joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b929c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4b92cd
dec al
je 0x4b9308
dec al
je 0x4b934d
dec al
je 0x4b93b6
jmp 0x4b9440
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4b9440
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4b92dd
jmp 0x4b9440
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4b9440
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4b9318
jmp 0x4b9440
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4b9440
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4b937c
xor ebp, ebp
jmp 0x4b938c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4b9395
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4b935d
jmp 0x4b9440
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4b9440
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4b940f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004b669c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4b93ca
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bd9f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov byte [ebp - 5], 1
mov ebx, dword [edi + 0x1a8]
mov esi, dword [ebx + 0xc]
mov eax, esi
mov edx, dword [0x42e370]
call fcn.0040440c
test al, al
je 0x4bda2b
mov eax, esi
call fcn.00436050
cmp al, 6
je 0x4bdb21
xor eax, eax
push ebp
push 0x4bdb13
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42e370]
call fcn.0043564c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bdb02
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 6
mov eax, dword [ebp - 0xc]
call fcn.00437144
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
call dword [edx + 0x24]
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00435f64
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
call fcn.0043025c
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004205a8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00435f64
pop edx
call fcn.00430640
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00435f64
xor ecx, ecx
xor edx, edx
call fcn.00430594
mov eax, dword [edi + 0x1a8]
mov edx, dword [ebp - 0xc]
call fcn.00432eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bdb09
mov eax, dword [ebp - 0xc]
call fcn.0040426c
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdeb4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x42e370]
call fcn.0043564c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4be04e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 6
mov eax, dword [ebp - 8]
call fcn.00437144
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.004334a8
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
call fcn.004334c0
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.00435f64
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c8]
call fcn.0043025c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004205a8
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00435f64
pop edx
call fcn.00430640
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00435f64
xor ecx, ecx
xor edx, edx
call fcn.00430594
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1a0]
push 4
mov eax, ebx
call fcn.00430aec
push eax
call sub.gdi32.dll_SetStretchBltMode
push 0
push 0
push 0
mov eax, ebx
call fcn.00430aec
push eax
call sub.gdi32.dll_SetBrushOrgEx
push 0xcc0020
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00435f64
call fcn.00430aec
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004bdc4c
mov esi, dword [ebp - 0xc]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004bdc4c
sub esi, dword [ebp - 0x24]
push esi
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004bdc4c
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004bdc4c
sub esi, dword [ebp - 0x48]
push esi
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 4]
call fcn.004bdc4c
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.004bdc4c
mov eax, dword [ebp - 0x68]
push eax
mov eax, ebx
call fcn.00430aec
push eax
call sub.gdi32.dll_StretchBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be055
mov eax, dword [ebp - 8]
call fcn.0040426c
ret
Function at 0x4c2e60
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x40a040]
call fcn.00406e64
xor eax, eax
push ebp
push 0x4c3021
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x51b30c], 0
jne 0x4c2eb4
mov ecx, dword [0x51fef4]
mov dl, 1
mov eax, dword [0x40b10c]
call fcn.00412114
call fcn.00404c60
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.004039d0
mov eax, ebx
call fcn.00405f0c
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x4c3030
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.0040856c
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x4c2efb
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4c2fc7
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4c2fb3
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.004062ec
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406354
mov eax, dword [ebp - 4]
test eax, eax
je 0x4c2f56
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4c2f56
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004056d0
mov ebx, eax
test ebx, ebx
je 0x4c2f61
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4c2f7e
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4c2f7e
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004056d0
mov edi, eax
test edi, edi
je 0x4c2f89
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.00406168
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00406168
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
sete al
jmp 0x4c2fb5
xor eax, eax
test al, al
je 0x4c2fc0
mov ebx, 0x15
jmp 0x4c2fcc
mov ebx, 0x10
jmp 0x4c2fcc
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x51b30c]
call fcn.004c2c70
mov eax, dword [ebp - 0xc]
call fcn.004c2c70
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00408584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3028
lea eax, [ebp - 0x14]
mov edx, dword [0x40a040]
call fcn.00406f3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004060d4
ret
Function at 0x4c62e0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff48
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c649c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xb0]
mov eax, esi
call fcn.004c5fa4
mov eax, ebx
call fcn.0042fce8
dec al
je 0x4c632a
dec al
je 0x4c6333
jmp 0x4c633c
mov byte [ebp - 0x97], 2
jmp 0x4c6343
mov byte [ebp - 0x97], 1
jmp 0x4c6343
mov byte [ebp - 0x97], 0
mov eax, dword [ebp - 0xac]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0xac], eax
mov eax, ebx
call fcn.0042fc60
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
mov dword [ebp - 0xa4], eax
mov eax, ebx
call fcn.0042fc9c
test al, 1
je 0x4c6390
or dword [ebp - 0xa8], 1
mov eax, ebx
call fcn.0042fc9c
test al, 2
je 0x4c63a2
or dword [ebp - 0xa8], 2
mov eax, ebx
call fcn.0042fc9c
test al, 4
je 0x4c63b4
or dword [ebp - 0xa8], 4
mov eax, ebx
call fcn.0042fc9c
test al, 8
je 0x4c63c6
or dword [ebp - 0xa8], 8
lea edx, [ebp - 0xb8]
mov eax, ebx
call fcn.0042fbb0
mov edx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov ecx, 0
call fcn.00406330
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0x96]
mov ecx, 0x20
call fcn.0040e510
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4c6412
cmp edi, 0x20000000
jne 0x4c641e
mov dword [ebp - 0xa8], 0x40000000
jmp 0x4c642b
mov eax, edi
call fcn.0042f264
mov dword [ebp - 0x9c], eax
or dword [ebp - 0xac], 0x8000000
mov eax, ebx
call fcn.0042fd28
mov byte [ebp - 0x98], al
lea eax, [ebp - 0x5c]
push eax
push 0x5c
mov eax, ebx
call fcn.0042f92c
push eax
call sub.gdi32.dll_GetObjectW
test eax, eax
je 0x4c646b
or dword [ebp - 0xac], 0x400000
movzx eax, word [ebp - 0x4c]
mov word [ebp - 0x76], ax
lea edx, [ebp - 0xb0]
mov eax, esi
call fcn.004c6010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c64a3
lea eax, [ebp - 0xb8]
call fcn.004060cc
lea eax, [ebp - 0xb4]
call fcn.004054e4
ret
Function at 0x4d4afc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4d4b2a
mov eax, ebx
call fcn.004d55a0
cmp dword [ebx + 0x3c], 0
je 0x4d4b23
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4d4b9b
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4d4b8d
cmp dword [ebx + 8], 0
je 0x4d4b4c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4d4b5e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d4b8d
cmp dword [ebx + 8], 0
je 0x4d4b3f
cmp eax, 3
je 0x4d4b71
dec eax
jne 0x4d4b3f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d4b3f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4d4b3f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4d4bb9
cmp dword [ebx + 0x10], 0xcc
je 0x4d4bb9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d4bc4
pop ebx
ret

Function at 0x4f6260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x4f6292
inc ecx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, 0xff
mov esi, dword [0x520234]
mov ebx, dword [esi + ebx*4]
shr eax, 8
and eax, 0xffffff
xor ebx, eax
mov eax, ebx
inc edx
dec ecx
jne 0x4f626e
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4f653c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
movzx edx, dl
mov ecx, dword [eax + 4]
xor edx, ecx
and edx, 0xff
mov ebx, dword [0x520234]
mov ebx, dword [ebx + edx*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [eax + 4], ebx
and ebx, 0xff
add dword [eax + 8], ebx
imul edx, dword [eax + 8], 0x8088405
inc edx
mov dword [eax + 8], edx
shr edx, 0x18
mov ecx, dword [eax + 0xc]
xor edx, ecx
and edx, 0xff
mov ebx, dword [0x520234]
mov edx, dword [ebx + edx*4]
shr ecx, 8
and ecx, 0xffffff
xor edx, ecx
mov dword [eax + 0xc], edx
pop ebx
ret

Function at 0x4f6628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov dword [ebp - 4], eax
lea eax, [ebp - 0x11]
mov ecx, 0xc
xchg edx, eax
call fcn.004248fc
mov edi, 0xc
lea esi, [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.004f6520
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004f653c
mov byte [esi], bl
inc esi
dec edi
jne 0x4f664d
cmp byte [ebp - 5], 0
je 0x4f667e
movzx eax, word [ebp + 8]
shr eax, 8
cmp al, byte [ebp - 6]
sete al
jmp 0x4f6690
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movzx eax, ax
shr eax, 8
cmp al, byte [ebp - 6]
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x505d50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004060c4
lea eax, [ebp - 0x278]
mov edx, dword [0x40b0ec]
call fcn.00406e64
xor eax, eax
push ebp
push 0x505ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 4]
mov edx, 0x505f00
call fcn.00406500
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.0040dcbc
mov edi, eax
test edi, edi
jne 0x505e7b
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 4]
call fcn.0040dfd4
push dword [ebp - 0x27c]
push 0x505f18
push dword [ebp - 0x264]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004066a4
mov esi, dword [ebp - 0x268]
test esi, 0x10
je 0x505e3a
cmp dword [ebp - 0x264], 0
je 0x505e66
mov eax, dword [ebp - 0x264]
mov edx, 0x505f28
call fcn.00406890
je 0x505e66
mov eax, dword [ebp - 0x264]
mov edx, 0x505f38
call fcn.00406890
je 0x505e66
mov eax, dword [ebp - 8]
call fcn.00505d50
test al, al
jne 0x505e66
xor ebx, ebx
jmp 0x505e66
cmp esi, 0x20
je 0x505e4c
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.0040dc10
mov eax, dword [ebp - 8]
call fcn.00406168
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x505e66
xor ebx, ebx
lea eax, [ebp - 0x278]
call fcn.0040dd0c
mov edi, eax
test edi, edi
je 0x505dc3
lea eax, [ebp - 0x278]
call fcn.0040dd30
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 4]
call fcn.0040dfd4
mov eax, dword [ebp - 0x280]
call fcn.0040e2e4
test al, al
jne 0x505ea5
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505ee8
lea eax, [ebp - 0x280]
mov edx, 2
call fcn.004060d4
lea eax, [ebp - 0x278]
mov edx, dword [0x40b0ec]
call fcn.00406f3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004060d4
ret
Function at 0x505f40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b1c
xor eax, eax
push ebp
push 0x506135
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004054e4
mov esi, 1
mov word [ebp - 0xc], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x505fa2
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x505fa2
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00405700
test eax, eax
je 0x505fab
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp esi, dword [ebp - 0x18]
jg 0x506112
jmp 0x50605b
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x505fdd
mov eax, ebx
sub eax, 0xa
cmp word [eax], 1
je 0x505fdd
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00405700
mov ebx, eax
movzx eax, byte [ebx + esi - 1]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
cmp eax, 0x3d
jg 0x506002
je 0x50602a
sub eax, 0x2b
je 0x506014
sub eax, 4
je 0x50601a
dec eax
sub eax, 0xa
jb 0x506020
jmp 0x506043
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x50602f
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x506039
jmp 0x506043
mov di, 0x3e
jmp 0x506047
mov di, 0x3f
jmp 0x506047
movzx edi, byte [ebp - 9]
sub di, 0xfffc
jmp 0x506047
or edi, 0xffffffff
jmp 0x506047
movzx edi, byte [ebp - 9]
sub di, 0x41
jmp 0x506047
movzx edi, byte [ebp - 9]
sub di, 0x47
jmp 0x506047
mov di, 0xfffe
cmp di, 0xfffe
je 0x50605a
movzx eax, word [ebp - 0xc]
mov word [ebp + eax*2 - 0x14], di
inc word [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 0x18]
jg 0x50606b
cmp word [ebp - 0xc], 4
jb 0x505fbc
cmp word [ebp - 0xc], 4
jne 0x506109
mov word [ebp - 0xc], 0
lea eax, [ebp - 0x1c]
movzx edx, word [ebp - 0x14]
add edx, edx
add edx, edx
movsx ecx, word [ebp - 0x12]
shr ecx, 4
or dl, cl
mov ecx, 0
call fcn.004057b8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004058a0
mov eax, dword [ebp - 8]
cmp word [ebp - 0x10], 0xffff
je 0x506112
lea eax, [ebp - 0x20]
movzx edx, word [ebp - 0x12]
shl edx, 4
movsx ecx, word [ebp - 0x10]
shr ecx, 2
or dl, cl
mov ecx, 0
call fcn.004057b8
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004058a0
mov eax, dword [ebp - 8]
cmp word [ebp - 0xe], 0xffff
je 0x506112
lea eax, [ebp - 0x24]
movzx edx, word [ebp - 0x10]
shl edx, 6
movzx ecx, word [ebp - 0xe]
or dl, cl
mov ecx, 0
call fcn.004057b8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.004058a0
mov eax, dword [ebp - 8]
cmp esi, dword [ebp - 0x18]
jle 0x50605b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50613c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405508
lea eax, [ebp - 4]
call fcn.004054e4
ret
Function at 0x508a08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
xor edx, edx
mov dword [ebp - 0x2e0], edx
mov dword [ebp - 0x2dc], edx
mov dword [ebp - 0x2d4], edx
mov dword [ebp - 0x2d8], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004060c4
lea eax, [ebp - 0x278]
mov edx, dword [0x40b0ec]
call fcn.00406e64
xor eax, eax
push ebp
push 0x508c9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
add eax, 0x3bc
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x3b8]
call fcn.004060dc
lea eax, [ebp - 0x2c0]
xor ecx, ecx
mov edx, 0x44
call fcn.004039d0
mov dword [ebp - 0x2c0], 0x44
mov word [ebp - 0x290], 0
or dword [ebp - 0x294], 1
lea edx, [ebp - 0x2d8]
mov eax, dword [0x520340]
mov eax, dword [eax]
call fcn.0048907c
mov eax, dword [ebp - 0x2d8]
lea edx, [ebp - 0x2d4]
call fcn.0040df98
push dword [ebp - 0x2d4]
push 0x508cb4
push dword [ebp - 4]
push 0x508cec
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
push dword [eax + 0x3b8]
push 0x508d00
push 0x508d18
lea eax, [ebp - 8]
mov edx, 7
call fcn.004066a4
xor eax, eax
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2c0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00406168
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x508b72
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2d0]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x27c]
push eax
mov eax, dword [ebp - 0x2d0]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x2d0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2cc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x3bc]
lea eax, [ebp - 0x2dc]
mov ecx, 0x508d28
call fcn.004065c0
mov eax, dword [ebp - 0x2dc]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.0040dcbc
mov ebx, eax
xor eax, eax
push ebp
push 0x508c43
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x508c2a
test byte [ebp - 0x268], 0x10
jne 0x508c19
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 0x264]
call fcn.0040e0d4
mov eax, dword [ebp - 0x2e0]
lea edx, [ebp - 8]
call fcn.0040cb28
mov eax, dword [ebp - 8]
call fcn.005066d4
test al, al
je 0x508c19
cmp dword [ebp - 0x26c], 0
jne 0x508c03
cmp dword [ebp - 0x270], 0
jbe 0x508c19
jmp 0x508c05
jle 0x508c19
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 0x264]
call fcn.00422c74
lea eax, [ebp - 0x278]
call fcn.0040dd0c
mov ebx, eax
test ebx, ebx
je 0x508bbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508c4a
lea eax, [ebp - 0x278]
call fcn.0040dd30
ret