joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1b6c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b1dfe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5624c0], 0
je 0x4b1de3
mov ebx, dword [0x5624c0]
call fcn.00404358
mov eax, ebx
call fcn.00404678
or edx, 0xffffffff
call fcn.00404404
xor eax, eax
push ebp
push 0x4b1ddc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5624c0]
mov edx, dword [eax + 0x30]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4b1ce1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5624c0]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x5624c0]
mov edx, dword [0x496544]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x4a7048
mov eax, dword [0x5624c0]
call fcn.004b088c
mov eax, dword [0x5624c0]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
mov eax, dword [0x5624c0]
mov ebx, dword [eax + 0x38]
cmp byte [0x562508], 0
je 0x4b1c76
test ebx, ebx
je 0x4b1c76
xor edi, edi
test ebx, ebx
je 0x4b1c76
cmp dword [ebx + 4], 0xfffffffe
jne 0x4b1c6f
inc edi
push 0x4b1e18
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040d350
push dword [ebp - 0x14]
push 0x4b1e58
push dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406834
mov eax, dword [ebp - 0x10]
call fcn.00406308
push eax
call sub.kernel32.dll_OutputDebugStringW
mov ebx, dword [ebx + 0x18]
test ebx, ebx
jne 0x4b1c34
mov eax, dword [0x5624c0]
mov ebx, dword [eax + 0x38]
test ebx, ebx
je 0x4b1cb8
mov esi, dword [ebx + 0x18]
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 4], 0xfffffffe
mov dword [ebx + 8], 0xe6
mov dword [ebx + 0xc], 0xe6
mov byte [ebx + 0x14], 0
mov edx, dword [ebx + 0x10]
mov ecx, ebx
mov eax, dword [0x5624c0]
call fcn.004b0b48
mov ebx, esi
test ebx, ebx
jne 0x4b1c82
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1ce8
mov eax, dword [0x5624c0]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x5624c0]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1e05
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406274
ret
Function at 0x4cc360
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x4cc4e9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.00432614
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4cc4cb
xor eax, eax
push ebp
push 0x4cc4c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call fcn.0040367c
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00432634
mov ebx, eax
jmp 0x4cc4a5
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.0040647c
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0040e2bc
mov edx, dword [ebp - 0x244]
mov eax, 0x4cc504
call fcn.0040ca78
test al, al
je 0x4cc495
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x4cc495
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x556b50]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4cc495
xor eax, eax
push ebp
push 0x4cc48e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x4cc477
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.00404d48
call fcn.00404d48
jmp 0x4cc4cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc495
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00432654
mov ebx, eax
test ebx, ebx
jne 0x4cc3e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc4cb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc4f0
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00406274
ret
Function at 0x4cc495
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x4cc4e9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.00432614
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4cc4cb
xor eax, eax
push ebp
push 0x4cc4c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call fcn.0040367c
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00432634
mov ebx, eax
jmp 0x4cc4a5
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.0040647c
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0040e2bc
mov edx, dword [ebp - 0x244]
mov eax, 0x4cc504
call fcn.0040ca78
test al, al
je 0x4cc495
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x4cc495
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x556b50]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4cc495
xor eax, eax
push ebp
push 0x4cc48e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x4cc477
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.00404d48
call fcn.00404d48
jmp 0x4cc4cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc495
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00432654
mov ebx, eax
test ebx, ebx
jne 0x4cc3e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc4cb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc4f0
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00406274
ret

Function at 0x4cc520
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x556b54], 0
je 0x4cc53a
call dword [0x556b54]
mov dword [ebp - 4], eax
jmp 0x4cc53f
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cc5ad
cmp dword [ebp - 4], 0xffffffff
je 0x4cc5ad
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x556b50]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4cc5a8
xor eax, eax
push ebp
push 0x4cc5a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x4cc585
call fcn.00404d48
jmp 0x4cc5c1
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc5ad
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cc5b9
cmp dword [ebp - 4], 0xffffffff
jne 0x4cc5c1
call fcn.004cc360
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cca3d
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406264
xor eax, eax
push ebp
push 0x4ccb45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040627c
mov edx, dword [ebp - 4]
mov eax, 0x4ccb60
call fcn.004cc750
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4cca3d
xor eax, eax
push ebp
push 0x4cca36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.004ccb7c
test al, al
je 0x4cca15
call fcn.00404d48
jmp 0x4ccb2f
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040627c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cca3d
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov dword [ebp - 0x10], 0x802
lea eax, [ebp - 0x822]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040367c
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x822]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00406308
mov ebx, eax
push ebx
push 0
call sub.advapi32.dll_LookupAccountNameW
cmp dword [ebp - 0x14], 0
jbe 0x4ccb2f
mov eax, dword [ebp - 0x14]
call fcn.00403074
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4ccb28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.0040367c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x822]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
jne 0x4ccaea
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.00403090
xor eax, eax
mov dword [ebp - 0x1c], eax
call fcn.00404d48
jmp 0x4ccb2f
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ConvertSidToStringSidW
test eax, eax
je 0x4ccb0f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00406428
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccb2f
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.00403090
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccb4c
lea eax, [ebp - 4]
call fcn.0040626c
ret
Function at 0x4cce6c
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.0040627c
cmp byte [0x5a2560], 0
je 0x4ccea3
xor eax, eax
call fcn.004cc930
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x4ccf12
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.004ccf34
jmp 0x4ccf12
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.004cc520
push eax
mov eax, dword [0x556b50]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4ccef0
mov eax, ebx
mov edx, dword [esp]
call fcn.00406428
mov eax, dword [ebx]
mov edx, 0x4ccf24
call fcn.0040ca78
test al, al
je 0x4ccee7
mov eax, ebx
xor edx, edx
call fcn.0040627c
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x4ccf12
xor eax, eax
call fcn.004cc930
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x4ccf12
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.004ccf34
pop ecx
pop edx
pop ebx
ret

Function at 0x4cf3a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff99c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406264
xor eax, eax
push ebp
push 0x4cf4dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40e]
mov ecx, 0x1ff
mov edx, dword [ebp - 4]
call fcn.0040e6bc
lea edx, [ebp - 8]
xor eax, eax
call fcn.00406d8c
lea eax, [ebp - 0x60e]
mov ecx, 0xfe
mov edx, dword [ebp - 8]
call fcn.0040e6bc
lea eax, [ebp - 0x654]
xor ecx, ecx
mov edx, 0x44
call fcn.0040367c
mov dword [ebp - 0x654], 0x44
mov dword [ebp - 0x628], 1
mov word [ebp - 0x624], bx
xor eax, eax
mov dword [ebp - 0x664], eax
xor eax, eax
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x40e]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4cf473
mov dword [ebp - 0xc], 0xffffffff
jmp 0x4cf4c2
test esi, esi
je 0x4cf48c
imul eax, esi, 0x3e8
push eax
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x4cf49a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x660]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf4e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406274
ret

Function at 0x4d3418
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004d3fd0
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4d3ecc
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x4d3f11
lea eax, [ebp - 0x60]
call fcn.004d3418
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.004d3440
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d3514
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x4d3f13
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x4d3f3c
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x4d3f42
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x4d3f21
lea eax, [ebp - 0x60]
call fcn.004d3418
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004d3440
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004d3db4
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d3514
lea eax, [ebp - 0x60]
call fcn.004d3418
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004d3440
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.004d3440
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d3514
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4dc01c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406264
xor eax, eax
push ebp
push 0x4dc0da
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4dc0bc
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408760
mov eax, dword [ebp - 8]
test eax, eax
je 0x4dc064
sub eax, 4
mov eax, dword [eax]
mov esi, eax
lea eax, [esi + 4]
mov dword [edi], eax
mov eax, dword [edi]
push eax
call fcn.00408624
pop ecx
mov dword [ebx], eax
mov ebx, dword [ebx]
mov eax, edi
mov edx, ebx
mov ecx, 4
call fcn.0040322c
add ebx, 4
lea eax, [ebp - 8]
call fcn.00405d34
mov ecx, esi
mov edx, ebx
call fcn.0040322c
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x4dc0bc
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + 0x55a5c4]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4dc0a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc0e1
lea eax, [ebp - 8]
call fcn.004054fc
lea eax, [ebp - 4]
call fcn.0040626c
ret
Function at 0x4dd718
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4dd721
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4dd8e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004dda7c
xor eax, eax
push ebp
push 0x4dd8b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4dd771
call fcn.00404d48
jmp 0x4dd8bf
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4dd846
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4dd7c6
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4dd7c6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004dd5ec
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406834
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4dd805
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004dd5ec
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406834
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.00406308
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4dd8a2
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004dd5ec
push dword [ebp - 0x24]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x4dd904
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406834
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.004dd60c
jmp 0x4dd8a2
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4dd869
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4dd869
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4dd87f
mov eax, ebx
call fcn.00406308
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4dd8a2
lea eax, [ebp - 0x28]
mov ecx, 0x4dd904
mov edx, ebx
call fcn.00406750
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004dd60c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd8bf
mov eax, dword [ebp - 4]
call fcn.004dda84
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd8ee
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00406274
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00406274
ret
Function at 0x4e1c50
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x4e1c64
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x4e1c63
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.00405da0
xor ebx, ebx
cmp esi, dword [esp]
jge 0x4e1dc8
inc ebx
mov eax, edi
call fcn.00405d34
movzx edx, byte [ebp + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x4e1d81
inc ebx
mov eax, edi
call fcn.00405d34
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x4e1d50
inc ebx
mov eax, edi
call fcn.00405d34
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405d34
movzx edx, byte [ebp + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x4e1dbc
inc ebx
mov eax, edi
call fcn.00405d34
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405d34
mov byte [eax + ebx - 1], 0x3d
jmp 0x4e1dbc
inc ebx
mov eax, edi
call fcn.00405d34
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00405d34
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00405d34
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x4e1c98
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e58ac
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x55a760
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4e58cb
mov esi, 1
mov edx, 0x55a868
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4e5944
dec ebx
je 0x4e5966
dec ebx
je 0x4e5988
dec ebx
je 0x4e59a9
jmp 0x4e59c3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4e59c3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4e59c3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4e59c3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4e5934
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4e58e7
mov esi, 0x20
mov eax, 0x55a790
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4e59e8
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e5a24
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x55a817]
test bl, bl
jbe 0x4e5a55
lea eax, [esi + 0x3e0]
call fcn.004e5a00
lea eax, [esi + 0x3fc]
call fcn.004e5a00
dec bl
jne 0x4e5a3b
mov cl, 0x30
mov edi, 0x55a7e8
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x4e5a76
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4e5a83
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4e5a5f
pop edx
pop edi
pop esi
pop ebx
ret