joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0ac0
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_RtlMoveMemory
push 0
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 0x10]
push eax
push 8
call sub.NTdll.dll_NtQuerySystemInformation
xor edx, edx
mov dword [esp], edx
test eax, eax
jne 0x4e0c06
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ebp, dword [esi + 4]
dec ebp
test ebp, ebp
jb 0x4e0b93
inc ebp
xor edi, edi
mov ecx, dword [esi + 0x10]
mov eax, edi
shl eax, 4
lea eax, [eax + eax*2]
add ecx, eax
mov ebx, dword [esi + 0xc]
add ebx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, dword [ecx]
adc edx, dword [ecx + 4]
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add eax, dword [ecx + 8]
adc edx, dword [ecx + 0xc]
add eax, dword [ecx + 0x10]
adc edx, dword [ecx + 0x14]
add eax, dword [ecx + 0x18]
adc edx, dword [ecx + 0x1c]
add eax, dword [ecx + 0x20]
adc edx, dword [ecx + 0x24]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
sub eax, dword [ebx + 0x10]
sbb edx, dword [ebx + 0x14]
sub eax, dword [ebx + 0x18]
sbb edx, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x20]
sbb edx, dword [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
inc edi
dec ebp
jne 0x4e0b23
mov eax, dword [esp + 8]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x24], eax
cmp dword [esp + 0xc], 0
jne 0x4e0bbb
cmp dword [esp + 8], 0
je 0x4e0bee
fild qword [esp + 0x10]
fild qword [esp + 8]
fdivp st(1)
fstp qword [esp + 0x18]
wait
fld qword [esp + 0x18]
fmul dword [0x4e0c14]
fstp qword [esp + 0x18]
wait
fld qword [esp + 0x18]
call fcn.004034ec
mov edx, 0x64
sub edx, eax
mov dword [esp], edx
cmp dword [esp], 0x64
jle 0x4e0bfb
mov dword [esp], 0x64
cmp dword [esp], 0
jge 0x4e0c06
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e46ec
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x4e4712
shr edx, 1
xor edx, eax
jmp 0x4e4714
shr edx, 1
inc ecx
jne 0x4e4704
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x4e46fd
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4e472c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4e4735
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004872b8
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4e47e2
cmp dword [ebp - 0xc], 0x2800
jl 0x4e4790
mov dword [ebp - 8], 0x2800
jmp 0x4e4796
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x4e47da
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x55e604]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x4e47b1
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x4e4778
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e64a4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4e653e
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x552340]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x552340]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x552340]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x552340]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4e64c3
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4e6554
dec edx
je 0x4e6589
jmp 0x4e65da
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x552340]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x552340]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4e65da
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x552340]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x552340]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x552340]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e66bc
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4e66db
add edx, 3
sar edx, 2
test edx, edx
jle 0x4e67e9
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4e6710
je 0x4e6753
sub ecx, 0x2b
je 0x4e6749
sub ecx, 4
je 0x4e674e
dec ecx
sub ecx, 0xa
jb 0x4e673b
jmp 0x4e6756
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4e6722
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4e672d
jmp 0x4e6756
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4e6756
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4e6756
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4e6756
mov byte [eax], 0x3e
jmp 0x4e6756
mov byte [eax], 0x3f
jmp 0x4e6756
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4e66f3
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4e67a7
cmp byte [esp + 7], 0xff
jne 0x4e67a7
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4e67de
cmp dl, 0xff
je 0x4e67de
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4e66ea
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4e763c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4e765d
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4e764a
pop edi
pop esi
pop ebx
ret

Function at 0x4ec040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x4ec094
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x5545c0]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x5549c0]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x554dc0]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x5551c0]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x4ec04e
pop edi
pop esi
pop ebx
ret
Function at 0x4eca88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4ecc88
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x482c60]
call fcn.00404370
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ecaf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00487ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ecb4f
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4ecb8c
mov eax, dword [ebp - 0xc]
call fcn.004043a0
lea eax, [ebp - 0x24]
mov ecx, 0x4ecd10
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x24]
call fcn.004ed928
jmp 0x4ecc65
lea edx, [ebp - 0x18]
mov ecx, 8
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dl, 1
mov eax, dword [0x482c60]
call fcn.00404370
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ecbea
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0048750c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004879fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ecc51
mov eax, dword [ebp - 0x10]
call fcn.004043a0
mov eax, dword [ebp - 0xc]
call fcn.004043a0
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecc8f
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.004066d0
lea eax, [ebp - 4]
call fcn.004066c8
ret
Function at 0x4ecdac
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4ecdb5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
mov eax, dword [ebp - 8]
call fcn.004066c0
mov eax, dword [ebp + 8]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4ecf61
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ecf2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp dword [ebx], 0
jne 0x4ece11
call fcn.00405280
jmp 0x4ecf31
lea eax, [ebp - 0x10]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004ecf8c
test al, al
jne 0x4ece3d
call fcn.00405280
jmp 0x4ecf31
push 2
lea eax, [ebp - 0x14]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x14]
call fcn.00406764
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x4ece6d
call fcn.00405280
jmp 0x4ecf31
lea eax, [ebp - 0x18]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x18]
call fcn.004eca88
test al, al
jne 0x4ece93
call fcn.00405280
jmp 0x4ecf31
push 2
lea eax, [ebp - 0x1c]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
push esi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x4eceb6
call fcn.00405280
jmp 0x4ecf31
lea eax, [ebp - 0x20]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x20]
mov edx, ebx
mov ecx, dword [ebp - 8]
call fcn.004ed2a0
test al, al
jne 0x4ecede
call fcn.00405280
jmp 0x4ecf31
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecf31
lea eax, [ebp - 0x24]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x24]
call fcn.0046fd24
test al, al
je 0x4ecf29
lea eax, [ebp - 0x28]
mov ecx, 0x4ecf80
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x28]
call fcn.00406764
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecf68
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.004066d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004066d0
lea eax, [ebp + 8]
call fcn.004066c8
ret
Function at 0x4ecf8c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
mov eax, dword [ebp - 8]
call fcn.004066c0
mov eax, dword [ebp - 0xc]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4ed18b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
call fcn.0046fd24
test al, al
jne 0x4ed002
lea eax, [ebp - 0x1c]
mov ecx, 0x4ed1ac
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x1c]
call fcn.004ed928
jmp 0x4ed163
mov dl, 1
mov eax, dword [0x482c60]
call fcn.00404370
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4ed034
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00487ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ed092
mov dl, 1
mov eax, dword [0x482c60]
call fcn.00404370
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4ed0ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4d73d0]
call fcn.004dc56c
mov eax, dword [ebp - 8]
call fcn.00406764
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.004879fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ed14f
mov eax, dword [ebp - 0x14]
call fcn.004043a0
mov eax, dword [ebp - 0x18]
call fcn.004043a0
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed192
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.004066d0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004066d0
ret
Function at 0x4ed2a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4ed2a9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
mov eax, dword [ebp - 8]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4ed53a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.0046fd24
test al, al
jne 0x4ed314
lea eax, [ebp - 0x18]
mov ecx, 0x4ed558
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x18]
call fcn.004ed928
jmp 0x4ed512
cmp dword [ebx], 0
jne 0x4ed328
mov eax, 0x4ed57c
call fcn.004ed928
jmp 0x4ed512
xor eax, eax
push ebp
push 0x4ed4fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4e4830]
call fcn.004e4bac
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x4eca20]
call fcn.00404370
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0xdc], edx
mov dword [eax + 0xd8], 0x4ed6ec
mov eax, dword [ebp - 0x10]
add eax, 0x8c
mov edx, dword [ebp - 8]
call fcn.004066d8
xor eax, eax
push ebp
push 0x4ed39f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004e4c80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ed3fa
xor eax, eax
push ebp
push 0x4ed421
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004e5c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ed4c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed505
cmp dword [ebp - 0x14], 0
je 0x4ed4e1
mov eax, dword [ebp - 0x14]
call fcn.004043a0
cmp dword [ebp - 0x10], 0
je 0x4ed4ef
mov eax, dword [ebp - 0x10]
call fcn.004043a0
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed541
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.004066d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004066d0
ret

Function at 0x4f07e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004f1694
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4f12f0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x4f1335
lea eax, [ebp - 0x60]
call fcn.004f07e0
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.004f0808
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004f08dc
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x4f1337
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x4f1360
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x4f1366
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x4f1345
lea eax, [ebp - 0x60]
call fcn.004f07e0
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004f0808
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004f117c
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004f08dc
lea eax, [ebp - 0x60]
call fcn.004f07e0
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004f0808
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.004f0808
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004f08dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f5454
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f545d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4f5623
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004f57b8
xor eax, eax
push ebp
push 0x4f55f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4f54ad
call fcn.00405280
jmp 0x4f55fb
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4f5582
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4f5502
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4f5502
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004f53a8
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406b7c
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4f5541
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004f53a8
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406b7c
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.00406764
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4f55de
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004f53a8
push dword [ebp - 0x24]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x4f5640
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406b7c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.004f53c8
jmp 0x4f55de
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4f55a5
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4f55a5
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4f55bb
mov eax, ebx
call fcn.00406764
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4f55de
lea eax, [ebp - 0x28]
mov ecx, 0x4f5640
mov edx, ebx
call fcn.00406aac
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004f53c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f55fb
mov eax, dword [ebp - 4]
call fcn.004f57c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f562a
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004066d0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004066d0
ret
Function at 0x4f998c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x4f99a0
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x4f999f
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.004061e0
xor ebx, ebx
cmp esi, dword [esp]
jge 0x4f9b04
inc ebx
mov eax, edi
call fcn.004060b8
movzx edx, byte [ebp + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x4f9abd
inc ebx
mov eax, edi
call fcn.004060b8
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x4f9a8c
inc ebx
mov eax, edi
call fcn.004060b8
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004060b8
movzx edx, byte [ebp + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x4f9af8
inc ebx
mov eax, edi
call fcn.004060b8
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004060b8
mov byte [eax + ebx - 1], 0x3d
jmp 0x4f9af8
inc ebx
mov eax, edi
call fcn.004060b8
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004060b8
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.004060b8
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x4f99d4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret