joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x406429
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x406450
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x40646d
jmp 0x406460
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x40646d
inc edi
cmp edi, edx
jb 0x406460
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x406582
cmp ecx, 3
jbe 0x4064a1
xor ebp, ebp
mov cl, byte [edi + 4]
mov dword [esp + 0x1c], eax
test cl, cl
je 0x4064db
cmp cl, 0xff
je 0x4064db
and ebp, 3
add ebp, ebp
or ebp, 1
inc eax
jmp 0x406450
dec ecx
shl ebp, cl
and ebp, 7
je 0x406486
movzx ecx, byte [ebp + 0x497624]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x49761c], 0
mov cl, byte [ebx + 4]
je 0x4064c9
test cl, cl
je 0x4064c9
cmp cl, 0xff
jne 0x406486
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
inc eax
jmp 0x406450
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x40650e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x406514
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x406554
movzx esi, byte [ebp + 0x497624]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x406539
cmp dl, 0xff
jne 0x406550
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x406500
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x406450
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x406595
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
dec ecx
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret
Function at 0x40c860
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x21c], 7
push eax
push 0x49b404
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00407570
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004332a0
add esi, 0x18
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40c8e4
mov esi, dword [esi]
push esi
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x485608
push 0x48560c
push str.SVWiFiSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x40c914
xor ecx, ecx
jmp 0x40c92f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c920
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00407570
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.0043a24c
mov ecx, dword [ebp - 0x21c]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x40c97f
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00407670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415b8c
mov esp, ebp
pop ebp
ret
Function at 0x40c9e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480f76
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00422c4e
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x828], ax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0x840]
mov dword [ebp - 0x814], 7
push eax
mov dword [ebp - 0x818], 0
call fcn.00407790
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.004332a0
add esi, 0x18
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40ca89
mov esi, dword [esi]
cmp dword [ebp - 0x82c], 8
lea ecx, [ebp - 0x810]
push esi
push 0x400
push ecx
lea eax, [ebp - 0x840]
cmovae eax, dword [ebp - 0x840]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x40cac1
xor ecx, ecx
jmp 0x40cadf
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cad0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00407570
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0043a24c
mov ecx, dword [ebp - 0x814]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x40cb2f
inc ecx
push ecx
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00407670
xor eax, eax
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x818], 0
cmp eax, 8
jb 0x40cb6a
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.00407670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415b8c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40cb90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x18
cmp dword [ecx + 0x14], 8
jb 0x40cb9e
mov ecx, dword [ecx]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop ebp
ret 0xc
Function at 0x40cbc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x218], 0
call fcn.004332a0
add esi, 0x18
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40cc1b
mov esi, dword [esi]
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x20c], ax
jne 0x40cc5b
xor ecx, ecx
jmp 0x40cc73
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cc64
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00407570
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415b8c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480fa6
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ce30
lea esi, [edi + 0x18]
cmp esi, edi
je 0x40cce9
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.00407790
push 8
push str.Bfih.ini
mov ecx, esi
call fcn.00407fe0
cmp dword [esi + 0x14], 8
jb 0x40cd01
mov eax, dword [esi]
jmp 0x40cd03
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cd2b
cmp esi, edi
je 0x40cd1d
push 0xffffffffffffffff
push eax
push edi
mov ecx, esi
call fcn.00407790
push 0xa
push str.BtfiOi.ini
mov ecx, esi
call fcn.00407fe0
cmp dword [esi + 0x14], 8
jb 0x40cd33
mov esi, dword [esi]
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00422f7f
add esp, 8
lea esi, [edi + 0x30]
mov ebx, eax
cmp esi, ebx
je 0x40cd83
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40cd5c
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00407670
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40cd74
mov eax, dword [esi]
jmp 0x40cd76
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.00407f70
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x40cd9f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407670
push 5
xor eax, eax
mov dword [ebp - 0x14], 7
push str.Cache
mov ecx, esi
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00407fe0
push 1
push 0x49b3f8
mov ecx, esi
call fcn.00407fe0
push 8
push str.Bfih.ini
mov ecx, esi
call fcn.00407fe0
cmp dword [esi + 0x14], 8
jb 0x40cde7
mov eax, dword [esi]
jmp 0x40cde9
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ce05
cmp dword [esi + 0x14], 8
jb 0x40cdfc
mov esi, dword [esi]
push esi
call fcn.0042303d
add esp, 4
mov ecx, edi
call fcn.0040cec0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415b8c
mov esp, ebp
pop ebp
ret 4

Function at 0x40cec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.004332a0
lea eax, [esi + 0x18]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40cef7
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.NULL
push str.eba54
push str.SVWiFiSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x20c], 0
jne 0x40cf27
xor ecx, ecx
jmp 0x40cf3f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cf30
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x48]
call fcn.00407570
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00415b8c
mov esp, ebp
pop ebp
ret
Function at 0x416940
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x482153
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a31d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x4a4878
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x4a4878
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x4853c0
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041a520
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a6e9
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4
Function at 0x41c81a
Capabilities:
Check if file exists

Disassembly:
push 0x68
mov eax, 0x4829bf
call fcn.00455282
mov esi, ecx
lea eax, [esi + 4]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00407cc0
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ebp + 8], edi
je 0x41c859
lea eax, [esi + 0x1c]
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x41c859
push 0xffffffffffffffff
push edi
push eax
call fcn.00407790
push 8
pop ebx
cmp dword [ebp + 0x50], ebx
lea eax, [ebp + 0x3c]
cmovae eax, dword [ebp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c879
xor esi, esi
inc esi
jmp 0x41c994
lea eax, [ebp + 0xc]
push eax
call fcn.0041b86d
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041af67
add esp, 0xc
cmp dword [ebp - 0x14], ebx
lea edx, [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp + 0x24]
cmovae edx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp + 0x38], ebx
push edx
cmovae ecx, dword [ebp + 0x24]
cmp dword [ebp - 0x2c], ebx
push ecx
cmovae eax, dword [ebp - 0x40]
push str.LastUpdTimeStamp
push eax
mov byte [ebp - 4], 4
call esi
cmp dword [ebp - 0x14], ebx
lea edx, [ebp - 0x28]
lea ecx, [ebp + 0x3c]
cmovae edx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp + 0x50], ebx
push edx
cmovae ecx, dword [ebp + 0x3c]
cmp dword [ebp - 0x2c], ebx
push ecx
cmovae eax, dword [ebp - 0x40]
push str.File
push eax
call esi
cmp dword [ebp + 0x50], ebx
lea eax, [ebp + 0x3c]
cmovae eax, dword [ebp + 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407440
lea eax, [ebp - 0x58]
push eax
call fcn.004297c5
add esp, 0x1c
cmp dword [ebp - 0x14], ebx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
cmovae edx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x44], ebx
push edx
cmovae ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], ebx
push ecx
cmovae eax, dword [ebp - 0x40]
push str.LastMD5
push eax
call esi
push edi
call fcn.0043a494
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041ca1c
add esp, 0xc
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
mov ecx, eax
cmovae edx, dword [ebp - 0x28]
cmp dword [ecx + 0x14], ebx
jb 0x41c95f
mov ecx, dword [ecx]
cmp dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x40]
push edx
cmovae eax, dword [ebp - 0x40]
push ecx
push str.CacheTime
push eax
call esi
xor esi, esi
lea ecx, [ebp - 0x70]
push edi
inc esi
push esi
call fcn.004074b0
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.004074b0
push edi
push esi
lea ecx, [ebp - 0x40]
call fcn.004074b0
push edi
push esi
lea ecx, [ebp - 0x28]
call fcn.004074b0
push edi
push esi
lea ecx, [ebp + 0xc]
call fcn.004074b0
push edi
push esi
lea ecx, [ebp + 0x24]
call fcn.004074b0
push edi
push esi
lea ecx, [ebp + 0x3c]
call fcn.004074b0
call fcn.0045523d
ret 0x4c
Function at 0x41ccbb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
xor ecx, ecx
xor edx, edx
xor esi, esi
push edi
cmp dword [ebp + 0xc], ecx
jle 0x41cd9c
mov edi, dword [ebp + 8]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x41ccdf
inc edx
cmp edx, 2
jg 0x41cd1d
cmp al, 0x7f
ja 0x41cd1d
movzx eax, al
mov al, byte [eax + 0x487a88]
cmp al, 0x7f
je 0x41cd1d
cmp al, 0x40
jae 0x41ccf8
test edx, edx
jne 0x41cd1d
inc ecx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x41ccd2
test ecx, ecx
je 0x41cd9c
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x41cd22
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x41cd1f
push 0xffffffffffffffee
pop eax
jmp 0x41cd9e
mov edx, dword [ebp + 0x10]
xor eax, eax
push ebx
xor ebx, ebx
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x41cd96
mov eax, dword [ebp + 8]
push 3
pop edi
movzx eax, byte [eax]
mov cl, byte [eax + 0x487a88]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x41cd87
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x41cd72
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x41cd7f
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x41cd87
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x41cd37
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
pop ebx
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x41cda2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x41cdb6
xor eax, eax
jmp 0x41cef4
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x41cddf
dec edx
sub edx, 1
jne 0x41cde1
add eax, 2
jmp 0x41cde1
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x41cdf4
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x41cef3
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x41ce8a
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x487a48]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x487a48]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x487a48]
mov byte [edi + 2], al
mov al, byte [esi + 0x487a48]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x41ce1f
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x41ce8d
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x41cee6
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x41cea2
movzx ecx, byte [eax + 1]
jmp 0x41cea4
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x487a48]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x487a48]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x41cedb
and ecx, 0xf
mov al, byte [ecx*4 + 0x487a48]
mov byte [edi + 2], al
jmp 0x41cedf
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d0f2
Capabilities:
Get mac address on windows

Disassembly:
push 0x58
mov eax, 0x482b55
call fcn.00455282
mov esi, dword [ebp + 8]
and dword [ebp - 0x64], 0
push 0x288
mov dword [ebp - 0x54], 4
call fcn.0043a6cc
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41d12e
push 0x4853c0
mov ecx, esi
call fcn.0040f990
jmp 0x41d296
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x41d153
push ebx
call fcn.0043a6d7
push dword [ebp - 0x54]
call fcn.0043a6cc
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41d11d
xor eax, eax
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x41d26b
mov byte [ebp - 0x20], al
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 0x60], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 1
mov edi, ebx
test ebx, ebx
je 0x41d244
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x20]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.0040c610
lea eax, [edi + 0x10c]
push eax
call fcn.0047e785
push 0x487b24
push eax
call fcn.004351a0
add esp, 0x2c
test eax, eax
jne 0x41d2a0
cmp dword [edi + 0x1a0], 0x47
je 0x41d2a0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x50]
call fcn.0040f990
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x60]
call fcn.0041d635
push 0
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0041a84e
mov edi, dword [edi]
test edi, edi
jne 0x41d19b
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
test eax, eax
je 0x41d263
lea eax, [ebp - 0x38]
cmp eax, ecx
je 0x41d263
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00409ad0
lea ecx, [ebp - 0x60]
call fcn.0041d5c3
push ebx
call fcn.0043a6d7
pop ecx
xor ebx, ebx
mov dword [esi + 0x14], 0xf
lea eax, [ebp - 0x38]
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00409860
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.0041a84e
mov eax, esi
call fcn.0045523d
ret 4
cmp byte [ebp - 0x20], 0
jne 0x41d2aa
xor eax, eax
jmp 0x41d2b4
lea eax, [ebp - 0x20]
push eax
call fcn.00442ab0
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409c00
jmp 0x41d263
Function at 0x41d2e0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x4a31d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.004332a0
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x49b3fc
call fcn.00442c2f
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004430c4
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.004332a0
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.004332a0
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.004332a0
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41d3de
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.0040c610
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.0040f990
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415b8c
mov esp, ebp
pop ebp
ret 4