joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ddc0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x45ddf1
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044e780
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x45ddfe
xor eax, eax
jmp 0x45df75
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x45de18
mov eax, dword [ebp - 4]
jmp 0x45df75
jmp 0x45de2c
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x45dea4
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x45de71
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x45de96
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [eax + 0x5d05d8]
mov byte [ecx], dl
jmp 0x45de68
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x45de1a
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x45df72
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x45decd
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x45def1
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x45dec4
jmp 0x45defc
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x45df0d
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x45def3
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x45df21
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x45df46
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x3f
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [ecx + 0x5d05d8]
mov byte [edx], al
jmp 0x45df18
mov dword [ebp - 8], 3
jmp 0x45df58
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x45df6b
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x45df4f
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46b840
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret
Function at 0x471708
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x471739
call fcn.00479884
mov dword [eax], esi
call fcn.00479871
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004804b9
add esp, 0x14
push 0x16
pop eax
jmp 0x47178e
test dword [ebp + 0xc], 0xfffffff9
jne 0x471715
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x471766
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00479897
pop ecx
call fcn.00479871
mov eax, dword [eax]
jmp 0x47178e
test al, 0x10
jne 0x47178c
test al, 1
je 0x47178c
test byte [ebp + 0xc], 2
je 0x47178c
call fcn.00479884
mov dword [eax], 5
call fcn.00479871
mov dword [eax], 0xd
jmp 0x47175d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x47209e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5fd0b0]
jne 0x4720a8
repz ret
jmp fcn.00481c66

Function at 0x47caa8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x47cad9
call fcn.00479884
mov dword [eax], esi
call fcn.00479871
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004804b9
add esp, 0x14
push 0x16
pop eax
jmp 0x47cb2e
test dword [ebp + 0xc], 0xfffffff9
jne 0x47cab5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47cb06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00479897
pop ecx
call fcn.00479871
mov eax, dword [eax]
jmp 0x47cb2e
test al, 0x10
jne 0x47cb2c
test al, 1
je 0x47cb2c
test byte [ebp + 0xc], 2
je 0x47cb2c
call fcn.00479884
mov dword [eax], 5
call fcn.00479871
mov dword [eax], 0xd
jmp 0x47cafd
xor eax, eax
pop esi
pop ebp
ret
Function at 0x49364e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0048589e
and dword [ebp - 4], 0
cmp dword [0x61120c], 0
mov ebx, eax
jne 0x4936ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4937b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5d5b98
push edi
call esi
test eax, eax
je 0x4937b0
push eax
call fcn.0048582c
mov dword [esp], 0x5d5b88
push edi
mov dword [0x61120c], eax
call esi
push eax
call fcn.0048582c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x611210], eax
call esi
push eax
call fcn.0048582c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x611214], eax
call esi
push eax
call fcn.0048582c
pop ecx
mov dword [0x61121c], eax
test eax, eax
je 0x4936ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048582c
pop ecx
mov dword [0x611218], eax
mov eax, dword [0x611218]
cmp eax, ebx
je 0x493757
cmp dword [0x61121c], ebx
je 0x493757
push eax
call fcn.004858a7
push dword [0x61121c]
mov esi, eax
call fcn.004858a7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x493757
test edi, edi
je 0x493757
call esi
test eax, eax
je 0x49374e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49374e
test byte [ebp - 0xc], 1
jne 0x493757
or dword [ebp + 0x10], 0x200000
jmp 0x493790
mov eax, dword [0x611210]
cmp eax, ebx
je 0x493790
push eax
call fcn.004858a7
pop ecx
test eax, eax
je 0x493790
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x493790
mov eax, dword [0x611214]
cmp eax, ebx
je 0x493790
push eax
call fcn.004858a7
pop ecx
test eax, eax
je 0x493790
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x61120c]
call fcn.004858a7
pop ecx
test eax, eax
je 0x4937b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4937b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a1450
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x4a1473
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.004a10b0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004a1110
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.004a11d0
lea eax, [esp + 0x18]
push eax
call fcn.004a0ab0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x4a1440
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4a1524
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.004a1420
or ax, ax
je 0x4a14ec
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x4a1510
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x4a1510
lea eax, [esp + 0xa]
push esi
push eax
call fcn.004a0bc0
or al, al
jne 0x4a1524
jmp 0x4a151f
lea eax, [esp + 8]
push esi
push eax
call fcn.004a0b10
or al, al
jne 0x4a1524
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x4a153c
cmp ax, 0xffff
je 0x4a153c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x4a1560
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x4a1583
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.004a10b0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004a1110
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.004a11d0
lea eax, [esp + 0x18]
push eax
call fcn.004a0ab0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x4a1550
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4a1634
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.004a1420
or ax, ax
je 0x4a1634
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x4a1634
cmp byte [esp + eax + 0xa], 0x3a
jne 0x4a1634
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.004a0b10
or al, al
jne 0x4a1620
jmp 0x4a162f
mov ax, word [esi]
cmp ax, 1
jl 0x4a162f
cmp ax, 6
jle 0x4a1634
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x4a1660
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.004a10b0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004a1110
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.004a12c0
lea eax, [esp + 4]
push 0x10
push eax
call fcn.004a1270
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x4a1650
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x4a16cf
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.004a0940
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x4a16e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.004a10b0
lea eax, [esp]
push 0x10
push eax
call fcn.004a1110
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.004a1220
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4

Function at 0x4a1750
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.004a0ad0
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.004a10b0
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.004a1110
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.004a1170
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.004a1320
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004a13d0
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.004a1380
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x4a1740
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4a1823
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.004a0940
or al, al
je 0x4a17f1
mov word [esi], 2
jmp 0x4a1823
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.004a0940
or al, al
je 0x4a180b
mov word [esi], 3
jmp 0x4a1823
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.004a0940
or al, al
je 0x4a1823
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x4a1a10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.004a1910
or al, al
jne 0x4a1b9a
test byte [edi + 0x1c], 4
je 0x4a1a73
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x4a1b00
mov dword [ebx + 0xa8], 0
jmp 0x4a1b0c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x4a1b20
mov dword [ebx + 0xac], 0
jmp 0x4a1b29
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x4a1b40
cmp word [ebp + 0xe], 0xffff
jne 0x4a1b40
or dword [ebx + 0x2c], 8
jmp 0x4a1b46
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x4a1a80
push esi
call fcn.004a1980
push esi
call fcn.004a18c0
push esi
call fcn.004a1880
mov eax, dword [esi + 0x10]
push eax
call fcn.004a2d40
mov word [esi + 0xc], ax
or ax, ax
je 0x4a1b90
lea eax, [esi + 4]
push eax
call fcn.004a2b90
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.004a1850
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x4a3c90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.004a1bb0
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.004a37c0
or al, al
jne 0x4a3d1a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004a45b0
or al, al
jne 0x4a3d1a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.004a4470
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004a4600
or di, di
je 0x4a3d1a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4a3dc0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.004a1bb0
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.004a1bb0
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.004a37c0
or al, al
jne 0x4a3ea3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.004a45b0
mov bx, ax
or bl, bl
jne 0x4a3e72
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.004a44c0
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.004a4600
push esi
call fcn.004a1cc0
cmp ax, 0xd
jne 0x4a3e82
mov bx, 0xd
cmp bl, 0xd
je 0x4a3e8d
cmp bx, 3
jne 0x4a3ea0
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x4a3e12
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x4a5c50
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x4a5ce6
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x4a5cc3
cmp eax, 3
jbe 0x4a5cdb
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4a5cd0
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x4a5d00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.004a5bf0
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x4a5d50
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.004a5bb0
or ebx, ebx
je 0x4a5d62
cmp word [esi + 6], 0xffff
jne 0x4a5d68
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x4a5e90
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.004a5e50
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4a5f00
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x4a5ed9
cmp eax, 3
jbe 0x4a5ef1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4a5ee6
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x4a5f10
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4a5fb0
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x4a5f8b
cmp eax, 3
jbe 0x4a5fa3
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4a5f98
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x4a5fd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.004a5bf0
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.004a5bb0
cmp edi, 1
jne 0x4a6015
cmp word [esi + 6], 0xffff
jne 0x4a601b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x4a61d0
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret
Function at 0x4a8ef3
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
jno 0x4cd194
shl cl, 0x20
jo 0x4a8f05
invalid
jo 0x4cd194
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x4a8f13
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x4db135
ret
push esi
ja 0x4b2dc7
xchg bl, ch
xchg ch, bl
jbe 0x4cd1a3
jecxz 0x4cd20a
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.004c1355
add byte [eax - 0x627df0fe], ch
retf 0
Function at 0x4ae6d7
Capabilities:
Check os version

Disassembly:
jno 0x4c1261
jo 0x4ae6e3
adc bh, byte ds:[ecx - 0x59]
jo 0x4c1261
adc byte [ecx + 0x2df226ff], 0xf
xchg dword [edx - 0x69], esp
push ebp
js 0x4bf155
jns 0x4c126c
cmc
lds ecx, [edi]
mov ebx, esp
fdivp st(7)
inc edi
cmp eax, 0x10820f
add byte [eax], al
shr cl, 0x40
jae 0x4c1283
jns 0x4bf155
invalid
nop
cpuid
ret 0x768d
lea esi, [esi + 8]
jmp dword [esi]

Function at 0x4b163f
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
js 0x4b6cc9
jns 0x4b164b
invalid
jns 0x4b6cc9
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
mov ax, ax
jno 0x4bfc63
jo 0x4b6cd8
cpuid
ret
jo 0x4bfc63
xor al, 0x77
call fcn.004a82fc
add esp, 0x24
test ax, ax
jb 0x4c94f3
je 0x4b6d1e
jne 0x4b6cfe
cmp ax, 0x1a
je 0x4b6d1e
jne 0x4b6d0e
cmp ax, 0xa
jne 0x4c43c5
push ebp
jmp fcn.004c43c6

Function at 0x4b1f81
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
jne 0x4d3528
je 0x4b1f91
mov word [eax - 0x51], ds
ja 0x4c149c
jbe 0x4b1f9b
test ecx, 0x1000
jb 0x4e652d
push ebx
pop ebx
jne 0x4b69de
push eax
pop eax
je 0x4b93bd
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x4e6522
jne 0x4c717a
je 0x4d3557
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x4b93a1
je 0x4d3574
cpuid
nop
ret
je 0x4b93a1
in al, dx
sub eax, dword [ebx]
pop ds
popfd
shl al, 0x20
jmp dword [esi - 4]
pushal
pop esp
shl esi, 0x20
movzx eax, byte [edi]
popfd
jmp dword [esi - 4]

Function at 0x4b2284
Capabilities:
Check os version
Encode data using base64
Get number of processors

Disassembly:
pop dword [esp - 4]
inc esp
and al, 0xfc
mov al, byte [ebp + 0xb]
add esp, 0x30
add eax, 0
cmp bl, 1
shr di, 0x40
mov cl, cl
mov byte [esi + 0xba], bl
js 0x4d81b0
jns 0x4b22b1
cpuid
pop edi
ret
jns 0x4d81b0
fnstenv [ebx - 0x4f3bea01]
pop esp
add byte [ebp - 0x7b7df040], al
cmp eax, dword [eax]
add byte [esi + 0xffa86d7], al
mov byte [ebp + 0x7900017a], cl
add al, 0xf
dec esi
jno 0x4b2285