], 0
je 0x4f2086
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, 6
cmp dword [esp + 0x24], eax
ja 0x4f20f0
mov byte [ebx], 0
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], str.RANDFILE
call sub.msvcrt.dll_getenv
mov esi, eax
test eax, eax
je 0x4f2062
cmp byte [eax], 0
je 0x4f20c6
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, dword [esp + 0x24]
jb 0x4f2140
call fcn.0056c740
test eax, eax
jne 0x4f2070
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
mov esi, eax
test eax, eax
jne 0x4f2070
jmp 0x4f206b
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004ea9d0
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6836f7
mov dword [esp], ebx
call fcn.004eaa50
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str..rnd
mov dword [esp], ebx
call fcn.004eaa50
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004ea9d0
cmp dword [esp + 0x24], eax
ja 0x4f2089
xor eax, eax
jmp 0x4f208b
Function at 0x5379b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
test ebp, ebp
je 0x537a90
test ecx, ecx
je 0x537a40
cmp ecx, 1
jbe 0x537a60
lea edx, [ecx - 1]
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x18], edx
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_memchr
test eax, eax
jne 0x537a90
mov edx, dword [esp + 0x18]
mov eax, edx
mov ecx, dword [esp + 0x1c]
cmp byte [ebp + eax], 0
jne 0x537a1a
mov ecx, eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], 2
mov dword [esp + 0x40], esi
mov edx, ebp
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00535510
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov ecx, eax
cmp eax, 1
jbe 0x537a1a
lea eax, [eax - 1]
jmp 0x537a11
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_memchr
test eax, eax
jne 0x537a90
mov ecx, 1
jmp 0x537a1a
mov eax, 0xfffffffe
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x546010
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov dword [esp], 0
call fcn.005ca470
mov ebx, eax
test eax, eax
je 0x5460c0
test esi, esi
je 0x5460d0
mov edi, esi
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.005ca510
test eax, eax
jle 0x546090
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00545a90
mov ebp, eax
test esi, esi
je 0x546100
mov dword [esp], ebx
call fcn.005ca4d0
mov eax, ebp
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esp + 0x38], 0x10
jne 0x5460a0
xor ebp, ebp
jmp 0x54606d
call fcn.004f5840
and eax, 0xfff
cmp eax, 0x72
jne 0x546097
call fcn.004f5590
mov ebp, 1
jmp 0x54606d
xor ebp, ebp
xor edi, edi
jmp 0x54606d
mov dword [esp], str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test eax, eax
je 0x546110
mov dword [esp], eax
call fcn.004ea6a0
mov edi, eax
test eax, eax
jne 0x54603b
xor edi, edi
xor ebp, ebp
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
call fcn.004bce80
jmp 0x546075
call fcn.005c5d90
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebp, [eax + 0xd]
mov dword [esp + 8], 0x21b
mov dword [esp + 4], str.conf_mod.c
mov dword [esp], ebp
call fcn.004bc970
mov edi, eax
test eax, eax
je 0x5460f2
call fcn.005c5d90
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004ea9d0
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x68eb1f
mov dword [esp], edi
call fcn.004eaa50
mov dword [esp + 8], ebp
mov dword [esp + 4], str.openssl.cnf
mov dword [esp], edi
call fcn.004eaa50
jmp 0x54603b
Function at 0x5b5710
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
push ecx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
test esi, esi
jle 0x5b57bf
lea ecx, [edi + 4]
mov dword [esp], 0
lea esi, [esi]
lea edi, [edi]
xor edx, edx
mov dl, byte [ebx]
cmp esi, 2
jle 0x5b57c8
mov edi, edx
shl edi, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
or edx, edi
movzx edi, byte [ebx + 2]
and edi, 0xff
or edx, edi
mov edi, ecx
mov ebp, edx
shr ebp, 0x12
mov al, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 4], al
mov ebp, edx
shr ebp, 0xc
and ebp, 0x3f
mov al, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 3], al
mov ebp, edx
shr ebp, 6
and ebp, 0x3f
mov al, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 2], al
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
add dword [esp], 4
add ebx, 3
sub esi, 3
add ecx, 4
test esi, esi
jg 0x5b5740
mov byte [edi], 0
mov eax, dword [esp]
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
jmp 0x5b57b3
shl edx, 0x10
cmp esi, 2
je 0x5b57fa
mov edi, edx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 4], al
shr edx, 0xc
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 3], al
mov dl, 0x3d
mov edi, ecx
mov byte [ecx - 2], dl
mov byte [ecx - 1], 0x3d
jmp 0x5b57a2
movzx edi, byte [ebx + 1]
and edi, 0xff
shl edi, 8
or edx, edi
mov edi, edx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 4], al
mov edi, edx
shr edi, 0xc
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 3], al
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x5b57ef
Function at 0x5cad30
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x5cadc1
test ebx, ebx
je 0x5cade0
test esi, esi
je 0x5cadd0
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
lea ebp, [esp + 0x14]
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004f1bb0
test eax, eax
je 0x5cad90
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x69f248
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x5cadf0
mov dword [esp + 0x14], 0x69f240
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004f1bb0
test eax, eax
jne 0x5cad76
xor eax, eax
jmp 0x5cad79
lea ebp, [esp + 0x14]
jmp 0x5cad9e
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
jmp 0x5cad79
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x5cad79
jmp 0x5cad9e

Function at 0x5ed440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov eax, dword [esi + 4]
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x5ed500
mov ecx, eax
mov eax, edx
mov edi, dword [esp + 0x30]
cmp dword [edi + 8], eax
jl 0x5ed515
test ecx, ecx
jle 0x5ed53d
mov eax, dword [esp + 0x30]
mov ebp, dword [eax]
mov edi, dword [ebx]
mov ecx, dword [esi]
xor eax, eax
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ecx + eax*4]
xor edx, dword [edi + eax*4]
mov dword [ebp + eax*4], edx
inc eax
cmp dword [esi + 4], eax
jg 0x5ed490
mov edx, dword [ebx + 4]
cmp edx, eax
jle 0x5ed4be
mov edi, dword [esp + 0x30]
mov esi, dword [edi]
mov ecx, dword [ebx]
nop
mov edx, dword [ecx + eax*4]
mov dword [esi + eax*4], edx
inc eax
mov edx, dword [ebx + 4]
cmp edx, eax
jg 0x5ed4b0
mov eax, dword [esp + 0x30]
mov dword [eax + 4], edx
test edx, edx
jle 0x5ed530
mov eax, dword [eax]
lea eax, [eax + edx*4 - 4]
nop
sub eax, 4
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x5ed4dd
dec edx
jne 0x5ed4d0
mov eax, dword [esp + 0x30]
mov dword [eax + 4], edx
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, edx
mov edx, ebx
mov ebx, esi
mov esi, edx
mov edi, dword [esp + 0x30]
cmp dword [edi + 8], eax
jge 0x5ed46e
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004d7f40
test eax, eax
jne 0x5ed544
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x5ed4a0
mov ecx, dword [esi + 4]
jmp 0x5ed46e
Function at 0x5fdbe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x5fdd70
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x5fdd70
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x5fdd70
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x5fdd70
mov eax, dword [esi + 8]
mov dword [ebx + 0x14], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x2c], 2
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], 0
test eax, eax
js 0x5fdd35
jne 0x5fdd3a
mov dword [esi + 4], 0x71
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0060a370
mov dword [ebx + 0x30], eax
mov dword [esi + 0x28], 0
mov dword [esp], esi
xor esi, esi
call fcn.00605550
mov ebx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x4c]
add eax, eax
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x44]
lea edx, [ecx + 0x7fffffff]
lea ecx, [edx + edx]
mov word [eax + edx*2], si
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x84]
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x74], 0
lea edx, [eax + eax*2]
shl edx, 2
lea eax, [edx + 0x6a7880]
movzx ecx, word [edx + 0x6a7882]
movzx edx, word [edx + 0x6a7880]
mov dword [ebx + 0x16b4], 0
mov dword [ebx + 0x78], 2
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x8c], edx
movzx edx, word [eax + 4]
movzx eax, word [eax + 6]
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x90], edx
mov dword [ebx + 0x7c], eax
xor eax, eax
mov dword [ebx + 0x48], 0
add esp, 0x14
pop ebx
pop esi
ret
neg eax
mov dword [esi + 0x18], eax
cmp eax, 2
mov dword [esi + 4], 0x2a
jne 0x5fdc53
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0060aa00
jmp 0x5fdc6f
mov eax, 0xfffffffe
jmp 0x5fdd2f
Function at 0x60b720
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.CHARSET
call sub.msvcrt.dll_getenv
test eax, eax
je 0x60b742
cmp byte [eax], 0
mov edx, str.ASCII
cmove eax, edx
add esp, 0x1c
ret
mov eax, str.ASCII
add esp, 0x1c
ret