joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105ed21
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1009810
call fcn.0105eeec
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x105ed5e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x105ed5e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x105ed76
cmp eax, 0x20b
je 0x105ed63
mov dword [ebp - 0x1c], ebx
jmp 0x105ed8a
cmp dword [ecx + 0x84], 0xe
jbe 0x105ed5e
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x105ed84
cmp dword [ecx + 0x74], 0xe
jbe 0x105ed5e
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x11150c0], 0xffffffff
or dword [0x11150c4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x111357c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1113578]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x11150bc], eax
call fcn.01066d9a
cmp dword [0x1111220], ebx
jne 0x105ede5
push fcn.01066d9a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0105f155
push 0x1111060
push 0x111105c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1113574]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1113570]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1111058
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x105ee7b
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x105ee4f
cmp al, 0x22
jne 0x105ee41
cmp byte [esi], 0x22
jne 0x105ee58
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x105ee62
cmp al, 0x20
jbe 0x105ee54
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x105ee86
movzx eax, word [ebp - 0x50]
jmp 0x105ee89
cmp byte [esi], 0x20
jbe 0x105ee58
inc esi
mov dword [ebp - 0x20], esi
jmp 0x105ee7b
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x105eea6
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x105eedb
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0105ef27
ret
Function at 0x10605f0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x111121c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push 0x1a
mov dword [ebp - 4], eax
pop eax
je 0x1060618
mov eax, 0x801a
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jl 0x1060656
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.01056538
push 0x100a36c
mov ecx, esi
call fcn.01060488
cmp byte [ebp + 0xc], bl
je 0x1060656
push esi
call fcn.010666b7
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0105ec09
leave
ret 8

Function at 0x10607c9
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x111121c]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
jne 0x1060837
lea eax, [ebp - 0x414]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1060809
mov word [ebp - 0x414], di
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1060822
mov word [ebp - 0x20c], di
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea esi, [ebp - 0x20c]
jmp 0x106083e
mov word [ebp - 0x414], di
xor eax, eax
push 0xf
pop ecx
lea edi, [ebp - 0x450]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x44c], 0x600
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x43c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x20c]
pop edi
cmp esi, eax
pop esi
pop ebx
jne 0x10608b7
cmp word [ebp - 0x414], 0
je 0x10608b7
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x430]
call fcn.0105ec09
leave
ret 0x18
Function at 0x1060a6c
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0xc]
or dword [edi], 0xffffffff
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1060b91
push ebx
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
mov dword [ebp - 0xc], ebx
je 0x1060b90
lea eax, [ebp - 4]
push eax
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x1060b87
lea esi, [ebx + 0x1ac]
test esi, esi
je 0x1060af3
lea edi, [esi + 4]
cmp byte [edi], 0
je 0x1060aea
push edi
call sub.WSOCK32.dll_inet_addr
test eax, eax
je 0x1060aea
inc dword [ebp - 8]
push edi
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov esi, dword [esi]
test esi, esi
jne 0x1060aca
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1060ac0
cmp dword [ebp - 8], 1
jle 0x1060b87
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
jl 0x1060b87
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [ebp - 0xc]
lea edx, [ebp + 0xc]
push edx
push 0x1009d28
push eax
call dword [ecx]
test eax, eax
jl 0x1060b7e
mov eax, dword [ebp + 0xc]
and dword [edi], 0
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x80]
test eax, eax
jne 0x1060b75
lea esi, [ebx + 0x1ac]
jmp 0x1060b62
lea eax, [esi + 4]
cmp byte [eax], 0
je 0x1060b60
push eax
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x1060b68
mov esi, dword [esi]
test esi, esi
jne 0x1060b4b
jmp 0x1060b6a
mov dword [edi], ecx
cmp dword [edi], 0
jne 0x1060b75
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1060b43
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
cmp dword [edi], 0xffffffff
pop edi
pop esi
jne 0x1060b9f
mov eax, 0x80004005
jmp 0x1060ba1
xor eax, eax
leave
ret 8
Function at 0x1062eb7
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x111121c]
or dword [ebp - 0x210], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0xa
mov dword [ebp - 4], eax
ja 0x1062f34
cmp dword [ebp + 0xc], edi
jbe 0x1062f28
cmp edi, 0xa
jae 0x1062f28
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1062f1e
cmp eax, 0xffffffff
je 0x1062f1e
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x1062ee7
jmp 0x1062f28
mov dword [ebp - 0x210], 0x9cc0
xor eax, eax
cmp edi, dword [ebp + 0xc]
sete al
mov edi, eax
jmp 0x1062f3e
mov dword [ebp - 0x210], 0x9cca
cmp dword [ebp + 0x14], 0
je 0x1062f81
cmp dword [ebp - 0x210], 0xffffffff
je 0x1062f81
mov eax, dword [ebp - 0x210]
sub eax, 0x9cca
neg eax
sbb eax, eax
push 0
not eax
lea ecx, [ebp - 0x214]
and eax, ecx
push eax
push 0x40
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0xa
push ebx
call fcn.01062b69
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0105ec09
leave
ret 0x10

Function at 0x1063ebe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 8], edi
mov dword [ebp - 4], 3
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 4
je 0x1063efd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 4], eax
cmp dword [esi + 4], edi
jne 0x1063f1e
cmp dword [ebp - 4], 3
jne 0x1063f0e
cmp dword [ebp - 8], 4
je 0x1063f1b
cmp dword [ebp - 4], 4
je 0x1063f1b
mov dword [esi + 4], 0x57
cmp dword [esi + 4], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
jne 0x1063f28
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x1064025
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x1064059
mov edx, dword [ebp + 8]
cmp dword [esi + 8], edx
ja 0x1064043
mov eax, 0x103
jmp 0x1064059
mov eax, dword [esi + 0x10]
mov ecx, dword [esi]
mov ecx, dword [ecx]
push eax
push dword [esi + 0xc]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [esi + 0x14], eax
pop esi
pop ebp
ret 4
Function at 0x10640b9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
je 0x106413e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x10640fe
cmp dword [esi + 0xc], ebx
je 0x1064105
cmp eax, 0xea
jne 0x1064125
push dword [ebp - 8]
mov ecx, esi
call fcn.01063f31
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x106414d
cmp dword [ebp - 4], 1
je 0x106413e
cmp dword [ebp - 4], 2
je 0x106413e
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x106414d
cmp dword [ebp - 8], ebx
je 0x106414d
mov eax, dword [esi + 0xc]
jmp 0x1064150
lea eax, [esi + 0x1a]
pop esi
pop ebx
leave
ret 4

Function at 0x106415b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
je 0x10641e0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x10641a0
cmp dword [esi + 0xc], ebx
je 0x10641a7
cmp eax, 0xea
jne 0x10641c7
push dword [ebp - 8]
mov ecx, esi
call fcn.01063f31
lea eax, [ebp - 8]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x10641ef
cmp dword [ebp - 4], 1
je 0x10641e0
cmp dword [ebp - 4], 2
je 0x10641e0
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x10641ef
cmp dword [ebp - 8], ebx
je 0x10641ef
mov eax, dword [esi + 0xc]
jmp 0x10641f2
lea eax, [esi + 0x18]
pop esi
pop ebx
leave
ret 4
Function at 0x10641fd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 8], 3
mov dword [ebp - 4], eax
je 0x106427c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x1064242
cmp dword [esi + 0xc], ebx
je 0x1064249
cmp eax, 0xea
jne 0x1064269
push dword [ebp - 4]
mov ecx, esi
call fcn.01063f31
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x1064292
cmp dword [ebp - 8], 3
je 0x106427c
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x1064292
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1064292
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x1064299
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x10642a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 8], 3
mov dword [ebp - 4], eax
je 0x1064323
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x10642e9
cmp dword [esi + 0xc], ebx
je 0x10642f0
cmp eax, 0xea
jne 0x1064310
push dword [ebp - 4]
mov ecx, esi
call fcn.01063f31
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov dword [esi + 4], eax
cmp dword [esi + 4], ebx
pop edi
jne 0x1064339
cmp dword [ebp - 8], 3
je 0x1064323
mov dword [esi + 4], 0x57
cmp dword [esi + 4], ebx
jne 0x1064339
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1064339
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x1064340
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x106438a
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x110c67f
call fcn.01105bf8
sub esp, 0x34
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov esi, ecx
jne 0x10643b7
cmp dword [esi + 8], ebx
je 0x1064421
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [esi + 4], eax
jmp 0x1064421
push 0xf003f
push ebx
push dword [esi]
lea ecx, [ebp - 0x40]
push dword [ebp + 8]
call fcn.01064063
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.01063fa0
cmp dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
push ebx
jne 0x10643fd
push dword [ebp + 8]
mov ecx, esi
call fcn.0106438a
jmp 0x1064409
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
call fcn.0106438a
push ebx
lea ecx, [ebp - 0x24]
call fcn.01064366
test eax, eax
je 0x10643ef
push dword [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0106409d
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x106482d
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
shl eax, 2
push 3
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 4], ebx
add eax, 5
cmp dword [ebp + 0x10], eax
jae 0x1064868
mov dword [ebp - 0xc], 0x80004005
jmp 0x1064930
cmp ebx, esi
push edi
mov edi, dword [ebp + 0xc]
jbe 0x106492b
lea eax, [ebx - 1]
push 3
xor edx, edx
pop ebx
div ebx
xor ecx, ecx
inc ecx
mov dword [ebp + 0xc], ecx
inc eax
mov dword [ebp - 8], eax
cmp ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dl, byte [eax + ecx - 1]
mov byte [ebp + 0x10], dl
jae 0x106489c
mov bl, byte [ecx + eax]
jmp 0x106489e
xor bl, bl
lea edx, [ecx + 1]
cmp edx, dword [ebp - 4]
jae 0x10648ac
mov al, byte [ecx + eax + 1]
jmp 0x10648ae
xor al, al
movzx ecx, byte [ebp + 0x10]
mov edx, ecx
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
movzx edx, bl
shl ecx, 4
mov ebx, edx
shr ebx, 4
or ebx, ecx
and ebx, 0x3f
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + edi], cl
mov ecx, dword [ebp + 0xc]
inc esi
cmp ecx, dword [ebp - 4]
jae 0x10648fc
movzx ebx, al
shl edx, 2
shr ebx, 6
or ebx, edx
and ebx, 0x3f
mov dl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
jmp 0x1064900
mov byte [esi + edi], 0x3d
lea edx, [ecx + 1]
inc esi
cmp edx, dword [ebp - 4]
jae 0x1064917
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
jmp 0x106491b
mov byte [esi + edi], 0x3d
add ecx, 3
inc esi
dec dword [ebp - 8]
mov dword [ebp + 0xc], ecx
jne 0x1064888
mov byte [esi + edi], 0
pop edi
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 0xc
Function at 0x106493e
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shl eax, 2
push 3
xor edx, edx
pop esi
div esi
xor ecx, ecx
mov dword [ebp - 8], ecx
add eax, 5
cmp dword [ebp + 0x14], eax
jae 0x106496f
mov dword [ebp - 8], 0x80004005
jmp 0x1064a39
cmp edi, ecx
mov esi, dword [ebp + 0xc]
jbe 0x1064a35
push ebx
lea eax, [edi - 1]
push 3
xor edx, edx
pop edi
div edi
xor ebx, ebx
inc ebx
mov dword [ebp + 0xc], ebx
inc eax
mov dword [ebp - 4], eax
cmp ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dl, byte [edi + ebx - 1]
jae 0x10649a3
mov al, byte [ebx + edi]
mov byte [ebp + 0x15], al
jmp 0x10649a7
mov byte [ebp + 0x15], 0
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0x10]
jae 0x10649b5
mov al, byte [ebx + edi + 1]
jmp 0x10649b7
xor al, al
movzx edx, dl
mov edi, edx
shr edi, 2
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx edi, byte [ebp + 0x15]
mov byte [ecx + esi], bl
shl edx, 4
mov ebx, edi
shr ebx, 4
or ebx, edx
and ebx, 0x3f
mov dl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0xc]
inc ecx
mov byte [ecx + esi], dl
inc ecx
cmp ebx, dword [ebp + 0x10]
jae 0x1064a05
movzx edx, al
shr edx, 6
shl edi, 2
or edx, edi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
jmp 0x1064a09
mov byte [ecx + esi], 0x3d
lea edx, [ebx + 1]
inc ecx
cmp edx, dword [ebp + 0x10]
jae 0x1064a20
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
jmp 0x1064a24
mov byte [ecx + esi], 0x3d
add ebx, 3
inc ecx
dec dword [ebp - 4]
mov dword [ebp + 0xc], ebx
jne 0x106498f
pop ebx
mov byte [ecx + esi], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x1066055
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
je 0x1066150
mov edi, dword [ebp + 0xc]
cmp edi, eax
je 0x1066150
mov esi, dword [ebp + 0x10]
cmp esi, eax
je 0x1066150
mov dword [edi], eax
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x10660cd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10660b8
call esi
mov esi, eax
jmp 0x1066164
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1066164
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x10660e4
mov esi, 0x8007000e
jmp 0x1066155
push eax
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1066119
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1066107
call esi
mov esi, eax
jmp 0x1066155
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1066155
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1002e70
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1066149
cmp dword [ebp - 0xc], 0
jbe 0x1066149
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
xor esi, esi
jmp 0x1066155
mov esi, 0x80004005
jmp 0x1066155
mov esi, 0x80070057
cmp dword [ebp - 4], 0
je 0x1066164
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x106625d
Capabilities:
Check os version

Disassembly:
mov eax, 0x110c6bb
call fcn.01105bf8
sub esp, 0x134
mov eax, dword [0x111121c]
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x124]
push eax
xor edi, edi
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1066326
cmp dword [ebp - 0x114], 2
jne 0x1066326
cmp dword [ebp - 0x120], 5
jbe 0x10662b2
xor edi, edi
inc edi
jmp 0x1066326
jne 0x1066326
cmp dword [ebp - 0x11c], 1
ja 0x10662ad
jne 0x1066326
mov eax, 0xa28
cmp dword [ebp - 0x118], eax
ja 0x10662ad
jne 0x1066326
push 0x20019
push edi
push reloc.WSOCK32.dll_bind
push 0x100adc8
lea ecx, [ebp - 0x140]
call fcn.01064063
cmp dword [ebp - 0x13c], edi
mov dword [ebp - 4], edi
jne 0x1066317
push edi
push 0x100ae1c
lea ecx, [ebp - 0x140]
call fcn.01063ebe
cmp dword [ebp - 0x13c], edi
jne 0x1066317
cmp eax, 0x100
jb 0x1066317
xor edi, edi
inc edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.0106409d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, edi
pop edi
call fcn.0105ec09
leave
ret